c6dae90a00e614781c88507e393837f6bcc17c0583349d4aabe14f95798eab10

Resubmissions

06/07/2024, 16:44

240706-t8v47avgpr 7

06/07/2024, 16:36

240706-t4fhyaxeqh 3

Analysis

max time kernel
44s
max time network
94s
platform
windows10-1703_x64
resource
win10-20240611-en
resource tags

arch:x64arch:x86image:win10-20240611-enlocale:en-usos:windows10-1703-x64system
submitted
06/07/2024, 16:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

VirusShare_2498a8b0f3bb1595a145448f21ac5928.zip
Size

332KB
MD5

04b5e7560a9a7359fab53c007aba9a60
SHA1

5a8bfcd3590a490579142c62905ac9daf1f1757c
SHA256

c6dae90a00e614781c88507e393837f6bcc17c0583349d4aabe14f95798eab10
SHA512

0846d637db729c9e0e501c37122abe3f4d57ed9ce1db3bab88f82b4590a0ccbe28817ff1454045e0910515bd91aafa85fc5e89d8affc135f0374b954bfa5a6c8
SSDEEP

6144:2qf6wp5mxQB8nMde7wVjzihORwawUjLWqqke38CrevqcdJTWOXt:F7pgxQ6jqigRwnUfzebrQp7Tv

Score

7^/10

persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Modifies system executable filetype association 2 TTPs 18 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\edit	regedit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\print\command	regedit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runas\command	regedit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runasuser\command	regedit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	regedit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\print	regedit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell	regedit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\ContextMenuHandlers\Compatibility	regedit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\PropertySheetHandlers	regedit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\{8895b1c6-b41f-4c1c-a562-0d564250836f}	regedit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open	regedit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runas	regedit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runasuser	regedit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\ContextMenuHandlers	regedit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\DropHandler	regedit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex	regedit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\DefaultIcon	regedit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\edit\command	regedit.exe

Checks processor information in registry 2 TTPs 13 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.edrwx\shellex\{e357fccd-a995-4576-b01f-234630154e96}	regedit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.mp3	regedit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00020803-0000-0000-C000-000000000046}\Verb	regedit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{02AF6DD2-77E6-44DF-B3E1-57CF1476D8EA}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}	regedit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CID.Local\66f3ba0f-d803-458c-8bb0-b6b9956bbd18\Endpoint	regedit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00020907-0000-0000-C000-000000000046}\Conversion	regedit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{000209FF-0000-0000-C000-000000000046}\ProgID	regedit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.der	regedit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.evo	regedit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.m1v\OpenWithProgIds	regedit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.mov\OpenWithProgIds	regedit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.mp4\OpenWithProgIds	regedit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0000050B-0000-0010-8000-00AA006D2EA4}\InprocServer32	regedit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00030004-0000-0000-C000-000000000046}\NotInsertable	regedit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1B261B22-AC6A-4E68-A870-AB5080E8687B}\TypeLib	regedit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1B261B22-AC6A-4E68-A870-AB5080E8687B}\Verb	regedit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.mp4\ShellEx	regedit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.txt\ShellNew	regedit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\7-Zip.tgz\shell	regedit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{2F76FDA4-6EA4-49E3-991B-E637A144480A}	regedit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CDO.SS_NNTPOnPostSink	regedit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\*	regedit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.dsw\PersistentHandler	regedit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.pptm\ShellEx	regedit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AcroExch.XFDFDoc\shell\Printto\command	regedit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00020907-0000-0000-C000-000000000046}\InprocHandler32	regedit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.fnt\PersistentHandler	regedit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.glox	regedit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00020833-0000-0000-C000-000000000046}\LocalServer32	regedit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.pl\PersistentHandler	regedit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00020820-0000-0000-C000-000000000046}\InprocHandler32	regedit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{03012959-F4F6-44D7-9D09-DAA087A9DB57}\Containers	regedit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00020906-0000-0000-C000-000000000046}\DataFormats\GetSet\4	regedit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{9B8C4620-2C1A-11D0-8493-00A02438AD48}	regedit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0C41D1E6-9D16-41ED-9CDD-D0665039857B}	regedit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.mhtml\OpenWithProgIds	regedit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.mp4	regedit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.vdx\shellex\{00021500-0000-0000-C000-000000000046}	regedit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AcroExch.XDPDoc\shell	regedit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell	regedit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00024502-0000-0000-C000-000000000046}\VersionIndependentProgID	regedit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00030001-0000-0000-C000-000000000046}\TreatAs	regedit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.easmx	regedit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.hxe\OpenWithProgIDs	regedit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.sldx	regedit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.sr2\ShellEx\{e357fccd-a995-4576-b01f-234630154e96}	regedit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\ASFFile\shellex\{8895b1c6-b41f-4c1c-a562-0d564250836f}	regedit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00020833-0000-0000-C000-000000000046}\AuxUserType	regedit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{B1B77C00-C3E4-11CF-AF79-00AA00B67A42}	regedit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{E4206432-01A1-4BEE-B3E1-3702C8EDC574}	regedit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.docx\Word.Document.12	regedit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\PersistentHandler	regedit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.hxa	regedit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.mpeg2	regedit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.pfm	regedit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.eprtx\PersistentHandler	regedit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.library-ms	regedit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\licensemanagershellext.exe\SupportedTypes	regedit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00020821-0000-0000-C000-000000000046}\Conversion\Readable\Main	regedit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00020821-0000-0000-C000-000000000046}\Conversion	regedit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{18A06B6B-2F3F-4e2b-A611-52BE631B2D22}\DataFormats\GetSet\1	regedit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.hxi	regedit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.srf\PersistentHandler	regedit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\bootstrap.vsto\CurVer	regedit.exe

Runs regedit.exe 1 IoCs

pid	Process
4948	regedit.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4948	regedit.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3260	firefox.exe
Token: SeDebugPrivilege	3260	firefox.exe
Token: SeDebugPrivilege	3580	firefox.exe
Token: SeDebugPrivilege	3580	firefox.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
3260	firefox.exe
3260	firefox.exe
3260	firefox.exe
3260	firefox.exe
3260	firefox.exe
3580	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3260	firefox.exe
3260	firefox.exe
3260	firefox.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3260	firefox.exe
3580	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 760 wrote to memory of 3260	760	firefox.exe	72
PID 760 wrote to memory of 3260	760	firefox.exe	72
PID 760 wrote to memory of 3260	760	firefox.exe	72
PID 760 wrote to memory of 3260	760	firefox.exe	72
PID 760 wrote to memory of 3260	760	firefox.exe	72
PID 760 wrote to memory of 3260	760	firefox.exe	72
PID 760 wrote to memory of 3260	760	firefox.exe	72
PID 760 wrote to memory of 3260	760	firefox.exe	72
PID 760 wrote to memory of 3260	760	firefox.exe	72
PID 760 wrote to memory of 3260	760	firefox.exe	72
PID 760 wrote to memory of 3260	760	firefox.exe	72
PID 3260 wrote to memory of 936	3260	firefox.exe	73
PID 3260 wrote to memory of 936	3260	firefox.exe	73
PID 3260 wrote to memory of 3376	3260	firefox.exe	74
PID 3260 wrote to memory of 3376	3260	firefox.exe	74
PID 3260 wrote to memory of 3376	3260	firefox.exe	74
PID 3260 wrote to memory of 3376	3260	firefox.exe	74
PID 3260 wrote to memory of 3376	3260	firefox.exe	74
PID 3260 wrote to memory of 3376	3260	firefox.exe	74
PID 3260 wrote to memory of 3376	3260	firefox.exe	74
PID 3260 wrote to memory of 3376	3260	firefox.exe	74
PID 3260 wrote to memory of 3376	3260	firefox.exe	74
PID 3260 wrote to memory of 3376	3260	firefox.exe	74
PID 3260 wrote to memory of 3376	3260	firefox.exe	74
PID 3260 wrote to memory of 3376	3260	firefox.exe	74
PID 3260 wrote to memory of 3376	3260	firefox.exe	74
PID 3260 wrote to memory of 3376	3260	firefox.exe	74
PID 3260 wrote to memory of 3376	3260	firefox.exe	74
PID 3260 wrote to memory of 3376	3260	firefox.exe	74
PID 3260 wrote to memory of 3376	3260	firefox.exe	74
PID 3260 wrote to memory of 3376	3260	firefox.exe	74
PID 3260 wrote to memory of 3376	3260	firefox.exe	74
PID 3260 wrote to memory of 3376	3260	firefox.exe	74
PID 3260 wrote to memory of 3376	3260	firefox.exe	74
PID 3260 wrote to memory of 3376	3260	firefox.exe	74
PID 3260 wrote to memory of 3376	3260	firefox.exe	74
PID 3260 wrote to memory of 3376	3260	firefox.exe	74
PID 3260 wrote to memory of 3376	3260	firefox.exe	74
PID 3260 wrote to memory of 3376	3260	firefox.exe	74
PID 3260 wrote to memory of 3376	3260	firefox.exe	74
PID 3260 wrote to memory of 3376	3260	firefox.exe	74
PID 3260 wrote to memory of 3376	3260	firefox.exe	74
PID 3260 wrote to memory of 3376	3260	firefox.exe	74
PID 3260 wrote to memory of 3376	3260	firefox.exe	74
PID 3260 wrote to memory of 3376	3260	firefox.exe	74
PID 3260 wrote to memory of 3376	3260	firefox.exe	74
PID 3260 wrote to memory of 3376	3260	firefox.exe	74
PID 3260 wrote to memory of 3376	3260	firefox.exe	74
PID 3260 wrote to memory of 3376	3260	firefox.exe	74
PID 3260 wrote to memory of 3376	3260	firefox.exe	74
PID 3260 wrote to memory of 3376	3260	firefox.exe	74
PID 3260 wrote to memory of 3376	3260	firefox.exe	74
PID 3260 wrote to memory of 3376	3260	firefox.exe	74
PID 3260 wrote to memory of 3376	3260	firefox.exe	74
PID 3260 wrote to memory of 3376	3260	firefox.exe	74
PID 3260 wrote to memory of 3376	3260	firefox.exe	74
PID 3260 wrote to memory of 3376	3260	firefox.exe	74
PID 3260 wrote to memory of 3376	3260	firefox.exe	74
PID 3260 wrote to memory of 3376	3260	firefox.exe	74
PID 3260 wrote to memory of 3376	3260	firefox.exe	74
PID 3260 wrote to memory of 3376	3260	firefox.exe	74
PID 3260 wrote to memory of 3052	3260	firefox.exe	76
PID 3260 wrote to memory of 3052	3260	firefox.exe	76
PID 3260 wrote to memory of 3052	3260	firefox.exe	76

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\VirusShare_2498a8b0f3bb1595a145448f21ac5928.zip
1⤵
PID:4468

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:760
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3260
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3260.0.344350954\1978131372" -parentBuildID 20221007134813 -prefsHandle 1704 -prefMapHandle 1700 -prefsLen 20845 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3f9de72e-0047-4747-90d4-0353f5b63a98} 3260 "\\.\pipe\gecko-crash-server-pipe.3260" 1780 298975e9758 gpu
    3⤵
    PID:936
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3260.1.172062781\1509743324" -parentBuildID 20221007134813 -prefsHandle 2100 -prefMapHandle 2096 -prefsLen 20926 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4e5ed16d-1754-4a2b-a071-c3c257d4dfbd} 3260 "\\.\pipe\gecko-crash-server-pipe.3260" 2136 2988c36fb58 socket
    3⤵
    - Checks processor information in registry
    PID:3376
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3260.2.1808311768\594869012" -childID 1 -isForBrowser -prefsHandle 3304 -prefMapHandle 3300 -prefsLen 21029 -prefMapSize 233444 -jsInitHandle 1336 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b713286f-2188-4438-8f9d-6716bff53e45} 3260 "\\.\pipe\gecko-crash-server-pipe.3260" 3424 2989ad17158 tab
    3⤵
    PID:3052
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3260.3.1652669926\1109720466" -childID 2 -isForBrowser -prefsHandle 3068 -prefMapHandle 3016 -prefsLen 26214 -prefMapSize 233444 -jsInitHandle 1336 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a7b2c159-a0f5-4d8f-a76a-c33c4cbe58d4} 3260 "\\.\pipe\gecko-crash-server-pipe.3260" 2744 2989c473b58 tab
    3⤵
    PID:4776
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3260.4.23279831\569990507" -childID 3 -isForBrowser -prefsHandle 3752 -prefMapHandle 3756 -prefsLen 26349 -prefMapSize 233444 -jsInitHandle 1336 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {85b5ff5f-0e58-45fb-a9dd-f0f5a5ca0071} 3260 "\\.\pipe\gecko-crash-server-pipe.3260" 3068 2989c472358 tab
    3⤵
    PID:4568
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3260.5.98219700\1346039579" -childID 4 -isForBrowser -prefsHandle 4780 -prefMapHandle 4532 -prefsLen 26433 -prefMapSize 233444 -jsInitHandle 1336 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0b1aad52-6baf-4c93-9416-941efa5abb5b} 3260 "\\.\pipe\gecko-crash-server-pipe.3260" 2608 2989b9d7e58 tab
    3⤵
    PID:932
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3260.6.1546715178\845723123" -childID 5 -isForBrowser -prefsHandle 1572 -prefMapHandle 1552 -prefsLen 26433 -prefMapSize 233444 -jsInitHandle 1336 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {cf5fe7ed-231f-42d0-aa22-7c9b4918e933} 3260 "\\.\pipe\gecko-crash-server-pipe.3260" 2900 2989dbea458 tab
    3⤵
    PID:2980
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3260.7.740630124\1096148770" -childID 6 -isForBrowser -prefsHandle 5212 -prefMapHandle 5216 -prefsLen 26433 -prefMapSize 233444 -jsInitHandle 1336 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b9ea3319-cf49-4603-9870-614cd2b2f5d1} 3260 "\\.\pipe\gecko-crash-server-pipe.3260" 5204 2989dbeb958 tab
    3⤵
    PID:4200
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3260.8.956973810\1039682643" -childID 7 -isForBrowser -prefsHandle 5588 -prefMapHandle 5580 -prefsLen 26433 -prefMapSize 233444 -jsInitHandle 1336 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9750df70-8e26-4266-a04a-9066c6bc4381} 3260 "\\.\pipe\gecko-crash-server-pipe.3260" 5596 2989ee5f358 tab
    3⤵
    PID:2340
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3260.9.1742798890\1821632636" -childID 8 -isForBrowser -prefsHandle 4500 -prefMapHandle 4496 -prefsLen 26433 -prefMapSize 233444 -jsInitHandle 1336 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {26ac673f-0074-431e-9e1f-8e60f2521cae} 3260 "\\.\pipe\gecko-crash-server-pipe.3260" 4660 2989a3c3b58 tab
    3⤵
    PID:4792
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3260.10.1774766994\162962883" -parentBuildID 20221007134813 -prefsHandle 3936 -prefMapHandle 4412 -prefsLen 26433 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {bfd0075b-b357-4999-9707-1ba2cfa0d959} 3260 "\\.\pipe\gecko-crash-server-pipe.3260" 4496 2989b24b558 rdd
    3⤵
    PID:64
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3260.11.1104577957\891458957" -parentBuildID 20221007134813 -sandboxingKind 1 -prefsHandle 3132 -prefMapHandle 3348 -prefsLen 26433 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2f1de410-7115-4d6f-b216-695cfe65d4c8} 3260 "\\.\pipe\gecko-crash-server-pipe.3260" 6088 2989c444b58 utility
    3⤵
    PID:5012
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3260.12.1960092863\182554901" -childID 9 -isForBrowser -prefsHandle 2476 -prefMapHandle 2584 -prefsLen 26608 -prefMapSize 233444 -jsInitHandle 1336 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d09b4d14-6422-4269-88b6-975c11553eb0} 3260 "\\.\pipe\gecko-crash-server-pipe.3260" 2408 2988c360d58 tab
    3⤵
    PID:2176

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:2528
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:3580
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3580.0.1730217708\1663235980" -parentBuildID 20221007134813 -prefsHandle 1560 -prefMapHandle 1548 -prefsLen 20969 -prefMapSize 233583 -appDir "C:\Program Files\Mozilla Firefox\browser" - {30e96469-1640-4f89-ba8b-0f6dcf4f63bb} 3580 "\\.\pipe\gecko-crash-server-pipe.3580" 1628 2c643efce58 gpu
    3⤵
    PID:4008
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3580.1.1421773361\1698456064" -parentBuildID 20221007134813 -prefsHandle 1940 -prefMapHandle 1936 -prefsLen 21014 -prefMapSize 233583 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6300f530-fa0c-4add-9431-208ebf6a341c} 3580 "\\.\pipe\gecko-crash-server-pipe.3580" 1952 2c643b3b158 socket
    3⤵
    PID:3916
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3580.2.1925641707\1883530210" -childID 1 -isForBrowser -prefsHandle 2752 -prefMapHandle 2748 -prefsLen 21475 -prefMapSize 233583 -jsInitHandle 1188 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {43d5bb6a-3930-456f-b963-206c37efc97e} 3580 "\\.\pipe\gecko-crash-server-pipe.3580" 2764 2c647fc2e58 tab
    3⤵
    PID:4856
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3580.3.736934518\2079618043" -childID 2 -isForBrowser -prefsHandle 2216 -prefMapHandle 2700 -prefsLen 26660 -prefMapSize 233583 -jsInitHandle 1188 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0f03c684-c3de-4177-ba62-2ebd910c81f9} 3580 "\\.\pipe\gecko-crash-server-pipe.3580" 2244 2c648f4a858 tab
    3⤵
    PID:3540
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3580.4.498110696\1254839629" -childID 3 -isForBrowser -prefsHandle 3312 -prefMapHandle 3308 -prefsLen 26660 -prefMapSize 233583 -jsInitHandle 1188 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fde5f3ac-b0c4-496c-b610-bda6b28b00bf} 3580 "\\.\pipe\gecko-crash-server-pipe.3580" 3324 2c639d67e58 tab
    3⤵
    PID:3564
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3580.5.507810807\2030824244" -childID 4 -isForBrowser -prefsHandle 4544 -prefMapHandle 4560 -prefsLen 26660 -prefMapSize 233583 -jsInitHandle 1188 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0ef4c449-f12d-4d16-98a4-0155faeb6369} 3580 "\\.\pipe\gecko-crash-server-pipe.3580" 4548 2c64acea358 tab
    3⤵
    PID:2156
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3580.6.89551381\850010055" -childID 5 -isForBrowser -prefsHandle 4764 -prefMapHandle 4768 -prefsLen 26660 -prefMapSize 233583 -jsInitHandle 1188 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {38db4fed-652a-412b-af17-be3850431767} 3580 "\\.\pipe\gecko-crash-server-pipe.3580" 4756 2c64aceaf58 tab
    3⤵
    PID:3688
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3580.7.1128179486\419776241" -childID 6 -isForBrowser -prefsHandle 4964 -prefMapHandle 4968 -prefsLen 26660 -prefMapSize 233583 -jsInitHandle 1188 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6616397c-646b-4036-9562-408ddd0117fd} 3580 "\\.\pipe\gecko-crash-server-pipe.3580" 4952 2c64aceb858 tab
    3⤵
    PID:3860

C:\Windows\regedit.exe
"C:\Windows\regedit.exe"
1⤵
- Modifies system executable filetype association
- Modifies registry class
- Runs regedit.exe
- Suspicious behavior: GetForegroundWindowSpam
PID:4948

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding
1⤵
PID:3628

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localserviceandnoimpersonation -s upnphost
1⤵
PID:1820

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\5aafb3b2e5604c408e89f703024a4c48 /t 2396 /p 4948
1⤵
PID:2172

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding
1⤵
PID:2164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

Filesize
9KB

MD5
7050d5ae8acfbe560fa11073fef8185d

SHA1
5bc38e77ff06785fe0aec5a345c4ccd15752560e

SHA256
cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

SHA512
a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\activity-stream.discovery_stream.json.tmp

Filesize
27KB

MD5
fe7db076d55bc89eb42cf46fbc6f9078

SHA1
8a3941b871fa23c1820c48db73048533f883969b

SHA256
2879e12d929615bbe6b9e17ad31c3ff490a8f0b88575fb30a8ea62bed5123c04

SHA512
59b1d46cdba1312dbec0db86c8a296f5debb24a75e2fec8570767226e906723c89359fa707eb520ebc80f72b1e550a22b1cb6d9c11640f3836b8455fe33d9e8e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\activity-stream.discovery_stream.json.tmp

Filesize
26KB

MD5
3515239afd948b483f453d5851d3553c

SHA1
c57cf805ecd444558bf314cdac3d7d67ab449ff6

SHA256
db8cf6cdc80fe7072fd6f75f0f445b037dff96cc791dec01df5027a5a4c42c74

SHA512
a638bbd41c5ec57fa8d75704f6b93135cd5c278c2045c0325747978a4ad32039c19bf4081415a6928e694e877390db97f63b069e225f1292a79f138311d70b61

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\cache2\entries\6D89348819C8881868053197CA0754F36784BF5F

Filesize
11KB

MD5
8b125f2dbc7aa3ecb91bd1b803532cbc

SHA1
918782e44b28383ebcd185aa7c0f21aef6440204

SHA256
b1c54f3172a9e7c1689ebb426bb1f1974157e10858acbe5182e87b487f4fa1c5

SHA512
0c7e07c540781d52e8164029c7566d3f05aee5a37813dd31a39d8ee6b6d28cd593060346c5c8d97f177adb3c500b2d1713e54c8aa24bcd594ded53c3211f6a52

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

Filesize
7KB

MD5
c460716b62456449360b23cf5663f275

SHA1
06573a83d88286153066bae7062cc9300e567d92

SHA256
0ec0f16f92d876a9c1140d4c11e2b346a9292984d9a854360e54e99fdcd99cc0

SHA512
476bc3a333aace4c75d9a971ef202d5889561e10d237792ca89f8d379280262ce98cf3d4728460696f8d7ff429a508237764bf4a9ccb59fd615aee07bdcadf30

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\startupCache\urlCache.bin

Filesize
3KB

MD5
79c8653c462a2e2f1a02f90397f3c470

SHA1
671e237e8a8e944b015b15a7b6ac5abb921dd1a5

SHA256
73a7a386a084413bd6e29f54c1ab3ac2b90ec5e7326a77d6fb64001813936fe2

SHA512
8303c8f5da0f82383ac2a3c89497de8cc2092b3b2ac4aa14501d815a016debca5e93a071bc41b1efa31593a36569410e3fb4d324cfd140a251f0a115a393a5c5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\AlternateServices.txt

Filesize
1KB

MD5
af203e49c3613d0b2330046fb03b75c2

SHA1
f6393d29ebe4d6b93d3177b916b0397222108ecf

SHA256
cb3483ad451774b0494554ec3108643b1c67118ab2961b899ff171ff8f331a87

SHA512
ba7a7ad18a6e0f4b433f799b5ca697031d09c744f068c2939df84f45e304dc971aedf0d5584381ff300475a349e5fe9df0e2d33b377990116345b397aa3a3665

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\SiteSecurityServiceState.txt

Filesize
349B

MD5
3d58bfbdcc583ea2b39fcfa8be3dc78f

SHA1
215a36e39fe526ef2a4997adce3880922ef159b0

SHA256
adf17719c94756924fac6c7a2e8d6c0f321e54956c8d616efa7f6ebfc0a618cd

SHA512
3d9e00685e7ad675ba048d9fd67e5fd453994f2b849a493397a711ea59eba7fc9fbe4ab2f09b1e2555e5530a88940c36705d0cde87d7aa9659122dcab0f8bcd3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\cert9.db

Filesize
224KB

MD5
dd3a1c7b0139755ec64ddf7f6d86b49f

SHA1
baca69e4a08ad31d3f98e6fb3a8ae818f0c3972b

SHA256
8c507f81feda61c130d0a84eb99db0a0efc8a18662ec97396057173ed1a9e84f

SHA512
6f5bf7ca020555aae2e2fbc239c11a72ea37f8db09a955cdfa70b1b2e67f3c29042a364ae2aa70e58f1822ab2cbfd34f4c424d01c68f30fe3c0a11bfc6f81e10

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\cookies.sqlite

Filesize
512KB

MD5
909c4f7fdee71ee8fd1203e87e054ac1

SHA1
73e7e300a2632027d364249598d590635860f013

SHA256
c2d272e83b182349043a01d4316e9d2107f654aa16e07bb3a883453d4bf6b20f

SHA512
193eea09144ab078b6f7f868de818c6500915388264988bf496605608dd126103e6790ce39530837f1ed7b8a917a04ceafb3b886132952253ef710e5ea8f8518

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
9a297295fc746813f67a44258f658359

SHA1
57e4b63d5d78ec7b6e350816c7eac568334b58ed

SHA256
a69edc7c57b55c2c38a30e88a0994e4ae3a367eebfa20f32783e1b529c6c1847

SHA512
2dfd54e11229d05a27f516d1e4d6823e86642ab99cc3b925b7be25fcb91060024d46522956aac100a6eac7142902359643507a928cd0a8e38439015b412630e9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
d49ccf37700d14fb16661016d08a4611

SHA1
6ab15b892c2eb0021e02267c98e705c926980937

SHA256
8ac6845c2b53e91e1ae778667d8e92819a6eae73d84a013f9af5322758fa127f

SHA512
b5a86b0d1b0794c12f4163cdb279bd7225c80fde32302e47893bd69d54492bbfae95c4b5de758545c2d9ca87a8b5af5305275050759da05aef6d310ed0174b2d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\datareporting\glean\db\data.safe.bin

Filesize
5KB

MD5
ee03b24cd70d8293340ee2011c29c368

SHA1
6e69b2c1d4e5db482f4a21a4703c72f6b29a4ec4

SHA256
8b7db28bf2bd3a29e0362c0d92f23ddce2563744d61bcd9758474b46d4f1e6d5

SHA512
981f8164fdd19d4f280b3e2e26a02b623ab8d377de8f5120019ab56512d1ce71e7ea66345b5f6436a0fe2052e41fa7d10eaac4520d4cc445ebc96fb678fe9aeb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\datareporting\glean\events\events

Filesize
166B

MD5
d1649a6c7d5a6480e7285b85eb19c227

SHA1
f3a98e705c5ea3ffd1fe751549ba6e8b671a98d5

SHA256
ff8f0d6288e9536dab6fffae1a7fe280b8b809d561d52c4eb12ea97d8ba64dc1

SHA512
4e6c127f7c7a5688c3c8cb8f07205aec45eca549c9bbbc9c63bd018dc7b4ccb1270b76d63ec64296d20cfc53e8311eaf48ccb131c1be8e0ffa9cd7b191a2b857

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\datareporting\glean\pending_pings\480e523b-64c5-4fe4-8bc6-5628cd81ceda

Filesize
771B

MD5
8dfa3bb2fb96994ca08e91d64b902acf

SHA1
a88f663201b769f0e64e2cfa6ae3e4a023340d77

SHA256
01cc8f75c2845ad1bea0f2faef80be0ebe13bf66de5a711897ced7960ea28888

SHA512
f9d22bb7c0840d4c35a6792aa29d19c46d016454f474a80381b708a826e37a7dbff3760a267425e523e57bf14696ec3e202e61035f808d9334c48c47ab9b2f55

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\datareporting\glean\pending_pings\75b147a2-4824-4f42-839f-2329cb5a3393

Filesize
10KB

MD5
e1997e88533dcfb5a134bf032a89cbc4

SHA1
56a2a0f5d6d93add780b713dc88310f30345209c

SHA256
80a1d51d13a36c9d04d3073117b6fb29141e790446b478fb359d429de5f73164

SHA512
e0bf3be90ed87944bc588044793a922c04effc5cb57471b36d1bf1adbafe9f21b84a5ec9563a2ce9a3d5c59d211a1f66eca4a76fe44342f418657ea933197d46

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\datareporting\glean\pending_pings\98458ac7-9ba3-401f-979b-49c271e6ed46

Filesize
790B

MD5
807fb318e093a9cd56fa49682578227d

SHA1
831faee11b47714b0ecf2873b990a881e05ca9c5

SHA256
e2f440857b8323c96200fade610838dcdc16eca1387655054dd7beb61a77602c

SHA512
954d75c77da84238bf9a58f474516253e7ce343ddbe2a8d9704cad9427599f476340b6c71fcb04103c314977a44a3a4e0d14180fdc4ec1c351d32d287252eb24

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\datareporting\glean\pending_pings\cc8b6035-7707-4307-9f0c-e9e845157935

Filesize
746B

MD5
15ed2feb7ee09fa2db8333a5e59c95fd

SHA1
802cfac7a3ec4da1bd55c39dcfc4ff551498e08d

SHA256
4f225a3460b7c4a6753bf268461897b22d4f6c35757f63e83aa67e7a5a816768

SHA512
8657a85f9866824e33d6c39f58fbd80654d1a388bedce2d86423dc0ae1444df9e324c1ae3b3ce792919dbe12612bb7fe43ee29fe075d568482fd5fa45787c627

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\favicons.sqlite

Filesize
5.0MB

MD5
18d19494817599fac392b1905b3c6d66

SHA1
3a0077f9224d94a875303cb7c74312d3fec42897

SHA256
212c96278d055351b98aac05450ceb7313038127f9bca65716a7a4db20d47412

SHA512
c8f909cf5f505318b49a6274da6be29f30a3d964802a8afc9ccd7999ab18faef2df07fdda68fc523e81d240e917121d3cbdb9e027ff3679e1e1cbca91c6bf13f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\permissions.sqlite

Filesize
96KB

MD5
24f9064b629e15f92486ced501677a02

SHA1
1f2982ebd4631a6e56361b71aa08e3a9c9c57c8e

SHA256
07d4e471a6c66f491cda46040f94408723d7865ab754603da2d3e325e97e857b

SHA512
d572fef17ffddfcaff3dc6b7a60160c0535718bd9a9d165244b6cb368fd2bbcff8bbf84ada0cbb5b17ea495b0b1d7c48d761411f257c891d4fb4d0e6b20d5125

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\places.sqlite

Filesize
5.0MB

MD5
748680cfe93f14c96a151f9a57c5c974

SHA1
f34c7df11631c5511c7dead4ab6e2e8c8adebd13

SHA256
552214cd2409d29bbe9a986fad85c15899a7087701ede94677b4acf88c477194

SHA512
c3600b8ed37c23fd0e5cdf825fec88d92e91b39a22c07828145580dd2e891b402268160cf6240f0e2da6c7fb9be5762483c7c8a7ebc1fdf35b9b68b524e4a657

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\prefs-1.js

Filesize
6KB

MD5
0d3b65c501946643309b07178e2cb0c2

SHA1
84f3d8095a8851cda67ac1672b7224921ad6948d

SHA256
afa2a94801ecd5df82b4e3aa2b51927067e55025bfa5a59af29b2eea194a1e8a

SHA512
483ff3c514f30f56f32e0409e28796b7816a11fc5e760bffdb471e515c1a2894177d6c043543dc9bb58a59798423fa6985f1c2eca1060ab58cf54d9ad2f0960e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\prefs-1.js

Filesize
6KB

MD5
f9e7da9bb25575276804f2482b2201be

SHA1
0c52fec4f9f87e2df27be8c3f0d6515239742923

SHA256
fa47abac7feee07dc67f46d4413f77d0b1b8086aaf2a33e3944acc6663e06835

SHA512
0b3201892b701603e59ca3ef5f92f4a6fb0fb1bf25057e39c6b3091cd54c641edd698915cc0fea6083e6432dbfa0e17a6db1fcf18010452de6aebacdf536a582

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\prefs.js

Filesize
6KB

MD5
08aa931fc46ffa036564722f94530923

SHA1
8eadee9f5e125d76c2227fb4d0297e50c47ea1f6

SHA256
370b30afbcef229a238ebbd4da041ea5a33867a7f08da2c1158e0b91e1ec0868

SHA512
be10cffdadfc36ec3033f38db89508df391b49a95600ce180bd1d40fadd9fc9462cf2c2032a5e058dc5425237f2364ab6d733ce401a69721221f133bc2e703e8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\prefs.js

Filesize
6KB

MD5
c85d748ce229770a27e20c06ea4ae65c

SHA1
4a239353cf5a1b5b74172e1b850a451a8a113d23

SHA256
f5b68db17074d64c1a1d6e9c6fe4653382cfcf41e0bce1fb99d6347b9b7aa8cc

SHA512
050ec9bfaae953085d73ce53700d6675cc35361ef73fd9ecdf2b8590878326ae54705653bae9f76dc518ee7e5d370e6bc9d5314f86c86d043b70ca055ae6da20

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\prefs.js

Filesize
6KB

MD5
c845750745578e7185701e2c2347054e

SHA1
b55061c02395936a84794a2509623f86a1bb9736

SHA256
ff0db082ea9a171dea32279aaf81404056b616d2daac31f87f1e12083aa2d440

SHA512
d65f3100dc32365a80b40b5ab8f5a6a9372fea0cc32486ea4085b14a2e81416c63f4480858e28153a7641b1bcfd0ffd170d7456e967a146008030fd05e495c4b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\protections.sqlite

Filesize
64KB

MD5
deeced8825e857ead7ba3784966be7be

SHA1
e72a09807d97d0aeb8baedd537f2489306e25490

SHA256
b9f022442a1506e592bf51284091a8a7fe17580b165d07e70c06fd6827343a54

SHA512
01d303232d6481af322137b44fef6c2a584f0643c48bab2836f9fe3193207015da7f7514fe338500ae4469651e3d9618293858ae507e722198a249257677099e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\sessionCheckpoints.json

Filesize
288B

MD5
6b77a9f779399e95d1cee931a2c8f8ff

SHA1
826efd4feb0d50fcce5696111af7c811b81adcd9

SHA256
3a0285c8233ef0324b269f7291094e19fd9b77259f9419861ad796f7e9c979f3

SHA512
ef537c75fab8e86483ac03cc0d2feaf41575e35f54b95669a26bf6dfbf58021dc9a5bbe54d9537b55da3fbb0e0262adf6c5efd4394faaec81a31604533afec4f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\sessionCheckpoints.json.tmp

Filesize
53B

MD5
ea8b62857dfdbd3d0be7d7e4a954ec9a

SHA1
b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a

SHA256
792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da

SHA512
076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\sessionCheckpoints.json.tmp

Filesize
122B

MD5
99601438ae1349b653fcd00278943f90

SHA1
8958d05e9362f6f0f3b616f7bfd0aeb5d37967c9

SHA256
72d74b596f7fc079d15431b51ce565a6465a40f5897682a94a3f1dd19b07959a

SHA512
ffa863d5d6af4a48aadc5c92df4781d3aacbf5d91b43b5e68569952ffec513ff95655b3e54c2161fe27d2274dd4778bad517c7a3972f206381ef292808628c55

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\sessionCheckpoints.json.tmp

Filesize
90B

MD5
c4ab2ee59ca41b6d6a6ea911f35bdc00

SHA1
5942cd6505fc8a9daba403b082067e1cdefdfbc4

SHA256
00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2

SHA512
71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\sessionCheckpoints.json.tmp

Filesize
259B

MD5
e6c20f53d6714067f2b49d0e9ba8030e

SHA1
f516dc1084cdd8302b3e7f7167b905e603b6f04f

SHA256
50a670fb78ff2712aae2c16d9499e01c15fddf24e229330d02a69b0527a38092

SHA512
462415b8295c1cdcac0a7cb16bb8a027ef36ae2ce0b061071074ac3209332a7eae71de843af4b96bbbd6158ca8fd5c18147bf9a79b8a7768a9a35edce8b784bf

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
2KB

MD5
aec48fa74e01154e470b6a3585ada322

SHA1
1972478c795286045e3a5dc417d6de1ce7c42321

SHA256
6897df237c5a27c0e9c2fca67f750facef7b6517a4ff415d80a140d2afb05d26

SHA512
9fe282b0ab77d010c93ffcf4ce34aa6f4a5791fc532ae5f85222d3ae8e86bc0ea35c6c86c34f073d95f239b6a2822f6eb9cfc82cd50528c578c33f6401e49e30

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
0f6a0b3d599b46554cc767eb863ba960

SHA1
95c612ecd78c5df207ce94e012fcb3bfc31f4998

SHA256
a290f13862e2ea43e55afc8c1bcf6e20903170eb3a4db38d45420e76c81070d0

SHA512
6e8d23c85eaaf60ba481acc17325ef9d9ed67b23974ec9b9ace95c9a84fa16a98ac2eb2dae5aff6267604bc2b449dcb09819e64b9fe15d714a9797374829b57c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\sessionstore.jsonlz4

Filesize
899B

MD5
f262b6937c11b896f13c6feef865f32a

SHA1
4e76b5f72af00fdff896f285d8d808af56489198

SHA256
ac196153c6c4167582d689567ca96430a65d09fc7456f90b5c210433eb5db220

SHA512
1da547710a2c7aee45ef999b9ab72a5d94e2bf2c991a3e2af7d742fecb46627234fc1cb5f6c3a69b03706f92efea7661dd04c9585fe5107ddc82fbca06b80079

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\sessionstore.jsonlz4

Filesize
2KB

MD5
af1e85ce4be8cf7b105db0da1a8c0113

SHA1
ee331c5bd6ad75f3a37bc10e9e766cc119b9671a

SHA256
6b5e490c8a6ef15a23f8e9dbe219ee7d323cfdbe82b6033eee5405d38cd1e123

SHA512
1959d3470c37685e8c03287efcc2c86e05c995582002dba9568efd53712f86ed65aa9c4f7e92cd505e50e01110e329b1d8bbdf10db31017f41a3745b0e7f07b5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\storage.sqlite

Filesize
4KB

MD5
594526b3a8326db6f22b5c9f2b36542c

SHA1
701edaee2950a5678c285ee0dabd6cb0828c732a

SHA256
17f07f8c1d141c81378a35e41212137a2b459830850ec73cab303a339788616e

SHA512
d6cd1bbd92b6243586b1490c76c076da888d2ebd9de53569f629870133dc757172c17da7da048e1502225352615891a9a5e397e78fe6e0863122bae25f72d15b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\storage\default\https+++www.youtube.com\cache\morgue\116\{02499674-0ba0-4577-b603-9b9aa7b57874}.final

Filesize
192B

MD5
2a252393b98be6348c4ba18003cc3471

SHA1
40f75302fcbe4a8ac2e33a8d9daf801abc2a9598

SHA256
04cae3c7b208fc55b25763913d0bbdc99232942086efdf705f2a27764be6f5ee

SHA512
07af4a7b0d10f1b5e1fe0877b21abc98483d78797608a1763cfb71e25559fdce10d20f03c16f4284d7ae7ab90266f45240425e3a264de9525ec1657345b85198

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\storage\default\https+++www.youtube.com\idb\2232182701SeesravbiacteaWDosrgk.sqlite

Filesize
48KB

MD5
5375e2bb8a644ed1d24f5710b30f4c22

SHA1
ac12c8ba60d08bbf87ad48213ebfcb92b4d42753

SHA256
02893144f1f434e8ccbccea7f52fee514ac5ada833783eb3651860da9c91b05c

SHA512
77c01fd3801d05091de550ce7922807d744e2e7e5e051986e9fba7b26690bbafbdf1a8c90598fbd00a91f151936e16926879849a9bdb0ff60109f47305d56b7f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite

Filesize
48KB

MD5
a50f1ade0d53b7089283c4bd1ca54602

SHA1
0a94ec73dd8d0061b1b8c6f826c81833b49c7381

SHA256
37843c717cd12959b64ed9659263eda6ab1bddd2176c72c4412813be1fba02a0

SHA512
d83d57481fa5d1be3b199579ff4dec699a4c9e9396239fcaa20960ffae298b57fd6f59977d7dfa38e75b1030e0b4f19666c6e01b3a8f63175bd770c2d897b6a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\xulstore.json

Filesize
218B

MD5
2d4eb8e5de4ec797450cd97c2082de10

SHA1
a793b8668470344239206a3b523c1c3be10b1808

SHA256
b88045ac2bc2d617b52bfc250a8382b6cfc4095667df453196773789340972e3

SHA512
2231896c66b2e71b21f639d770c5bff9cee76a34fa0de446ae8c0db34ade416b0166d50cee0f35e449d68581b5f41514046b31e53f44de138ab09a0b7151a2e8

Download Submit

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads