904037f5cba76fcd8931fd8efc0a2a4515044b812b313afecce37efc83c4f212

Analysis

max time kernel
58s
max time network
50s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2024, 21:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DarkSide Cheat V1 Undetectable (1).rar
Size

368KB
MD5

c5a707989700807e53c36b93bd95cd6b
SHA1

26a2e4993824c1a26d3c8c1264e46019e7e33054
SHA256

904037f5cba76fcd8931fd8efc0a2a4515044b812b313afecce37efc83c4f212
SHA512

4f7d556c2f3026d3af8ca8f2931a325f2e8acdb721645944584264e5fb74b80cd1300ab9d652abf473829c175013cb2eb4a9538f957fe54dd4d667d8738803ff
SSDEEP

6144:NUBv0/hngqbohbQhojKyArQdHinp6k9pwYEOQuB/VB6UBzN9KetMbkXd7pd:i05nNkshM1EnvphEWdB7zrKetMbCPd

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4524	OpenWith.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4440	firefox.exe
Token: SeDebugPrivilege	4440	firefox.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
4440	firefox.exe
4440	firefox.exe
4440	firefox.exe
4440	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4440	firefox.exe
4440	firefox.exe
4440	firefox.exe

Suspicious use of SetWindowsHookEx 20 IoCs

pid	Process
4524	OpenWith.exe
4524	OpenWith.exe
4524	OpenWith.exe
4524	OpenWith.exe
4524	OpenWith.exe
4524	OpenWith.exe
4524	OpenWith.exe
4524	OpenWith.exe
4524	OpenWith.exe
4524	OpenWith.exe
4524	OpenWith.exe
4524	OpenWith.exe
4524	OpenWith.exe
4524	OpenWith.exe
4524	OpenWith.exe
2020	AcroRd32.exe
2020	AcroRd32.exe
2020	AcroRd32.exe
2020	AcroRd32.exe
4440	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4524 wrote to memory of 2020	4524	OpenWith.exe	91
PID 4524 wrote to memory of 2020	4524	OpenWith.exe	91
PID 4524 wrote to memory of 2020	4524	OpenWith.exe	91
PID 2020 wrote to memory of 4416	2020	AcroRd32.exe	94
PID 2020 wrote to memory of 4416	2020	AcroRd32.exe	94
PID 2020 wrote to memory of 4416	2020	AcroRd32.exe	94
PID 4416 wrote to memory of 3076	4416	RdrCEF.exe	95
PID 4416 wrote to memory of 3076	4416	RdrCEF.exe	95
PID 4416 wrote to memory of 3076	4416	RdrCEF.exe	95
PID 4416 wrote to memory of 3076	4416	RdrCEF.exe	95
PID 4416 wrote to memory of 3076	4416	RdrCEF.exe	95
PID 4416 wrote to memory of 3076	4416	RdrCEF.exe	95
PID 4416 wrote to memory of 3076	4416	RdrCEF.exe	95
PID 4416 wrote to memory of 3076	4416	RdrCEF.exe	95
PID 4416 wrote to memory of 3076	4416	RdrCEF.exe	95
PID 4416 wrote to memory of 3076	4416	RdrCEF.exe	95
PID 4416 wrote to memory of 3076	4416	RdrCEF.exe	95
PID 4416 wrote to memory of 3076	4416	RdrCEF.exe	95
PID 4416 wrote to memory of 3076	4416	RdrCEF.exe	95
PID 4416 wrote to memory of 3076	4416	RdrCEF.exe	95
PID 4416 wrote to memory of 3076	4416	RdrCEF.exe	95
PID 4416 wrote to memory of 3076	4416	RdrCEF.exe	95
PID 4416 wrote to memory of 3076	4416	RdrCEF.exe	95
PID 4416 wrote to memory of 3076	4416	RdrCEF.exe	95
PID 4416 wrote to memory of 3076	4416	RdrCEF.exe	95
PID 4416 wrote to memory of 3076	4416	RdrCEF.exe	95
PID 4416 wrote to memory of 3076	4416	RdrCEF.exe	95
PID 4416 wrote to memory of 3076	4416	RdrCEF.exe	95
PID 4416 wrote to memory of 3076	4416	RdrCEF.exe	95
PID 4416 wrote to memory of 3076	4416	RdrCEF.exe	95
PID 4416 wrote to memory of 3076	4416	RdrCEF.exe	95
PID 4416 wrote to memory of 3076	4416	RdrCEF.exe	95
PID 4416 wrote to memory of 3076	4416	RdrCEF.exe	95
PID 4416 wrote to memory of 3076	4416	RdrCEF.exe	95
PID 4416 wrote to memory of 3076	4416	RdrCEF.exe	95
PID 4416 wrote to memory of 3076	4416	RdrCEF.exe	95
PID 4416 wrote to memory of 3076	4416	RdrCEF.exe	95
PID 4416 wrote to memory of 3076	4416	RdrCEF.exe	95
PID 4416 wrote to memory of 3076	4416	RdrCEF.exe	95
PID 4416 wrote to memory of 3076	4416	RdrCEF.exe	95
PID 4416 wrote to memory of 3076	4416	RdrCEF.exe	95
PID 4416 wrote to memory of 3076	4416	RdrCEF.exe	95
PID 4416 wrote to memory of 3076	4416	RdrCEF.exe	95
PID 4416 wrote to memory of 3076	4416	RdrCEF.exe	95
PID 4416 wrote to memory of 3076	4416	RdrCEF.exe	95
PID 4416 wrote to memory of 3076	4416	RdrCEF.exe	95
PID 4416 wrote to memory of 3076	4416	RdrCEF.exe	95
PID 4416 wrote to memory of 2672	4416	RdrCEF.exe	96
PID 4416 wrote to memory of 2672	4416	RdrCEF.exe	96
PID 4416 wrote to memory of 2672	4416	RdrCEF.exe	96
PID 4416 wrote to memory of 2672	4416	RdrCEF.exe	96
PID 4416 wrote to memory of 2672	4416	RdrCEF.exe	96
PID 4416 wrote to memory of 2672	4416	RdrCEF.exe	96
PID 4416 wrote to memory of 2672	4416	RdrCEF.exe	96
PID 4416 wrote to memory of 2672	4416	RdrCEF.exe	96
PID 4416 wrote to memory of 2672	4416	RdrCEF.exe	96
PID 4416 wrote to memory of 2672	4416	RdrCEF.exe	96
PID 4416 wrote to memory of 2672	4416	RdrCEF.exe	96
PID 4416 wrote to memory of 2672	4416	RdrCEF.exe	96
PID 4416 wrote to memory of 2672	4416	RdrCEF.exe	96
PID 4416 wrote to memory of 2672	4416	RdrCEF.exe	96
PID 4416 wrote to memory of 2672	4416	RdrCEF.exe	96
PID 4416 wrote to memory of 2672	4416	RdrCEF.exe	96
PID 4416 wrote to memory of 2672	4416	RdrCEF.exe	96

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\DarkSide Cheat V1 Undetectable (1).rar"
1⤵
- Modifies registry class
PID:976

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4524
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\DarkSide Cheat V1 Undetectable (1).rar"
  2⤵
  - Checks processor information in registry
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2020
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4416
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=649F75BEF432769DCA4E189363AE0DBB --mojo-platform-channel-handle=1760 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:3076
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=1883154C1A19F2423448131B4B8ED761 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=1883154C1A19F2423448131B4B8ED761 --renderer-client-id=2 --mojo-platform-channel-handle=1776 --allow-no-sandbox-job /prefetch:1
      4⤵
      PID:2672
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=AA1CD2480F0187C2FF39505E1E4A7951 --mojo-platform-channel-handle=2312 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:3688
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=9AFFD5C60ABAFD2031380948DC48BBA0 --mojo-platform-channel-handle=2476 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:1376
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=62BE0307D952DD97CE7445370D9FF635 --mojo-platform-channel-handle=1756 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:1580

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:2264
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:4440
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4440.0.1220410506\1674710282" -parentBuildID 20230214051806 -prefsHandle 1784 -prefMapHandle 1776 -prefsLen 22076 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3c9d4094-d5a1-4a8b-9f8b-d7d9149cc741} 4440 "\\.\pipe\gecko-crash-server-pipe.4440" 1864 284b400d758 gpu
    3⤵
    PID:3808
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4440.1.1842625112\859225872" -parentBuildID 20230214051806 -prefsHandle 2420 -prefMapHandle 2408 -prefsLen 22112 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c1a88260-7419-459b-8a81-8651c4650cd6} 4440 "\\.\pipe\gecko-crash-server-pipe.4440" 2432 284a7289658 socket
    3⤵
    PID:1856
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4440.2.277714407\308905213" -childID 1 -isForBrowser -prefsHandle 2956 -prefMapHandle 2952 -prefsLen 22150 -prefMapSize 235121 -jsInitHandle 1264 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1b674af6-dec2-456f-930e-f051feb23d19} 4440 "\\.\pipe\gecko-crash-server-pipe.4440" 2968 284b68f9258 tab
    3⤵
    PID:4900
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4440.3.2119788699\1317363282" -childID 2 -isForBrowser -prefsHandle 3648 -prefMapHandle 3644 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1264 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a3dac628-6d82-47f5-b4c2-20fd3b312304} 4440 "\\.\pipe\gecko-crash-server-pipe.4440" 3660 284a7279f58 tab
    3⤵
    PID:876
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4440.4.477125963\273546724" -childID 3 -isForBrowser -prefsHandle 5112 -prefMapHandle 5108 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 1264 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6072c126-9aa3-44f9-ad1c-e96c7e85c28a} 4440 "\\.\pipe\gecko-crash-server-pipe.4440" 5024 284b9947b58 tab
    3⤵
    PID:3968
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4440.5.2097884934\1226060076" -childID 4 -isForBrowser -prefsHandle 5260 -prefMapHandle 5268 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 1264 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {047cffe2-9aad-43e4-a1b5-97aa604e17d3} 4440 "\\.\pipe\gecko-crash-server-pipe.4440" 5252 284bb310858 tab
    3⤵
    PID:380
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4440.6.1042131363\337306013" -childID 5 -isForBrowser -prefsHandle 5528 -prefMapHandle 5524 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 1264 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dd493349-1ce4-40d7-aa5a-473f6c3012b6} 4440 "\\.\pipe\gecko-crash-server-pipe.4440" 5536 284bb30de58 tab
    3⤵
    PID:1564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ue3bcu6m.default-release\activity-stream.discovery_stream.json.tmp

Filesize
23KB

MD5
c021e148b57bd1576b6832500525fc86

SHA1
df33996554b57fd96802ff2de32ba4c57268047e

SHA256
90bb17248d365662ca09349b478e478d4224226ecf041d958bfd198fd1100479

SHA512
6d082fad3d627f809b8d6f4d81a2f21d0c8483298b8795c5ea7acebebe4d92141fe222988b6ffac27ae79fc02ae1aadd1df6bb0aab845cbd88cb3e99fdb88d9f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ue3bcu6m.default-release\activity-stream.discovery_stream.json.tmp

Filesize
23KB

MD5
2a15e5a09f24ea1444ed6b6190a0a4c7

SHA1
6458f5256561fa1e29cb757887999eac7f74c140

SHA256
e9df708fff030600595caeb1b7f0d2132a15d800cdcde4fa43ae8aced4e95ce0

SHA512
9ba5971af78f31e96ccb8023cfd6cf67c9173aeb42be9952aafc046945a2cfdd0c0b8342b4da2f5ed699aa48f027d2d7462c0af8c31a6f8bbb787fd91dd0dd78

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ue3bcu6m.default-release\prefs-1.js

Filesize
6KB

MD5
609ea2d4f289f7dbab5cf7dc59fcdaad

SHA1
d5579b384123f47017f8ffcbffd86005c6288a1d

SHA256
8f1b2ca254ba1a27ebda5e8e1f3032ebc351ed1ed85dc3b424ba53a556a8fbe5

SHA512
10e5d5d82082f9b494e1b6d169f720e52ede24ea47c110aa48d5161cb1905af1bdeb459abe2a634ee2b174c104e763f5123a2ee236036abb736d89e11d66ef89

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ue3bcu6m.default-release\prefs.js

Filesize
6KB

MD5
fe7298f7256b84c81fb1511992fe5129

SHA1
a0458efee1d934d86ea0741c3ca4dbaaaf042182

SHA256
04cd3732594c06edf0cfc1d5d834972520e7d9d681e737fc5927a6b1e7246ddf

SHA512
309e168a3240872733ae5e8d201d5827cd85807bbe00ebe983a64a81a574469e6eabf8d3f763417b552097848301ef0175b2e91c9b20a36e480575b74058df2f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ue3bcu6m.default-release\prefs.js

Filesize
6KB

MD5
171f482ed12a4444817dc542ddd7a1fd

SHA1
bef88ad1ad0922c9cc2d517ff535293562b34acc

SHA256
d63d7a863cf81b734ffaa5277cc57dd4a667242246ff998257a3194ee4d33cd1

SHA512
78a01c6a9f262c054eaa8a324927ff02c6d682d210c39e417cfeb8ceff3d4c4739b2fadd983277534107c79fa716574c308509261721c2c3b1932446c3c3ffcc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ue3bcu6m.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
6d2f4a1f8ffa7f283daec0b64e4ba399

SHA1
9e41ca804ca7c55bcd706357579b2357f7e35b09

SHA256
5ae713c6e421a7481d34c25d993787ec9bb7611a0c258aa6f2f19cc1dc1a27af

SHA512
8bad29b03e452bccc24c40a1a872e11ccdbc582c4bd04cd672932d6337f764de1a10c7b8adb98e33fb3b0be2a76a562740b95ad409357d868f665943d3db0d5d

Download Submit