Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
14-07-2024 09:20
Static task
static1
Behavioral task
behavioral1
Sample
73aa846fc6566e449ad9c89f487f74c7c51dea5c003f8a9010cc1b9b49248789.exe
Resource
win7-20240705-en
General
-
Target
73aa846fc6566e449ad9c89f487f74c7c51dea5c003f8a9010cc1b9b49248789.exe
-
Size
2.4MB
-
MD5
98d75ac516c8422010860028f45fe6d7
-
SHA1
2e70fd8c3f8ed1cdeeb754c8bc005b66971208ce
-
SHA256
73aa846fc6566e449ad9c89f487f74c7c51dea5c003f8a9010cc1b9b49248789
-
SHA512
21f0bd0a73376d70147d4bf186fb8ca3ddc731aff01613c120bc17ac33266a4861e9e9344252f87a5c6376c66dd5e3f7b4a5906bdcb5f7d3150ad0d969badbea
-
SSDEEP
49152:lAz1nDsYWmekVo7fwXRq02Xv835G/8cxGGSgklYcZqXpPDM8:eqYtVycBq0yklykPZwDh
Malware Config
Extracted
stealc
hate
http://85.28.47.30
-
url_path
/920475a59bac849d.php
Extracted
amadey
4.30
4dd39d
http://77.91.77.82
-
install_dir
ad40971b6b
-
install_file
explorti.exe
-
strings_key
a434973ad22def7137dbb5e059b7081e
-
url_paths
/Hun4Ko/index.php
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorti.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ ECBGCBGCAF.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion ECBGCBGCAF.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion ECBGCBGCAF.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorti.exe -
Executes dropped EXE 4 IoCs
pid Process 2796 ECBGCBGCAF.exe 1052 explorti.exe 2584 07d624f8b2.exe 1940 4cef862db6.exe -
Identifies Wine through registry keys 2 TTPs 2 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Wine ECBGCBGCAF.exe Key opened \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Wine explorti.exe -
Loads dropped DLL 7 IoCs
pid Process 2508 73aa846fc6566e449ad9c89f487f74c7c51dea5c003f8a9010cc1b9b49248789.exe 2508 73aa846fc6566e449ad9c89f487f74c7c51dea5c003f8a9010cc1b9b49248789.exe 2608 cmd.exe 2796 ECBGCBGCAF.exe 1052 explorti.exe 1052 explorti.exe 1052 explorti.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/files/0x0005000000019db2-148.dat autoit_exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
pid Process 2508 73aa846fc6566e449ad9c89f487f74c7c51dea5c003f8a9010cc1b9b49248789.exe 2508 73aa846fc6566e449ad9c89f487f74c7c51dea5c003f8a9010cc1b9b49248789.exe 2508 73aa846fc6566e449ad9c89f487f74c7c51dea5c003f8a9010cc1b9b49248789.exe 2796 ECBGCBGCAF.exe 1052 explorti.exe 2584 07d624f8b2.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\explorti.job ECBGCBGCAF.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 73aa846fc6566e449ad9c89f487f74c7c51dea5c003f8a9010cc1b9b49248789.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 73aa846fc6566e449ad9c89f487f74c7c51dea5c003f8a9010cc1b9b49248789.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_Classes\Local Settings firefox.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2508 73aa846fc6566e449ad9c89f487f74c7c51dea5c003f8a9010cc1b9b49248789.exe 2508 73aa846fc6566e449ad9c89f487f74c7c51dea5c003f8a9010cc1b9b49248789.exe 2796 ECBGCBGCAF.exe 1052 explorti.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2172 firefox.exe Token: SeDebugPrivilege 2172 firefox.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2796 ECBGCBGCAF.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 2172 firefox.exe 2172 firefox.exe 2172 firefox.exe 2172 firefox.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 2172 firefox.exe 2172 firefox.exe 2172 firefox.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe 1940 4cef862db6.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2508 73aa846fc6566e449ad9c89f487f74c7c51dea5c003f8a9010cc1b9b49248789.exe 2584 07d624f8b2.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2508 wrote to memory of 2608 2508 73aa846fc6566e449ad9c89f487f74c7c51dea5c003f8a9010cc1b9b49248789.exe 30 PID 2508 wrote to memory of 2608 2508 73aa846fc6566e449ad9c89f487f74c7c51dea5c003f8a9010cc1b9b49248789.exe 30 PID 2508 wrote to memory of 2608 2508 73aa846fc6566e449ad9c89f487f74c7c51dea5c003f8a9010cc1b9b49248789.exe 30 PID 2508 wrote to memory of 2608 2508 73aa846fc6566e449ad9c89f487f74c7c51dea5c003f8a9010cc1b9b49248789.exe 30 PID 2508 wrote to memory of 2628 2508 73aa846fc6566e449ad9c89f487f74c7c51dea5c003f8a9010cc1b9b49248789.exe 32 PID 2508 wrote to memory of 2628 2508 73aa846fc6566e449ad9c89f487f74c7c51dea5c003f8a9010cc1b9b49248789.exe 32 PID 2508 wrote to memory of 2628 2508 73aa846fc6566e449ad9c89f487f74c7c51dea5c003f8a9010cc1b9b49248789.exe 32 PID 2508 wrote to memory of 2628 2508 73aa846fc6566e449ad9c89f487f74c7c51dea5c003f8a9010cc1b9b49248789.exe 32 PID 2608 wrote to memory of 2796 2608 cmd.exe 34 PID 2608 wrote to memory of 2796 2608 cmd.exe 34 PID 2608 wrote to memory of 2796 2608 cmd.exe 34 PID 2608 wrote to memory of 2796 2608 cmd.exe 34 PID 2796 wrote to memory of 1052 2796 ECBGCBGCAF.exe 35 PID 2796 wrote to memory of 1052 2796 ECBGCBGCAF.exe 35 PID 2796 wrote to memory of 1052 2796 ECBGCBGCAF.exe 35 PID 2796 wrote to memory of 1052 2796 ECBGCBGCAF.exe 35 PID 1052 wrote to memory of 2584 1052 explorti.exe 37 PID 1052 wrote to memory of 2584 1052 explorti.exe 37 PID 1052 wrote to memory of 2584 1052 explorti.exe 37 PID 1052 wrote to memory of 2584 1052 explorti.exe 37 PID 1052 wrote to memory of 1940 1052 explorti.exe 38 PID 1052 wrote to memory of 1940 1052 explorti.exe 38 PID 1052 wrote to memory of 1940 1052 explorti.exe 38 PID 1052 wrote to memory of 1940 1052 explorti.exe 38 PID 1940 wrote to memory of 2232 1940 4cef862db6.exe 39 PID 1940 wrote to memory of 2232 1940 4cef862db6.exe 39 PID 1940 wrote to memory of 2232 1940 4cef862db6.exe 39 PID 1940 wrote to memory of 2232 1940 4cef862db6.exe 39 PID 2232 wrote to memory of 2172 2232 firefox.exe 40 PID 2232 wrote to memory of 2172 2232 firefox.exe 40 PID 2232 wrote to memory of 2172 2232 firefox.exe 40 PID 2232 wrote to memory of 2172 2232 firefox.exe 40 PID 2232 wrote to memory of 2172 2232 firefox.exe 40 PID 2232 wrote to memory of 2172 2232 firefox.exe 40 PID 2232 wrote to memory of 2172 2232 firefox.exe 40 PID 2232 wrote to memory of 2172 2232 firefox.exe 40 PID 2232 wrote to memory of 2172 2232 firefox.exe 40 PID 2232 wrote to memory of 2172 2232 firefox.exe 40 PID 2232 wrote to memory of 2172 2232 firefox.exe 40 PID 2232 wrote to memory of 2172 2232 firefox.exe 40 PID 2172 wrote to memory of 2808 2172 firefox.exe 41 PID 2172 wrote to memory of 2808 2172 firefox.exe 41 PID 2172 wrote to memory of 2808 2172 firefox.exe 41 PID 2172 wrote to memory of 2720 2172 firefox.exe 42 PID 2172 wrote to memory of 2720 2172 firefox.exe 42 PID 2172 wrote to memory of 2720 2172 firefox.exe 42 PID 2172 wrote to memory of 2720 2172 firefox.exe 42 PID 2172 wrote to memory of 2720 2172 firefox.exe 42 PID 2172 wrote to memory of 2720 2172 firefox.exe 42 PID 2172 wrote to memory of 2720 2172 firefox.exe 42 PID 2172 wrote to memory of 2720 2172 firefox.exe 42 PID 2172 wrote to memory of 2720 2172 firefox.exe 42 PID 2172 wrote to memory of 2720 2172 firefox.exe 42 PID 2172 wrote to memory of 2720 2172 firefox.exe 42 PID 2172 wrote to memory of 2720 2172 firefox.exe 42 PID 2172 wrote to memory of 2720 2172 firefox.exe 42 PID 2172 wrote to memory of 2720 2172 firefox.exe 42 PID 2172 wrote to memory of 2720 2172 firefox.exe 42 PID 2172 wrote to memory of 2720 2172 firefox.exe 42 PID 2172 wrote to memory of 2720 2172 firefox.exe 42 PID 2172 wrote to memory of 2720 2172 firefox.exe 42 PID 2172 wrote to memory of 2720 2172 firefox.exe 42 PID 2172 wrote to memory of 2720 2172 firefox.exe 42 PID 2172 wrote to memory of 2720 2172 firefox.exe 42 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\73aa846fc6566e449ad9c89f487f74c7c51dea5c003f8a9010cc1b9b49248789.exe"C:\Users\Admin\AppData\Local\Temp\73aa846fc6566e449ad9c89f487f74c7c51dea5c003f8a9010cc1b9b49248789.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\ECBGCBGCAF.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\ECBGCBGCAF.exe"C:\Users\Admin\AppData\Local\Temp\ECBGCBGCAF.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe"C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe"4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\1000006001\07d624f8b2.exe"C:\Users\Admin\AppData\Local\Temp\1000006001\07d624f8b2.exe"5⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:2584
-
-
C:\Users\Admin\AppData\Local\Temp\1000011001\4cef862db6.exe"C:\Users\Admin\AppData\Local\Temp\1000011001\4cef862db6.exe"5⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account6⤵
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account7⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2172.0.906376178\1418829180" -parentBuildID 20221007134813 -prefsHandle 1252 -prefMapHandle 1100 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {12e6f76b-6a39-4718-bab0-8c4c9e826f28} 2172 "\\.\pipe\gecko-crash-server-pipe.2172" 1332 f3dac58 gpu8⤵PID:2808
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2172.1.1727929496\202398311" -parentBuildID 20221007134813 -prefsHandle 1556 -prefMapHandle 1552 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {15a9f648-de23-4581-907a-3878701ce779} 2172 "\\.\pipe\gecko-crash-server-pipe.2172" 1568 d6f258 socket8⤵PID:2720
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2172.2.954014479\1696821522" -childID 1 -isForBrowser -prefsHandle 1884 -prefMapHandle 1880 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 832 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8903beae-0e8c-47b2-a80b-946f5ef6da1e} 2172 "\\.\pipe\gecko-crash-server-pipe.2172" 1896 18f53b58 tab8⤵PID:2824
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2172.3.2074745198\1911261565" -childID 2 -isForBrowser -prefsHandle 2512 -prefMapHandle 2508 -prefsLen 26151 -prefMapSize 233444 -jsInitHandle 832 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ef8adafe-b0b6-4680-b9b5-89a72cbfc57b} 2172 "\\.\pipe\gecko-crash-server-pipe.2172" 2524 d62858 tab8⤵PID:1056
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2172.4.1756657239\653453441" -childID 3 -isForBrowser -prefsHandle 3840 -prefMapHandle 3816 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 832 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a951bebf-3fb0-48bf-88a0-67a98964118d} 2172 "\\.\pipe\gecko-crash-server-pipe.2172" 3852 1feb3f58 tab8⤵PID:2600
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2172.5.1740682733\74971508" -childID 4 -isForBrowser -prefsHandle 3960 -prefMapHandle 3964 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 832 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b0bf966f-9dda-4dea-91d7-417615111b76} 2172 "\\.\pipe\gecko-crash-server-pipe.2172" 3948 1da0dc58 tab8⤵PID:2440
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2172.6.308150722\252786934" -childID 5 -isForBrowser -prefsHandle 4132 -prefMapHandle 4136 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 832 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {83cb387f-2f0a-44c1-9508-dc27db66e3fd} 2172 "\\.\pipe\gecko-crash-server-pipe.2172" 4120 1da0ee58 tab8⤵PID:2428
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\FHIDBKFCAA.exe"2⤵PID:2628
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\x07tfuqf.default-release\activity-stream.discovery_stream.json.tmp
Filesize29KB
MD54f199d7a112a2dce2c85d92b7757ccb6
SHA16d574a8c5239dc845db6887eb416d7c012ecc853
SHA256c6c6fdb1056dbcaa4f4565c336583478ef450ac4e2848f5377a760d9e8c748c2
SHA5125a055d7e017b8793ad7b93ae3dc1d77af79069ffd0ba0999a1a5b2706830b2adebbb6fbb49cab3f5396c36ec51384b4e947bcf02325ab675565eedd2d3a52c9a
-
Filesize
2.4MB
MD5220d3b545e973e99f08261987a537e94
SHA1086b1e036bf86da6eb993026aee9a5ef97cadacc
SHA2564dbce3b48eaa032021893a69d50f153369ebfb5c8c1a5d8f1df2a35debc0f357
SHA5120400a7380b680770450764fb92c42137c88a78c671d1dead66675b9e31098f5406e75025fec2e122208642e9c3bdb9bd661e68139cdf6b66c0e0f7ec036d8966
-
Filesize
1.2MB
MD58f70d68b785ed8ab5f860b9faa821373
SHA1e21847d136339151dd24a342e41b4d9031ba1f7f
SHA2565af03de2cc60a723fd26a7a87c7ef797e9a5afde7edaa5e86e3ac3945867f287
SHA51202166b3b2eaafa6cafc95209d4c385585712eb4fa1980e9c929375e8a26bb03a15a89e91c05de99a786ed20785b66f8db4230a85d2864ea5ed89cd55419591bb
-
Filesize
1.8MB
MD53333c3b751e0b28e90ffa07d30d42ca7
SHA1273c785405fcd7a318a0733a430a4f962034c566
SHA2565f25cf3f879570c9af1bb5ba6723de653a2d34cf738a8f863e68014538bd21e4
SHA512e39fc71b6e7b4fca433a399a6f31d405b3353363d9366376ca099ad2cb7a130847762a82478452072bcc55bd2ee31f92f5d61a913ef8e1e718186c8d50ab74a6
-
Filesize
442KB
MD585430baed3398695717b0263807cf97c
SHA1fffbee923cea216f50fce5d54219a188a5100f41
SHA256a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
SHA51206511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1
-
Filesize
8.0MB
MD5a01c5ecd6108350ae23d2cddf0e77c17
SHA1c6ac28a2cd979f1f9a75d56271821d5ff665e2b6
SHA256345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42
SHA512b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x07tfuqf.default-release\datareporting\glean\db\data.safe.bin
Filesize2KB
MD5f3a25678081eb8670da6d02516d98700
SHA1c47a815c56b186fd0b0069b7aa576a80d39e5c47
SHA2560d83ec113dfa7cb8db24f454f6bb59f7da6445269f896612d1d3e6aba5050e30
SHA51285a573b1f18749b6d5547002fe7c65aefc4916a9ea3f5c05bc787267c75536cb9499c5e2f6a2bfc916cabe9255088a9bed9b49345a7b5185d8e5d709fe4cf641
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x07tfuqf.default-release\datareporting\glean\pending_pings\4d32d224-3c21-4e67-aeba-9885c77ae21f
Filesize12KB
MD5f99b377e1044bf3c20bc5a7a11fb1345
SHA10954c043e7a38538d31ca7d9a5e06e9a2873f4b8
SHA256c582f1e5d42911973470d8b6b0e7cc818850258451253a861f5473465ac12f99
SHA5120944cbd217266278a8c179e550ecde058af1af5aac6fe26519ed0560c21396980f363cb2c01fa8b1fc993faedd5f36c9056a9a90e6a669b6205ba3a4e82d957f
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x07tfuqf.default-release\datareporting\glean\pending_pings\d8cf684d-94b1-48cf-bd38-7e79a7d34830
Filesize745B
MD5393ebce4ef75c5c4c90fba97254b731b
SHA1a12a261830cf960a39431cc09271d86df3b49dbb
SHA256d53b8f18bc6f1537d9ea504cc7497b047dcabda3d965a17300af1b1d027c3353
SHA5120fcb231ee8c20aebe51ece17c3ba20d08cfaf7be1c7bc48b2e81ab310149831d131ae31994ede37d3a5bf2dd110b0b727672127a851bedaa389537d9e08d50d8
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x07tfuqf.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
Filesize997KB
MD5fe3355639648c417e8307c6d051e3e37
SHA1f54602d4b4778da21bc97c7238fc66aa68c8ee34
SHA2561ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
SHA5128f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x07tfuqf.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
Filesize116B
MD53d33cdc0b3d281e67dd52e14435dd04f
SHA14db88689282fd4f9e9e6ab95fcbb23df6e6485db
SHA256f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
SHA512a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x07tfuqf.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
Filesize479B
MD549ddb419d96dceb9069018535fb2e2fc
SHA162aa6fea895a8b68d468a015f6e6ab400d7a7ca6
SHA2562af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
SHA51248386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x07tfuqf.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
Filesize372B
MD58be33af717bb1b67fbd61c3f4b807e9e
SHA17cf17656d174d951957ff36810e874a134dd49e0
SHA256e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
SHA5126125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x07tfuqf.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
Filesize11.8MB
MD533bf7b0439480effb9fb212efce87b13
SHA1cee50f2745edc6dc291887b6075ca64d716f495a
SHA2568ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e
SHA512d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x07tfuqf.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
Filesize1KB
MD5688bed3676d2104e7f17ae1cd2c59404
SHA1952b2cdf783ac72fcb98338723e9afd38d47ad8e
SHA25633899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
SHA5127a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x07tfuqf.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
Filesize1KB
MD5937326fead5fd401f6cca9118bd9ade9
SHA14526a57d4ae14ed29b37632c72aef3c408189d91
SHA25668a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
SHA512b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2
-
Filesize
7KB
MD572281e4cc2a018c31e60da9bc477a610
SHA137a808641d937215ea9a59444a502aa175ccb1ae
SHA256d3a54f6f426e32b7eb567fdbddcc725dd7403c9a5aa2228ffb3217e42c72ffc1
SHA512a08616e9f34bb5431f890e5be447a6eca631dbc59ec3d0418030ae7dfe14d97d66a05ad919596481949e1b36dbbf4dee6de59c9439a956db0773aac95c05739f
-
Filesize
7KB
MD5ec5620c4525fcb68136fd786eaed1f7a
SHA180de1440044032016f2ca2d1403b1b1ec0d064f6
SHA25621955b5db8793e966c2e796f50061ba792f471f792e5fef23ba213559d75cfd6
SHA5128f472001f7636406849321f3fd32468d9c5a80bb99567df232bc4fcdfc8e6bbce5a39910bebc57137d6cb23a47876b42a48e5586fd8d321a24bc4dbdbe852212
-
Filesize
6KB
MD5ae87a6f88546210972e637a7efcea2fc
SHA1af4b772f2456bad753543a472f0f04e8c6ba9f37
SHA256ba7c8880ddf813122302ffabad6ffd7483ea42458875be2b8e7f4151925bff2b
SHA51266374c84d4d0c30001ae8a7359985dae0cadd38cdfd2a808d29fb1ae9616bcec7b05ad390a7398945c41cac6002dee15c71a649b243b26d20f5a4da5d2c3b098
-
Filesize
6KB
MD5d22a07947387ed17479acd213a08d7c5
SHA119b53728b26e1b3fc66853bdb9e557130c974c16
SHA2568a0abe1175197c65a19b4940bf0fb63c51d25fffe80a5f172bfdf582a364d274
SHA51265d4a892fab07b19651d77fcb3acbdf7256657277272a807819f52b1a908178bc224f33ce3d61170b917952f68a0e79ff787cbc47c41192efead9b13a0b2e076
-
Filesize
6KB
MD54479bc561c415e5de3af361fa19973d4
SHA149bac6b03d4ab4bc2bd6354a229e7237008aab64
SHA256300ac04b830db8d2b144c401f98c63e0a103aadd76afc736fb12571da5e5126e
SHA5129b29f2b9fac1aec815194aaa3265dbb530c0d2a1a76806b9e821ea30999e11b9ddb1a90e0962212ab603b859b4b0de8b81f43c81a08c550f8a5fd16851c17a1a
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x07tfuqf.default-release\sessionstore-backups\recovery.jsonlz4
Filesize4KB
MD5b2334288d91e3356e792695f240d21dd
SHA1bbfac75b1dedca18b0b7a011c00736abc21ddd4e
SHA256166984ed78206465fac1cf1a55b46348047cb66cb9ffea816d51651ca5c7df32
SHA51257919128a4a416367a1c66efa6e548c3dc3f613b5298fb471c8395a161129a290350436e9562c280ea8bc9ce52669de8555cda8ae8eb8788d54452b178d46305
-
Filesize
593KB
MD5c8fd9be83bc728cc04beffafc2907fe9
SHA195ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
-
Filesize
2.0MB
MD51cc453cdf74f31e4d913ff9c10acdde2
SHA16e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571