09976fd76ae40a608f424655cda82b2be77c426c88ea95af78378b47630397bf

Analysis

max time kernel
105s
max time network
113s
platform
windows10-1703_x64
resource
win10-20231215-en
resource tags

arch:x64arch:x86image:win10-20231215-enlocale:en-usos:windows10-1703-x64system
submitted
09-02-2024 17:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

LastActivityView.exe
Size

130KB
MD5

f27a284ef9b018cdd2a98a7b78ccdcb3
SHA1

67e260b11e6227c18cae8925b4f6899103c607f2
SHA256

af86dc3f76d39b67b967a3b714e9e70ed43eec8d3871e9691cb45d84372b53fb
SHA512

9a8811f13517748539308a70933b126a3348407f397bf30f903019379f927532c64015853b94acf21bdbc554d638a0265d4394d026e289103db06fe93fe5524b
SSDEEP

3072:5e69eWHZXp1nPDhhloZqX6EsSiEF4Gw1aqL1p7BZ5CJ/:5e/+1nrhPKqX6EsS94H8B

Score

4^/10

discovery

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 16 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1364394410-760759377-2797241167-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1364394410-760759377-2797241167-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4856	LastActivityView.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeBackupPrivilege	4856	LastActivityView.exe
Token: SeSecurityPrivilege	4856	LastActivityView.exe
Token: SeSecurityPrivilege	4856	LastActivityView.exe
Token: SeSecurityPrivilege	4856	LastActivityView.exe
Token: SeSecurityPrivilege	4856	LastActivityView.exe
Token: SeSecurityPrivilege	4856	LastActivityView.exe
Token: SeSecurityPrivilege	4856	LastActivityView.exe
Token: SeBackupPrivilege	4856	LastActivityView.exe
Token: SeSecurityPrivilege	4856	LastActivityView.exe
Token: SeSecurityPrivilege	4856	LastActivityView.exe
Token: SeSecurityPrivilege	4856	LastActivityView.exe
Token: SeSecurityPrivilege	4856	LastActivityView.exe
Token: SeSecurityPrivilege	4856	LastActivityView.exe
Token: SeSecurityPrivilege	4856	LastActivityView.exe
Token: SeSecurityPrivilege	4856	LastActivityView.exe
Token: SeSecurityPrivilege	4856	LastActivityView.exe
Token: SeBackupPrivilege	4856	LastActivityView.exe
Token: SeSecurityPrivilege	4856	LastActivityView.exe
Token: SeSecurityPrivilege	4856	LastActivityView.exe
Token: SeSecurityPrivilege	4856	LastActivityView.exe
Token: SeSecurityPrivilege	4856	LastActivityView.exe
Token: SeSecurityPrivilege	4856	LastActivityView.exe
Token: SeSecurityPrivilege	4856	LastActivityView.exe
Token: SeSecurityPrivilege	4856	LastActivityView.exe
Token: SeSecurityPrivilege	4856	LastActivityView.exe
Token: SeSecurityPrivilege	4856	LastActivityView.exe
Token: SeSecurityPrivilege	4856	LastActivityView.exe
Token: SeSecurityPrivilege	4856	LastActivityView.exe
Token: SeSecurityPrivilege	4856	LastActivityView.exe
Token: SeSecurityPrivilege	4856	LastActivityView.exe
Token: SeSecurityPrivilege	4856	LastActivityView.exe
Token: SeSecurityPrivilege	4856	LastActivityView.exe
Token: SeSecurityPrivilege	4856	LastActivityView.exe
Token: SeSecurityPrivilege	4856	LastActivityView.exe
Token: SeSecurityPrivilege	4856	LastActivityView.exe
Token: SeSecurityPrivilege	4856	LastActivityView.exe
Token: SeSecurityPrivilege	4856	LastActivityView.exe
Token: SeSecurityPrivilege	4856	LastActivityView.exe
Token: SeSecurityPrivilege	4856	LastActivityView.exe
Token: SeSecurityPrivilege	4856	LastActivityView.exe
Token: SeSecurityPrivilege	4856	LastActivityView.exe
Token: SeSecurityPrivilege	4856	LastActivityView.exe
Token: SeSecurityPrivilege	4856	LastActivityView.exe
Token: SeSecurityPrivilege	4856	LastActivityView.exe
Token: SeSecurityPrivilege	4856	LastActivityView.exe
Token: SeSecurityPrivilege	4856	LastActivityView.exe
Token: SeSecurityPrivilege	4856	LastActivityView.exe
Token: SeSecurityPrivilege	4856	LastActivityView.exe
Token: SeSecurityPrivilege	4856	LastActivityView.exe
Token: SeSecurityPrivilege	4856	LastActivityView.exe
Token: SeSecurityPrivilege	4856	LastActivityView.exe
Token: SeSecurityPrivilege	4856	LastActivityView.exe
Token: SeSecurityPrivilege	4856	LastActivityView.exe
Token: SeSecurityPrivilege	4856	LastActivityView.exe
Token: SeSecurityPrivilege	4856	LastActivityView.exe
Token: SeSecurityPrivilege	4856	LastActivityView.exe
Token: SeSecurityPrivilege	4856	LastActivityView.exe
Token: SeSecurityPrivilege	4856	LastActivityView.exe
Token: SeSecurityPrivilege	4856	LastActivityView.exe
Token: SeSecurityPrivilege	4856	LastActivityView.exe
Token: SeSecurityPrivilege	4856	LastActivityView.exe
Token: SeSecurityPrivilege	4856	LastActivityView.exe
Token: SeSecurityPrivilege	4856	LastActivityView.exe
Token: SeSecurityPrivilege	4856	LastActivityView.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
4164	firefox.exe
4164	firefox.exe
4164	firefox.exe
4164	firefox.exe
3844	firefox.exe
3844	firefox.exe
3844	firefox.exe
3844	firefox.exe

Suspicious use of SendNotifyMessage 6 IoCs

pid	Process
4164	firefox.exe
4164	firefox.exe
4164	firefox.exe
3844	firefox.exe
3844	firefox.exe
3844	firefox.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4164	firefox.exe
3844	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4888 wrote to memory of 4164	4888	firefox.exe	76
PID 4888 wrote to memory of 4164	4888	firefox.exe	76
PID 4888 wrote to memory of 4164	4888	firefox.exe	76
PID 4888 wrote to memory of 4164	4888	firefox.exe	76
PID 4888 wrote to memory of 4164	4888	firefox.exe	76
PID 4888 wrote to memory of 4164	4888	firefox.exe	76
PID 4888 wrote to memory of 4164	4888	firefox.exe	76
PID 4888 wrote to memory of 4164	4888	firefox.exe	76
PID 4888 wrote to memory of 4164	4888	firefox.exe	76
PID 4888 wrote to memory of 4164	4888	firefox.exe	76
PID 4888 wrote to memory of 4164	4888	firefox.exe	76
PID 4164 wrote to memory of 1528	4164	firefox.exe	77
PID 4164 wrote to memory of 1528	4164	firefox.exe	77
PID 4164 wrote to memory of 1676	4164	firefox.exe	78
PID 4164 wrote to memory of 1676	4164	firefox.exe	78
PID 4164 wrote to memory of 1676	4164	firefox.exe	78
PID 4164 wrote to memory of 1676	4164	firefox.exe	78
PID 4164 wrote to memory of 1676	4164	firefox.exe	78
PID 4164 wrote to memory of 1676	4164	firefox.exe	78
PID 4164 wrote to memory of 1676	4164	firefox.exe	78
PID 4164 wrote to memory of 1676	4164	firefox.exe	78
PID 4164 wrote to memory of 1676	4164	firefox.exe	78
PID 4164 wrote to memory of 1676	4164	firefox.exe	78
PID 4164 wrote to memory of 1676	4164	firefox.exe	78
PID 4164 wrote to memory of 1676	4164	firefox.exe	78
PID 4164 wrote to memory of 1676	4164	firefox.exe	78
PID 4164 wrote to memory of 1676	4164	firefox.exe	78
PID 4164 wrote to memory of 1676	4164	firefox.exe	78
PID 4164 wrote to memory of 1676	4164	firefox.exe	78
PID 4164 wrote to memory of 1676	4164	firefox.exe	78
PID 4164 wrote to memory of 1676	4164	firefox.exe	78
PID 4164 wrote to memory of 1676	4164	firefox.exe	78
PID 4164 wrote to memory of 1676	4164	firefox.exe	78
PID 4164 wrote to memory of 1676	4164	firefox.exe	78
PID 4164 wrote to memory of 1676	4164	firefox.exe	78
PID 4164 wrote to memory of 1676	4164	firefox.exe	78
PID 4164 wrote to memory of 1676	4164	firefox.exe	78
PID 4164 wrote to memory of 1676	4164	firefox.exe	78
PID 4164 wrote to memory of 1676	4164	firefox.exe	78
PID 4164 wrote to memory of 1676	4164	firefox.exe	78
PID 4164 wrote to memory of 1676	4164	firefox.exe	78
PID 4164 wrote to memory of 1676	4164	firefox.exe	78
PID 4164 wrote to memory of 1676	4164	firefox.exe	78
PID 4164 wrote to memory of 1676	4164	firefox.exe	78
PID 4164 wrote to memory of 1676	4164	firefox.exe	78
PID 4164 wrote to memory of 1676	4164	firefox.exe	78
PID 4164 wrote to memory of 1676	4164	firefox.exe	78
PID 4164 wrote to memory of 1676	4164	firefox.exe	78
PID 4164 wrote to memory of 1676	4164	firefox.exe	78
PID 4164 wrote to memory of 1676	4164	firefox.exe	78
PID 4164 wrote to memory of 1676	4164	firefox.exe	78
PID 4164 wrote to memory of 1676	4164	firefox.exe	78
PID 4164 wrote to memory of 1676	4164	firefox.exe	78
PID 4164 wrote to memory of 1676	4164	firefox.exe	78
PID 4164 wrote to memory of 1676	4164	firefox.exe	78
PID 4164 wrote to memory of 1676	4164	firefox.exe	78
PID 4164 wrote to memory of 1676	4164	firefox.exe	78
PID 4164 wrote to memory of 1676	4164	firefox.exe	78
PID 4164 wrote to memory of 1676	4164	firefox.exe	78
PID 4164 wrote to memory of 1676	4164	firefox.exe	78
PID 4164 wrote to memory of 1676	4164	firefox.exe	78
PID 4164 wrote to memory of 556	4164	firefox.exe	79
PID 4164 wrote to memory of 556	4164	firefox.exe	79
PID 4164 wrote to memory of 556	4164	firefox.exe	79

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\LastActivityView.exe
"C:\Users\Admin\AppData\Local\Temp\LastActivityView.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:4856

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4888
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4164
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4164.0.1723926544\10455627" -parentBuildID 20221007134813 -prefsHandle 1756 -prefMapHandle 1748 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ba4f00cf-0ae2-4e91-82c9-0493849176ef} 4164 "\\.\pipe\gecko-crash-server-pipe.4164" 1828 27d4d4e4758 gpu
    3⤵
    PID:1528
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4164.1.2143743406\346940137" -parentBuildID 20221007134813 -prefsHandle 2172 -prefMapHandle 2168 -prefsLen 20828 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4f583715-7153-412e-bdfe-dbf68be6ca42} 4164 "\\.\pipe\gecko-crash-server-pipe.4164" 2184 27d42570758 socket
    3⤵
    - Checks processor information in registry
    PID:1676
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4164.2.537019842\1341845186" -childID 1 -isForBrowser -prefsHandle 2992 -prefMapHandle 2988 -prefsLen 20931 -prefMapSize 233444 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9c5c4c72-70c6-4504-bc1b-aa5349b61063} 4164 "\\.\pipe\gecko-crash-server-pipe.4164" 3000 27d514cc958 tab
    3⤵
    PID:556
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4164.3.1976636705\652485611" -childID 2 -isForBrowser -prefsHandle 3268 -prefMapHandle 1028 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0b529a0b-9544-43db-8cbf-dbf9d924a384} 4164 "\\.\pipe\gecko-crash-server-pipe.4164" 3280 27d4ff3fc58 tab
    3⤵
    PID:1744
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4164.4.884828109\342650072" -childID 3 -isForBrowser -prefsHandle 4200 -prefMapHandle 4176 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a6ffa4df-4f16-49e8-af76-68e31d6a9127} 4164 "\\.\pipe\gecko-crash-server-pipe.4164" 4268 27d5340d258 tab
    3⤵
    PID:4040
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4164.7.1687173545\1476236308" -childID 6 -isForBrowser -prefsHandle 5200 -prefMapHandle 5204 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7f2959c8-a15a-4d97-abd4-0b7937a60669} 4164 "\\.\pipe\gecko-crash-server-pipe.4164" 5192 27d53b0e458 tab
    3⤵
    PID:4956
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4164.6.453144658\1204165250" -childID 5 -isForBrowser -prefsHandle 5008 -prefMapHandle 5012 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f66bce7b-6282-4358-8aa6-4d942e597498} 4164 "\\.\pipe\gecko-crash-server-pipe.4164" 5000 27d53b0e758 tab
    3⤵
    PID:216
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4164.5.2147386375\1976186686" -childID 4 -isForBrowser -prefsHandle 4856 -prefMapHandle 4852 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a3b1cfdd-5d0d-46fb-a30d-b69b451e28ae} 4164 "\\.\pipe\gecko-crash-server-pipe.4164" 4864 27d51d93e58 tab
    3⤵
    PID:224

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:1860
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:3844
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3844.0.1066991570\253977093" -parentBuildID 20221007134813 -prefsHandle 1716 -prefMapHandle 1708 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f770f1b9-3512-4acb-b11f-93aae679cc9b} 3844 "\\.\pipe\gecko-crash-server-pipe.3844" 1796 2576add6458 gpu
    3⤵
    PID:1956
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3844.1.241432047\372238196" -parentBuildID 20221007134813 -prefsHandle 2140 -prefMapHandle 2136 -prefsLen 20828 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b04d0304-660e-42cb-b365-2ace6c2bce99} 3844 "\\.\pipe\gecko-crash-server-pipe.3844" 2152 2575fd72858 socket
    3⤵
    - Checks processor information in registry
    PID:3988
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3844.2.1178425754\2122527277" -childID 1 -isForBrowser -prefsHandle 2924 -prefMapHandle 2848 -prefsLen 20931 -prefMapSize 233444 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {13e79323-1004-4089-b8c6-5abaaef784d5} 3844 "\\.\pipe\gecko-crash-server-pipe.3844" 2840 2576ad59858 tab
    3⤵
    PID:3212
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3844.3.974427760\1487999084" -childID 2 -isForBrowser -prefsHandle 3392 -prefMapHandle 3384 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {38603799-2c5c-44f1-ac22-7029a79afb3c} 3844 "\\.\pipe\gecko-crash-server-pipe.3844" 3432 2575fd68758 tab
    3⤵
    PID:5048
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3844.4.613015029\1998272388" -childID 3 -isForBrowser -prefsHandle 4188 -prefMapHandle 4184 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6cf92869-985e-4fb2-bcaa-f0da1526e32d} 3844 "\\.\pipe\gecko-crash-server-pipe.3844" 4200 2577066f958 tab
    3⤵
    PID:424
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3844.5.831765530\1069212468" -childID 4 -isForBrowser -prefsHandle 4816 -prefMapHandle 4812 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {13352921-7ea3-4526-a505-bbd66b96d7ca} 3844 "\\.\pipe\gecko-crash-server-pipe.3844" 3776 2576ee48c58 tab
    3⤵
    PID:3188
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3844.7.957558049\1607840661" -childID 6 -isForBrowser -prefsHandle 5116 -prefMapHandle 5124 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0456537d-b51e-40ce-81bd-04c320805a1a} 3844 "\\.\pipe\gecko-crash-server-pipe.3844" 3776 25771898358 tab
    3⤵
    PID:4428
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3844.6.752358862\417375410" -childID 5 -isForBrowser -prefsHandle 4924 -prefMapHandle 4928 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {bde2dc80-f5b7-4eb3-9b33-e60eecb4ae71} 3844 "\\.\pipe\gecko-crash-server-pipe.3844" 4916 257713ae758 tab
    3⤵
    PID:168
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3844.8.1657952719\1290609820" -childID 7 -isForBrowser -prefsHandle 5572 -prefMapHandle 5620 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {748dd1db-d7c9-4f54-88cf-b911af1981b2} 3844 "\\.\pipe\gecko-crash-server-pipe.3844" 5632 25772e97e58 tab
    3⤵
    PID:4040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\w1dhfpjv.default-release\cache2\entries\254256B27E0C48CF9B80B695F0B3B8CA84610495

Filesize
9KB

MD5
2e7a245bac5e63b953d85f03169e85c2

SHA1
a782275dc94b614c7379c3c0a2138b0c37da9cd3

SHA256
218fffc5f402f9a0762bfd3241e751fdbe9031df226387d71fac1a58dec9f86d

SHA512
fb0b8226a9e0cde9ba7aba22d8216358b24fb05a7c60e003e8e354ac680f94f17739138026e1c8733543687cffa2e8a3ef1e903d7ddd43eff98bea8eb0884567

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\w1dhfpjv.default-release\cache2\entries\6D89348819C8881868053197CA0754F36784BF5F

Filesize
10KB

MD5
1363b0378d700d5b4a6c5bf1c07486ea

SHA1
bf51c45774c5b6410c07a20b630caa548d252d23

SHA256
420abca56a738d88ee4045aa3421f3f565962a900bad44d81373e58a4502f1b2

SHA512
f0eeb3dfb1d0e53a2ea359436c899e94bde20cd4a98c4ae11d3ac63edaf309261cc73699715c100b8aa862b0b989d867b2581ee44ae479a3fedf522b7b394b5a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\w1dhfpjv.default-release\startupCache\scriptCache-child.bin

Filesize
464KB

MD5
b1c0b3951a7abee30fb0ab72941beba3

SHA1
3d996cedee1d6eb87d144f8e220d41740978247e

SHA256
41edcec5320de0978c90cc2563ad07fd3e1e39b00be164ec27a299885b71299f

SHA512
dc2f9b4b5e4a81d9537d47372763b7570e8dee1b25e80131548ad816c8823424e9e2e298975932ea2d36e680922312cab5e65ee6c5715ba078a4c28d11b8829f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\w1dhfpjv.default-release\startupCache\urlCache.bin

Filesize
2KB

MD5
bacd0ac73618189ce79c7050905a0d76

SHA1
64fd0ed79c66533756aef2b8501e220bb241cb82

SHA256
33b16610fb6519e9d412e6943417893e0e2ddb8599eb1025f812fbd3c41cc8a0

SHA512
b4e1da9bc8d7773c59e38cd1adffaa34f55608a06e3d42f5f3ef4446571e2d0ececadb02baf6a08a406f90a1f3867dccb9cce523cdf5051deb2d858ecb0bcffd

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w1dhfpjv.default-release\SiteSecurityServiceState.txt

Filesize
324B

MD5
7fa1c6d2e49c75a2f77572df6f102328

SHA1
db61d696651e3b7862927a310997498ebc3092f4

SHA256
51a0462215d74ecaeded95270ec43f40ecd8bdd2aded03972a659e75474e4a5f

SHA512
4d3caaaa4d015a53aa85a162546371d6b61ee488ae5bed9d33276556deb64fed1923563722afd9b7f5f69bccc11cfb16478828a164152dd8f0a348caa3fb1be8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w1dhfpjv.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
342dd7d0cc660859ab91168878374d47

SHA1
343c0e3ef3ec4018b75dcac80d23bcf145cab52e

SHA256
287af6ae143d4fd16678a7e1b2c893e6e14a73aa61066638a707c393e5aad701

SHA512
d28b559c03b55f8e4911d36c1ef391c94d1b77090a5d8dc8a62d2ab4480c2e2dfe1cad8d84d7bc20a33cc7b2baac3d9afa0bad9b34fc61c1edba689e13d80df2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w1dhfpjv.default-release\datareporting\glean\db\data.safe.bin

Filesize
4KB

MD5
52e282a8d3920d68756578dda7428148

SHA1
10b993ff9f46748e1d655367232edbf9b50cb3f0

SHA256
c9a57a7225ffd0f17dd9d4c11d3206898e6d36e92e56f23bc33be9da8bebd2c1

SHA512
67855044cc87ba6b54aa85ece1200259dbc678c3ac60eb397bf62044ae76193a5db7d93d2f773f7097b6ce33648dc6f8a0cde0ba06890bee661707dfbbca4861

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w1dhfpjv.default-release\datareporting\glean\pending_pings\1b36358b-31d5-4c31-bb02-dcdf2ca7b3ec

Filesize
657B

MD5
6469b328f3e6ba0ec91e82276eba3be8

SHA1
b36305776b94ccb62085b6a1b531326862d3d8e8

SHA256
60b454feb6978ee44946c3a5e536ffa54368c741940e548abc02139090633148

SHA512
7978d4df840655c39a590d115648b215cb87eb237ad3a001ed62a804b3be978214afe6dafe66291458f0ca1815209002f06c19b470fdfa9f77e5306e5ef3f601

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w1dhfpjv.default-release\datareporting\glean\pending_pings\9b048ad6-8d3c-499e-8894-a6b3877221e7

Filesize
746B

MD5
77d083f4fe0ab838ebb1d763f7daa13d

SHA1
f5a88305265a76ed7ec05c2f8046dafb902e8527

SHA256
5fffd4fbee88ea8fef3a07daa6d73c1b1909ac46e85b9ed75337203c55682559

SHA512
711ff6232f6f35c18bc988ba0fc6f44c462ef8d9b567715dde83a8267c4cfcbe5a64a8a394c5a9c30fcf4c06005702208625949fe5b0ec28b26b1322b240184a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w1dhfpjv.default-release\datareporting\glean\pending_pings\c1d8f25c-480f-498c-bf3a-55f8cff9df29

Filesize
9KB

MD5
4074f632b149c5ffb0ace43b9551a39a

SHA1
ff70ca3cc5c5441e13f1ffd4212e08334fbe2fba

SHA256
17914447659715280928110692f1bc16be3236210d1a78439be34309fb77902b

SHA512
411820b9262bd224414a6fe57ffcef782048908319887772d95046c6ffb5db043a56b8b5931da6094b97a43510703490bbef4262ad7db28c4560b495d9c8aeb5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w1dhfpjv.default-release\prefs-1.js

Filesize
6KB

MD5
d78122cab0fc6a722f35b530af094974

SHA1
5ad1e19687d36a15308bd24561cde6448c64c042

SHA256
7aa9f8a7972bae0b16dc359d1287667ac54c4827a581dbdb8b0453642dcb63b1

SHA512
df8efd72223d03cffd4261d9b47bd2071082c398141f57c62a89e88c658790451cabf621d61d6e98f54a5310e1c64f5ced3c413cc52a503281b349f0f1668895

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w1dhfpjv.default-release\prefs.js

Filesize
6KB

MD5
b37850ef7e388b8d37739ebd062a63c7

SHA1
a5a7bad0d14be9e38a3a4ea4fbf13ea7b4c086c1

SHA256
51daa190b9063e8d57c0b72a4082b92f1e34d30ae1e550aae06c8cb04bcae57b

SHA512
ce487a45274a53fd6d80678ee0489ef2ae3a49b6fd83e4022d2d971b25f87c4e83576cd9c68efaa7d6d418dbe599fcf29002ee97f57c371953274f9adf9daea5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w1dhfpjv.default-release\prefs.js

Filesize
6KB

MD5
27b26ba3cfae9ea87b83050e75170784

SHA1
4135c825a81c44bc3b5526389ac41e9f4b8965fb

SHA256
7c6fb804537bd938591091e48c0252775d9adf9549cc37c25bd8c42fa6ac78d5

SHA512
be2bfbfbb9654ad669099309c837bf605be486101acd7424e8a5990433b91dd42f200ccde6e33d06fb9f8202fc7ba83756011abca6c167076cc663b7b1cb2986

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w1dhfpjv.default-release\prefs.js

Filesize
6KB

MD5
3df5cf4372e8ae93255f863d920e3064

SHA1
dba0d4d23b8caa0b0d614b627927e01e333c8bf7

SHA256
5fb82c8542ffea847e8e619f4a37953306619bb3035fd4342938902ccb94eb21

SHA512
90ce94e69682f138d596b11909aa13dc7345aaa32445bc9006bc28aca26ac7581c22b403f6312bac07c848cc2ab34ef0671e9bb5393da9046a26f69554e594ff

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w1dhfpjv.default-release\protections.sqlite

Filesize
64KB

MD5
49397db0486dc59d607907a086f40c9b

SHA1
08742ce9db9569062def08e99eea8470702feb7d

SHA256
890033ea279f13478e655150a823a5f84176d2f8f2ec3724dc61dfec775707c4

SHA512
fc8dad1ae2215cd96c41bb3e683670bb9138467677da46c19d1e58972775842a995b70123c22ea1efb659d043f5116d0c9dca422035a6646b35f81033c9f5f53

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w1dhfpjv.default-release\sessionCheckpoints.json

Filesize
288B

MD5
6b77a9f779399e95d1cee931a2c8f8ff

SHA1
826efd4feb0d50fcce5696111af7c811b81adcd9

SHA256
3a0285c8233ef0324b269f7291094e19fd9b77259f9419861ad796f7e9c979f3

SHA512
ef537c75fab8e86483ac03cc0d2feaf41575e35f54b95669a26bf6dfbf58021dc9a5bbe54d9537b55da3fbb0e0262adf6c5efd4394faaec81a31604533afec4f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w1dhfpjv.default-release\sessionCheckpoints.json.tmp

Filesize
53B

MD5
ea8b62857dfdbd3d0be7d7e4a954ec9a

SHA1
b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a

SHA256
792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da

SHA512
076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w1dhfpjv.default-release\sessionCheckpoints.json.tmp

Filesize
122B

MD5
99601438ae1349b653fcd00278943f90

SHA1
8958d05e9362f6f0f3b616f7bfd0aeb5d37967c9

SHA256
72d74b596f7fc079d15431b51ce565a6465a40f5897682a94a3f1dd19b07959a

SHA512
ffa863d5d6af4a48aadc5c92df4781d3aacbf5d91b43b5e68569952ffec513ff95655b3e54c2161fe27d2274dd4778bad517c7a3972f206381ef292808628c55

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w1dhfpjv.default-release\sessionCheckpoints.json.tmp

Filesize
90B

MD5
c4ab2ee59ca41b6d6a6ea911f35bdc00

SHA1
5942cd6505fc8a9daba403b082067e1cdefdfbc4

SHA256
00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2

SHA512
71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w1dhfpjv.default-release\sessionCheckpoints.json.tmp

Filesize
146B

MD5
65690c43c42921410ec8043e34f09079

SHA1
362add4dbd0c978ae222a354a4e8d35563da14b4

SHA256
7343d5a46e2fca762305a4f85c45484a49c1607ede8e8c4bd12bedd2327edb8d

SHA512
c0208d51cf1586e75f22764b82c48ecbb42c1ff54aa412a85af13d686e0119b4e49e98450d25c70e3792d3b9c2cda0c5ab0c6931ebaf548693bb970a35ae62b9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w1dhfpjv.default-release\sessionCheckpoints.json.tmp

Filesize
259B

MD5
e6c20f53d6714067f2b49d0e9ba8030e

SHA1
f516dc1084cdd8302b3e7f7167b905e603b6f04f

SHA256
50a670fb78ff2712aae2c16d9499e01c15fddf24e229330d02a69b0527a38092

SHA512
462415b8295c1cdcac0a7cb16bb8a027ef36ae2ce0b061071074ac3209332a7eae71de843af4b96bbbd6158ca8fd5c18147bf9a79b8a7768a9a35edce8b784bf

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w1dhfpjv.default-release\sessionstore.jsonlz4

Filesize
885B

MD5
0c18d3f2b98bc27d81f6e0f8b9eb9887

SHA1
1d0b46ba40a5aab230fcd487dd8a7b120f834047

SHA256
e7b19eb3205827b374760d8ec729660f8e2d9af34da3ccb5f9617b23d91d3120

SHA512
425b0f343ba72617b537c9a29d083586dd7596b94c4cad1381b4ade1f6c80a2cdda53006b0aa75e34d45e09c3365f0cf050fdacd4492c5b2c442b65c5618da97

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w1dhfpjv.default-release\sessionstore.jsonlz4

Filesize
4KB

MD5
22e369a566d9eaf844e20f798143200e

SHA1
b7a1d18b1ed51176bcf7e0b921fac9731b8de6af

SHA256
ea6633d99d01b606d7043b370e29c597a1d598879d8a5ea46c867ca42039a200

SHA512
16f88094ea984bf0a67e02c16dcc0dbf1e3cc2cb74bbc803ddbe4bb809fd827dfbad51b3021fbe3a1f7231dfe02d51a830da8416ab09c32a6873961c88f67f56

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w1dhfpjv.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite

Filesize
48KB

MD5
9c9b7969716ef2bea9eccd5976fcc008

SHA1
c93b1e70217ea6e24c8073e161312d7307b955a8

SHA256
fcea27ae015b5e47ddad04a1ac29f0a7e6451fd22f0c6a23e6c9a5cbe60ecd40

SHA512
302378e1267b49e5c33104f33d9e18401bdbb31b2beb583d139c56af082f75187cd14feeb41d722f4f305bc7f1e1d5e002871b5fb415880e82cf5ff45184e06a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w1dhfpjv.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
184KB

MD5
cce9aa2d663e6ce1db4bf06c64a0d318

SHA1
82a957cd007577c21cbe7e876f054cad3fc6fb4a

SHA256
8575d1ead68838c4a1d7f48157e4773a15ede878be4064b2c5fd70bb32218471

SHA512
b537881517a387dce0a768b97e3014bf6be54f5e357b37a6e5fbdc9fe536e271b3045e24a2c1e53442ec060e327976400ea281ad3901f5e52f07cb24e5948d0f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w1dhfpjv.default-release\xulstore.json

Filesize
120B

MD5
05e1ddb4298be4c948c3ae839859c3e9

SHA1
ea9195602eeed8d06644026809e07b3ad29335e5

SHA256
1c2c5d5211674c3c8473e0589085499471399e53e9a85d7dd3b075fef6cbb6be

SHA512
3177b48cd0c877821419d7e5eb247a4c899bc37258994f22257ceaafefb316e6f5959faae02e380e432d7752f0218d45d56d6878c1e751d201d9fdb3ff98612e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w1dhfpjv.default-release\xulstore.json.tmp

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit