Overview
overview
9Static
static
3FantasyLauncher.rar
windows10-1703-x64
3FantasyLauncher.exe
windows10-1703-x64
9$PLUGINSDI...er.dll
windows10-1703-x64
3$PLUGINSDI...ls.dll
windows10-1703-x64
3$PLUGINSDI...em.dll
windows10-1703-x64
3$PLUGINSDI...ll.dll
windows10-1703-x64
3$PLUGINSDIR/app-64.7z
windows10-1703-x64
3LICENSE.electron.txt
windows10-1703-x64
1LICENSES.c...m.html
windows10-1703-x64
4MysticLauncher.exe
windows10-1703-x64
9chrome_100...nt.pak
windows10-1703-x64
3chrome_200...nt.pak
windows10-1703-x64
3d3dcompiler_47.dll
windows10-1703-x64
1ffmpeg.dll
windows10-1703-x64
1icudtl.dat
windows10-1703-x64
3libEGL.dll
windows10-1703-x64
1libGLESv2.dll
windows10-1703-x64
1resources/elevate.exe
windows10-1703-x64
3v8_context...ot.bin
windows10-1703-x64
3vk_swiftshader.dll
windows10-1703-x64
1vk_swiftsh...d.json
windows10-1703-x64
3vulkan-1.dll
windows10-1703-x64
1$PLUGINSDI...ec.dll
windows10-1703-x64
3$PLUGINSDI...7z.dll
windows10-1703-x64
3$R0/Uninst...er.exe
windows10-1703-x64
7Analysis
- max time kernel
145s - max time network
151s - platform
windows10-1703_x64 - resource
win10-20240404-en - resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system - submitted
10/08/2024, 15:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
FantasyLauncher.rar
Resource
win10-20240404-en
windows10-1703-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
FantasyLauncher.exe
Resource
win10-20240404-en
windows10-1703-x64
16 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/SpiderBanner.dll
Resource
win10-20240404-en
windows10-1703-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10-20240611-en
windows10-1703-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win10-20240404-en
windows10-1703-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/WinShell.dll
Resource
win10-20240404-en
windows10-1703-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
$PLUGINSDIR/app-64.7z
Resource
win10-20240404-en
windows10-1703-x64
3 signatures
150 seconds
Behavioral task
behavioral8
Sample
LICENSE.electron.txt
Resource
win10-20240404-en
windows10-1703-x64
1 signatures
150 seconds
Behavioral task
behavioral9
Sample
LICENSES.chromium.html
Resource
win10-20240404-en
windows10-1703-x64
7 signatures
150 seconds
Behavioral task
behavioral10
Sample
MysticLauncher.exe
Resource
win10-20240404-en
windows10-1703-x64
13 signatures
150 seconds
Behavioral task
behavioral11
Sample
chrome_100_percent.pak
Resource
win10-20240611-en
windows10-1703-x64
3 signatures
150 seconds
Behavioral task
behavioral12
Sample
chrome_200_percent.pak
Resource
win10-20240404-en
windows10-1703-x64
3 signatures
150 seconds
Behavioral task
behavioral13
Sample
d3dcompiler_47.dll
Resource
win10-20240404-en
windows10-1703-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
ffmpeg.dll
Resource
win10-20240404-en
windows10-1703-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
icudtl.dat
Resource
win10-20240404-en
windows10-1703-x64
3 signatures
150 seconds
Behavioral task
behavioral16
Sample
libEGL.dll
Resource
win10-20240404-en
windows10-1703-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
libGLESv2.dll
Resource
win10-20240404-en
windows10-1703-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
resources/elevate.exe
Resource
win10-20240404-en
windows10-1703-x64
1 signatures
150 seconds
Behavioral task
behavioral19
Sample
v8_context_snapshot.bin
Resource
win10-20240404-en
windows10-1703-x64
3 signatures
150 seconds
Behavioral task
behavioral20
Sample
vk_swiftshader.dll
Resource
win10-20240404-en
windows10-1703-x64
0 signatures
150 seconds
Behavioral task
behavioral21
Sample
vk_swiftshader_icd.json
Resource
win10-20240404-en
windows10-1703-x64
3 signatures
150 seconds
Behavioral task
behavioral22
Sample
vulkan-1.dll
Resource
win10-20240404-en
windows10-1703-x64
0 signatures
150 seconds
Behavioral task
behavioral23
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10-20240611-en
windows10-1703-x64
3 signatures
150 seconds
Behavioral task
behavioral24
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win10-20240404-en
windows10-1703-x64
3 signatures
150 seconds
Behavioral task
behavioral25
Sample
$R0/Uninstall MysticLauncher.exe
Resource
win10-20240404-en
windows10-1703-x64
9 signatures
150 seconds
General
- Target FantasyLauncher.rar
- Size 90.9MB
- Sample240810-sdtr7svapp
- SHA256 5f4b9ae4506d950030be7c04bbc0cc038b63b862401c34d5130ddaddd66976bf
- MD5 90ba79188cb3fe7b4f4338ccf6596c0e
- SHA1 1cd51e8bfc704829f2b449e4d554ff643d8da0fe
- SHA512 9751ac5f66e2e97ad54d836a9d3059b368cb21afcb311747bdecf29a0f2ece3122e0145d92959d751281c143f6e14ed1345a16715e619bc62d87a4568679f2b4
- SSDEEP 1572864:iqjBlGEbZRn1qOwNtTp+FsFcaLHY4CnT5ba/I0/Pvvauq292xwDO5zyUjij:iKOEDn0Tp+FO8k/I0XvvauqE2xLyUjs
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe - Modifies registry class 28 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" firefox.exe Set value (str) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic" firefox.exe Set value (data) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 firefox.exe Key created \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU firefox.exe Key created \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 firefox.exe Key created \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell firefox.exe Key created \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags firefox.exe Set value (int) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" firefox.exe Set value (data) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 firefox.exe Key created \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings firefox.exe Key created \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg firefox.exe Set value (int) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" firefox.exe Key created \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell firefox.exe Set value (data) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff firefox.exe Key created \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2 firefox.exe Set value (int) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1" firefox.exe Key created \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 firefox.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance firefox.exe Key created \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} firefox.exe Set value (int) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" firefox.exe Key created \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202 firefox.exe Key created \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance firefox.exe Set value (int) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257" firefox.exe Set value (int) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" firefox.exe Set value (int) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" firefox.exe Set value (str) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" firefox.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 700 OpenWith.exe - Suspicious use of AdjustPrivilegeToken 19 IoCs
description pid Process Token: SeDebugPrivilege 1916 firefox.exe Token: SeDebugPrivilege 1916 firefox.exe Token: SeDebugPrivilege 1916 firefox.exe Token: SeDebugPrivilege 1916 firefox.exe Token: SeDebugPrivilege 1916 firefox.exe Token: SeDebugPrivilege 1916 firefox.exe Token: SeDebugPrivilege 1916 firefox.exe Token: SeDebugPrivilege 1916 firefox.exe Token: SeDebugPrivilege 1916 firefox.exe Token: SeDebugPrivilege 1916 firefox.exe Token: SeDebugPrivilege 1916 firefox.exe Token: SeDebugPrivilege 1916 firefox.exe Token: SeDebugPrivilege 1916 firefox.exe Token: SeDebugPrivilege 1916 firefox.exe Token: SeDebugPrivilege 1916 firefox.exe Token: SeDebugPrivilege 1916 firefox.exe Token: SeDebugPrivilege 1916 firefox.exe Token: 33 5172 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 5172 AUDIODG.EXE - Suspicious use of FindShellTrayWindow 7 IoCs
pid Process 1916 firefox.exe 1916 firefox.exe 1916 firefox.exe 1916 firefox.exe 1916 firefox.exe 1916 firefox.exe 1916 firefox.exe - Suspicious use of SendNotifyMessage 5 IoCs
pid Process 1916 firefox.exe 1916 firefox.exe 1916 firefox.exe 1916 firefox.exe 1916 firefox.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 700 OpenWith.exe 700 OpenWith.exe 700 OpenWith.exe 700 OpenWith.exe 700 OpenWith.exe 700 OpenWith.exe 700 OpenWith.exe 700 OpenWith.exe 700 OpenWith.exe 700 OpenWith.exe 700 OpenWith.exe 700 OpenWith.exe 700 OpenWith.exe 700 OpenWith.exe 700 OpenWith.exe 700 OpenWith.exe 700 OpenWith.exe 700 OpenWith.exe 700 OpenWith.exe 700 OpenWith.exe 700 OpenWith.exe 700 OpenWith.exe 700 OpenWith.exe 700 OpenWith.exe 700 OpenWith.exe 700 OpenWith.exe 700 OpenWith.exe 700 OpenWith.exe 700 OpenWith.exe 700 OpenWith.exe 700 OpenWith.exe 700 OpenWith.exe 700 OpenWith.exe 700 OpenWith.exe 700 OpenWith.exe 700 OpenWith.exe 700 OpenWith.exe 700 OpenWith.exe 700 OpenWith.exe 700 OpenWith.exe 700 OpenWith.exe 700 OpenWith.exe 700 OpenWith.exe 700 OpenWith.exe 700 OpenWith.exe 700 OpenWith.exe 700 OpenWith.exe 700 OpenWith.exe 700 OpenWith.exe 700 OpenWith.exe 700 OpenWith.exe 700 OpenWith.exe 700 OpenWith.exe 700 OpenWith.exe 700 OpenWith.exe 700 OpenWith.exe 700 OpenWith.exe 700 OpenWith.exe 700 OpenWith.exe 700 OpenWith.exe 700 OpenWith.exe 700 OpenWith.exe 700 OpenWith.exe 700 OpenWith.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2436 wrote to memory of 1916 2436 firefox.exe 79 PID 2436 wrote to memory of 1916 2436 firefox.exe 79 PID 2436 wrote to memory of 1916 2436 firefox.exe 79 PID 2436 wrote to memory of 1916 2436 firefox.exe 79 PID 2436 wrote to memory of 1916 2436 firefox.exe 79 PID 2436 wrote to memory of 1916 2436 firefox.exe 79 PID 2436 wrote to memory of 1916 2436 firefox.exe 79 PID 2436 wrote to memory of 1916 2436 firefox.exe 79 PID 2436 wrote to memory of 1916 2436 firefox.exe 79 PID 2436 wrote to memory of 1916 2436 firefox.exe 79 PID 2436 wrote to memory of 1916 2436 firefox.exe 79 PID 1916 wrote to memory of 5076 1916 firefox.exe 80 PID 1916 wrote to memory of 5076 1916 firefox.exe 80 PID 1916 wrote to memory of 4408 1916 firefox.exe 81 PID 1916 wrote to memory of 4408 1916 firefox.exe 81 PID 1916 wrote to memory of 4408 1916 firefox.exe 81 PID 1916 wrote to memory of 4408 1916 firefox.exe 81 PID 1916 wrote to memory of 4408 1916 firefox.exe 81 PID 1916 wrote to memory of 4408 1916 firefox.exe 81 PID 1916 wrote to memory of 4408 1916 firefox.exe 81 PID 1916 wrote to memory of 4408 1916 firefox.exe 81 PID 1916 wrote to memory of 4408 1916 firefox.exe 81 PID 1916 wrote to memory of 4408 1916 firefox.exe 81 PID 1916 wrote to memory of 4408 1916 firefox.exe 81 PID 1916 wrote to memory of 4408 1916 firefox.exe 81 PID 1916 wrote to memory of 4408 1916 firefox.exe 81 PID 1916 wrote to memory of 4408 1916 firefox.exe 81 PID 1916 wrote to memory of 4408 1916 firefox.exe 81 PID 1916 wrote to memory of 4408 1916 firefox.exe 81 PID 1916 wrote to memory of 4408 1916 firefox.exe 81 PID 1916 wrote to memory of 4408 1916 firefox.exe 81 PID 1916 wrote to memory of 4408 1916 firefox.exe 81 PID 1916 wrote to memory of 4408 1916 firefox.exe 81 PID 1916 wrote to memory of 4408 1916 firefox.exe 81 PID 1916 wrote to memory of 4408 1916 firefox.exe 81 PID 1916 wrote to memory of 4408 1916 firefox.exe 81 PID 1916 wrote to memory of 4408 1916 firefox.exe 81 PID 1916 wrote to memory of 4408 1916 firefox.exe 81 PID 1916 wrote to memory of 4408 1916 firefox.exe 81 PID 1916 wrote to memory of 4408 1916 firefox.exe 81 PID 1916 wrote to memory of 4408 1916 firefox.exe 81 PID 1916 wrote to memory of 4408 1916 firefox.exe 81 PID 1916 wrote to memory of 4408 1916 firefox.exe 81 PID 1916 wrote to memory of 4408 1916 firefox.exe 81 PID 1916 wrote to memory of 4408 1916 firefox.exe 81 PID 1916 wrote to memory of 4408 1916 firefox.exe 81 PID 1916 wrote to memory of 4408 1916 firefox.exe 81 PID 1916 wrote to memory of 4408 1916 firefox.exe 81 PID 1916 wrote to memory of 4408 1916 firefox.exe 81 PID 1916 wrote to memory of 4408 1916 firefox.exe 81 PID 1916 wrote to memory of 4408 1916 firefox.exe 81 PID 1916 wrote to memory of 4408 1916 firefox.exe 81 PID 1916 wrote to memory of 4408 1916 firefox.exe 81 PID 1916 wrote to memory of 4408 1916 firefox.exe 81 PID 1916 wrote to memory of 4408 1916 firefox.exe 81 PID 1916 wrote to memory of 4408 1916 firefox.exe 81 PID 1916 wrote to memory of 4408 1916 firefox.exe 81 PID 1916 wrote to memory of 4408 1916 firefox.exe 81 PID 1916 wrote to memory of 4408 1916 firefox.exe 81 PID 1916 wrote to memory of 4408 1916 firefox.exe 81 PID 1916 wrote to memory of 4408 1916 firefox.exe 81 PID 1916 wrote to memory of 3356 1916 firefox.exe 82 PID 1916 wrote to memory of 3356 1916 firefox.exe 82 PID 1916 wrote to memory of 3356 1916 firefox.exe 82 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\FantasyLauncher.rar1⤵
- Modifies registry class
PID:5084
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:700
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1324
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1916.0.1638710019\795858977" -parentBuildID 20221007134813 -prefsHandle 1684 -prefMapHandle 1676 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e303ea1e-3d5e-4407-a407-60fbd6f73185} 1916 "\\.\pipe\gecko-crash-server-pipe.1916" 1764 1ede1bd8858 gpu3⤵PID:5076
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1916.1.781296870\671918940" -parentBuildID 20221007134813 -prefsHandle 2108 -prefMapHandle 2104 -prefsLen 20828 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9aad77d7-3f97-404d-bd93-03966a0fc9a0} 1916 "\\.\pipe\gecko-crash-server-pipe.1916" 2120 1edcf772858 socket3⤵PID:4408
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1916.2.635924279\1238292370" -childID 1 -isForBrowser -prefsHandle 2716 -prefMapHandle 2756 -prefsLen 20866 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {74a0a3e4-9902-4e5f-bda5-d1298e4b667c} 1916 "\\.\pipe\gecko-crash-server-pipe.1916" 2532 1ede5d9c658 tab3⤵PID:3356
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1916.3.1337727859\974799301" -childID 2 -isForBrowser -prefsHandle 3484 -prefMapHandle 3480 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3a8e03aa-8d6e-4a67-92a4-306b755150a5} 1916 "\\.\pipe\gecko-crash-server-pipe.1916" 3496 1edcf762858 tab3⤵PID:2772
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1916.4.1567080095\1867618783" -childID 3 -isForBrowser -prefsHandle 4128 -prefMapHandle 4124 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d90140a5-8160-4c3a-b431-98df1d8e9b78} 1916 "\\.\pipe\gecko-crash-server-pipe.1916" 4140 1ede788aa58 tab3⤵PID:4528
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1916.5.417636234\823441417" -childID 4 -isForBrowser -prefsHandle 2608 -prefMapHandle 4976 -prefsLen 26328 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {044da761-e7be-4711-a69a-08bac5c490fd} 1916 "\\.\pipe\gecko-crash-server-pipe.1916" 3628 1ede4c2db58 tab3⤵PID:2128
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1916.6.652684880\369581090" -childID 5 -isForBrowser -prefsHandle 5072 -prefMapHandle 5076 -prefsLen 26328 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b5a5d110-5605-4d23-b385-df5a0b58d7aa} 1916 "\\.\pipe\gecko-crash-server-pipe.1916" 4920 1ede81c7e58 tab3⤵PID:916
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1916.7.553212791\85299816" -childID 6 -isForBrowser -prefsHandle 5268 -prefMapHandle 5272 -prefsLen 26328 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ff4faecb-703f-454a-8365-7fc7b12c0082} 1916 "\\.\pipe\gecko-crash-server-pipe.1916" 5260 1ede8669258 tab3⤵PID:2440
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1916.8.2119761985\575311924" -childID 7 -isForBrowser -prefsHandle 6656 -prefMapHandle 6600 -prefsLen 26328 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {203687da-4eea-4fe4-b1fb-b57d017315a9} 1916 "\\.\pipe\gecko-crash-server-pipe.1916" 6268 1ede7c1ff58 tab3⤵PID:1224
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1916.9.537967496\1771446068" -parentBuildID 20221007134813 -prefsHandle 6428 -prefMapHandle 6964 -prefsLen 26328 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {82a3ee83-78de-44a3-8543-727578df4448} 1916 "\\.\pipe\gecko-crash-server-pipe.1916" 6972 1ede7c20558 rdd3⤵PID:2236
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1916.10.112618358\299756524" -parentBuildID 20221007134813 -sandboxingKind 1 -prefsHandle 6196 -prefMapHandle 7000 -prefsLen 26328 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b631fb76-3793-4af1-9b4c-fd99aa2c24fe} 1916 "\\.\pipe\gecko-crash-server-pipe.1916" 7040 1ede8812558 utility3⤵PID:5088
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x2001⤵
- Suspicious use of AdjustPrivilegeToken
PID:5172
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\db\data.safe.bin
- Size 2KB
- SHA256 925d79e3d6d7bdf2fc209855767bb5001f4b7305e8f9f9f57a617b18c6919940
- MD5 33e751e132f0a1643365891f0fb6f688
- SHA1 8f74008834c24f8901793a14b1ec83d2eedaa0f8
- SHA512 0f378dfaf2b19d089056ecaeaeffb5492587d193919bf5a2edf7198c852a27fdf21d8b1e8746bc20946f72bd973d8317173287617b22e2a6f4145b23dc75f206
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\pending_pings\37a4c0b4-e10b-4ac1-bd76-22f78740a395
- Size 10KB
- SHA256 2cc792cf16e66cd6e318ecbed3d0b3afbeac4be375c8e8f43c5b6300bf1093c5
- MD5 ffd982353ebb62fd057e727c603c7871
- SHA1 e7af60546e0c1b4ffdaa2c590f95998b934d00b0
- SHA512 0496c9a3c0e9877b35b72c37fe3a93f461a8af3510027a5587f9a6b74806feda4d05d818003f49b42a829538c0a3fc1513aae3da39a2b3ed0057a483d14117ee
- SSDEEP 192:ZYE4MbHfntyM5v6vAi7UwjJEQM4e5bbhObxLJsdF0nwuKrjdIZs4Glakn4qp:XmFszlhrp
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\pending_pings\72b12af7-bb16-4992-a240-3ffdda675012
- Size 746B
- SHA256 65051e3ababc003d225046d0328712eaa917b092abbcce83aaabb4f18320ba13
- MD5 e3f630985f65fbf721c86d32c6e2feb4
- SHA1 effc49b9e005ec737a14dde3185f5a6a6d9e0d06
- SHA512 1e01225805ad79609e25b7e743be93dd2bf35a8a532582d4d9d1d393216b4e670a50c8b9e65d34b1d8b2d8192123b92afa08abee40c1549fde1ca44c380d9a34
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\prefs-1.js
- Size 6KB
- SHA256 6a70ec0b02683fb5595029ececf9539b34788be3d879b1bea8d62f4590f90abc
- MD5 7bde7f68a47d8f1b71b18e9558606be5
- SHA1 6d49437c7ba1939264f33fe11bf880b204b817d0
- SHA512 b897ea0551b55ad7a34f5be060db8a1148313820bbb8ca902c55ed80b66945505957d5e1fb81ce9069f695b4eeb6aca162589d74f15837ac761cf150a3c32c21
- SSDEEP 96:xHYdnUTeqGqPdUF5eOTzS7PXAnpj4HrB8sDJ9nzBw8H4UBGS:WdnIRPdUF5elPXBFpDXzBw8Hj
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\prefs.js
- Size 6KB
- SHA256 718728be8fafa2732384e516fcce4d940d3f465bafdd22584b6b5746c006f1d4
- MD5 88085cab30527f66309293166fbd150a
- SHA1 838dd0b6d20c8af227c36192b2208329782aaf97
- SHA512 e7ef556988feb2f3cdc12af8a7498e061deaf3e9ea6bcc7d3f9062cb140cb00286d6149ce379af5eed69a5b2968eea6f1b821094d679e21aa000dc7a4f8fb82c
- SSDEEP 96:xHY5nUTeqGqPdUPPeOTzSTPXAnpj3HrB8sDJ9nzBw8V4UW:W5nIRPdUPPeZPXAFpDXzBw8VO
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\prefs.js
- Size 6KB
- SHA256 729e569d6f97b00e3f4387350990b081fc46b2b430970a6aae69d2ee40c5cb3e
- MD5 1a3f6ee852957751a23cd781e9af74bb
- SHA1 092abc24af1a2dccb32970a3548ffee92608e40a
- SHA512 6dbbc4a6ba60124fd1581378bcef9c8b7b6b12643735f860765e41d22f85c038fea7027e7cc1d278489ac1730dbbb74a2d16405aa1545dac3581dbb74bad9c89
- SSDEEP 96:xHY5nUTeqGqPdUPPeOTzS7PXAnpj3HrB8sDJ9nzBw8H4UW:W5nIRPdUPPelPXAFpDXzBw8HO
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4
- Size 14KB
- SHA256 bd0cc5502ed764bec07ca4ad3223eb48841dd866969bbd62ab168d84903e95ee
- MD5 de917ab8d0730d5e91448b4ab41f81d8
- SHA1 fc1ea4ef391f4c8e9320e8d65189539a02ddf43d
- SHA512 39215cd55d64d036cbf9e0da5fc58e700c6419f1c7716cfea59b61865b25e1a5a0a8096fc739a04e2a4a816391335b2d34788f5a894bb7d1aac6ce25ff6e2c07
- SSDEEP 192:w8xhYPNOYlvF0PZhUpBj8XVh+oIZ0+Si2xCHSSlC5umNjvN3daOIdYcyh6zM:sVOYlyaouoJwHSSlCVBRcO8lQ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4
- Size 1KB
- SHA256 00204cb57febc32a2955a0465ab366930c401b47573dcc72e3b6acbf1c1efcb6
- MD5 e806a0059ae34262f9c1a2a8a13d564e
- SHA1 05104e54363b21a4300328b9f636292dcf00feee
- SHA512 d856afb72b2faf807a0ef6757bd98e8cdfb4cf9f6c61f8b9f1dc717076ca17402cf1492d3c04bcf29a4ff3171d6f8aaa74dbb363fea5a3819db3987fb7c2e547
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4
- Size 15KB
- SHA256 d2c546f0620dcd0cdab21051895857a533222c81c41af9e98db4e61271eaa214
- MD5 ac199105e3e37a16438e7dc14f8f5a31
- SHA1 d114ba08d6f02d787320e59ae0a980fda8f276bf
- SHA512 5f133412f3caeeb977688e677946fbdbf4d642819d7fcb96b9a1db4a59a68e0e086e8ee638868d032e07ac290db61359be009886dfee3eef816bae32d1eb50f5
- SSDEEP 384:Rx1z7KqG1IYl6mGCoJwHSSlCVKvRcg8vND:Fz/GPXkJwZCVK5iZ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4
- Size 15KB
- SHA256 c725b2cda6e32958db62c846d457cff8bbd556f392a2bc9876bb81dff18158cb
- MD5 53d3c1d0f69d06fabde1cf123042f19d
- SHA1 d4ce1f48603dec37315f43de8ee14bb65ef19bd1
- SHA512 e927f3d81bb8b80f8bfd880d574ac33312405755133af09ad8204b31a91f91eb9b744c9d543c1b2399bc4a5ba72524777ab4230c41cadebc70dc4ca31df7b5f2
- SSDEEP 384:Ql1zHKHG1IYl6mGCoJwHSSlCVKvRcg8xg:4zQGPXkJwZCVK5iu
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
- Size 184KB
- SHA256 b228e23ecfb7965e3badefcbb031de0b4bb887634bccb34a826ac8ac89124ac5
- MD5 7f868e557b098795d645df9ea302427f
- SHA1 001f3306144559b4049a8ab139b4139f51e59c0e
- SHA512 56fd8aa514cc25db5a2c9191d665eaffe90182cc5e4f15317e0cfbc9adf7336d9ad937d20384b0504f784e5939b76b4c4b0020cb06e4a472c650355cc6c4c89a
- SSDEEP 3072:EMcHDPRuFP+3y3gE396O6uacMKeHIx2K:EMcHDPR023y3ga6uacMKeHDK
- MD5 SHA1 SHA512 SSDEEP