raccoon | 012e382049b88808e2d0b26e016dc189f608deea9b6cc993ce24a57c99dd93d1

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
07/03/2024, 16:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

unpackme.exe
Size

604KB
MD5

03c5e639039fc1d30c92df7527e6e464
SHA1

42af028d0e3255c97626b06ae262a34b46419772
SHA256

012e382049b88808e2d0b26e016dc189f608deea9b6cc993ce24a57c99dd93d1
SHA512

43e215724d8a91c09c8a4c3c23584f4d4f39d0278e28bc918ee82fdc96ec36eb5cfb8c03491b80045d9448c6c1a775aa236a852d62117810a87aef6d32b0b84e
SSDEEP

12288:kwFVzgdn12PiuBWq5y6zLJ7M29SGMzmr:kAVgn+igWwVgXGMzy

Score

10^/10

raccoon c021300d0074689fde86c87568e215c582272721 stealer

Malware Config

Extracted

Family

raccoon

Version

1.7.3

Botnet

c021300d0074689fde86c87568e215c582272721

Attributes

url4cnc
https://tttttt.me/ch0koalpengold

rc4.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V1 payload 4 IoCs

resource	yara_rule
behavioral1/memory/4584-2-0x0000000002180000-0x0000000002211000-memory.dmp	family_raccoon_v1
behavioral1/memory/4584-3-0x0000000000400000-0x00000000004AC000-memory.dmp	family_raccoon_v1
behavioral1/memory/4584-4-0x0000000000400000-0x00000000004AC000-memory.dmp	family_raccoon_v1
behavioral1/memory/4584-92-0x0000000002180000-0x0000000002211000-memory.dmp	family_raccoon_v1

Program crash 6 IoCs

pid	pid_target	Process	procid_target
2748	4584	WerFault.exe	87
824	4584	WerFault.exe	87
8	4584	WerFault.exe	87
3856	4584	WerFault.exe	87
3580	4584	WerFault.exe	87
3268	4584	WerFault.exe	87

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3860	firefox.exe
Token: SeDebugPrivilege	3860	firefox.exe
Token: SeDebugPrivilege	3860	firefox.exe
Token: SeDebugPrivilege	3860	firefox.exe
Token: SeDebugPrivilege	3860	firefox.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
3860	firefox.exe
3860	firefox.exe
3860	firefox.exe
3860	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3860	firefox.exe
3860	firefox.exe
3860	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3860	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4516 wrote to memory of 3860	4516	firefox.exe	116
PID 4516 wrote to memory of 3860	4516	firefox.exe	116
PID 4516 wrote to memory of 3860	4516	firefox.exe	116
PID 4516 wrote to memory of 3860	4516	firefox.exe	116
PID 4516 wrote to memory of 3860	4516	firefox.exe	116
PID 4516 wrote to memory of 3860	4516	firefox.exe	116
PID 4516 wrote to memory of 3860	4516	firefox.exe	116
PID 4516 wrote to memory of 3860	4516	firefox.exe	116
PID 4516 wrote to memory of 3860	4516	firefox.exe	116
PID 4516 wrote to memory of 3860	4516	firefox.exe	116
PID 4516 wrote to memory of 3860	4516	firefox.exe	116
PID 3860 wrote to memory of 1752	3860	firefox.exe	117
PID 3860 wrote to memory of 1752	3860	firefox.exe	117
PID 3860 wrote to memory of 4276	3860	firefox.exe	118
PID 3860 wrote to memory of 4276	3860	firefox.exe	118
PID 3860 wrote to memory of 4276	3860	firefox.exe	118
PID 3860 wrote to memory of 4276	3860	firefox.exe	118
PID 3860 wrote to memory of 4276	3860	firefox.exe	118
PID 3860 wrote to memory of 4276	3860	firefox.exe	118
PID 3860 wrote to memory of 4276	3860	firefox.exe	118
PID 3860 wrote to memory of 4276	3860	firefox.exe	118
PID 3860 wrote to memory of 4276	3860	firefox.exe	118
PID 3860 wrote to memory of 4276	3860	firefox.exe	118
PID 3860 wrote to memory of 4276	3860	firefox.exe	118
PID 3860 wrote to memory of 4276	3860	firefox.exe	118
PID 3860 wrote to memory of 4276	3860	firefox.exe	118
PID 3860 wrote to memory of 4276	3860	firefox.exe	118
PID 3860 wrote to memory of 4276	3860	firefox.exe	118
PID 3860 wrote to memory of 4276	3860	firefox.exe	118
PID 3860 wrote to memory of 4276	3860	firefox.exe	118
PID 3860 wrote to memory of 4276	3860	firefox.exe	118
PID 3860 wrote to memory of 4276	3860	firefox.exe	118
PID 3860 wrote to memory of 4276	3860	firefox.exe	118
PID 3860 wrote to memory of 4276	3860	firefox.exe	118
PID 3860 wrote to memory of 4276	3860	firefox.exe	118
PID 3860 wrote to memory of 4276	3860	firefox.exe	118
PID 3860 wrote to memory of 4276	3860	firefox.exe	118
PID 3860 wrote to memory of 4276	3860	firefox.exe	118
PID 3860 wrote to memory of 4276	3860	firefox.exe	118
PID 3860 wrote to memory of 4276	3860	firefox.exe	118
PID 3860 wrote to memory of 4276	3860	firefox.exe	118
PID 3860 wrote to memory of 4276	3860	firefox.exe	118
PID 3860 wrote to memory of 4276	3860	firefox.exe	118
PID 3860 wrote to memory of 4276	3860	firefox.exe	118
PID 3860 wrote to memory of 4276	3860	firefox.exe	118
PID 3860 wrote to memory of 4276	3860	firefox.exe	118
PID 3860 wrote to memory of 4276	3860	firefox.exe	118
PID 3860 wrote to memory of 4276	3860	firefox.exe	118
PID 3860 wrote to memory of 4276	3860	firefox.exe	118
PID 3860 wrote to memory of 4276	3860	firefox.exe	118
PID 3860 wrote to memory of 4276	3860	firefox.exe	118
PID 3860 wrote to memory of 4276	3860	firefox.exe	118
PID 3860 wrote to memory of 4276	3860	firefox.exe	118
PID 3860 wrote to memory of 4276	3860	firefox.exe	118
PID 3860 wrote to memory of 4276	3860	firefox.exe	118
PID 3860 wrote to memory of 4276	3860	firefox.exe	118
PID 3860 wrote to memory of 4276	3860	firefox.exe	118
PID 3860 wrote to memory of 4276	3860	firefox.exe	118
PID 3860 wrote to memory of 4276	3860	firefox.exe	118
PID 3860 wrote to memory of 4276	3860	firefox.exe	118
PID 3860 wrote to memory of 4276	3860	firefox.exe	118
PID 3860 wrote to memory of 3208	3860	firefox.exe	119
PID 3860 wrote to memory of 3208	3860	firefox.exe	119
PID 3860 wrote to memory of 3208	3860	firefox.exe	119

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\unpackme.exe
"C:\Users\Admin\AppData\Local\Temp\unpackme.exe"
1⤵
PID:4584
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4584 -s 740
  2⤵
  - Program crash
  PID:2748
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4584 -s 776
  2⤵
  - Program crash
  PID:824
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4584 -s 760
  2⤵
  - Program crash
  PID:8
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4584 -s 756
  2⤵
  - Program crash
  PID:3856
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4584 -s 1196
  2⤵
  - Program crash
  PID:3580
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4584 -s 856
  2⤵
  - Program crash
  PID:3268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4584 -ip 4584
1⤵
PID:2624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4584 -ip 4584
1⤵
PID:4468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4584 -ip 4584
1⤵
PID:2264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4584 -ip 4584
1⤵
PID:904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4584 -ip 4584
1⤵
PID:4436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4584 -ip 4584
1⤵
PID:1148

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4516
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3860
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3860.0.1291282095\1334835217" -parentBuildID 20221007134813 -prefsHandle 1928 -prefMapHandle 1900 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {270759aa-9ba6-474c-81eb-2e30a4eabe67} 3860 "\\.\pipe\gecko-crash-server-pipe.3860" 2008 1b659ed2458 gpu
    3⤵
    PID:1752
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3860.1.2036855692\2004518331" -parentBuildID 20221007134813 -prefsHandle 2396 -prefMapHandle 2384 -prefsLen 20785 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7a6f2d7d-c5b3-4d39-9ba9-1845797fcc9e} 3860 "\\.\pipe\gecko-crash-server-pipe.3860" 2408 1b64d4e6658 socket
    3⤵
    PID:4276
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3860.2.216854836\1886721594" -childID 1 -isForBrowser -prefsHandle 1760 -prefMapHandle 3060 -prefsLen 20888 -prefMapSize 233444 -jsInitHandle 1164 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6505aeef-e499-4cf5-994c-bbcdb34466a4} 3860 "\\.\pipe\gecko-crash-server-pipe.3860" 2744 1b65dd9ca58 tab
    3⤵
    PID:3208
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3860.3.666036275\1566582076" -childID 2 -isForBrowser -prefsHandle 3560 -prefMapHandle 3556 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1164 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {583f5f02-e394-4e72-a1f8-05f976e49e81} 3860 "\\.\pipe\gecko-crash-server-pipe.3860" 3528 1b64d461c58 tab
    3⤵
    PID:1904
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3860.4.383783242\1903111396" -childID 3 -isForBrowser -prefsHandle 3480 -prefMapHandle 3956 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1164 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {16cf90c0-78b5-4140-bab4-0f13aa9db824} 3860 "\\.\pipe\gecko-crash-server-pipe.3860" 4000 1b65f08bf58 tab
    3⤵
    PID:5256
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3860.5.1433908726\280823993" -childID 4 -isForBrowser -prefsHandle 5148 -prefMapHandle 5180 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1164 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a548e8e8-6cb7-49da-8848-95989b21c247} 3860 "\\.\pipe\gecko-crash-server-pipe.3860" 5188 1b65febde58 tab
    3⤵
    PID:5804
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3860.6.72814074\433651348" -childID 5 -isForBrowser -prefsHandle 5324 -prefMapHandle 5328 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1164 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {58e911d8-e1a5-44a6-ad6a-789cff3552f8} 3860 "\\.\pipe\gecko-crash-server-pipe.3860" 5408 1b65ff7e358 tab
    3⤵
    PID:5812
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3860.7.1199523872\164683139" -childID 6 -isForBrowser -prefsHandle 5572 -prefMapHandle 5576 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1164 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7ce761d1-e6a3-4fba-b4ac-c3a312f65c9a} 3860 "\\.\pipe\gecko-crash-server-pipe.3860" 5396 1b65ff7fb58 tab
    3⤵
    PID:5888
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3860.8.920246225\1060905150" -childID 7 -isForBrowser -prefsHandle 5928 -prefMapHandle 4956 -prefsLen 26285 -prefMapSize 233444 -jsInitHandle 1164 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e950d30a-85ed-42d9-825c-878a46e8db61} 3860 "\\.\pipe\gecko-crash-server-pipe.3860" 5940 1b660125858 tab
    3⤵
    PID:5756
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3860.9.1850853873\126602664" -childID 8 -isForBrowser -prefsHandle 5200 -prefMapHandle 3484 -prefsLen 26725 -prefMapSize 233444 -jsInitHandle 1164 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {42641265-5609-4683-b6a8-7a79bb2e54c9} 3860 "\\.\pipe\gecko-crash-server-pipe.3860" 5884 1b65fe93258 tab
    3⤵
    PID:5460
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3860.10.186731350\1767455183" -childID 9 -isForBrowser -prefsHandle 10064 -prefMapHandle 10060 -prefsLen 26725 -prefMapSize 233444 -jsInitHandle 1164 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {821627e0-035f-4670-a2c0-831b81f85076} 3860 "\\.\pipe\gecko-crash-server-pipe.3860" 10072 1b662945058 tab
    3⤵
    PID:2924
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3860.11.2145150261\1251162289" -childID 10 -isForBrowser -prefsHandle 10132 -prefMapHandle 9704 -prefsLen 26725 -prefMapSize 233444 -jsInitHandle 1164 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5cc030a6-731c-4717-ba46-dad02b474a0b} 3860 "\\.\pipe\gecko-crash-server-pipe.3860" 10112 1b662e75d58 tab
    3⤵
    PID:180
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3860.12.1192199750\1244545552" -childID 11 -isForBrowser -prefsHandle 9568 -prefMapHandle 9564 -prefsLen 26725 -prefMapSize 233444 -jsInitHandle 1164 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b140d6b9-3660-4a4f-83de-144c7126fbf8} 3860 "\\.\pipe\gecko-crash-server-pipe.3860" 9576 1b662c7a858 tab
    3⤵
    PID:4884
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3860.13.1437976130\640936622" -childID 12 -isForBrowser -prefsHandle 10036 -prefMapHandle 10084 -prefsLen 26725 -prefMapSize 233444 -jsInitHandle 1164 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {855f9e45-4be4-409c-bd7c-af6bce506852} 3860 "\\.\pipe\gecko-crash-server-pipe.3860" 9976 1b64d463b58 tab
    3⤵
    PID:5500
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3860.14.948196009\1724187967" -childID 13 -isForBrowser -prefsHandle 9236 -prefMapHandle 9232 -prefsLen 26725 -prefMapSize 233444 -jsInitHandle 1164 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7a2c9430-597a-48e5-b9ae-4e459806ff8e} 3860 "\\.\pipe\gecko-crash-server-pipe.3860" 9248 1b662afc558 tab
    3⤵
    PID:5564
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3860.15.1464293009\692065073" -childID 14 -isForBrowser -prefsHandle 8952 -prefMapHandle 8956 -prefsLen 26725 -prefMapSize 233444 -jsInitHandle 1164 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8d0f7153-f491-4184-bdf1-3c851cb4f3b5} 3860 "\\.\pipe\gecko-crash-server-pipe.3860" 9036 1b662d77458 tab
    3⤵
    PID:4004
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3860.16.1089103115\1095574146" -childID 15 -isForBrowser -prefsHandle 9204 -prefMapHandle 9200 -prefsLen 26725 -prefMapSize 233444 -jsInitHandle 1164 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a6306b08-a61e-4cab-b043-782592ee0887} 3860 "\\.\pipe\gecko-crash-server-pipe.3860" 9368 1b6630e6d58 tab
    3⤵
    PID:2944
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3860.17.776151951\1444169315" -childID 16 -isForBrowser -prefsHandle 8708 -prefMapHandle 8704 -prefsLen 26725 -prefMapSize 233444 -jsInitHandle 1164 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {03228761-bfb4-4617-adc8-c9348bef5860} 3860 "\\.\pipe\gecko-crash-server-pipe.3860" 9200 1b661bc2658 tab
    3⤵
    PID:6380
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3860.18.150022811\1458836327" -childID 17 -isForBrowser -prefsHandle 8560 -prefMapHandle 8556 -prefsLen 26725 -prefMapSize 233444 -jsInitHandle 1164 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9cf456c3-a7fd-4581-b4b1-1675f80ec301} 3860 "\\.\pipe\gecko-crash-server-pipe.3860" 8472 1b661bc1758 tab
    3⤵
    PID:6388
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3860.19.2073019090\51186656" -childID 18 -isForBrowser -prefsHandle 8264 -prefMapHandle 8268 -prefsLen 26725 -prefMapSize 233444 -jsInitHandle 1164 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {06c4aa00-7937-454e-9fa5-079d19c2230f} 3860 "\\.\pipe\gecko-crash-server-pipe.3860" 8252 1b661bc0e58 tab
    3⤵
    PID:6396
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3860.20.254531648\987022354" -childID 19 -isForBrowser -prefsHandle 8580 -prefMapHandle 7932 -prefsLen 26725 -prefMapSize 233444 -jsInitHandle 1164 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b682e217-4608-4b78-865c-6d489cc7740c} 3860 "\\.\pipe\gecko-crash-server-pipe.3860" 9984 1b664941858 tab
    3⤵
    PID:6408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qapp529h.default-release\cache2\doomed\13794

Filesize
9KB

MD5
9a4859fd4b9ec64ee91b3f51ab07db51

SHA1
b6fa2ea249dcc853f9e7ff4139eb6fe43240cc68

SHA256
85130e704519e6a5f5e08669c947ba24605705c082388acb2bc1f013899507d1

SHA512
829cb8508a262ae6c040bfc3f3a6bed40e4e71d56a25b7ff0d5df417a2cad6524b1e2e3e3d01ecb756e7db1a468a481132dc28017019e211e36b654e75ed2459

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qapp529h.default-release\cache2\doomed\2808

Filesize
9KB

MD5
725a91cb761e9a5a17600569f807106a

SHA1
47d90a375596610940cc42038ec3e201826b11c1

SHA256
286104cd3c56132668601b642e4bcd85e633b2ba6ca8eabd4801f0c1b3c771fc

SHA512
92d69c8f886da8c4aeb9b5d2aeef089f2cf2e58270865806a2c5fba3b7d00797abce480c19acb3883f0ac4eeefb5b1b8c63798716e721712f88ebffd1f5f137b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qapp529h.default-release\cache2\entries\677B80A25A006EDCC273545819E7C8B9A97E5201

Filesize
41KB

MD5
c4adee53efff878eb3dc044b9157dd8a

SHA1
cf7ea28e400e19b42494fefebed04ad3b6ce54a9

SHA256
f8ff8cfd116bc590239afe1bd062705fb0f2a037aa51ae4d79c045a33bbf84fe

SHA512
02ca6283584e17be43f0b425c071ff455f067db7484b900822b95a3e3fd8e9e52d25c8859ff23b0ead18d55bcb7bc5610af41d7bd6d03bfc8b6855d06b6a216d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qapp529h.default-release\cache2\entries\BB340411BD2C0201D7C00E564C9F7A0E242C5683

Filesize
203KB

MD5
b089693dde415c16b8a07250d36543a2

SHA1
abee1490ded8c7155e1248b797ce638fecf747ed

SHA256
04fd4ff3ce7bbc6252e610cae8cb2cffd8cbfbe3391b5b4e447c8afa5716d118

SHA512
6929657bfda10b467fbe4122f44f2a5ce14c7d251bf8a54a2da2b986aa40d16193504bfb545c24b08b5b8b4b503460c0557aa6e90165bb2d1af59be6fd204b67

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qapp529h.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
3c0fbb097026ea4b854b24f4ab5aa6c0

SHA1
4c1065f9b5bf37149497a7217451a618614123a8

SHA256
52267001e0023f8122ff06de910d19387e927d95b6eff071febc3089249d4da1

SHA512
5fb1e09b5714d6d94191c3ac2b5bbd19144e1d5cdc1c9cfcec3dfedb52fe1938c9d6d672fc3580793608b49b297ebb2ec97322cda2dd781a919460eb996a8efe

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qapp529h.default-release\datareporting\glean\pending_pings\3ead057f-a391-461a-ab2b-75d8e79df88f

Filesize
11KB

MD5
ef8d1a4291f56f25ceb6fc289c8b8c52

SHA1
c9b97374c100989710dc9f98458dec74df553ff7

SHA256
acc044eb9fd65fba7fd986df4c7b152f27d27a268702366516a054b9bddd8963

SHA512
3c4ad4d0a5567eff80829df12a90fadce169bac8cffe1c3ef709ac4efae720ac1167eb831cae3de05589e6730facafb3491a2bee65060e42681de77d4498219a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qapp529h.default-release\datareporting\glean\pending_pings\bf020396-dc7b-4c97-9408-7c7b9eae6d3e

Filesize
746B

MD5
dce0f7a7717b6453e9a5533b90b9aa99

SHA1
ba5dcff2937e80f5077bdc238f49582ec183acff

SHA256
e1d91c9f099f17de05fd92dba37125e7295efcbca4d7c2af53ee8cbb395e33bb

SHA512
c9ba170cb73e87c219c8b3381a91679d1075d63b7b72324fa7b1fb7c4dd1f4ce5c760ce7a2d6b5c772a1e03fa040e280cb9d1eecf8aafa596a4eec40ec88a07d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qapp529h.default-release\prefs-1.js

Filesize
6KB

MD5
5dfe3963aacfe1ccc0ada573c778b494

SHA1
3a6fcb8652329ec801c2538547ab86051a94b83b

SHA256
e01b0a337aca32b77a28205920d6f8e38d2acd0c8c019c74be7d67d781503ba5

SHA512
036f4b6698ddbf9160bba2addb87c1261f63314c2e34e77bf44198f99da9ad3a7fcb8f0b589e9c61e3cc65128dbbe3c4286106f7104b5f9f394cd608bd38c7ae

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qapp529h.default-release\prefs-1.js

Filesize
6KB

MD5
8f1aef6d49e9a55fa579ddcda03bdbfb

SHA1
041ee146bed55adf2dd6b23a23cd38ffde43989b

SHA256
b5b1595400b984a9947264cc36d8a240dfc7fca2f185d9b9f01a805f8c455349

SHA512
ed0e76a47af25c9b129ef0e3edc0f106b60361bdb38b25f611c13f50e73dc2380e0e17c510cc222aa91e0fe4e102fefa6719346227917645c3186665a943c779

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qapp529h.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
e2463054bd01f9fae4718f049f1770bc

SHA1
106ca886d905e355a8d316ec0c7da2cf60da2c0d

SHA256
dedfbb8ac065f934a106088c0c3fd0674aa87d738c086a7362533ba0045c9a24

SHA512
0a9323170dcb723727a525c7d74212ac781be26f4eba204c3358acdbc45457b1db81b9330ab9bbca682957ffc2207187ec5951aa83cfcdb1c8efcf911044a0f1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qapp529h.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
6KB

MD5
3e388337359f1a6ef76c3267534c09c6

SHA1
e348a6159110e40613dd64af2602347cf58c391d

SHA256
5e9c08ad8434469d80426d5d4bdc3b4a5b7cfe8ef858a995b6ab400e9172f5b4

SHA512
94e1eb115e8a1c44c442afdb7b922445ff265c40bdcf826b564f8a021bfb0b4e953f893993899e9a06acc9d411c675a5b5cb13dba9fb3f674cc1e866c50f555c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qapp529h.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
33f7b2ef4d6cb3e4bd724cf46be387a5

SHA1
951bf60886de5dc5cc1b80abddf269e39c1a5b20

SHA256
818c051eca14a32113990282a7e03e3beef1040177091243cbac300d0486c0d6

SHA512
1d86147996628d7e1b40638a341bedfbd701cbffe128f47759b9415c19cbfdad103732072dd045e36cea88d6e18d35a5e127c74973d9e1f8444092c13ef3ed38

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qapp529h.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
6KB

MD5
d22f100f26254fc3eb0561e42440682a

SHA1
e6e4edae44393d680cd1a2a6b3db0db65a83488a

SHA256
fa5c7663bc32b0dab95c08354400a856203b3d4384e8b397b79622dbad640ebf

SHA512
67109cc9ef738bd9ee37ee7f249708b145f19c1ea0957ea7324e8bb893e1f3424bc1098b6c0bb2c8d40237e682336d036c7fe5fac80e61c3968287fea75581e3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qapp529h.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
6KB

MD5
e43de6d7dfe887ed00d22b3f6b23f4de

SHA1
0e7452613718e2bc0e1f5333072f2aefb03a7f8c

SHA256
3f1beacd29bf5a60450825103b66ec7b925a0952501b00642d321eafb13a891f

SHA512
80b8283a9ab63d3a8e5a3ae046a2a0c36f6a00501ec058d1c880b55beb0be26776fbabb0f660bee86e69ef1f8b800b8ad1107acd4ff676110bffda2e60894db1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qapp529h.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
9f68b4a7064d7d3664d783a2019ac71c

SHA1
016c5d2cf449be93d430d67fafd25082d49a9db6

SHA256
c74d223bc1a59738121cf79882feb12bab519756cef717ec6bbdfe64c7f02694

SHA512
fce6461ae7bb8dc847383e8ed8a7dbd1f1e0e0effcafb2321f29de987f4bfbb4b24d4c206a48f4fb0bb401b9afdaa9315142fb87e1174bdfd56712f1783290f1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qapp529h.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
6KB

MD5
d88493b9fb7d62106894f1fa9606f0e4

SHA1
820f82e6e0bedf851e4694612e05029951bfff36

SHA256
3b48e70afba777dfd67f4487eae25e85ca395dccbcf52f8423b933986eda77f7

SHA512
af61a567a1ced71399a7e596752eae171513179c12d91648414291c33494019affc55359ce592fb3eb1cf0d5d22f734c6674bd63e98930b9970077f89d4e4908

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qapp529h.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
6KB

MD5
402b60b219e4f3e6378d2a814a2d5382

SHA1
5a119ee7f24295cf9e80ba7769036fc4d6823395

SHA256
f6cc53e4665a5f68d4ac3a44d7d42a45c004373977d1e1c05655902575e1ad08

SHA512
537768638aba7a62b84828b042be1a6dbef45072db6a846291bcb640b9a67b77ddb8b97130a17920de770324ab83a4ba4de5c6aa786421d8730e32181b9e1352

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qapp529h.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
6KB

MD5
9af6da8742df9d71af8e0e097db9310b

SHA1
7cb1d665b1997e639d494ad13cabf2cde3c3d65d

SHA256
cbbfb321975e52c030549f544d65c1faf184c4d55c371a94832bc341322e8a3d

SHA512
c43e84933756a61e9307c835e7bc544fcd927dc273ed0e469a0d5699a81c6436f1fa697a01eaff05188edc0bbebb2e5743a6c0b25f441432cf97a2138ae04344

Download Submit
memory/4584-2-0x0000000002180000-0x0000000002211000-memory.dmp

Filesize
580KB

Download
memory/4584-92-0x0000000002180000-0x0000000002211000-memory.dmp

Filesize
580KB

Download
memory/4584-5-0x0000000000610000-0x0000000000710000-memory.dmp

Filesize
1024KB

Download
memory/4584-4-0x0000000000400000-0x00000000004AC000-memory.dmp

Filesize
688KB

Download
memory/4584-3-0x0000000000400000-0x00000000004AC000-memory.dmp

Filesize
688KB

Download
memory/4584-1-0x0000000000610000-0x0000000000710000-memory.dmp

Filesize
1024KB

Download