f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018

Analysis

max time kernel
149s
max time network
158s
platform
windows11-21h2_x64
resource
win11-20240709-en
resource tags

arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
submitted
22/07/2024, 13:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe
Size

1.2MB
MD5

7eb7229fd89c5b50e720b8606495e79d
SHA1

44e352c1fbc8751527aeaa7a8974d3991eb1890d
SHA256

f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018
SHA512

fd246dde7eee0284c2b918612aa26e4d9b892b413956ef65c5e5561bea7049ac809fccf2df25da5a14ca94b4bcfe8e6ec5215202f8411385b0af8dad5985a2cf
SSDEEP

24576:xqDEvCTbMWu7rQYlBQcBiT6rprG8aLA2Sbly7TWEPje:xTvC/MTQYxsWR7aLA2dW

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-514081398-208714212-3319599467-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4060	firefox.exe
Token: SeDebugPrivilege	4060	firefox.exe
Token: SeDebugPrivilege	4060	firefox.exe
Token: SeDebugPrivilege	4060	firefox.exe
Token: SeDebugPrivilege	4060	firefox.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1248	f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe
1248	f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe
1248	f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe
1248	f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe
1248	f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe
1248	f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe
1248	f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe
4060	firefox.exe
4060	firefox.exe
4060	firefox.exe
4060	firefox.exe
4060	firefox.exe
4060	firefox.exe
4060	firefox.exe
4060	firefox.exe
4060	firefox.exe
4060	firefox.exe
4060	firefox.exe
4060	firefox.exe
4060	firefox.exe
4060	firefox.exe
4060	firefox.exe
4060	firefox.exe
4060	firefox.exe
4060	firefox.exe
4060	firefox.exe
4060	firefox.exe
4060	firefox.exe
1248	f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe
1248	f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe
1248	f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe
1248	f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe
1248	f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe
1248	f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe
1248	f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe
1248	f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe
1248	f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe
1248	f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe
1248	f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe
1248	f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe
1248	f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe
1248	f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe
1248	f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe
1248	f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe
1248	f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe
1248	f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe
1248	f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe
1248	f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe
1248	f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe
1248	f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe
1248	f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe
1248	f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe
1248	f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe
1248	f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe
1248	f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe
1248	f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe
1248	f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe
1248	f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe
1248	f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe
1248	f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe
1248	f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe
1248	f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe
1248	f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe
1248	f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1248	f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe
1248	f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe
1248	f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe
1248	f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe
1248	f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe
1248	f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe
1248	f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe
1248	f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe
1248	f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe
1248	f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe
1248	f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe
1248	f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe
1248	f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe
1248	f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe
1248	f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe
1248	f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe
1248	f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe
1248	f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe
1248	f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe
1248	f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe
1248	f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe
1248	f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe
1248	f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe
1248	f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe
1248	f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe
1248	f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe
1248	f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe
1248	f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe
1248	f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe
1248	f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe
1248	f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe
1248	f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe
1248	f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe
1248	f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe
1248	f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe
1248	f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe
1248	f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe
1248	f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe
1248	f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe
1248	f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe
1248	f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe
1248	f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe
1248	f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe
1248	f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe
1248	f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe
1248	f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe
1248	f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe
1248	f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe
1248	f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe
1248	f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe
1248	f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe
1248	f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe
1248	f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe
1248	f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe
1248	f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe
1248	f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe
1248	f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe
1248	f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe
1248	f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe
1248	f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe
1248	f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe
1248	f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe
1248	f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe
1248	f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4060	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1248 wrote to memory of 2008	1248	f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe	83
PID 1248 wrote to memory of 2008	1248	f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe	83
PID 2008 wrote to memory of 4060	2008	firefox.exe	86
PID 2008 wrote to memory of 4060	2008	firefox.exe	86
PID 2008 wrote to memory of 4060	2008	firefox.exe	86
PID 2008 wrote to memory of 4060	2008	firefox.exe	86
PID 2008 wrote to memory of 4060	2008	firefox.exe	86
PID 2008 wrote to memory of 4060	2008	firefox.exe	86
PID 2008 wrote to memory of 4060	2008	firefox.exe	86
PID 2008 wrote to memory of 4060	2008	firefox.exe	86
PID 2008 wrote to memory of 4060	2008	firefox.exe	86
PID 2008 wrote to memory of 4060	2008	firefox.exe	86
PID 2008 wrote to memory of 4060	2008	firefox.exe	86
PID 4060 wrote to memory of 5708	4060	firefox.exe	87
PID 4060 wrote to memory of 5708	4060	firefox.exe	87
PID 4060 wrote to memory of 5708	4060	firefox.exe	87
PID 4060 wrote to memory of 5708	4060	firefox.exe	87
PID 4060 wrote to memory of 5708	4060	firefox.exe	87
PID 4060 wrote to memory of 5708	4060	firefox.exe	87
PID 4060 wrote to memory of 5708	4060	firefox.exe	87
PID 4060 wrote to memory of 5708	4060	firefox.exe	87
PID 4060 wrote to memory of 5708	4060	firefox.exe	87
PID 4060 wrote to memory of 5708	4060	firefox.exe	87
PID 4060 wrote to memory of 5708	4060	firefox.exe	87
PID 4060 wrote to memory of 5708	4060	firefox.exe	87
PID 4060 wrote to memory of 5708	4060	firefox.exe	87
PID 4060 wrote to memory of 5708	4060	firefox.exe	87
PID 4060 wrote to memory of 5708	4060	firefox.exe	87
PID 4060 wrote to memory of 5708	4060	firefox.exe	87
PID 4060 wrote to memory of 5708	4060	firefox.exe	87
PID 4060 wrote to memory of 5708	4060	firefox.exe	87
PID 4060 wrote to memory of 5708	4060	firefox.exe	87
PID 4060 wrote to memory of 5708	4060	firefox.exe	87
PID 4060 wrote to memory of 5708	4060	firefox.exe	87
PID 4060 wrote to memory of 5708	4060	firefox.exe	87
PID 4060 wrote to memory of 5708	4060	firefox.exe	87
PID 4060 wrote to memory of 5708	4060	firefox.exe	87
PID 4060 wrote to memory of 5708	4060	firefox.exe	87
PID 4060 wrote to memory of 5708	4060	firefox.exe	87
PID 4060 wrote to memory of 5708	4060	firefox.exe	87
PID 4060 wrote to memory of 5708	4060	firefox.exe	87
PID 4060 wrote to memory of 5708	4060	firefox.exe	87
PID 4060 wrote to memory of 5708	4060	firefox.exe	87
PID 4060 wrote to memory of 5708	4060	firefox.exe	87
PID 4060 wrote to memory of 5708	4060	firefox.exe	87
PID 4060 wrote to memory of 5708	4060	firefox.exe	87
PID 4060 wrote to memory of 5708	4060	firefox.exe	87
PID 4060 wrote to memory of 5708	4060	firefox.exe	87
PID 4060 wrote to memory of 5708	4060	firefox.exe	87
PID 4060 wrote to memory of 5708	4060	firefox.exe	87
PID 4060 wrote to memory of 5708	4060	firefox.exe	87
PID 4060 wrote to memory of 5708	4060	firefox.exe	87
PID 4060 wrote to memory of 5708	4060	firefox.exe	87
PID 4060 wrote to memory of 5708	4060	firefox.exe	87
PID 4060 wrote to memory of 5708	4060	firefox.exe	87
PID 4060 wrote to memory of 5708	4060	firefox.exe	87
PID 4060 wrote to memory of 5708	4060	firefox.exe	87
PID 4060 wrote to memory of 5708	4060	firefox.exe	87
PID 4060 wrote to memory of 1588	4060	firefox.exe	88
PID 4060 wrote to memory of 1588	4060	firefox.exe	88
PID 4060 wrote to memory of 1588	4060	firefox.exe	88
PID 4060 wrote to memory of 1588	4060	firefox.exe	88
PID 4060 wrote to memory of 1588	4060	firefox.exe	88
PID 4060 wrote to memory of 1588	4060	firefox.exe	88

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe
"C:\Users\Admin\AppData\Local\Temp\f19e7cd4c2be82f3f076fc290b19c271c9c9922073ab06a1890a4c5b7ee5e018.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1248
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2008
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4060
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1996 -parentBuildID 20240401114208 -prefsHandle 1924 -prefMapHandle 1916 -prefsLen 25751 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9158feee-04eb-464d-ad9c-c7c788c62ca7} 4060 "\\.\pipe\gecko-crash-server-pipe.4060" gpu
      4⤵
      PID:5708
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2416 -parentBuildID 20240401114208 -prefsHandle 2408 -prefMapHandle 2396 -prefsLen 26671 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f0bafcf1-640a-44bd-a790-82478ce84e01} 4060 "\\.\pipe\gecko-crash-server-pipe.4060" socket
      4⤵
      PID:1588
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3152 -childID 1 -isForBrowser -prefsHandle 1472 -prefMapHandle 1348 -prefsLen 22698 -prefMapSize 244658 -jsInitHandle 1324 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {18eedb4b-d738-462c-b4bc-fa42b069f764} 4060 "\\.\pipe\gecko-crash-server-pipe.4060" tab
      4⤵
      PID:916
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3448 -childID 2 -isForBrowser -prefsHandle 3608 -prefMapHandle 3432 -prefsLen 31161 -prefMapSize 244658 -jsInitHandle 1324 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {40e320f6-e8df-468d-a47d-539ccea26f96} 4060 "\\.\pipe\gecko-crash-server-pipe.4060" tab
      4⤵
      PID:2544
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4756 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4660 -prefMapHandle 4732 -prefsLen 31161 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {be80d7e5-fa4e-47e9-8fc3-bfffa98b37f4} 4060 "\\.\pipe\gecko-crash-server-pipe.4060" utility
      4⤵
      Checks processor information in registry
      PID:3364
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5596 -childID 3 -isForBrowser -prefsHandle 5588 -prefMapHandle 5572 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1324 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5de9b311-ebca-45a9-b5cc-18114edae791} 4060 "\\.\pipe\gecko-crash-server-pipe.4060" tab
      4⤵
      PID:4372
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5612 -childID 4 -isForBrowser -prefsHandle 5716 -prefMapHandle 5720 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1324 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6ecf37c3-279d-4cd5-a831-f003be99537f} 4060 "\\.\pipe\gecko-crash-server-pipe.4060" tab
      4⤵
      PID:5008
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6020 -childID 5 -isForBrowser -prefsHandle 5940 -prefMapHandle 5944 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1324 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {66afd79e-a7cf-406c-8a08-ba582ce59f42} 4060 "\\.\pipe\gecko-crash-server-pipe.4060" tab
      4⤵
      PID:2452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ywkpx7r6.default-release\activity-stream.discovery_stream.json.tmp

Filesize
18KB

MD5
34701392187a9c8b8a503f38baaa1c9a

SHA1
0aeef98e4fe8f8923a725594423b6bdeb4345509

SHA256
476025d62666795f76b4713e6f28383ac82ba244d5df005001ff37d5681a55f5

SHA512
b2030fe8bde40af94603facd73729ab283cd19c5a25cb2dd6f2a6e26b2af16f020194cfafb2311a9d9e08237ee684f4f3edca6ce47f7f0615a0c1f4d9c572878

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ywkpx7r6.default-release\cache2\entries\8A2034D325DC0B5C9E11EDDA3FC70A54C8DC1C0D

Filesize
13KB

MD5
e039c3f965105001921e92a9d5f0e3d5

SHA1
189d7bf65e667eea793d0c40dde1207f6cbbcb05

SHA256
5fc9562b9236df3039a5397f0a80dd38170f12005043725d0c1242cbeece7c35

SHA512
c514acea4d446bf8684506afe4e163d7dec561fd2ee54851381f42dd3b1c578cc0ab351a7b995bd81056d652b7f893a2e7d9a50197abf117bd33de04c51e5886

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ywkpx7r6.default-release\AlternateServices.bin

Filesize
8KB

MD5
2a4ccfd43a69459eedd51b528e47a870

SHA1
e66f8eb6e62f1495c09bf92073a8556c9c4f7d53

SHA256
b72b51f419a8d7f164225d9612135feec806d960cbe8c85fbb858c95e2a1887f

SHA512
6d5d2d5331d70fbfe391a02903627ee497a470f51caed400175d340b21bc222d2788fb398a3076741fd2f124ed7e07322494df2df2026ef2d495abd87478bd34

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ywkpx7r6.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
1e0e4503a7911451b78d7d63bf738b75

SHA1
b3cc1928f49d27c76772e7d671f47f967dac2660

SHA256
2378a09f6d4f97f3a5e16a359bea7e9b238942632f9d42b1020a647995ca9c22

SHA512
374ca8ef546e0e1e53aa466fe55a3738df1b75d7beaa5eb22071aaf41537312f57bb1a568740b949453566ba0c0135e431731f1dde9bfe1cb681805aa60a97b8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ywkpx7r6.default-release\datareporting\glean\db\data.safe.tmp

Filesize
16KB

MD5
c6ea7afd8f0f53080308073e552b206d

SHA1
d2b6a808fb307823e71af73e5e1192911238a5fa

SHA256
ba5e83d0a2096d2ff71ca18033096bf3434c599b952785126e80b2c72a1f9365

SHA512
a7a0fc00c3d204df692c6b83bdc3c05d12a3080fbb4e610102eb94af36ded05031c914581f4df7a9c46dd01a50e317216e64c73470d2929c3860310847e38b7e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ywkpx7r6.default-release\datareporting\glean\pending_pings\541ff19c-ac6b-4f2a-a943-0f220d247bae

Filesize
26KB

MD5
2f310fa042cad84662d99ed4b9bdf73a

SHA1
e9cb576bf1baf34a7ee90df2192f2e1bb786d67d

SHA256
556b137921013a738fb385c6815e4ab2afb32c56d9efd9c8517f27febeb55fec

SHA512
ebb1b4383c36d8832f8ed0f9053773f2ff54c2287462e8a250a94c35d284b17315850428ee6e03d59e23d7a37044d7c2076538df860639d357e50fdcd1338c26

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ywkpx7r6.default-release\datareporting\glean\pending_pings\ce59c6e5-4b7d-419d-8f8e-242af644a627

Filesize
671B

MD5
3ba7500358a7e5c93dfbf06d2b9c4f72

SHA1
9b62472f0d1b4023505dd1542b91ba32c4e54cf9

SHA256
601f287eab0014d0edba0d33fa989861ad30757cf1d4e10b3e7d5dfdf1a91992

SHA512
006714023447c8a20e173b50bc1c882c96220abaeb61e5546f25d9145e02657805c10c2802a1b21486d83d92791299958b01b216d962dcba7b95ce07d14e0d57

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ywkpx7r6.default-release\datareporting\glean\pending_pings\e5549f9c-18c7-42b3-8a76-c3d67c241a33

Filesize
982B

MD5
7fad04266a38fd02b92e5c0314ad3986

SHA1
3e1b90558ad4e90cd640aba05ba3064ae134cddd

SHA256
3a8c5b1f37b9a1a4edecedf56e4ad61e602377b62053d7dc0ab16b64f43eb5f3

SHA512
2cc5ec23dd703efa13b4ae4c93d31612c93cd54e8fba7feaedcb87bd5ac43615ead375b75f9fc7d21216da7ebbf0f905553c467c7c956422481cf0b75c00feb3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ywkpx7r6.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ywkpx7r6.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ywkpx7r6.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ywkpx7r6.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ywkpx7r6.default-release\prefs-1.js

Filesize
13KB

MD5
2794a409a5365679ee1b7c868dcbf463

SHA1
987c56dc3cc999d3b4f8a302485ab3438badd84b

SHA256
6b2d33de00f5958cc0f742109abd0fc5127b79b9331244ca44c9508d5c16ce24

SHA512
61c5c3158087bbe8ba1b3e30543e8afd8dff9dfe1ae6e12fb7990b4600eaab291deb51c2ad31ade0fd59d1fec85cb5c286da4b4d770d190981b005db35434097

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ywkpx7r6.default-release\prefs-1.js

Filesize
11KB

MD5
229049e3af9a7a6413b3f6ccc129dcaf

SHA1
9a9384b149a3225dec467cea57075c9d20eaba7e

SHA256
e6073956759d777d0b2c7864e33aa02771acf72dd5a2917f3a89ca73ac7e8849

SHA512
611c198ff37023365c95f9d4ef73f77e9e76073c754e8d56f6f0241139556d6a4067304c4cf84c25c87c138ef0b082ac597cd28b52f98b7060adbc35f732671c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ywkpx7r6.default-release\prefs.js

Filesize
8KB

MD5
325b22095060972399387e9438c0bb2f

SHA1
4959a7d409957f1c4cd1728da2517ba0afa94e1c

SHA256
dd99b9b3f0baf2d366f80b4fcb56ec0f55bdf6352d5ccf9abfe9ffe96beceff3

SHA512
65756c7a452f3ac05c2acdeb7cffb007191a04e98980b4abb70c0a41ff5515e4b01fcbda147463034b23b0ac47a8f8b8319f7b6570647ffa8196ccc03097e920

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ywkpx7r6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
944KB

MD5
b2c35b8657331fc0a69c9590785c4732

SHA1
1af8631149652ffb769fcafe3a6d81ef4ea60e4b

SHA256
25578995c3505da767961c5e703db1b9bcaf9e628367c88e43942183b6b041b2

SHA512
795f295742c491120978fe12ea7e4de9ce63405aac753554d6564de44ac4f1343e0fd34c60994f202bed8214d52a7fea4e8823150216228017ee3de58eda980c

Download Submit