hxxps://go[.]plusgrade[.]com/ls/click?upn=u001[.]-2FAKz9yuAuJ5SnoGWInmZRWocA7pJVxglfp8qaYFK8d0j8P64lbMRKFccQyGAgEJfNUw79J3D5qKcn4PKPAixDtTg1K6GeXsJoF6x5BsCq6hozpGFqKvITSjw6aGw-2Frhw7MIednRx6X0M7-2BMoGTgXRh3HjGlyOq-2BSCJCZKJKYJDpZnzgMXDKyWTEaOimZrV2LYW8kLZ-2FojYPclpyiBrMTrz4Z-2BMxdBodTtbE6gbqXzgBaVMM-2FjE3deD0C35IP4YzYfWUf_hl7d6mc6SANDgYfwrN4BjIQbuneQeUsrUsIY9D13ySM5lTRjg793dHcnFm9Pa0PXZX9LQ-2BiLt9pZ-2BpJIbB4su73fkxMnjTNsYdhJz8o3AVEnjpDKy-2FIc2VmGcwxRvz7UdZQ5f4-2B7No8axUHmGuzGmqaAcJw9-2BKwmy0ApcDv2hgbVZu-2FEjSPSYH-2F-2FkXDcHCVC6CPZDElW2Z1qQrxGN-2FFIgCoh4nmzdi5ljfPMUeGXK0-2BHWIEHsWsvEQyCjGGfV-2FXkHoUJYg65GkGfuUrOYY5L4eQULmXwkAj5fnsHUKQ-2F-2FJQw3CF3LZ60J8G2NM-2B7gnrbjp8TERcNigS75C3HWufZ1adkaMPL3zMVdnbMcLhtsfIB4p03SGwWFXkULnaSSBTx8QElSKwllPubqcNig6SnGo4IgiyHLRj-2FWUuy9LkvbS0Og2E3JuqaptUvIKuDsPeHTQORygw3NkrSyJP3G4b6-2Bv3un9kJbNr8EkGaDyzNh5aNEbHlfWqqcWi-2BmDcaX5vHMmv-2FA39MDVNEkC2ZNsqzA6t-2B9kvpCTr8w76JJPfUSIRLJcBqDTzi1Lelj6fORcj3QUtgv6QkH6bENMdD2BvrtxC5-2FLx0s3RsW4T0HHHKbYNafBl-2BfYkK4T64ltvUCPkWkvn-2B5Yop1B1zLCdHtuXMkWcV65-2BkJtYVtQMAjzbnIUhx-2FbvKNz655w0eZje5YI6NYilT35n-2FJx4IvDtN7fuotc1g6EDItrGIVV-2Bj3JUBw5CIlA6ytEIDpGdIkjL2aMRvR314W-2F8a3mL9M8ORdlmnBP33Buduijxh472wSk9SXq5B38TdjW1KKhDKQj7-2Fw6WXfqEduEGwZmsSKX5iBw9LGQw-2BPb9b8tPAygCHXVOlNobM8vZ0iiIepnBfBz4g-2Fl00cEi-2B0OqLlDFoH1moVaFtrIsoepPfm-2BXbB7o5ks6LHRmU-2F0f8NpvdVuHuZEEINT-2FGyocUV2OkIYD7IQSIvqi-2FXKonFKvtPcRmNLPsvlMd71J47Ezfu1yfLUSC2zGqh3MW6fMw45I8YfgORxYVJaHNP-2FpIijV9c7rAfxtP0FFeRgbV12bHvRDjqSWh7xPus5ScUbjypSuxD9jHBdeTeZdOqw-3D-3D

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
13-05-2024 07:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://go.plusgrade.com/ls/click?upn=u001.-2FAKz9yuAuJ5SnoGWInmZRWocA7pJVxglfp8qaYFK8d0j8P64lbMRKFccQyGAgEJfNUw79J3D5qKcn4PKPAixDtTg1K6GeXsJoF6x5BsCq6hozpGFqKvITSjw6aGw-2Frhw7MIednRx6X0M7-2BMoGTgXRh3HjGlyOq-2BSCJCZKJKYJDpZnzgMXDKyWTEaOimZrV2LYW8kLZ-2FojYPclpyiBrMTrz4Z-2BMxdBodTtbE6gbqXzgBaVMM-2FjE3deD0C35IP4YzYfWUf_hl7d6mc6SANDgYfwrN4BjIQbuneQeUsrUsIY9D13ySM5lTRjg793dHcnFm9Pa0PXZX9LQ-2BiLt9pZ-2BpJIbB4su73fkxMnjTNsYdhJz8o3AVEnjpDKy-2FIc2VmGcwxRvz7UdZQ5f4-2B7No8axUHmGuzGmqaAcJw9-2BKwmy0ApcDv2hgbVZu-2FEjSPSYH-2F-2FkXDcHCVC6CPZDElW2Z1qQrxGN-2FFIgCoh4nmzdi5ljfPMUeGXK0-2BHWIEHsWsvEQyCjGGfV-2FXkHoUJYg65GkGfuUrOYY5L4eQULmXwkAj5fnsHUKQ-2F-2FJQw3CF3LZ60J8G2NM-2B7gnrbjp8TERcNigS75C3HWufZ1adkaMPL3zMVdnbMcLhtsfIB4p03SGwWFXkULnaSSBTx8QElSKwllPubqcNig6SnGo4IgiyHLRj-2FWUuy9LkvbS0Og2E3JuqaptUvIKuDsPeHTQORygw3NkrSyJP3G4b6-2Bv3un9kJbNr8EkGaDyzNh5aNEbHlfWqqcWi-2BmDcaX5vHMmv-2FA39MDVNEkC2ZNsqzA6t-2B9kvpCTr8w76JJPfUSIRLJcBqDTzi1Lelj6fORcj3QUtgv6QkH6bENMdD2BvrtxC5-2FLx0s3RsW4T0HHHKbYNafBl-2BfYkK4T64ltvUCPkWkvn-2B5Yop1B1zLCdHtuXMkWcV65-2BkJtYVtQMAjzbnIUhx-2FbvKNz655w0eZje5YI6NYilT35n-2FJx4IvDtN7fuotc1g6EDItrGIVV-2Bj3JUBw5CIlA6ytEIDpGdIkjL2aMRvR314W-2F8a3mL9M8ORdlmnBP33Buduijxh472wSk9SXq5B38TdjW1KKhDKQj7-2Fw6WXfqEduEGwZmsSKX5iBw9LGQw-2BPb9b8tPAygCHXVOlNobM8vZ0iiIepnBfBz4g-2Fl00cEi-2B0OqLlDFoH1moVaFtrIsoepPfm-2BXbB7o5ks6LHRmU-2F0f8NpvdVuHuZEEINT-2FGyocUV2OkIYD7IQSIvqi-2FXKonFKvtPcRmNLPsvlMd71J47Ezfu1yfLUSC2zGqh3MW6fMw45I8YfgORxYVJaHNP-2FpIijV9c7rAfxtP0FFeRgbV12bHvRDjqSWh7xPus5ScUbjypSuxD9jHBdeTeZdOqw-3D-3D

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1608	firefox.exe
Token: SeDebugPrivilege	1608	firefox.exe
Token: SeDebugPrivilege	1608	firefox.exe
Token: SeDebugPrivilege	1608	firefox.exe
Token: SeDebugPrivilege	1608	firefox.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1608	firefox.exe
1608	firefox.exe
1608	firefox.exe
1608	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
1608	firefox.exe
1608	firefox.exe
1608	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1608	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 836 wrote to memory of 1608	836	firefox.exe	83
PID 836 wrote to memory of 1608	836	firefox.exe	83
PID 836 wrote to memory of 1608	836	firefox.exe	83
PID 836 wrote to memory of 1608	836	firefox.exe	83
PID 836 wrote to memory of 1608	836	firefox.exe	83
PID 836 wrote to memory of 1608	836	firefox.exe	83
PID 836 wrote to memory of 1608	836	firefox.exe	83
PID 836 wrote to memory of 1608	836	firefox.exe	83
PID 836 wrote to memory of 1608	836	firefox.exe	83
PID 836 wrote to memory of 1608	836	firefox.exe	83
PID 836 wrote to memory of 1608	836	firefox.exe	83
PID 1608 wrote to memory of 232	1608	firefox.exe	84
PID 1608 wrote to memory of 232	1608	firefox.exe	84
PID 1608 wrote to memory of 232	1608	firefox.exe	84
PID 1608 wrote to memory of 232	1608	firefox.exe	84
PID 1608 wrote to memory of 232	1608	firefox.exe	84
PID 1608 wrote to memory of 232	1608	firefox.exe	84
PID 1608 wrote to memory of 232	1608	firefox.exe	84
PID 1608 wrote to memory of 232	1608	firefox.exe	84
PID 1608 wrote to memory of 232	1608	firefox.exe	84
PID 1608 wrote to memory of 232	1608	firefox.exe	84
PID 1608 wrote to memory of 232	1608	firefox.exe	84
PID 1608 wrote to memory of 232	1608	firefox.exe	84
PID 1608 wrote to memory of 232	1608	firefox.exe	84
PID 1608 wrote to memory of 232	1608	firefox.exe	84
PID 1608 wrote to memory of 232	1608	firefox.exe	84
PID 1608 wrote to memory of 232	1608	firefox.exe	84
PID 1608 wrote to memory of 232	1608	firefox.exe	84
PID 1608 wrote to memory of 232	1608	firefox.exe	84
PID 1608 wrote to memory of 232	1608	firefox.exe	84
PID 1608 wrote to memory of 232	1608	firefox.exe	84
PID 1608 wrote to memory of 232	1608	firefox.exe	84
PID 1608 wrote to memory of 232	1608	firefox.exe	84
PID 1608 wrote to memory of 232	1608	firefox.exe	84
PID 1608 wrote to memory of 232	1608	firefox.exe	84
PID 1608 wrote to memory of 232	1608	firefox.exe	84
PID 1608 wrote to memory of 232	1608	firefox.exe	84
PID 1608 wrote to memory of 232	1608	firefox.exe	84
PID 1608 wrote to memory of 232	1608	firefox.exe	84
PID 1608 wrote to memory of 232	1608	firefox.exe	84
PID 1608 wrote to memory of 232	1608	firefox.exe	84
PID 1608 wrote to memory of 232	1608	firefox.exe	84
PID 1608 wrote to memory of 232	1608	firefox.exe	84
PID 1608 wrote to memory of 232	1608	firefox.exe	84
PID 1608 wrote to memory of 232	1608	firefox.exe	84
PID 1608 wrote to memory of 232	1608	firefox.exe	84
PID 1608 wrote to memory of 232	1608	firefox.exe	84
PID 1608 wrote to memory of 232	1608	firefox.exe	84
PID 1608 wrote to memory of 232	1608	firefox.exe	84
PID 1608 wrote to memory of 232	1608	firefox.exe	84
PID 1608 wrote to memory of 232	1608	firefox.exe	84
PID 1608 wrote to memory of 232	1608	firefox.exe	84
PID 1608 wrote to memory of 232	1608	firefox.exe	84
PID 1608 wrote to memory of 232	1608	firefox.exe	84
PID 1608 wrote to memory of 4468	1608	firefox.exe	85
PID 1608 wrote to memory of 4468	1608	firefox.exe	85
PID 1608 wrote to memory of 4468	1608	firefox.exe	85
PID 1608 wrote to memory of 4468	1608	firefox.exe	85
PID 1608 wrote to memory of 4468	1608	firefox.exe	85
PID 1608 wrote to memory of 4468	1608	firefox.exe	85
PID 1608 wrote to memory of 4468	1608	firefox.exe	85
PID 1608 wrote to memory of 4468	1608	firefox.exe	85
PID 1608 wrote to memory of 4468	1608	firefox.exe	85
PID 1608 wrote to memory of 4468	1608	firefox.exe	85

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://go.plusgrade.com/ls/click?upn=u001.-2FAKz9yuAuJ5SnoGWInmZRWocA7pJVxglfp8qaYFK8d0j8P64lbMRKFccQyGAgEJfNUw79J3D5qKcn4PKPAixDtTg1K6GeXsJoF6x5BsCq6hozpGFqKvITSjw6aGw-2Frhw7MIednRx6X0M7-2BMoGTgXRh3HjGlyOq-2BSCJCZKJKYJDpZnzgMXDKyWTEaOimZrV2LYW8kLZ-2FojYPclpyiBrMTrz4Z-2BMxdBodTtbE6gbqXzgBaVMM-2FjE3deD0C35IP4YzYfWUf_hl7d6mc6SANDgYfwrN4BjIQbuneQeUsrUsIY9D13ySM5lTRjg793dHcnFm9Pa0PXZX9LQ-2BiLt9pZ-2BpJIbB4su73fkxMnjTNsYdhJz8o3AVEnjpDKy-2FIc2VmGcwxRvz7UdZQ5f4-2B7No8axUHmGuzGmqaAcJw9-2BKwmy0ApcDv2hgbVZu-2FEjSPSYH-2F-2FkXDcHCVC6CPZDElW2Z1qQrxGN-2FFIgCoh4nmzdi5ljfPMUeGXK0-2BHWIEHsWsvEQyCjGGfV-2FXkHoUJYg65GkGfuUrOYY5L4eQULmXwkAj5fnsHUKQ-2F-2FJQw3CF3LZ60J8G2NM-2B7gnrbjp8TERcNigS75C3HWufZ1adkaMPL3zMVdnbMcLhtsfIB4p03SGwWFXkULnaSSBTx8QElSKwllPubqcNig6SnGo4IgiyHLRj-2FWUuy9LkvbS0Og2E3JuqaptUvIKuDsPeHTQORygw3NkrSyJP3G4b6-2Bv3un9kJbNr8EkGaDyzNh5aNEbHlfWqqcWi-2BmDcaX5vHMmv-2FA39MDVNEkC2ZNsqzA6t-2B9kvpCTr8w76JJPfUSIRLJcBqDTzi1Lelj6fORcj3QUtgv6QkH6bENMdD2BvrtxC5-2FLx0s3RsW4T0HHHKbYNafBl-2BfYkK4T64ltvUCPkWkvn-2B5Yop1B1zLCdHtuXMkWcV65-2BkJtYVtQMAjzbnIUhx-2FbvKNz655w0eZje5YI6NYilT35n-2FJx4IvDtN7fuotc1g6EDItrGIVV-2Bj3JUBw5CIlA6ytEIDpGdIkjL2aMRvR314W-2F8a3mL9M8ORdlmnBP33Buduijxh472wSk9SXq5B38TdjW1KKhDKQj7-2Fw6WXfqEduEGwZmsSKX5iBw9LGQw-2BPb9b8tPAygCHXVOlNobM8vZ0iiIepnBfBz4g-2Fl00cEi-2B0OqLlDFoH1moVaFtrIsoepPfm-2BXbB7o5ks6LHRmU-2F0f8NpvdVuHuZEEINT-2FGyocUV2OkIYD7IQSIvqi-2FXKonFKvtPcRmNLPsvlMd71J47Ezfu1yfLUSC2zGqh3MW6fMw45I8YfgORxYVJaHNP-2FpIijV9c7rAfxtP0FFeRgbV12bHvRDjqSWh7xPus5ScUbjypSuxD9jHBdeTeZdOqw-3D-3D"
1⤵
- Suspicious use of WriteProcessMemory
PID:836
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://go.plusgrade.com/ls/click?upn=u001.-2FAKz9yuAuJ5SnoGWInmZRWocA7pJVxglfp8qaYFK8d0j8P64lbMRKFccQyGAgEJfNUw79J3D5qKcn4PKPAixDtTg1K6GeXsJoF6x5BsCq6hozpGFqKvITSjw6aGw-2Frhw7MIednRx6X0M7-2BMoGTgXRh3HjGlyOq-2BSCJCZKJKYJDpZnzgMXDKyWTEaOimZrV2LYW8kLZ-2FojYPclpyiBrMTrz4Z-2BMxdBodTtbE6gbqXzgBaVMM-2FjE3deD0C35IP4YzYfWUf_hl7d6mc6SANDgYfwrN4BjIQbuneQeUsrUsIY9D13ySM5lTRjg793dHcnFm9Pa0PXZX9LQ-2BiLt9pZ-2BpJIbB4su73fkxMnjTNsYdhJz8o3AVEnjpDKy-2FIc2VmGcwxRvz7UdZQ5f4-2B7No8axUHmGuzGmqaAcJw9-2BKwmy0ApcDv2hgbVZu-2FEjSPSYH-2F-2FkXDcHCVC6CPZDElW2Z1qQrxGN-2FFIgCoh4nmzdi5ljfPMUeGXK0-2BHWIEHsWsvEQyCjGGfV-2FXkHoUJYg65GkGfuUrOYY5L4eQULmXwkAj5fnsHUKQ-2F-2FJQw3CF3LZ60J8G2NM-2B7gnrbjp8TERcNigS75C3HWufZ1adkaMPL3zMVdnbMcLhtsfIB4p03SGwWFXkULnaSSBTx8QElSKwllPubqcNig6SnGo4IgiyHLRj-2FWUuy9LkvbS0Og2E3JuqaptUvIKuDsPeHTQORygw3NkrSyJP3G4b6-2Bv3un9kJbNr8EkGaDyzNh5aNEbHlfWqqcWi-2BmDcaX5vHMmv-2FA39MDVNEkC2ZNsqzA6t-2B9kvpCTr8w76JJPfUSIRLJcBqDTzi1Lelj6fORcj3QUtgv6QkH6bENMdD2BvrtxC5-2FLx0s3RsW4T0HHHKbYNafBl-2BfYkK4T64ltvUCPkWkvn-2B5Yop1B1zLCdHtuXMkWcV65-2BkJtYVtQMAjzbnIUhx-2FbvKNz655w0eZje5YI6NYilT35n-2FJx4IvDtN7fuotc1g6EDItrGIVV-2Bj3JUBw5CIlA6ytEIDpGdIkjL2aMRvR314W-2F8a3mL9M8ORdlmnBP33Buduijxh472wSk9SXq5B38TdjW1KKhDKQj7-2Fw6WXfqEduEGwZmsSKX5iBw9LGQw-2BPb9b8tPAygCHXVOlNobM8vZ0iiIepnBfBz4g-2Fl00cEi-2B0OqLlDFoH1moVaFtrIsoepPfm-2BXbB7o5ks6LHRmU-2F0f8NpvdVuHuZEEINT-2FGyocUV2OkIYD7IQSIvqi-2FXKonFKvtPcRmNLPsvlMd71J47Ezfu1yfLUSC2zGqh3MW6fMw45I8YfgORxYVJaHNP-2FpIijV9c7rAfxtP0FFeRgbV12bHvRDjqSWh7xPus5ScUbjypSuxD9jHBdeTeZdOqw-3D-3D
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1608
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1608.0.91549104\377252089" -parentBuildID 20230214051806 -prefsHandle 1800 -prefMapHandle 1796 -prefsLen 22076 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5bed9a09-2062-483c-8996-34df3b30321a} 1608 "\\.\pipe\gecko-crash-server-pipe.1608" 1876 1d895b2fd58 gpu
    3⤵
    PID:232
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1608.1.1794656778\2049107600" -parentBuildID 20230214051806 -prefsHandle 2444 -prefMapHandle 2432 -prefsLen 22927 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2427e873-9008-429c-8f6f-a588194c7e6c} 1608 "\\.\pipe\gecko-crash-server-pipe.1608" 2472 1d8819a8058 socket
    3⤵
    PID:4468
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1608.2.2003033354\1504188643" -childID 1 -isForBrowser -prefsHandle 2912 -prefMapHandle 3004 -prefsLen 22965 -prefMapSize 235121 -jsInitHandle 1176 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {851b9650-2c4b-47ff-ab6b-a9bea370a27b} 1608 "\\.\pipe\gecko-crash-server-pipe.1608" 1560 1d898b4c658 tab
    3⤵
    PID:5080
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1608.3.1779217946\458343343" -childID 2 -isForBrowser -prefsHandle 3680 -prefMapHandle 3676 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1176 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a7f7ce4c-20ad-40a6-b6f9-72f1a072e5f1} 1608 "\\.\pipe\gecko-crash-server-pipe.1608" 3416 1d89a921a58 tab
    3⤵
    PID:400
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1608.4.1023463346\721527833" -childID 3 -isForBrowser -prefsHandle 5000 -prefMapHandle 4968 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1176 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7b9d9b49-9de1-43cc-a59e-5b7b29916f63} 1608 "\\.\pipe\gecko-crash-server-pipe.1608" 5016 1d89bcb1858 tab
    3⤵
    PID:2600
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1608.5.310997908\1982443808" -childID 4 -isForBrowser -prefsHandle 5148 -prefMapHandle 5152 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1176 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {15216323-b5d1-439f-a316-191134b8894c} 1608 "\\.\pipe\gecko-crash-server-pipe.1608" 5224 1d89c089358 tab
    3⤵
    PID:2364
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1608.6.1656681067\830898507" -childID 5 -isForBrowser -prefsHandle 5432 -prefMapHandle 5428 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1176 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f56840f8-1234-45a0-b853-c4eb21decafd} 1608 "\\.\pipe\gecko-crash-server-pipe.1608" 5440 1d89c088a58 tab
    3⤵
    PID:3632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\h6dhg2l4.default-release\activity-stream.discovery_stream.json.tmp

Filesize
25KB

MD5
d970c3490293f8e314f6821420e775f2

SHA1
1d99ffc52e0b12cc7cedb56f968cb492b48ab243

SHA256
36bd0fedf5bcad4a1d331565f98721f77ab3b117059c537bd91f19e395502673

SHA512
e2fc83a445e250b1b1b6e87e1bd5204e98472da8feba0f644222314b26b1103013151bb7fdabd2459acd13159769efbb90dde8d6b44c87fcc5b551912171889d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\h6dhg2l4.default-release\cache2\entries\CC9AFF3BE02AD27708D587AE49B3DC68644172BA

Filesize
13KB

MD5
b4f163b57116165807231586b9d2f629

SHA1
455e6b3131ed2596df31d44e86192cfd50d9bef6

SHA256
fc37c83692fffe71c6c1fbdcd2f6c164b91490622c7dd8f2421303ca1cef662d

SHA512
596362d7d8e9ad6d4e7d82273ad2876459b04c457c7eb94ca60d424fd8f16e4a12bfe34257050ea0c3b5824615d2d77409e440c985beb776d144c1464e15dbab

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\h6dhg2l4.default-release\cache2\entries\F4EFE37A30D0F14C6AC03FF7949A51CBC2EBC649

Filesize
13KB

MD5
bb68302b09272f4744b9939acfb050c5

SHA1
287c03efd0233db6f428bde7ec3df1b493377d2c

SHA256
75f4a8110a19d4ae96bc3be76ca77aa9833d5644e7849dfdd1f52753fc533e24

SHA512
d6395b3ecc4056fc323ec255fec2f7dd87ee1a915aa580336fc971c7aabd7789602f5116345e961ca5455a1be389bd646b3393466bdc9ff5cc283a586bbfc744

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
8.0MB

MD5
a01c5ecd6108350ae23d2cddf0e77c17

SHA1
c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

SHA256
345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

SHA512
b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h6dhg2l4.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h6dhg2l4.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h6dhg2l4.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h6dhg2l4.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h6dhg2l4.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

Filesize
11.8MB

MD5
33bf7b0439480effb9fb212efce87b13

SHA1
cee50f2745edc6dc291887b6075ca64d716f495a

SHA256
8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

SHA512
d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h6dhg2l4.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h6dhg2l4.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h6dhg2l4.default-release\prefs-1.js

Filesize
7KB

MD5
2f9c198907d8ba70e9f58e9d5309e55e

SHA1
2a16371d69416611a5880a7eb7db4ad8eac92fa1

SHA256
26c0ea2124d401491f1315fa90c340366a2df11132072289d79107a6484e6bc9

SHA512
5e4000e0b8564c9a9cd9e284ea223334f01ef9d9d8eed08b3e8007e970ed7f259b62d307b24f75c669e0fefd5f45d6ab35a0f50914c0a7b645d707f640019610

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h6dhg2l4.default-release\prefs-1.js

Filesize
8KB

MD5
df4d7b008d3d38109731ceaaa9c900b8

SHA1
9d822324682e77f7039ca8fd200bae56545fbbda

SHA256
c58873e15b3dc240a6be49c33cff297a53fbf7dedf0fcb7fab50649c05264e25

SHA512
0d84539dfb21e3e0c2a0c9f944b1a42caadcf398af1c552300f4228b1ff8b37d35a29c77b9a11dfe11b510c940b34cc623af264b48f3ffa22b926ea1e37f34c8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h6dhg2l4.default-release\prefs.js

Filesize
6KB

MD5
4d9e6e632770546c3dd4fae3ae2a414a

SHA1
c6a1dc1f9d5736abfe200f27ec8146458115bae9

SHA256
1ef581a62c1b670716ac13e723fc57e07588aa5f9edae3c3cb38572a93c60acb

SHA512
a3bc81b49d4a1f55f2a699d1dff5e231faa83d0007e222dceeb700ccba01b499ee894887a8f57abb37d2dab0d811360b9d6e5d01b957eeff07fcce7f972a91b2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h6dhg2l4.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
e69c41e35361beab85cb9d946d39c716

SHA1
fe00339ad16ade34d741fb7a8fe7f50187a52496

SHA256
d39e4ecb26b9cc055cadc81f99a27d02b5028bd061a8a5e9eaef9995708542be

SHA512
7fcc051bb7d3e52cf646d5c5695549943af210b24e9cb7a352ae5dc1a1551885f9423e171f304ef145630f1d3e9ba5ccf548388f5b3f8565b9896f5559d68bcf

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h6dhg2l4.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
df0f008b2a603b04854c2ccb2f0b1449

SHA1
0ba360e08263215f8df35a8b7af87f6cd2a00316

SHA256
3c6e45e2b47249a7ff9b71f08505a9c88549b3cb05cac4232c3cd3a9605bfc91

SHA512
f408e28e8ad412b12dee0f189836736f5a29538754547abc656d31c7ee0f340cf86b3cadee9acd138085322e0e83deca802b37ae70134dd13b5a228b449bdf4a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h6dhg2l4.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
bb973d4e316a6c6ecc7e818dd538300e

SHA1
5b9178190e6eb15717265ee3a2b68996f8d64e96

SHA256
250f1f02e27c97480430a2d44f014ff329f46c44b78cebafb0bdd73a606048f0

SHA512
19a6cd00362c23260d934c1edb8855cb38ea9c6225cce1a962e2a477b76e4399e992c316adec919d4bcd02565bf701c58e9e4a9a8313e6d2381a6fa3799a1504

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h6dhg2l4.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
b2468cdd50a619b7e76e5831401390a3

SHA1
f35a0eac44f3144b8c291c9305ec4c92d100a2f6

SHA256
9029107ffc0a73c7547419367b85edadc43cff74d55b1cae0c1fa2a1ed8b98d3

SHA512
515386adfb2f6ce3ca194d369c2c67408a196099ccac9129876c036db1a0a69e9bed83dced4a23dd9eeaf8e510afa4b0241c36a0c6cb2398f778eee9079457eb

Download Submit