1ee3788918d34886873b12b45d7723e64eebe81cd117dbbf95f75fb99b38ea2d

Resubmissions

08/07/2024, 11:05

240708-m639fsyaph4

08/07/2024, 11:00

08/07/2024, 10:54

08/07/2024, 10:49

08/07/2024, 10:46

08/07/2024, 10:42

Analysis

max time kernel
202s
max time network
205s
platform
windows11-21h2_x64
resource
win11-20240704-en
resource tags

arch:x64arch:x86image:win11-20240704-enlocale:en-usos:windows11-21h2-x64system
submitted
08/07/2024, 11:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AntivirusDefender8.0-main/.gitattributes
Size 66B
Sample240708-m359msxhrf
SHA256 1a1dbe176bc233b499d35a57db7513f2941c99ab9759f177830c9149be99005b
MD5 05bdb783ee6514c8c072e47680af8ff7
SHA1 ba3dfe345280bdcc5e817bb02cf49b8b8d8e1c4c
SHA512 9e820d6126d62c0b89e380c69685f6668b2f131283f57e524f59492fa6df22844dda1b90d244d4a1f8aea78a84e65d47b1a878168c4e41001459a947ef275ffe
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 35 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3590242114-4229536887-1276274119-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3590242114-4229536887-1276274119-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3590242114-4229536887-1276274119-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3590242114-4229536887-1276274119-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 14002e803accbfb42cdb4c42b0297fe99a87c6410000	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3590242114-4229536887-1276274119-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3590242114-4229536887-1276274119-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3590242114-4229536887-1276274119-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3590242114-4229536887-1276274119-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3590242114-4229536887-1276274119-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3590242114-4229536887-1276274119-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3590242114-4229536887-1276274119-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3590242114-4229536887-1276274119-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3590242114-4229536887-1276274119-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3590242114-4229536887-1276274119-1000_Classes\Local Settings	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3590242114-4229536887-1276274119-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3590242114-4229536887-1276274119-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = ffffffff	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3590242114-4229536887-1276274119-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3590242114-4229536887-1276274119-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3590242114-4229536887-1276274119-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3590242114-4229536887-1276274119-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3590242114-4229536887-1276274119-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3590242114-4229536887-1276274119-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3590242114-4229536887-1276274119-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Generic"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3590242114-4229536887-1276274119-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3590242114-4229536887-1276274119-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3590242114-4229536887-1276274119-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3590242114-4229536887-1276274119-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3590242114-4229536887-1276274119-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3590242114-4229536887-1276274119-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3590242114-4229536887-1276274119-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3590242114-4229536887-1276274119-1000_Classes\Local Settings	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3590242114-4229536887-1276274119-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3590242114-4229536887-1276274119-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3590242114-4229536887-1276274119-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\NodeSlot = "3"	firefox.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: SeDebugPrivilege	1384	firefox.exe
Token: SeDebugPrivilege	1384	firefox.exe
Token: SeDebugPrivilege	1384	firefox.exe
Token: SeDebugPrivilege	1384	firefox.exe
Token: SeDebugPrivilege	1384	firefox.exe
Token: SeDebugPrivilege	1384	firefox.exe
Token: SeDebugPrivilege	1384	firefox.exe
Token: SeDebugPrivilege	1384	firefox.exe
Token: SeDebugPrivilege	1384	firefox.exe
Token: SeDebugPrivilege	1384	firefox.exe
Token: SeDebugPrivilege	1384	firefox.exe
Token: SeDebugPrivilege	1384	firefox.exe
Token: SeDebugPrivilege	1384	firefox.exe
Token: SeDebugPrivilege	1384	firefox.exe
Token: SeDebugPrivilege	1384	firefox.exe
Token: SeDebugPrivilege	1384	firefox.exe
Token: SeDebugPrivilege	1384	firefox.exe
Token: SeDebugPrivilege	1384	firefox.exe
Token: SeDebugPrivilege	1384	firefox.exe
Token: SeDebugPrivilege	1384	firefox.exe
Token: SeDebugPrivilege	1384	firefox.exe
Token: SeBackupPrivilege	5548	svchost.exe
Token: SeRestorePrivilege	5548	svchost.exe
Token: SeSecurityPrivilege	5548	svchost.exe
Token: SeTakeOwnershipPrivilege	5548	svchost.exe
Token: 35	5548	svchost.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
1384	firefox.exe
1384	firefox.exe
1384	firefox.exe
1384	firefox.exe
1384	firefox.exe
1384	firefox.exe

Suspicious use of SendNotifyMessage 5 IoCs

pid	Process
1384	firefox.exe
1384	firefox.exe
1384	firefox.exe
1384	firefox.exe
1384	firefox.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1428	OpenWith.exe
1384	firefox.exe
1384	firefox.exe
1384	firefox.exe
1384	firefox.exe
1384	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 1384	2444	firefox.exe	87
PID 2444 wrote to memory of 1384	2444	firefox.exe	87
PID 2444 wrote to memory of 1384	2444	firefox.exe	87
PID 2444 wrote to memory of 1384	2444	firefox.exe	87
PID 2444 wrote to memory of 1384	2444	firefox.exe	87
PID 2444 wrote to memory of 1384	2444	firefox.exe	87
PID 2444 wrote to memory of 1384	2444	firefox.exe	87
PID 2444 wrote to memory of 1384	2444	firefox.exe	87
PID 2444 wrote to memory of 1384	2444	firefox.exe	87
PID 2444 wrote to memory of 1384	2444	firefox.exe	87
PID 2444 wrote to memory of 1384	2444	firefox.exe	87
PID 1384 wrote to memory of 3144	1384	firefox.exe	88
PID 1384 wrote to memory of 3144	1384	firefox.exe	88
PID 1384 wrote to memory of 3144	1384	firefox.exe	88
PID 1384 wrote to memory of 3144	1384	firefox.exe	88
PID 1384 wrote to memory of 3144	1384	firefox.exe	88
PID 1384 wrote to memory of 3144	1384	firefox.exe	88
PID 1384 wrote to memory of 3144	1384	firefox.exe	88
PID 1384 wrote to memory of 3144	1384	firefox.exe	88
PID 1384 wrote to memory of 3144	1384	firefox.exe	88
PID 1384 wrote to memory of 3144	1384	firefox.exe	88
PID 1384 wrote to memory of 3144	1384	firefox.exe	88
PID 1384 wrote to memory of 3144	1384	firefox.exe	88
PID 1384 wrote to memory of 3144	1384	firefox.exe	88
PID 1384 wrote to memory of 3144	1384	firefox.exe	88
PID 1384 wrote to memory of 3144	1384	firefox.exe	88
PID 1384 wrote to memory of 3144	1384	firefox.exe	88
PID 1384 wrote to memory of 3144	1384	firefox.exe	88
PID 1384 wrote to memory of 3144	1384	firefox.exe	88
PID 1384 wrote to memory of 3144	1384	firefox.exe	88
PID 1384 wrote to memory of 3144	1384	firefox.exe	88
PID 1384 wrote to memory of 3144	1384	firefox.exe	88
PID 1384 wrote to memory of 3144	1384	firefox.exe	88
PID 1384 wrote to memory of 3144	1384	firefox.exe	88
PID 1384 wrote to memory of 3144	1384	firefox.exe	88
PID 1384 wrote to memory of 3144	1384	firefox.exe	88
PID 1384 wrote to memory of 3144	1384	firefox.exe	88
PID 1384 wrote to memory of 3144	1384	firefox.exe	88
PID 1384 wrote to memory of 3144	1384	firefox.exe	88
PID 1384 wrote to memory of 3144	1384	firefox.exe	88
PID 1384 wrote to memory of 3144	1384	firefox.exe	88
PID 1384 wrote to memory of 3144	1384	firefox.exe	88
PID 1384 wrote to memory of 3144	1384	firefox.exe	88
PID 1384 wrote to memory of 3144	1384	firefox.exe	88
PID 1384 wrote to memory of 3144	1384	firefox.exe	88
PID 1384 wrote to memory of 3144	1384	firefox.exe	88
PID 1384 wrote to memory of 3144	1384	firefox.exe	88
PID 1384 wrote to memory of 3144	1384	firefox.exe	88
PID 1384 wrote to memory of 3144	1384	firefox.exe	88
PID 1384 wrote to memory of 3144	1384	firefox.exe	88
PID 1384 wrote to memory of 3144	1384	firefox.exe	88
PID 1384 wrote to memory of 3144	1384	firefox.exe	88
PID 1384 wrote to memory of 3144	1384	firefox.exe	88
PID 1384 wrote to memory of 3144	1384	firefox.exe	88
PID 1384 wrote to memory of 3920	1384	firefox.exe	89
PID 1384 wrote to memory of 3920	1384	firefox.exe	89
PID 1384 wrote to memory of 3920	1384	firefox.exe	89
PID 1384 wrote to memory of 3920	1384	firefox.exe	89
PID 1384 wrote to memory of 3920	1384	firefox.exe	89
PID 1384 wrote to memory of 3920	1384	firefox.exe	89
PID 1384 wrote to memory of 3920	1384	firefox.exe	89
PID 1384 wrote to memory of 3920	1384	firefox.exe	89
PID 1384 wrote to memory of 3920	1384	firefox.exe	89
PID 1384 wrote to memory of 3920	1384	firefox.exe	89

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\AntivirusDefender8.0-main\.gitattributes
1⤵
- Modifies registry class
PID:1432

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1428

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1384
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1384.0.936017609\1520476410" -parentBuildID 20230214051806 -prefsHandle 1800 -prefMapHandle 1792 -prefsLen 22074 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1458a3a8-bf09-40b5-81dc-c23100371d71} 1384 "\\.\pipe\gecko-crash-server-pipe.1384" 1860 1cb170c6458 gpu
    3⤵
    PID:3144
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1384.1.1236328577\1927731460" -parentBuildID 20230214051806 -prefsHandle 2372 -prefMapHandle 2368 -prefsLen 22110 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b201be98-bd8a-457e-91f4-7665f8ee108c} 1384 "\\.\pipe\gecko-crash-server-pipe.1384" 2384 1cb0b385958 socket
    3⤵
    PID:3920
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1384.2.700122404\930828906" -childID 1 -isForBrowser -prefsHandle 2792 -prefMapHandle 3028 -prefsLen 22148 -prefMapSize 235121 -jsInitHandle 1288 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5693abd7-af24-440e-b156-036fe6b7461a} 1384 "\\.\pipe\gecko-crash-server-pipe.1384" 3100 1cb1aad5258 tab
    3⤵
    PID:2040
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1384.3.1780606634\120990547" -childID 2 -isForBrowser -prefsHandle 1084 -prefMapHandle 2524 -prefsLen 27614 -prefMapSize 235121 -jsInitHandle 1288 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a287f94e-33be-4229-bcd8-588c770d459d} 1384 "\\.\pipe\gecko-crash-server-pipe.1384" 3472 1cb1d65d858 tab
    3⤵
    PID:2888
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1384.4.683512351\887780225" -childID 3 -isForBrowser -prefsHandle 5128 -prefMapHandle 5124 -prefsLen 27614 -prefMapSize 235121 -jsInitHandle 1288 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8b763bd2-35e8-43ca-b109-b38b914df3cf} 1384 "\\.\pipe\gecko-crash-server-pipe.1384" 5140 1cb1f957f58 tab
    3⤵
    PID:2316
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1384.5.457680353\396076443" -childID 4 -isForBrowser -prefsHandle 5368 -prefMapHandle 5364 -prefsLen 27614 -prefMapSize 235121 -jsInitHandle 1288 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {aa5cc874-baf8-441e-81b9-c44fcd12b932} 1384 "\\.\pipe\gecko-crash-server-pipe.1384" 5376 1cb1f955e58 tab
    3⤵
    PID:2292
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1384.6.568721902\1059567900" -childID 5 -isForBrowser -prefsHandle 5520 -prefMapHandle 5524 -prefsLen 27614 -prefMapSize 235121 -jsInitHandle 1288 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7ffe3ad1-0d05-452f-b540-d176f5ccfd69} 1384 "\\.\pipe\gecko-crash-server-pipe.1384" 5512 1cb1f957658 tab
    3⤵
    PID:1944
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1384.7.1720011705\1927268708" -childID 6 -isForBrowser -prefsHandle 5552 -prefMapHandle 5556 -prefsLen 27774 -prefMapSize 235121 -jsInitHandle 1288 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2b3da6cf-575a-4556-b060-1d250253114a} 1384 "\\.\pipe\gecko-crash-server-pipe.1384" 5544 1cb1eb3e358 tab
    3⤵
    PID:1296
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1384.8.887554682\1175706556" -childID 7 -isForBrowser -prefsHandle 6076 -prefMapHandle 6072 -prefsLen 27774 -prefMapSize 235121 -jsInitHandle 1288 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bcf14076-7302-43b9-b653-aa98c894e2f6} 1384 "\\.\pipe\gecko-crash-server-pipe.1384" 6084 1cb1eb3d758 tab
    3⤵
    PID:3204
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1384.9.1440711638\81229636" -childID 8 -isForBrowser -prefsHandle 5484 -prefMapHandle 5480 -prefsLen 27774 -prefMapSize 235121 -jsInitHandle 1288 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {401376cb-62a4-473f-b63a-0156c3b4be62} 1384 "\\.\pipe\gecko-crash-server-pipe.1384" 5472 1cb1f5fcc58 tab
    3⤵
    PID:1512
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1384.10.1938835721\450756785" -childID 9 -isForBrowser -prefsHandle 5392 -prefMapHandle 5224 -prefsLen 27774 -prefMapSize 235121 -jsInitHandle 1288 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {95498b5e-b5fc-42e4-96d0-a2aa24faa4da} 1384 "\\.\pipe\gecko-crash-server-pipe.1384" 5360 1cb1f929458 tab
    3⤵
    PID:1820
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1384.11.137808423\1825889366" -childID 10 -isForBrowser -prefsHandle 9828 -prefMapHandle 9656 -prefsLen 28039 -prefMapSize 235121 -jsInitHandle 1288 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e43e0263-f6c8-4a3a-a7b1-fdda651dfb97} 1384 "\\.\pipe\gecko-crash-server-pipe.1384" 9888 1cb21fc3c58 tab
    3⤵
    PID:3164
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1384.12.1336523302\729355257" -parentBuildID 20230214051806 -prefsHandle 5788 -prefMapHandle 9728 -prefsLen 28039 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {178b52d3-5e25-441d-8975-c8b55985607c} 1384 "\\.\pipe\gecko-crash-server-pipe.1384" 9748 1cb204f5258 rdd
    3⤵
    PID:1616
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1384.13.26127148\962129373" -childID 11 -isForBrowser -prefsHandle 4996 -prefMapHandle 4904 -prefsLen 28175 -prefMapSize 235121 -jsInitHandle 1288 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8cb5550a-3113-45b9-aef1-4219469400fe} 1384 "\\.\pipe\gecko-crash-server-pipe.1384" 5412 1cb0b374a58 tab
    3⤵
    PID:2316
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1384.14.1889056842\2144770027" -childID 12 -isForBrowser -prefsHandle 4904 -prefMapHandle 4996 -prefsLen 28175 -prefMapSize 235121 -jsInitHandle 1288 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f2bb6423-bcbc-40cd-afb0-acf466688948} 1384 "\\.\pipe\gecko-crash-server-pipe.1384" 9376 1cb0b33f758 tab
    3⤵
    PID:352

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5628

C:\Windows\system32\notepad.exe
"C:\Windows\system32\notepad.exe"
1⤵
PID:5412

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SDRSVC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5548

C:\Users\Admin\AppData\Local\Temp\AntivirusDefender8.0-main\RUNTHISFIRST.exe
"C:\Users\Admin\AppData\Local\Temp\AntivirusDefender8.0-main\RUNTHISFIRST.exe"
1⤵
PID:5716
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c mountvol x: /s
  2⤵
  PID:5864
- - C:\Windows\SysWOW64\mountvol.exe
    mountvol x: /s
    3⤵
    PID:5752

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /min /c "start cmd /c "mountvol x: /s && icacls x: && del x:\efi\microsoft\boot\bootmgfw.efi && copy bootmgfw.efi x:\efi\microsoft\boot\bootmgfw.efi /Y""
1⤵
PID:5368
- C:\Windows\system32\cmd.exe
  cmd /c "mountvol x: /s && icacls x: && del x:\efi\microsoft\boot\bootmgfw.efi && copy bootmgfw.efi x:\efi\microsoft\boot\bootmgfw.efi /Y"
  2⤵
  PID:6004
- - C:\Windows\system32\mountvol.exe
    mountvol x: /s
    3⤵
    PID:6024

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /min /c "start cmd /c "mountvol x: /s && icacls x: && del x:\efi\microsoft\boot\bootmgfw.efi && copy bootmgfw.efi x:\efi\microsoft\boot\bootmgfw.efi /Y""
1⤵
PID:2624
- C:\Windows\system32\cmd.exe
  cmd /c "mountvol x: /s && icacls x: && del x:\efi\microsoft\boot\bootmgfw.efi && copy bootmgfw.efi x:\efi\microsoft\boot\bootmgfw.efi /Y"
  2⤵
  PID:5380
- - C:\Windows\system32\mountvol.exe
    mountvol x: /s
    3⤵
    PID:5016

C:\Users\Admin\AppData\Local\Temp\AntivirusDefender8.0-main\RUNTHISFIRST.exe
"C:\Users\Admin\AppData\Local\Temp\AntivirusDefender8.0-main\RUNTHISFIRST.exe"
1⤵
PID:1408
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c mountvol x: /s
  2⤵
  PID:1188
- - C:\Windows\SysWOW64\mountvol.exe
    mountvol x: /s
    3⤵
    PID:4952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RUNTHISFIRST.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RUNTHISFIRST.exe.log
Size 226B
SHA256 494398ec6108c68573c366c96aae23d35e7f9bdbb440a4aab96e86fcad5871d0
MD5 1294de804ea5400409324a82fdc7ec59
SHA1 9a39506bc6cadf99c1f2129265b610c69d1518f7
SHA512 033905cc5b4d0c0ffab2138da47e3223765146fa751c9f84b199284b653a04874c32a23aae577d2e06ce6c6b34fec62331b5fc928e3baf68dc53263ecdfa10c1
MD5 SHA1 SHA512

Submit Download

activity-stream.discovery_stream.json.tmp

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4926s7ha.default-release\activity-stream.discovery_stream.json.tmp
Size 25KB
SHA256 7166362dfd0bb07756a6fef2106f7e2a41f019039a8f0835d8857e9fe0b73d62
MD5 095f64d81ee0588ec900531a8548f0d3
SHA1 c952a1de0f8d17cab96cb4ac5d4c6c93fd70aecd
SHA512 0831a2e11a1a4333251f4fecb975746a9d6fb4da813c561b98d1c6aa391f0220645f0588636f29ad3689441d164eb3c6b3fcc2c970f67fe9c64dc4f185594cf3
SSDEEP 384:roPMiq69ZlJtE2LKMcQmWSRLsvlA/sgJv6zK9veEHkWGHBgyauFTb/TblA:roPMB6DlxLPpOsysK93GhgydF/lA
MD5 SHA1 SHA512 SSDEEP

Submit Download

activity-stream.discovery_stream.json.tmp

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4926s7ha.default-release\activity-stream.discovery_stream.json.tmp
Size 25KB
SHA256 086333d6488de33f8f7bdc28c947cf6a07e66433a9e7df1270038087bc917539
MD5 a9c8b3234c2916bed78c7dca097d270d
SHA1 ea2687def8511ffbc81f0a8c606364f4323bf1d6
SHA512 3548065b1a21a8883f7ee07cd71d320cb67eaff1eb57a601b1edabe6998f918bdec6d6552435af3e904e3b0327333af1dcae497752ee80ce5887fb290d2e6b81
SSDEEP 384:r0nh8YpAT0HYKiLRTXQx8dJcUgyauFTb/TblA:r0nh8+pw7cUgydF/lA
MD5 SHA1 SHA512 SSDEEP

Submit Download

17769

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4926s7ha.default-release\cache2\doomed\17769
Size 15KB
SHA256 d5ab8e8e0c35ba56b2c05acf7dc9a6a397a719bda94ef3ab7fd1e6f4556e24a0
MD5 57ba4af7535bf2e1d2e0edb38d7d16dd
SHA1 f32986c9415c2f0250b7c10c558c24b5d126a98a
SHA512 b8597c5921d03c372558786681c493dd79a160fa0343d656f17f55c157b5798b9f497e41d4db549011cd322b3aabb6bccfadb792812a15e38f20598cde72e918
SSDEEP 384:f8cFbFM2l0tsldZq2o9jb/uw2rhMq6mI6Pdd8qyKY0261MvHD8PDA/LhGcg3Cb5j:eS6mPVd8rKY36Wj8rA3YCN
MD5 SHA1 SHA512 SSDEEP

Submit Download

21932

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4926s7ha.default-release\cache2\doomed\21932
Size 11KB
SHA256 c84dd4f9f2241b8be5cbd821fdd7cde9b050f0875755aee17bd63f36a24733a4
MD5 d7a7a7c4c1d967d363bd43945f0fdcc0
SHA1 dc54eca967c2084ab5ad5b865ab01d78d3fa3413
SHA512 e64f743666b62760f11b7edfcef6b0120dc63267c12fb228f33a2e437fe2282577a062b5f81d856fc9154f6e0700c58750100d2c94bc148c88f5f40cd990dd84
SSDEEP 192:17t1zOLCI6f3d7p8qv6PiY02LAZwKZAK3cUI3/Hhl2xtPDm1uwL313Gcg3Cxdrz7:J6mI6Pdd8qyKY0261MvHD8PDA/LhGcg0
MD5 SHA1 SHA512 SSDEEP

Submit Download

22683

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4926s7ha.default-release\cache2\doomed\22683
Size 13KB
SHA256 9539af73592a0bf15de6792d2e97cf8bedb58a6e89405b23ac55081f547fb4bc
MD5 e6d9354d6140f0e00125a76c02924b1a
SHA1 e05cc59f749a0d6e442af819daa3355528145af5
SHA512 a120f97c9c5a63255b003db8d0a57c07ae4e34f88442d43b4ebfc1a99f31d57d7fd35d249e2408444817334b15bb34808eb9a9fb17da2e7e370094a48dee93a0
SSDEEP 384:g8DHNHxdGlsYeom8HyrsVFZDtRfpuM9nSrqObaAN5q5S:THNHDwsYm8Hyr6ntRwM9nSrqUa2
MD5 SHA1 SHA512 SSDEEP

Submit Download

28912

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4926s7ha.default-release\cache2\doomed\28912
Size 11KB
SHA256 4875a418987b6b62e54100cc7900943d26e497b48c2be9ecb55d5bbbae75646a
MD5 db1718f1157f8bb02303b5ace083e16b
SHA1 3e4330fe283947c57698a465dff3ba4c50824bb6
SHA512 907684022065c176c0d7e0b05115f2893c68c4e42180ec112f2cf9155f4d2608d53e328a27144040954f42cbfaea2af8c79e05171918f2214f5fa29b9febe517
SSDEEP 192:KRbwJb5a7t1zOLCI6f3d7p8qv6PiY02LAZwKZAK3cUI3/Hhl2xtPDm1uwL313Gca:Wboq6mI6Pdd8qyKY0261MvHD8PDA/Lh8
MD5 SHA1 SHA512 SSDEEP

Submit Download

308

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4926s7ha.default-release\cache2\doomed\308
Size 11KB
SHA256 f58afb13c7861212810fd983954f72369360b3e0d029dda32777f346ae633308
MD5 4c25f8412700eadd5478d69184ebb9b0
SHA1 12d4dcbe98fde621222fd54a1acdc76911072e7a
SHA512 9b4d86cec24e3705dd682061910ffb91de99b8a071f87103ecd0ac13c9999e3d4980e87322a0190c543fc457b04d36f36e2bb3c45e687291eeef43046718e81f
SSDEEP 192:w7t1zOLCI6f3d7p8qv6PiY02LAZwKZAK3cUI3/Hhl2xtPDm1uwL313Gcg3CxdrdC:O6mI6Pdd8qyKY0261MvHD8PDA/LhGcg7
MD5 SHA1 SHA512 SSDEEP

Submit Download

4F1CBB1EEA253BD91F5E99878F0A35DF5B479581

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4926s7ha.default-release\cache2\entries\4F1CBB1EEA253BD91F5E99878F0A35DF5B479581
Size 934KB
SHA256 92d2c1249a0a000cb4c31ca10bc28cb5c96a0636fc2b31f2107886ebc4d25fa8
MD5 cfed1ee9cbe83fec1e4494b56000c550
SHA1 3893ace3d35073b703234fee3aca1e34481a1483
SHA512 996747e9bf13db393a09e93e0d5a2b427dcf6a1baf58c7b60c77bb66e717acb109532a7b3202bb4c73486e6f0d8076423e988de15314f33ab39178b389571ca1
SSDEEP 12288:ELwgUdZWOJ5thkE+W2pC1kHUtBAhuYWdaGQn:ELGXWOJbaW2G2GaL
MD5 SHA1 SHA512 SSDEEP

Submit Download

6852D37B385EA080351617C9F18310B3213A46B5

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4926s7ha.default-release\cache2\entries\6852D37B385EA080351617C9F18310B3213A46B5
Size 108KB
SHA256 592420729b86a08683a690c1e3e2efd7afccb2d7a9c278457639f1f3bd74474c
MD5 836080cb1e104d218709e222b39b2bef
SHA1 936d507a5ed22d915191aa1cd76815b6e0a4a150
SHA512 828de25fb3369371f1473dafa2d473e0f7859ac53ce7cd83a32cdc53a1c97d30f6ecf55d2ba654e8120c44b42cc1673198493fa264685636684495ae8061c819
SSDEEP 1536:WiPEPyNd7a+sa4vd1X01h0ePwuUXmRtONbLdsl13SCra6I6+j9yoRUzU4TBPOZuH:9MKYJgnGjoo6FWFWbh
MD5 SHA1 SHA512 SSDEEP

Submit Download

D24E8DF3B19D6412C7F2B56BEB14156721FBAFBA

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4926s7ha.default-release\cache2\entries\D24E8DF3B19D6412C7F2B56BEB14156721FBAFBA
Size 415KB
SHA256 903a08c5898b9e63a595f5fbc2348da4ed5dab9b34f054a20093e9060a17b5be
MD5 987ec5d3e6cfea0c6436a6f27ff31e9a
SHA1 e40e8076143f1f224451497dc7da1e80cb0cd81e
SHA512 44ec66b934c23ba74650ea23f523b6f61aa7c93796d18ec97ca27bdc014ba6248aeea4a8a549a0a6b2bb761c9cb2bbd2153236a99f1a3b8f32a92712ed63b8cb
SSDEEP 6144:QpBazHp2jRYTllxA/PSbFheq5ma85DiC8o2jcyd0KP90fK1vTux5+IBQlU:0G2OTNA/PAFrx02IkId
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4926s7ha.default-release\prefs-1.js
Size 7KB
SHA256 9b8113b9df85b33996e99fbb5b69d734f590a96a4f5f3c73e708e2261ced9bec
MD5 59cb6618480b8669c5ba94cb3d1c6866
SHA1 2d77963cc463a2a07d75c2d1de29201cd42cbcf6
SHA512 d5bb808e1424b0b0775041c878064a819c8b4297a8e54e9ced9573e1dea6fd2b59aff1e586a7f181c7d095509dd16fe164e915d02789351c6608d3ee059a1407
SSDEEP 96:xHqnnUTUSxqGqEf9WaLHzSJ0XlnBOjY3I2HzSW3+Bw8H8ruwS1GS:MnnLREf9WKs0Xbb3IYzSlBw8H8awS/
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4926s7ha.default-release\prefs.js
Size 6KB
SHA256 7eca2bcf0d4664f0094e37278d337c6673f6ba9409453e2d127da16d550ec0d0
MD5 522a9944c905d981f2edd3156a9390a9
SHA1 76e2a020810b767674478b57d8332a8a70cc1be3
SHA512 f14f8c32481f7292e6218319b2e6db628d392b5e0dcdf4a7732e23fdff8003820cc8344f7add7e2ffc95c22659915cd5a586653749b1b8b7b602d3c94fca086a
SSDEEP 96:xHq5nUTUSxqGqEf9WaLHzSJ0XlnBOjY3I2HzSW3+Bw8H8rRwSo:M5nLREf9WKs0Xbb3IYzSlBw8H8FwSo
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4926s7ha.default-release\prefs.js
Size 7KB
SHA256 e4a3798517b4001dad8624e51dd9706a528e5c159cab72b89a8e399cfd1b3684
MD5 71f3000b1fccb4f4cc6d223b527e6024
SHA1 3ecfca26b6e668df6b2df8b9680e7586c7aec06f
SHA512 0ebb30dfdaa2467e541b71745891bcbe8401cabaf0f1ae1996fdcf56785fac528144f730771f58d666f7e7a00f575460b8afbf1515cf386938345662a74b810b
SSDEEP 96:xHq5nUTUSxqGqof98kLHzSJ0XlnBOjr73I2HzSW3+Bw8H8rRwSo:M5nLRof98Es0XbE3IYzSlBw8H8FwSo
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4926s7ha.default-release\sessionstore-backups\recovery.jsonlz4
Size 3KB
SHA256 f00027a54e56094e54dc9a82d3f1cf51dd0aa9a0ae4eabd1637d4d2456431018
MD5 acdf4b68d09c5d3f0803c0a58fea0996
SHA1 11c3095079f0f59ff1975c9c7497f420211fac91
SHA512 b6a244c0eb5617de7649bc25092f17526a5eb24ad484cc58fa5c3bfc4c253f0a74806f29dc07bea69df896e95a046618452b2605514a56638b0f2c2a96e92069
MD5 SHA1 SHA512

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4926s7ha.default-release\sessionstore-backups\recovery.jsonlz4
Size 12KB
SHA256 6e11965d8985c67291b1d5c029db048e603b8e4524a73d9f162879de44fa2e30
MD5 681346b301c6e4bb044cfa0e301034f4
SHA1 1d4ae875a9a0b2df368ac1d5f145965e4b6036c4
SHA512 7f8ab093e784b620619a9e6a89b30ddd7cfdf23a5a3e8a832c4b12711c901f9f31f89f19443418f8eff6c4cd9b326e81cbbcaca483199985fd7fb6d695bc665d
SSDEEP 384:3YCPe+NlywbvCQhatS0+MT5R5/jdKOgHHJ/DFOE:3Y0lywbvCQkXv5RQJ78E
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4926s7ha.default-release\sessionstore-backups\recovery.jsonlz4
Size 13KB
SHA256 e97f91278d8915dc64a21be3c74a41d0377c0904214ab90e878a6a4487581214
MD5 16ccf8e543bb0e3d0015d32c0ad60d00
SHA1 ac900781db3016fd8c8ae8067f7c475d75d5015f
SHA512 50f9ba8c2df5254f795ed8c51d69680cb841c503c394cb048584d771e6948b837874e9feecf4834954df6eff2942c5f881906d3228fbdb00934b7f704e35ffe2
SSDEEP 384:JYCPe+NlywbvCQhatS0+MtWkPjwTu4TL/qYxAaX:JY0lywbvCQkXJDsTLiY
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4926s7ha.default-release\sessionstore-backups\recovery.jsonlz4
Size 11KB
SHA256 dc0e7a9c93149022d75004d53f2a29fc9e80799469f296c6d683ea5088e593f9
MD5 0b90cbe4a2a5a58cbbd866a09442d6c9
SHA1 251d4fd015c5d31029b4a299e838631965b34b62
SHA512 179a90257543973f1288eaf1bce68349f5ccb22927494003e8f801986d3795f1fd8a1e5e661ed059357e7fa4f1f9eafe5eaacfaed7ca811962a38c4ebd3deb42
SSDEEP 192:oMYC9f5eRAN2NlqmIwbvCQU4KGNl/YMYhbpPTjeG8HddRy/EaQb0:/YCPeWwNlywbvCQU47l/YMYh9b89i/c4
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4926s7ha.default-release\sessionstore-backups\recovery.jsonlz4
Size 3KB
SHA256 accfcd1a2e2cfa931071460309bd955b4317a0347899afc3172bcba03cefeee7
MD5 85ab2f2bd9cf78149be4652578d3c9fa
SHA1 8509cf678cdaf0e1f93ea823d6c2b429be034546
SHA512 55b2e8f84555d077091903a36d9758924b633995f9a3bba287185b209b8fde783416156dac9dff3c347bf88bb5ddd48a77311c355f46f2c889681af3dbb21dd4
MD5 SHA1 SHA512

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4926s7ha.default-release\sessionstore-backups\recovery.jsonlz4
Size 9KB
SHA256 1f987709a54dbe8b3a4d5bddcdb245295e6535d047669175284081ab773f216a
MD5 ff7861fa70a4c89e24c4337194fb677d
SHA1 1efaaa6ea0c0ea7f2f03e05e8c74be9465301834
SHA512 13768010717b890add6b94106ac0db3f7231bcce5a15da6f4b605103a758aea667f3dfe71809bdfa5f4577b3c0aeb9d143a1087e4586f9dbb3283a4da29578a5
SSDEEP 192:1MYC9f5eRAN2NlqmIwbvCQU4KGNl/YMYhOpPTpyA:uYCPeWwNlywbvCQU47l/YMYhUlyA
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4926s7ha.default-release\sessionstore-backups\recovery.jsonlz4
Size 11KB
SHA256 6841ad2e4af0700672c5574fcc28bd5f53e15cdcf4c10919a3001bef0b77244b
MD5 d32298aa89fe4872f804231a3c28e504
SHA1 619c32cbd764a3ef0e0ee771c677b62cdec69902
SHA512 c7d5353865d6eaeff3a1067d9648460ad576b5973c6bba4c65d1024578e364d0891c6c3e2ec07559486ff9b381aa90c7dd63293628b1b3c4db0cfaeb6b42a0f2
SSDEEP 192:oMYC9f5eRl2NlqmIwbvCQhaK2L4npPTJevhsApL4+VpA19RyIOaspiAjeNdw/ExF:/YCPe+NlywbvCQhaPaChsAp4+wRAasMj
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4926s7ha.default-release\sessionstore-backups\recovery.jsonlz4
Size 13KB
SHA256 08bf88c80797a0ff84d350d3695c89b61e3974daf817ae5460f944099376285a
MD5 51d377c11521beebcb8abf94e8ec6e29
SHA1 b31acd8d4a16d379b827994edf4c15403df7a1b7
SHA512 31addd644641c83ffe2adafa15f4e137637dca2557f1521fbcd762f85988ad7e8028515dcee96c34324aab02d07858ae24c158c02d8a1ef678f0ed4aceb654ec
SSDEEP 384:EYCPe+NlywbvCQhatS0+MtWkPjwTu4TL/qYaUI18k:EY0lywbvCQkXJDsTLi5Ug
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/5716-881-0x0000000000130000-0x0000000000138000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads