hxxps://fbi[.]net/

Analysis

max time kernel
488s
max time network
390s
platform
windows10-1703_x64
resource
win10-20240611-en
resource tags

arch:x64arch:x86image:win10-20240611-enlocale:en-usos:windows10-1703-x64system
submitted
13/06/2024, 04:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://fbi.net/
Sample240613-e62rmaxhkn

Score

6^/10

phishing

Malware Config

Signatures

Looks up external IP address via web service 8 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
185	wtfismyip.com
186	wtfismyip.com
187	wtfismyip.com
188	wtfismyip.com
126	wtfismyip.com
127	wtfismyip.com
165	wtfismyip.com
166	wtfismyip.com

Detected phishing page
phishing

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\INF\netsstpa.PNF	svchost.exe
File created	C:\Windows\INF\netrasa.PNF	svchost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0051	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Mfg	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\300A	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0008	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004D	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Capabilities	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0016	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\300A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004\	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\DeviceDesc	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0018	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0016	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004D	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0016	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0005	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0003	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0005	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004C	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0051	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2002	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0038	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004C	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{4340a6c5-93fa-4706-972c-7b648008a5a7}\0008	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0064	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\000A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004E	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A\	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0052	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0034	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004\	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2003	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0065	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0054	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Capabilities	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\ConfigFlags	svchost.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133627268991646198"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache	svchost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
5696	chrome.exe
5696	chrome.exe

Suspicious behavior: LoadsDriver 10 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
632	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2236	chrome.exe
Token: SeCreatePagefilePrivilege	2236	chrome.exe
Token: SeShutdownPrivilege	2236	chrome.exe
Token: SeCreatePagefilePrivilege	2236	chrome.exe
Token: SeShutdownPrivilege	2236	chrome.exe
Token: SeCreatePagefilePrivilege	2236	chrome.exe
Token: SeShutdownPrivilege	2236	chrome.exe
Token: SeCreatePagefilePrivilege	2236	chrome.exe
Token: SeShutdownPrivilege	2236	chrome.exe
Token: SeCreatePagefilePrivilege	2236	chrome.exe
Token: SeShutdownPrivilege	2236	chrome.exe
Token: SeCreatePagefilePrivilege	2236	chrome.exe
Token: 33	2624	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2624	AUDIODG.EXE
Token: SeShutdownPrivilege	2236	chrome.exe
Token: SeCreatePagefilePrivilege	2236	chrome.exe
Token: SeShutdownPrivilege	2236	chrome.exe
Token: SeCreatePagefilePrivilege	2236	chrome.exe
Token: SeShutdownPrivilege	2236	chrome.exe
Token: SeCreatePagefilePrivilege	2236	chrome.exe
Token: SeShutdownPrivilege	2236	chrome.exe
Token: SeCreatePagefilePrivilege	2236	chrome.exe
Token: SeShutdownPrivilege	2236	chrome.exe
Token: SeCreatePagefilePrivilege	2236	chrome.exe
Token: SeShutdownPrivilege	2236	chrome.exe
Token: SeCreatePagefilePrivilege	2236	chrome.exe
Token: SeShutdownPrivilege	2236	chrome.exe
Token: SeCreatePagefilePrivilege	2236	chrome.exe
Token: SeShutdownPrivilege	2236	chrome.exe
Token: SeCreatePagefilePrivilege	2236	chrome.exe
Token: SeShutdownPrivilege	4624	svchost.exe
Token: SeCreatePagefilePrivilege	4624	svchost.exe
Token: SeLoadDriverPrivilege	4624	svchost.exe
Token: SeLoadDriverPrivilege	4624	svchost.exe
Token: SeShutdownPrivilege	2236	chrome.exe
Token: SeCreatePagefilePrivilege	2236	chrome.exe
Token: SeLoadDriverPrivilege	4624	svchost.exe
Token: SeLoadDriverPrivilege	4624	svchost.exe
Token: SeLoadDriverPrivilege	4624	svchost.exe
Token: SeLoadDriverPrivilege	4624	svchost.exe
Token: SeLoadDriverPrivilege	4624	svchost.exe
Token: SeLoadDriverPrivilege	4624	svchost.exe
Token: SeLoadDriverPrivilege	4624	svchost.exe
Token: SeLoadDriverPrivilege	4624	svchost.exe
Token: SeShutdownPrivilege	2236	chrome.exe
Token: SeCreatePagefilePrivilege	2236	chrome.exe
Token: SeLoadDriverPrivilege	4624	svchost.exe
Token: SeLoadDriverPrivilege	4624	svchost.exe
Token: SeLoadDriverPrivilege	4624	svchost.exe
Token: SeLoadDriverPrivilege	4624	svchost.exe
Token: SeLoadDriverPrivilege	4624	svchost.exe
Token: SeLoadDriverPrivilege	4624	svchost.exe
Token: SeShutdownPrivilege	2236	chrome.exe
Token: SeCreatePagefilePrivilege	2236	chrome.exe
Token: SeShutdownPrivilege	2236	chrome.exe
Token: SeCreatePagefilePrivilege	2236	chrome.exe
Token: SeShutdownPrivilege	2236	chrome.exe
Token: SeCreatePagefilePrivilege	2236	chrome.exe
Token: SeShutdownPrivilege	2236	chrome.exe
Token: SeCreatePagefilePrivilege	2236	chrome.exe
Token: SeShutdownPrivilege	2236	chrome.exe
Token: SeCreatePagefilePrivilege	2236	chrome.exe
Token: SeShutdownPrivilege	2236	chrome.exe
Token: SeCreatePagefilePrivilege	2236	chrome.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
4988	firefox.exe
4988	firefox.exe
4988	firefox.exe
4988	firefox.exe
2236	chrome.exe

Suspicious use of SendNotifyMessage 29 IoCs

pid	Process
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
4988	firefox.exe
4988	firefox.exe
4988	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4988	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 1716	2236	chrome.exe	71
PID 2236 wrote to memory of 1716	2236	chrome.exe	71
PID 2236 wrote to memory of 3484	2236	chrome.exe	73
PID 2236 wrote to memory of 3484	2236	chrome.exe	73
PID 2236 wrote to memory of 3484	2236	chrome.exe	73
PID 2236 wrote to memory of 3484	2236	chrome.exe	73
PID 2236 wrote to memory of 3484	2236	chrome.exe	73
PID 2236 wrote to memory of 3484	2236	chrome.exe	73
PID 2236 wrote to memory of 3484	2236	chrome.exe	73
PID 2236 wrote to memory of 3484	2236	chrome.exe	73
PID 2236 wrote to memory of 3484	2236	chrome.exe	73
PID 2236 wrote to memory of 3484	2236	chrome.exe	73
PID 2236 wrote to memory of 3484	2236	chrome.exe	73
PID 2236 wrote to memory of 3484	2236	chrome.exe	73
PID 2236 wrote to memory of 3484	2236	chrome.exe	73
PID 2236 wrote to memory of 3484	2236	chrome.exe	73
PID 2236 wrote to memory of 3484	2236	chrome.exe	73
PID 2236 wrote to memory of 3484	2236	chrome.exe	73
PID 2236 wrote to memory of 3484	2236	chrome.exe	73
PID 2236 wrote to memory of 3484	2236	chrome.exe	73
PID 2236 wrote to memory of 3484	2236	chrome.exe	73
PID 2236 wrote to memory of 3484	2236	chrome.exe	73
PID 2236 wrote to memory of 3484	2236	chrome.exe	73
PID 2236 wrote to memory of 3484	2236	chrome.exe	73
PID 2236 wrote to memory of 3484	2236	chrome.exe	73
PID 2236 wrote to memory of 3484	2236	chrome.exe	73
PID 2236 wrote to memory of 3484	2236	chrome.exe	73
PID 2236 wrote to memory of 3484	2236	chrome.exe	73
PID 2236 wrote to memory of 3484	2236	chrome.exe	73
PID 2236 wrote to memory of 3484	2236	chrome.exe	73
PID 2236 wrote to memory of 3484	2236	chrome.exe	73
PID 2236 wrote to memory of 3484	2236	chrome.exe	73
PID 2236 wrote to memory of 3484	2236	chrome.exe	73
PID 2236 wrote to memory of 3484	2236	chrome.exe	73
PID 2236 wrote to memory of 3484	2236	chrome.exe	73
PID 2236 wrote to memory of 3484	2236	chrome.exe	73
PID 2236 wrote to memory of 3484	2236	chrome.exe	73
PID 2236 wrote to memory of 3484	2236	chrome.exe	73
PID 2236 wrote to memory of 3484	2236	chrome.exe	73
PID 2236 wrote to memory of 3484	2236	chrome.exe	73
PID 2236 wrote to memory of 656	2236	chrome.exe	74
PID 2236 wrote to memory of 656	2236	chrome.exe	74
PID 2236 wrote to memory of 1376	2236	chrome.exe	75
PID 2236 wrote to memory of 1376	2236	chrome.exe	75
PID 2236 wrote to memory of 1376	2236	chrome.exe	75
PID 2236 wrote to memory of 1376	2236	chrome.exe	75
PID 2236 wrote to memory of 1376	2236	chrome.exe	75
PID 2236 wrote to memory of 1376	2236	chrome.exe	75
PID 2236 wrote to memory of 1376	2236	chrome.exe	75
PID 2236 wrote to memory of 1376	2236	chrome.exe	75
PID 2236 wrote to memory of 1376	2236	chrome.exe	75
PID 2236 wrote to memory of 1376	2236	chrome.exe	75
PID 2236 wrote to memory of 1376	2236	chrome.exe	75
PID 2236 wrote to memory of 1376	2236	chrome.exe	75
PID 2236 wrote to memory of 1376	2236	chrome.exe	75
PID 2236 wrote to memory of 1376	2236	chrome.exe	75
PID 2236 wrote to memory of 1376	2236	chrome.exe	75
PID 2236 wrote to memory of 1376	2236	chrome.exe	75
PID 2236 wrote to memory of 1376	2236	chrome.exe	75
PID 2236 wrote to memory of 1376	2236	chrome.exe	75
PID 2236 wrote to memory of 1376	2236	chrome.exe	75
PID 2236 wrote to memory of 1376	2236	chrome.exe	75
PID 2236 wrote to memory of 1376	2236	chrome.exe	75
PID 2236 wrote to memory of 1376	2236	chrome.exe	75

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://fbi.net/
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffac85d9758,0x7ffac85d9768,0x7ffac85d9778
  2⤵
  PID:1716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1596 --field-trial-handle=1864,i,17347659022347064132,16146180626792063707,131072 /prefetch:2
  2⤵
  PID:3484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1776 --field-trial-handle=1864,i,17347659022347064132,16146180626792063707,131072 /prefetch:8
  2⤵
  PID:656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2100 --field-trial-handle=1864,i,17347659022347064132,16146180626792063707,131072 /prefetch:8
  2⤵
  PID:1376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2976 --field-trial-handle=1864,i,17347659022347064132,16146180626792063707,131072 /prefetch:1
  2⤵
  PID:1524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2984 --field-trial-handle=1864,i,17347659022347064132,16146180626792063707,131072 /prefetch:1
  2⤵
  PID:3808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3724 --field-trial-handle=1864,i,17347659022347064132,16146180626792063707,131072 /prefetch:1
  2⤵
  PID:3076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=5060 --field-trial-handle=1864,i,17347659022347064132,16146180626792063707,131072 /prefetch:1
  2⤵
  PID:4492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3260 --field-trial-handle=1864,i,17347659022347064132,16146180626792063707,131072 /prefetch:8
  2⤵
  PID:4924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5404 --field-trial-handle=1864,i,17347659022347064132,16146180626792063707,131072 /prefetch:8
  2⤵
  PID:2484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5136 --field-trial-handle=1864,i,17347659022347064132,16146180626792063707,131072 /prefetch:8
  2⤵
  PID:4816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5128 --field-trial-handle=1864,i,17347659022347064132,16146180626792063707,131072 /prefetch:8
  2⤵
  PID:5624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5160 --field-trial-handle=1864,i,17347659022347064132,16146180626792063707,131072 /prefetch:8
  2⤵
  PID:5616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=4660 --field-trial-handle=1864,i,17347659022347064132,16146180626792063707,131072 /prefetch:1
  2⤵
  PID:5628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3040 --field-trial-handle=1864,i,17347659022347064132,16146180626792063707,131072 /prefetch:8
  2⤵
  PID:5084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2988 --field-trial-handle=1864,i,17347659022347064132,16146180626792063707,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5696

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2936

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x408
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2624

C:\Windows\System32\SystemSettingsBroker.exe
C:\Windows\System32\SystemSettingsBroker.exe -Embedding
1⤵
PID:1108

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s RmSvc
1⤵
PID:4880

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s SstpSvc
1⤵
PID:1868

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -s DsmSvc
1⤵
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:3264

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s NetSetupSvc
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4624

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s RasMan
1⤵
PID:2216

C:\Windows\System32\SystemSettingsBroker.exe
C:\Windows\System32\SystemSettingsBroker.exe -Embedding
1⤵
PID:2748

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s RasMan
1⤵
PID:4972

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:1472
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:4988
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4988.0.674338118\1255585632" -parentBuildID 20221007134813 -prefsHandle 1684 -prefMapHandle 1676 -prefsLen 20845 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {967187f6-d5d9-40dd-b159-a2e8acf52b02} 4988 "\\.\pipe\gecko-crash-server-pipe.4988" 1760 2a15cbd9158 gpu
    3⤵
    PID:316
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4988.1.1910469320\378590386" -parentBuildID 20221007134813 -prefsHandle 2104 -prefMapHandle 2100 -prefsLen 20926 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {169c7a25-03ca-4ac1-851a-be799c6fc11f} 4988 "\\.\pipe\gecko-crash-server-pipe.4988" 2116 2a151b6f858 socket
    3⤵
    - Checks processor information in registry
    PID:4864
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4988.2.837311841\1689736381" -childID 1 -isForBrowser -prefsHandle 2940 -prefMapHandle 2752 -prefsLen 21029 -prefMapSize 233444 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f44fccc6-fd2e-4f2e-ad89-f7280dba8c39} 4988 "\\.\pipe\gecko-crash-server-pipe.4988" 3020 2a160ddd058 tab
    3⤵
    PID:5208
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4988.3.2115552803\386701552" -childID 2 -isForBrowser -prefsHandle 3424 -prefMapHandle 3420 -prefsLen 26214 -prefMapSize 233444 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0a115106-fc88-4dc2-a97c-1e97a8d4bfa1} 4988 "\\.\pipe\gecko-crash-server-pipe.4988" 3460 2a151b62b58 tab
    3⤵
    PID:5352
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4988.4.1161111736\452325440" -childID 3 -isForBrowser -prefsHandle 4280 -prefMapHandle 4276 -prefsLen 26349 -prefMapSize 233444 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {cc06d3be-c0c6-4781-a7d0-6227c53b100d} 4988 "\\.\pipe\gecko-crash-server-pipe.4988" 4288 2a1628cc758 tab
    3⤵
    PID:5484
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4988.5.1543237416\210924449" -childID 4 -isForBrowser -prefsHandle 4740 -prefMapHandle 4752 -prefsLen 26354 -prefMapSize 233444 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {97e66860-54df-4262-8caa-ea17c140217d} 4988 "\\.\pipe\gecko-crash-server-pipe.4988" 4744 2a161bd4e58 tab
    3⤵
    PID:4296
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4988.6.1268617666\808327383" -childID 5 -isForBrowser -prefsHandle 4892 -prefMapHandle 4896 -prefsLen 26354 -prefMapSize 233444 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {609382ee-b20e-461e-8461-2857914b344a} 4988 "\\.\pipe\gecko-crash-server-pipe.4988" 4884 2a163322a58 tab
    3⤵
    PID:3800
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4988.7.2081554916\196438025" -childID 6 -isForBrowser -prefsHandle 5088 -prefMapHandle 5092 -prefsLen 26354 -prefMapSize 233444 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f810cb30-b582-4c29-80f3-067f9c611fe7} 4988 "\\.\pipe\gecko-crash-server-pipe.4988" 5076 2a163391a58 tab
    3⤵
    PID:4216
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4988.8.1089569233\413778956" -childID 7 -isForBrowser -prefsHandle 3956 -prefMapHandle 1484 -prefsLen 29551 -prefMapSize 233444 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {91663012-5676-42e1-a45f-e86ec2f6ae64} 4988 "\\.\pipe\gecko-crash-server-pipe.4988" 5600 2a163378b58 tab
    3⤵
    PID:412
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4988.9.1120208183\2015926584" -parentBuildID 20221007134813 -prefsHandle 5932 -prefMapHandle 5928 -prefsLen 29551 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f502b5fa-5a97-4c12-b516-3bcbbbb47054} 4988 "\\.\pipe\gecko-crash-server-pipe.4988" 5896 2a163378558 rdd
    3⤵
    PID:4784
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4988.10.1414876422\1363496615" -parentBuildID 20221007134813 -sandboxingKind 1 -prefsHandle 5948 -prefMapHandle 5960 -prefsLen 29551 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f9731cd5-a869-4ea4-a2ff-4f783677ab39} 4988 "\\.\pipe\gecko-crash-server-pipe.4988" 2516 2a165b9b258 utility
    3⤵
    PID:4584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

070E0202839D9D67350CD2613E78E416

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416
Size 1KB
SHA256 d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb
MD5 55540a230bdab55187a841cfe1aa1545
SHA1 363e4734f757bdeb89868efe94907774a327695e
SHA512 c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54
MD5 SHA1 SHA512

Submit Download

070E0202839D9D67350CD2613E78E416

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416
Size 230B
SHA256 4352989d1c1e65534ebea744b256c06ce1744c0a10e406346a3ef4f53a36ba57
MD5 f69041db7c81d52b514ded0a95e3e4d0
SHA1 76030c9c8b07b6a285bebbc5929dd533deca2ae2
SHA512 94223eba161ccb99f1ba488feef8852d01d12738c5999808bc41001efc74713b095cd8fd9daefeb09e02c1e6397093ecb558feaba2a84c7de8e6119d1a980342
MD5 SHA1 SHA512

Submit Download

f_00001b

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001b
Size 1024KB
SHA256 2188e3eb0373d8366b2a22285e77f67e77d4482f0dc8eed146dd12f2ac610397
MD5 c158c8db1df14aa0e6e56750a91eefaf
SHA1 9bfb19f5e16dcbfc7e4c4a848850939f2e2d58de
SHA512 82a5fd38e60cad09b9b213115b04d73bca8fea83251f31b8b63fb9fba3d4d60fbe8be5a1ebb7c8f3bc4e0b778254651cd8bb3d16785be2ef03b4542491434257
SSDEEP 24576:mz8U3YQ7lWaEaKnq+dJj9QP/cS75BV5xdyl2oM:UoQ7Aq+dJ9QP/pFBV5zyl8
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 528B
SHA256 8794a0f109f8e5b7e5efdb536eae30ee52760d06654d916397d7a61f1e6e9e2f
MD5 91947c5521fdd701e937fe90852e7904
SHA1 b1f0ff4374a441befdc37d34293aa45b40782db5
SHA512 99cd5862e5644a4a6020e01b3dab902c3f642aa3bf37b656cee258a90210a64cfbf118656ed8c0687627f6887e1746b935410ae7a8d9e288c4ed54065884568a
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 648B
SHA256 c1965d73905629c32317050bda412e772f90503c3f8eb48de3eeb84eb669299b
MD5 f8d7c12f4b33fc7c5bf53f569edc98b2
SHA1 5141b1265f88ce0cb8547bce44329d545c435f3d
SHA512 6d77d5c360712bf3d97d00e1425b66e88bec3782c51c225f4da295c807a33b718a8cd1573db8e3153fde45e1e24f5cf3e936bef1512883f2125a88648102f737
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 0769be4d657d081c85fd3ce12266acfea75fa0664f120a71c6809e8e0aae44ae
MD5 ad886ec960f9f50e5fe17df0e5a348e1
SHA1 34e7a7cfec93427b3cdd76730ea04caaf1860803
SHA512 1e1831b2c7b41ce5f68707c0027b803a8afc7f23028aacc75a48ec5af6ae13cfbe3dd02f1ea45f0f87671c920d20fac90d1f06560619fcaee3671f1fa05ea424
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 c388965e30b4341337bc1654bff26be035facb10d7320226b52164b7930eac1a
MD5 c9828fdfcf45759f191f35fc809c297b
SHA1 51be3852d61f1adcd7e54788da00ebcf55fc3c93
SHA512 5c72820f5251dd37220c926317c8bbf686067518e27c23d055982726ca66be58aade4d9c04d22aaba7c63c2c54c30759a11b7ea6cba82ec757b01e82132ee534
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 46515246605aaa4bec5b488a7ded7f8320611d18cfd92fbc1d6c596564fdff4f
MD5 40ed22e24e3d28dd0afb6077c0991c33
SHA1 b6bbe1fdebba811023f51b0dbf80018c3b91c061
SHA512 06082714e9c823f3df8bf239bc0a18a2966b7bb7227cbefb644bd5fdf46bed8690fafb1613525b981faee4418a3709c7dff9bff2fef67ccb74084cc3d600e636
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 5b32916a8a72db24353222a52f308753554ce9ceba71f4c03d6632ac78c61334
MD5 1bcbca977e8791207985ede1aa783573
SHA1 cf7ebd08d49e3010e4c8947265be8a52df448550
SHA512 e1080ed9a6a52d215071a00697e99700d0bf2fa527ac1907c4eec645bf34702aa359dc845282f0a78c0b8ec35b9bf70b40a000fcb5b50fbd636a0285eda14526
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 6KB
SHA256 f865456351e82e3fb0cbb122cd5ab34013eda95f75f3ec42a1af1b8be48d6014
MD5 f44238b44f2ee1e6cd02502a96eb8fc8
SHA1 83bdfb88e20a9f1a04fca88d117e0d0d52dcf589
SHA512 69a0629250698b67bcfce7189f7ce63ebc1c221e3afa92d2d2cb4d07c1131b04a931047b3dbb4e8302d11b67eecf845f5ebc885af739d2416a05a14e2fefea8f
SSDEEP 192:WlCa7A8syy+F21sYxQBhkaBgkLl2tjEsXtScPS:WlCVyxqsDlnYtIsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 6KB
SHA256 5fde8f6f4bab7adc2a320b8c3a7b0d117312622350398e8e46d98b3f6a1a84cc
MD5 e0eb472910d50665b663b3041a25fbf1
SHA1 ecb1a9feea47cf926a95a0ba5d247de73f056e80
SHA512 bea74cd7c56a21e9d1f247e692610872de125e91d3aa48197622fbe37f3b0f94a41f9331669ed9a6c2332687c5a2a43407d190e000a581364aafa10f8cdadd28
SSDEEP 192:WlCa7A8syy+F21sYekaBjks/otjEsXtScPS:WlCVyxqs/hgtIsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 5KB
SHA256 b1374127bf128b0ec1a54d439e390271c7e5e43a686f69b0627b47368b0e8e20
MD5 76b64fd90e7408639139383bbe9dfd85
SHA1 4a00204a9b0f071585c3c648b5d520d8bf692ede
SHA512 dff78235c56d03b538528a8b8f75b9c06414136e2032334e2eb813f6fb32c4009be206351c836e03da694cfdb4992a0b349a788d4886ae852af2b39a6f36247b
SSDEEP 96:WlYtbIn7A8iZRy7Di+6MsmdeRka1IOQDwSjVhYtjEsXt0/cg2Vup:WlCa7A8syy+F8kaGotjEsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 5KB
SHA256 a002128e232d44fea5e832874c9b49868eb0faf7a4419773901247bcdb52bdd6
MD5 c98a60f145c9523af18c06a3749d234a
SHA1 2c34157a29e4980ea75b4aaf1b8c62c7d6b80fa9
SHA512 9444d506a6142cd6290927b409ba8370b8fcbb8e31909203500aba8887f54afd2975e647defc1aec99e670a643e918fd0c8f89946a71d6cf89bac08f2d13499b
SSDEEP 96:WlYtbIn7A8iZRy7Di+6MsmdeRka1iTOQDwSjVhYtjEsXt0/cg2Vup:WlCa7A8syy+F8ka2otjEsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 150KB
SHA256 d51a6d102609fae61dd3f98a41650c3e3f9fd1cb62e7f9859363755c051024eb
MD5 905265bc734da91d28582727c6f9c45d
SHA1 c58d72559a18dbd2aaca16b77821daca9e769601
SHA512 05b55ea8b360c7c9f6445bfd4e1f2ae65b59a47e3cc51c3a406ddda0ad0b27bf5a2103ab857c901ebb8f5b60b0be0d0f67d8a4316931248116dd3d4b41ef08ef
SSDEEP 3072:e2urMmYyU91oXxek153VKrlfl5LFzDAbvbds0oT2IM1B51huY2o67bwo/z0zPFe:FN/yU9iFPkNTFh0oT2IM1BFuYq7r/wk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 150KB
SHA256 15b923c56f281b0af20c2e827cadc8f055423a0173d390ed0dd2192ad8c811a5
MD5 e1c866aea12a3042c5d53ef71bcb01d1
SHA1 ff4b62ce121c63d3242e43d84e8075c6375f6d18
SHA512 52cbfadc1135906885c81f679fe9d36968e00bf305b9d25fc1d53c39076ce2ae215463b5ab6de16ee1ed4bbe9c9dcdef948f7998a77dc654e2655ecb46e76df8
SSDEEP 3072:nrMmYyU91oXxek153VKrlfl5LFzDAbvbds0oT2IM1B51huY2o67bwo/z0zPFe:g/yU9iFPkNTFh0oT2IM1BFuYq7r/wk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 150KB
SHA256 18bddf922cdf3b565764dfe7d2829994f129f0e81aaf8c7a920ebe34be5a3ac7
MD5 bb38a6ff7d90f6b7db1ba3601574062f
SHA1 9a32b647e5c52a2a72eea419d33759a09893f2ba
SHA512 dc874fcd18cb82508ee25153cb864765b8aa6d4cdb6cd4ab98af71ce91bf24616ee104d6f71ff79f3992a613a6a2852a415b6cde660610eae6436e4bf87899cf
SSDEEP 3072:y0SrMmYyU91oXxek153VKrlfl5LFzDAbvbds0oT2IM1B51huY2o67bwo/z0zPFe:NB/yU9iFPkNTFh0oT2IM1BFuYq7r/wk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 167KB
SHA256 05f7ad2a50c80cd7bd356da78e4655d6d5cc61b247c904d0b8d1ade882df23e6
MD5 c0faca918e60af9495d73a680beeb89c
SHA1 7e6afbcd6d4146ef3f3cbf831144148d56956564
SHA512 28eea43d0d92f41d8d4f011033d24fee1d80be77126955f00b51be13fd1a0752290a9e95765e3b1fce8bb01ac81a99acc0e1cc03245dd0503e25e1c085e438b0
SSDEEP 3072:GoPNKa25g7rMmYyU91oXxek153VKrlfl5LFzDAbvbds0oT2IM1B51huY2o67bwoF:vPwa25gU/yU9iFPkNTFh0oT2IM1BFuY+
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 176KB
SHA256 0885c2d82d69194f7d6b94253ff03d476f05e9bab961c655d00930df1a573934
MD5 ea6e4d8b7424d0e1e1815abc1ef2ae54
SHA1 9b1746a9ff58b07a99c68bb6dc16f8973ce39544
SHA512 1b98fe6f42354687c078b8ff0cb511aaf8528d0aabc3437a004c5b6d46716b4d85dd95d035381525bfed0ad7f602278af51d6e6999012c65ede82b3b45297c72
SSDEEP 3072:+yik3xovQhrMmYyU91oXxek153VKrlfl5LFzDAbvbds0oT2IM1B51huY2o67bwoF:FFmvQG/yU9iFPkNTFh0oT2IM1BFuYq7B
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 150KB
SHA256 08b227c9ce57a7bc4cb3f83245013ee6f691f848705230ea12fba5a2c1a2e04a
MD5 679a8c6f4dae353c90a3930d9f79a56d
SHA1 5cbdcfd4e68e63bbf42e7ada0bd07fce913b5001
SHA512 ba46a42b51f7f9576397d3778b64558f29e91dcb51426dbf6e0f295d9c80ba95d92fbe1d8b5c605625d1b13942662401fe0cd79a3f1acbd378d5148320375837
SSDEEP 3072:GWmrMmYyU91oXxek153VKrlfl5LFzDAbvbds0oT2IM1B51huY2o67bwo/z0zPFe:Jl/yU9iFPkNTFh0oT2IM1BFuYq7r/wk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Module Info Cache

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Size 99KB
SHA256 b88b398894bc45a79ad6294ccfc51c2c17a7d0ab36b475e279bda0d0808ee2a3
MD5 134aa9835a39fb8fd2baa55f4a0cc1e2
SHA1 4d963e533f20e6ef7d5bd7bd4101b38563a0f521
SHA512 bb47295ebe3848c2634207684a76fef70df4b7f9a645ec8208bbaf8936518297f2d079ce4b9f82dea6c22d7538a022ad85bd34a193c1b9bbcc3df8cd11e8e0dd
SSDEEP 384:0NuTM+Y+3MnWRZRvhzkMKzmcVpEHy+QqyLcZZcs5a20Lak4IV2kKopYkm4tsLHlF:0Z+Y+3zhwnh+FgSYSWuKT3EIYj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Module Info Cache~RFe58f826.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe58f826.TMP
Size 99KB
SHA256 aa86955830fbe468058d8252b06efeee2363a92fd11777e1eaf1869ca712a6db
MD5 650561c8474bfe4a1358e5b1940f9e21
SHA1 f94d9c5b9bfb2daabc0402c3ab86dcf6fac9133e
SHA512 80cb3b8944ae955ab2a57951df553b19cc0d62f300db290098928fa3e3c0e9500b4f74795a08761735d0aa8a07939e0ff2bbb83ff8db4e6271200e871155cc7f
SSDEEP 384:sNuTM+Y+3MnWRZRvhzkMKzmcVpEHy+QqyLcZZcs5a20Lak4IV2kKopYkm4tsLowM:sZ+Y+3zhwnh+ogSYSWuKT3EIYZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 3abf7a3ad77895e4e9d04e020705bb3fe0d60f49c4d1d67e0c1a28e49b1e5f7f
MD5 1a1cbfbb7b89e655f795cc962ae20d8e
SHA1 caf68b9ffae38d6cd07d335324aa5199d651a4d7
SHA512 986b42ca3e52ade787e965a4a377d20b7f58a8a63aceb7ac291c6913f4f8e62b3228f34b7233014c52c2101c42dc2af25e0c9b976dd219547bacc8b8c32ced38
SSDEEP 3:MsEllllkEthXllkl2zExllbXqRl:/M/xT02zEKl
MD5 SHA1 SHA512 SSDEEP

Submit Download

persisted_first_party_sets.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

activity-stream.discovery_stream.json.tmp

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\activity-stream.discovery_stream.json.tmp
Size 29KB
SHA256 a0b779be426e85aabd6b34c29e3e2a10b1a6fb4e32a8dfc9fa9de973e2d697be
MD5 b84eb0e7410bc3f0875c6f59ea634b7c
SHA1 8e52c8fd4885b1bf6d5b54b79191be9dc47be13c
SHA512 1bf0f35223f223a53a21835f09ced621dac39e416f9e511134813380df16cec31e5ff8c2f3ddd080132595b8a3d4aee01b5c02c569f89ecf986615b421387d2b
SSDEEP 768:rygnmF7vW9WP9XZEzkYINXxoydnoDJEiD30bT:uR7vW9WP4mxTJomiET
MD5 SHA1 SHA512 SSDEEP

Submit Download

4129

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\cache2\doomed\4129
Size 3.3MB
SHA256 12108e21854c73e7737f4e8c80bc476079111ceebb98818e5d8620071368d5a0
MD5 ff212c393125ea78b48f12bd3746cded
SHA1 147c55e69fc659308dee2c66ab5bb522f4ac3e8c
SHA512 7f59db830231167af827ebf733bb503c337def5821b88043cc80586339e4a584ce530810e5fb670d29086ea42e851993f7f08af615d4c55cf9205a27cf9bfd2f
SSDEEP 98304:+LdBmbaojpvEisuGMbx7zAzdvY7BzzR4r:ambao98i/wiHR4r
MD5 SHA1 SHA512 SSDEEP

Submit Download

6055

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\cache2\doomed\6055
Size 9KB
SHA256 16638a77d88be8d741496e85a754402e0d9de3bfef4771cbe2cebce6f4d85887
MD5 d0c434bb8108f9d8c9bde26ebc1177be
SHA1 aa0b7c700544662f81dd400e4a5c9bd0d8279b4f
SHA512 280b2a44b2a0c5f45db5764ba01250593b857ed4cf90a836e58df306a5616e35045eb85278817caa3ce3e8620a108826435f14a8b2c619e1fb012b708ec1b13d
SSDEEP 192:Ll5zb6wBS595J2Cow1Cqfw7F5oG0TBv13rzeHQ4W29t2BVUMMGpUMMGB1:nn6we58fefwfolprWQ4WCt2BJ1
MD5 SHA1 SHA512 SSDEEP

Submit Download

383A97A57B113BD106DE6984E6DBA5F537327263

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\cache2\entries\383A97A57B113BD106DE6984E6DBA5F537327263
Size 13KB
SHA256 88bab3f7a5e981f4db86825970ff4d53a425e59f5e441d0ad2b4c68f582e1e0a
MD5 d468b547441ed52f9c72687e64921d20
SHA1 906eea919434a45c998d523d73dd9ba538d9a5ae
SHA512 0611be66d290f555b3a8644b5a4148dacd830fb03cf8f1d4353f8feb34ca4fee81eddcd23901b78bc7c8eb9481f7ab58bf9b37406a77646bbc636cb14259028c
SSDEEP 384:H7Ku9fiGLm4pUFuL6eFuF/5uL6eFuFWCmAl7YNFU8rIVy8eIC3QU:vBi8mCUFVewd5VewnmAl7qIVy8s
MD5 SHA1 SHA512 SSDEEP

Submit Download

asrouter.ftl

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
Size 7KB
SHA256 0ec0f16f92d876a9c1140d4c11e2b346a9292984d9a854360e54e99fdcd99cc0
MD5 c460716b62456449360b23cf5663f275
SHA1 06573a83d88286153066bae7062cc9300e567d92
SHA512 476bc3a333aace4c75d9a971ef202d5889561e10d237792ca89f8d379280262ce98cf3d4728460696f8d7ff429a508237764bf4a9ccb59fd615aee07bdcadf30
SSDEEP 192:63/CCBm4CsBJumwOGmnOqiwpJibAKGb9CqwGV:OHPnIwyqwGV
MD5 SHA1 SHA512 SSDEEP

Submit Download

cc40259d4258e1951552a8316324267d.png

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\thumbnails\cc40259d4258e1951552a8316324267d.png
Size 73KB
SHA256 0813b29ad0abe6da7e28b897a01b726b0717b292f0cdb58aa83c5e27a64f65a5
MD5 637249d3ebd6c792d668d8ee45606c51
SHA1 4da593f8c9695b3ed23e0b01212ab946954f3dfa
SHA512 0f2182e6c0f3fd89f3779b6830ade8d137be44ca9de69722984a2d432c6e2052d71206fa44e52351d5bf348ce3f4a48e671a4cc67f19a91d50957e2046ee232c
SSDEEP 1536:jZJDHasJYBxnhX8VvpBpsWCcxtRhTE+1da5UDjZGBu1xFOhUNwr/:jjvYOvpBXnRl/aA2UNW/
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 442KB
SHA256 a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
MD5 85430baed3398695717b0263807cf97c
SHA1 fffbee923cea216f50fce5d54219a188a5100f41
SHA512 06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1
SSDEEP 12288:tESTeqTI2r4ZbCgUKWKNeRcPMb6qlV7hVZe3:tEsed2Xh9/bdzZe3
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 8.0MB
SHA256 345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42
MD5 a01c5ecd6108350ae23d2cddf0e77c17
SHA1 c6ac28a2cd979f1f9a75d56271821d5ff665e2b6
SHA512 b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72
SSDEEP 196608:945hXmP7/cvflwtf0FzVC/5lHevzc8XZbivwEiw3cFTx7z4zV:9tP7/cvflof0FzVgKRF9zw3c9x4zV
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\datareporting\glean\db\data.safe.bin
Size 2KB
SHA256 d92ce76a809ad62a34ea7f53574fa77879f453baca6615817508c5c1273efcc7
MD5 13e68b18fa7c4e44787af18918a95f0b
SHA1 b3d1acce7bbb68b18ad1cc1c1752fd341288fab1
SHA512 f75f336aa5cba9e7fea0d2582b77dcaf8392c67e714981c46ddb11c5bb5c994252ac2b731595818094d6c3d3bc6bf7edbf42f5b15e885622d846fe50cd9aca08
MD5 SHA1 SHA512

Submit Download

18ad7bb5-1bdd-4209-9e0d-17869a68d511

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\datareporting\glean\pending_pings\18ad7bb5-1bdd-4209-9e0d-17869a68d511
Size 10KB
SHA256 c41d20a5a926ff0be6f81748a87b1256af14532c0d5f9de83ae00504e519c9bc
MD5 9476e4df3cefd628ea3a4223cfeb192e
SHA1 0d1382049983be0e8a67d506750f246edb39bfe0
SHA512 b2e4edf8d2c0c6ed03743a8e0567a59c6ccd8bafe4f36e95ab9913e4ab2bbe758e0f360c0e17cff2ce0f070cdb0e2a2a37c958283aadfeac021003d6ff813808
SSDEEP 192:BWrGlScjW5Xk/+EcBOBuOx9iRMFxf5DqgL7Gly7x5KHjoG61oCXJYe8xA23:8GlSh4I
MD5 SHA1 SHA512 SSDEEP

Submit Download

c95d9913-5154-4374-ba22-658c21884010

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\datareporting\glean\pending_pings\c95d9913-5154-4374-ba22-658c21884010
Size 746B
SHA256 c893460bc2c0d5279992330cf10565f7739f41d9c46cdf8c028bf53b0ccae24a
MD5 1a1f2d050bfcdb9059cd4bee7b1920fe
SHA1 5afe2b90a703586ddf1d9d840ecd34e5383f5e64
SHA512 f7076855a8d9101815894e486821cbfc98ee120830384d2e4f63f83728609848c947c25ccf2002415f6733b33b810445fa58d40774eea9cafa1eee6e21bac56e
MD5 SHA1 SHA512

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
Size 997KB
SHA256 1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
MD5 fe3355639648c417e8307c6d051e3e37
SHA1 f54602d4b4778da21bc97c7238fc66aa68c8ee34
SHA512 8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c
SSDEEP 12288:vYLdTfFKbNSjv92eFN+3wH+NYriA0Iq6lh6VawYIpAvwHN/Uf1h47HAfg1oet:vYLdTZ923NYrjwNpgwef1hzfg1x
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
Size 116B
SHA256 f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
MD5 3d33cdc0b3d281e67dd52e14435dd04f
SHA1 4db88689282fd4f9e9e6ab95fcbb23df6e6485db
SHA512 a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1
MD5 SHA1 SHA512

Submit Download

LICENSE.txt

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
Size 479B
SHA256 2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
MD5 49ddb419d96dceb9069018535fb2e2fc
SHA1 62aa6fea895a8b68d468a015f6e6ab400d7a7ca6
SHA512 48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
Size 372B
SHA256 e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
MD5 8be33af717bb1b67fbd61c3f4b807e9e
SHA1 7cf17656d174d951957ff36810e874a134dd49e0
SHA512 6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
Size 11.8MB
SHA256 8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e
MD5 33bf7b0439480effb9fb212efce87b13
SHA1 cee50f2745edc6dc291887b6075ca64d716f495a
SHA512 d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275
SSDEEP 196608:lP4/vkvbdjMq4ytbko4qIUcXkhrVp1HSTDsoTn90lcGeFaxJI3qLaLhFT7Uc:lPcvyiXSWxRU/OpZXJFee3qGhFMc
MD5 SHA1 SHA512 SSDEEP

Submit Download

widevinecdm.dll.lib

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
Size 1KB
SHA256 33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
MD5 688bed3676d2104e7f17ae1cd2c59404
SHA1 952b2cdf783ac72fcb98338723e9afd38d47ad8e
SHA512 7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll.sig

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
Size 1KB
SHA256 68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
MD5 937326fead5fd401f6cca9118bd9ade9
SHA1 4526a57d4ae14ed29b37632c72aef3c408189d91
SHA512 b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2
MD5 SHA1 SHA512

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\prefs-1.js
Size 7KB
SHA256 45e78f293e8bfc201adb5d5bc0c74ebef17e55c66deac1114fdcedd19a1c2c9d
MD5 f8146d816dfd84821614d3a8f19b313a
SHA1 4156c7d0f628629394f90ce8a6f117cd32dd6e96
SHA512 45565aea7ec56096dfa37ffbeb1ff8c035722559bf84b092fc272bceef3119cf1616f0c94ec50de2724b3f0cb14524c357d091f844cf2b92a61da4fba08381e3
SSDEEP 96:xHDqnUTeqGqfhd8W9eOTzSc2PXAnpjDiHVtMOSNgnYBw8H6BIC4GS:FqnIRfhd8W9e7PX1VbSNKYBw8H/
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\prefs-1.js
Size 10KB
SHA256 0c0b9fc108d4349b20f639b052b79d23e39e006f64190d172c652e9b76b16fcb
MD5 07c8abcfd1d5f5dc3e74cadba1daec22
SHA1 b17e0e47d196f1e4a209e38d6cfde5bd41043803
SHA512 4c287eac29ba3278ebff4793fc2eb22c8084e301d1bf1370715ff5d6416f0c0b48c8e776b11cb7f557a4015bcec1d8c9c0e6ae2524c70099a5f136ef401620d5
SSDEEP 96:xHDUdnUTeqGqfhd8W9eOTzSc2PXAnpjDiHVtMOSNgnuNeRBw8H6NpFHDo0OmBNGH:FqnIRfhd8W9e7PX1VbSNKFRBw8H5
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\prefs-1.js
Size 6KB
SHA256 f9b614877e3e1f3be5d70a412849312b1023787ce89a7641e451b61ffdf92d18
MD5 0818ca74f3a7ef523fd5e967ed04318e
SHA1 122acd580d3b3ee312ccd7ff351af02c0db29d4c
SHA512 d6f9907196bda73e53ee1d6da635d79be107c1e18b62eeea4c2ab01fa3b4f74dd01d1b45275c67885d8cf6ef4185f41dd64bd50cf6562207aeb3c857b5c5f737
SSDEEP 96:xHgqnUTeqGqfhd8W9eOTzSc2PXAnpjDiHVtMOSNgnnBw8Hk4GS:GqnIRfhd8W9e7PX1VbSNKnBw8Hf
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\prefs.js
Size 6KB
SHA256 0196f9698c3990e230a6075c199b65af46965c759a3b1ecf17d7925a5ee74579
MD5 620553f4e3f86d1959348bb000d836e7
SHA1 6822ff76e39fab9b72acaf3348b996f60c6c18b6
SHA512 bcb5d3653036b6e0e316eae651be75b667c7b4c2e7052deb2dbf15b967f7dc77e1a57931bd5d46a761ae03690f0a32b17f10e5ea91186966d28a6f2abcb17b05
SSDEEP 96:xHg5nUTeqGqfhd8W9eOTzSc2PXAnpjDiHVtMOSNgnnBw8Hkj:G5nIRfhd8W9e7PX1VbSNKnBw8H+
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\prefs.js
Size 6KB
SHA256 daf4af4fe04334ff76a602ae1eaa7ec4be0363bbbd2ab78a54fdba13ef24ffe7
MD5 e50c88ef31b2aac546a3e7c300ffff85
SHA1 f260b27420dde8af0bc7d72645ffb3590a386903
SHA512 8e6e3aaa3dace0c0001b22402b0fea8bfb3979e5499e2e68362902edca7009cb33e009239db1362a9e21d73bc353e1e5db7f1397db81cb08e8242b7f110bb13a
SSDEEP 96:xHg5nUTeqGqfXd8rkeOTzSc2PXAnpjBuHVtMOSNgnnBw8Hkj:G5nIRfXd8rke7PXIAVbSNKnBw8H+
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 f3dd5da7eafa24d0f484d4ef40a343a81c8ff1b6f4446419decc626ba5f89c47
MD5 38587a8fc0e86636f66458ef56e034b9
SHA1 526ba024feda0da3b0480b56cc9c2cdcec182ef5
SHA512 3ceddd19709ca9eb3e90c12fae3bee40d8a02dc9bab5c8e7612cd4c6600c3159be9b2d4c36d9528422ffa8009fb123b27b6542dc53e165f564967bfa05372b68
MD5 SHA1 SHA512

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 5f3c6d8dd8050132b18fb4156f8912ab9a58435c499a3ac443196309d112644b
MD5 df35a3c786388a98b9f6c0d5cce6f2f6
SHA1 eeaf7f8a44cd087a123a3253ffa33fbd13cf8307
SHA512 9109941692658d629f95b124e246883e56dab2edc6880d7fc34efeb51be6710086afef9cc0ecff2a915cf43c5a986f7a88bae191e0bf832ed12adc73b02ea361
MD5 SHA1 SHA512

Submit Download

sessionstore.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\sessionstore.jsonlz4
Size 1KB
SHA256 447942f679a5b9ac59e4ae10765212bb5f7f4ebb19363b21fbd84241ce854dca
MD5 94f5fd534167e5a1364ee43a3cf500aa
SHA1 24f63d1c0d38491c50a0ac679bbc778588005c72
SHA512 56b5a2de2011870dc309b3d69a53fc1f0bd70f1bad8efd815d835852280f005bdab127077e4cbc9e16f84b5ba0d95ad0820fd0820b147050d6db2f61b9d12224
MD5 SHA1 SHA512

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 616KB
SHA256 585982b53fb282aa7dc37452c189b335ed51b5a8db94ae0082067e2d5f8631cd
MD5 d8c479084d632695f096b5c6caf051e9
SHA1 885bc5863f7323a99032fbe961952fa8d381ed33
SHA512 25b1ba6cce2b16252fb2d233bb97a94597dc7df8c7f29b4348d98f6b2f002b3acd4288f598b360e0f830f42ee0de0cadce09e94c2a878ca6edfce59f88edcba6
SSDEEP 6144:en3jq0cY3K393z3m3sxGBxAsXpeSN/aYtEsY4dBvYlf1HmcHCQuTH3eHJZmz0Pus:eV2B5NPlhKy
MD5 SHA1 SHA512 SSDEEP

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 808KB
SHA256 e28b3cbf1141e5f3cb3aba945397f02ec15edd7da501d43419c8156a71db7d7a
MD5 cde23fc3d3a48e2767c0aa7ea28e91f7
SHA1 437d37f7d97233909e9957edf95c222869d1477e
SHA512 b9f8d8f9eecb95c7baa3cf4e4d928a2f9ce63b7287cf1aad7b1d0a2a0cf7a085fad67e0fbd777412a0b6be8f25ed6a0b9288136b692b9ea618fea67709729a25
SSDEEP 6144:MCBq0cT3K393z3m3oT1HFBxAsXvUZZmz0PjtT6CY4dBvFlZ1HmcHCQuTH3eHrZmq:MyWF6Yzbibav/C7Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 7.5MB
SHA256 bac1ee23bff296e53999bd4b390a3bc95ff257d0abed8f1046777f4dc7fa565b
MD5 34a506ebc529ae7c27172ebaf6c4bff9
SHA1 2002eb4cbb60b6df8c295181925df3bd266521bf
SHA512 663470cdef37a257ee07ed225ad64dc1d797ab39f0bae0e50e83c02af75de6d4094ee6368ab35105c3dfa69b50a6716eb0a347b808b1ea2445dc14140c270d56
SSDEEP 24576:9jTylt73zfnOAxARlws2eKhbLxF57ozrcpXiTbAyWp7fWnSsVCSv7K7oChv6Q0Q1:8peKLEhSdzvXZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

netrasa.PNF

Path C:\Windows\INF\netrasa.PNF
Size 22KB
SHA256 8ab9a39457507e405ade5ef9d723e0f89bc46d8d8b33d354b00d95847f098380
MD5 80648b43d233468718d717d10187b68d
SHA1 a1736e8f0e408ce705722ce097d1adb24ebffc45
SHA512 eec0ac7e7abcf87b3f0f4522b0dd95c658327afb866ceecff3c9ff0812a521201d729dd71d43f3ac46536f8435d4a49ac157b6282077c7c1940a6668f3b3aea9
SSDEEP 384:u687/H569J/gcqqVYL4f4r4B4Fs4HtC+HmOm5y2rDmBQ3qnoA5xRx2rPQ:uP/H569J/gcqqVYL4f4r4B4Fs4HtC+HL
MD5 SHA1 SHA512 SSDEEP

Submit Download

netsstpa.PNF

Path C:\Windows\INF\netsstpa.PNF
Size 6KB
SHA256 35ad0403fdef3fce3ef5cd311c72fef2a95a317297a53c02735cda4bd6e0c74f
MD5 01e21456e8000bab92907eec3b3aeea9
SHA1 39b34fe438352f7b095e24c89968fca48b8ce11c
SHA512 9d5153450e8fe3f51f20472bae4a2ab2fed43fad61a89b04a70325559f6ffed935dd72212671cc6cfc0288458d359bc71567f0d9af8e5770d696adc5bdadd7ec
SSDEEP 96:ezl5u+BEC7/VRDZSYiId6bwXSR3loE1Dj0eqmn:y//V/S6d6TnhDn
MD5 SHA1 SHA512 SSDEEP

Submit Download