hxxps://patrimoines[.]ain[.]fr/redirections/url_redirect/n[:]80?redirection=https%3A%2F%2Fbadotherm-holland[.]com/cgi/?wb=user@mae[.]ro

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
04/05/2023, 12:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://patrimoines.ain.fr/redirections/url_redirect/n:80?redirection=https%3A%2F%2Fbadotherm-holland.com/cgi/[email protected]
Sample230504-pe2mnacb99

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	3852	firefox.exe
Token: SeDebugPrivilege	3852	firefox.exe
Token: SeManageVolumePrivilege	3396	svchost.exe
Token: SeDebugPrivilege	3852	firefox.exe
Token: SeDebugPrivilege	3852	firefox.exe
Token: SeDebugPrivilege	3852	firefox.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
3852	firefox.exe
3852	firefox.exe
3852	firefox.exe
3852	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3852	firefox.exe
3852	firefox.exe
3852	firefox.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3852	firefox.exe
3852	firefox.exe
3852	firefox.exe
3852	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3908 wrote to memory of 3852	3908	firefox.exe	84
PID 3908 wrote to memory of 3852	3908	firefox.exe	84
PID 3908 wrote to memory of 3852	3908	firefox.exe	84
PID 3908 wrote to memory of 3852	3908	firefox.exe	84
PID 3908 wrote to memory of 3852	3908	firefox.exe	84
PID 3908 wrote to memory of 3852	3908	firefox.exe	84
PID 3908 wrote to memory of 3852	3908	firefox.exe	84
PID 3908 wrote to memory of 3852	3908	firefox.exe	84
PID 3908 wrote to memory of 3852	3908	firefox.exe	84
PID 3908 wrote to memory of 3852	3908	firefox.exe	84
PID 3908 wrote to memory of 3852	3908	firefox.exe	84
PID 3852 wrote to memory of 3672	3852	firefox.exe	85
PID 3852 wrote to memory of 3672	3852	firefox.exe	85
PID 3852 wrote to memory of 3356	3852	firefox.exe	86
PID 3852 wrote to memory of 3356	3852	firefox.exe	86
PID 3852 wrote to memory of 3356	3852	firefox.exe	86
PID 3852 wrote to memory of 3356	3852	firefox.exe	86
PID 3852 wrote to memory of 3356	3852	firefox.exe	86
PID 3852 wrote to memory of 3356	3852	firefox.exe	86
PID 3852 wrote to memory of 3356	3852	firefox.exe	86
PID 3852 wrote to memory of 3356	3852	firefox.exe	86
PID 3852 wrote to memory of 3356	3852	firefox.exe	86
PID 3852 wrote to memory of 3356	3852	firefox.exe	86
PID 3852 wrote to memory of 3356	3852	firefox.exe	86
PID 3852 wrote to memory of 3356	3852	firefox.exe	86
PID 3852 wrote to memory of 3356	3852	firefox.exe	86
PID 3852 wrote to memory of 3356	3852	firefox.exe	86
PID 3852 wrote to memory of 3356	3852	firefox.exe	86
PID 3852 wrote to memory of 3356	3852	firefox.exe	86
PID 3852 wrote to memory of 3356	3852	firefox.exe	86
PID 3852 wrote to memory of 3356	3852	firefox.exe	86
PID 3852 wrote to memory of 3356	3852	firefox.exe	86
PID 3852 wrote to memory of 3356	3852	firefox.exe	86
PID 3852 wrote to memory of 3356	3852	firefox.exe	86
PID 3852 wrote to memory of 3356	3852	firefox.exe	86
PID 3852 wrote to memory of 3356	3852	firefox.exe	86
PID 3852 wrote to memory of 3356	3852	firefox.exe	86
PID 3852 wrote to memory of 3356	3852	firefox.exe	86
PID 3852 wrote to memory of 3356	3852	firefox.exe	86
PID 3852 wrote to memory of 3356	3852	firefox.exe	86
PID 3852 wrote to memory of 3356	3852	firefox.exe	86
PID 3852 wrote to memory of 3356	3852	firefox.exe	86
PID 3852 wrote to memory of 3356	3852	firefox.exe	86
PID 3852 wrote to memory of 3356	3852	firefox.exe	86
PID 3852 wrote to memory of 3356	3852	firefox.exe	86
PID 3852 wrote to memory of 3356	3852	firefox.exe	86
PID 3852 wrote to memory of 3356	3852	firefox.exe	86
PID 3852 wrote to memory of 3356	3852	firefox.exe	86
PID 3852 wrote to memory of 3356	3852	firefox.exe	86
PID 3852 wrote to memory of 3356	3852	firefox.exe	86
PID 3852 wrote to memory of 3356	3852	firefox.exe	86
PID 3852 wrote to memory of 3356	3852	firefox.exe	86
PID 3852 wrote to memory of 3356	3852	firefox.exe	86
PID 3852 wrote to memory of 3356	3852	firefox.exe	86
PID 3852 wrote to memory of 3356	3852	firefox.exe	86
PID 3852 wrote to memory of 3356	3852	firefox.exe	86
PID 3852 wrote to memory of 3356	3852	firefox.exe	86
PID 3852 wrote to memory of 3356	3852	firefox.exe	86
PID 3852 wrote to memory of 3356	3852	firefox.exe	86
PID 3852 wrote to memory of 3356	3852	firefox.exe	86
PID 3852 wrote to memory of 3356	3852	firefox.exe	86
PID 3852 wrote to memory of 4416	3852	firefox.exe	87
PID 3852 wrote to memory of 4416	3852	firefox.exe	87
PID 3852 wrote to memory of 4416	3852	firefox.exe	87

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" https://patrimoines.ain.fr/redirections/url_redirect/n:80?redirection=https%3A%2F%2Fbadotherm-holland.com/cgi/[email protected]
1⤵
- Suspicious use of WriteProcessMemory
PID:3908
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" https://patrimoines.ain.fr/redirections/url_redirect/n:80?redirection=https%3A%2F%2Fbadotherm-holland.com/cgi/[email protected]
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3852
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3852.0.105857545\905009240" -parentBuildID 20221007134813 -prefsHandle 1856 -prefMapHandle 1848 -prefsLen 20890 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ec8ec1d4-6ebb-4a7c-a08c-2671fc1af969} 3852 "\\.\pipe\gecko-crash-server-pipe.3852" 1936 2071ca16858 gpu
    3⤵
    PID:3672
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3852.1.449892728\483204832" -parentBuildID 20221007134813 -prefsHandle 2428 -prefMapHandle 2424 -prefsLen 21706 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {55469d6a-48b6-450f-aeaf-12fdab02f49e} 3852 "\\.\pipe\gecko-crash-server-pipe.3852" 2440 2070ea74558 socket
    3⤵
    PID:3356
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3852.2.410216684\193362077" -childID 1 -isForBrowser -prefsHandle 3456 -prefMapHandle 1464 -prefsLen 21854 -prefMapSize 232675 -jsInitHandle 1476 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b5593c27-b757-4774-9e8c-74f0a728ab86} 3852 "\\.\pipe\gecko-crash-server-pipe.3852" 3148 2071f714c58 tab
    3⤵
    PID:4416
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3852.3.67621741\964115557" -childID 2 -isForBrowser -prefsHandle 4052 -prefMapHandle 4048 -prefsLen 26519 -prefMapSize 232675 -jsInitHandle 1476 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7a708080-8eeb-4bdd-8d79-34dfc2acbe76} 3852 "\\.\pipe\gecko-crash-server-pipe.3852" 3280 20720665558 tab
    3⤵
    PID:3544
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3852.4.1892433927\1318266340" -childID 3 -isForBrowser -prefsHandle 4528 -prefMapHandle 2988 -prefsLen 26578 -prefMapSize 232675 -jsInitHandle 1476 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {99184d95-fa15-4997-a8d7-0d1a8d00b973} 3852 "\\.\pipe\gecko-crash-server-pipe.3852" 4536 20721b46b58 tab
    3⤵
    PID:4396
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3852.5.1317920943\1350087925" -childID 4 -isForBrowser -prefsHandle 4780 -prefMapHandle 4764 -prefsLen 26578 -prefMapSize 232675 -jsInitHandle 1476 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {32fe6d2e-2450-487f-961a-8a64e26772e4} 3852 "\\.\pipe\gecko-crash-server-pipe.3852" 4660 20721bd3358 tab
    3⤵
    PID:3648
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3852.6.1180016842\449715862" -childID 5 -isForBrowser -prefsHandle 4948 -prefMapHandle 4952 -prefsLen 26578 -prefMapSize 232675 -jsInitHandle 1476 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {53bb9c99-a23f-4ab7-8319-95e10c33837d} 3852 "\\.\pipe\gecko-crash-server-pipe.3852" 4732 20721bd1e58 tab
    3⤵
    PID:2112
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3852.7.1621041585\71780214" -childID 6 -isForBrowser -prefsHandle 3544 -prefMapHandle 2984 -prefsLen 26834 -prefMapSize 232675 -jsInitHandle 1476 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e97f290e-282c-420a-9a7b-952e32ebce71} 3852 "\\.\pipe\gecko-crash-server-pipe.3852" 2808 20721bd1258 tab
    3⤵
    PID:3468
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3852.8.1173318541\276909035" -childID 7 -isForBrowser -prefsHandle 4800 -prefMapHandle 4816 -prefsLen 26834 -prefMapSize 232675 -jsInitHandle 1476 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e139dfb9-6f35-442d-933a-51cca3b8410a} 3852 "\\.\pipe\gecko-crash-server-pipe.3852" 4812 207222df458 tab
    3⤵
    PID:64
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3852.9.2123229916\1503081933" -childID 8 -isForBrowser -prefsHandle 6172 -prefMapHandle 5948 -prefsLen 30379 -prefMapSize 232675 -jsInitHandle 1476 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ed97b85a-d603-437d-9803-dc38e53e9e2c} 3852 "\\.\pipe\gecko-crash-server-pipe.3852" 4848 20721d7e258 tab
    3⤵
    PID:5488

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3396

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

store.jfm

Path C:\Users\Admin\AppData\Local\Comms\UnistoreDB\store.jfm
Size 16KB
SHA256 e1feb79f49228989cdad6c9c6c0876d6543d1623e2d49e9e1f098cf6375f05ef
MD5 e711fa6f56898d425b1a6cb65bd3eee8
SHA1 dc0e03e6df6e92adf6031518dfc40b6af13f746f
SHA512 1c7f590c00fec4e86a79504ee2204a3e471ab3ac72636d796ed4c162187be5b2f73eef86d5771d33d2ea1e638b3c9541fce0a7a5f5ffa43b75c94f2667e3de7c
SSDEEP 6:5b9KP2mlarz5/+XkW4zxWl/EMl/4EQltMYDl/M9/N/aS/3WWwvlk93ekO+XD/rpC:59YGdhxyDUV5/G/N/cvi9DT/rNvrNB
MD5 SHA1 SHA512 SSDEEP

Submit Download

activity-stream.discovery_stream.json.tmp

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6exu9k4v.default-release\activity-stream.discovery_stream.json.tmp
Size 144KB
SHA256 79da2c837e7347434a9c462c6e2c42f502d06dca3aa723fee63b420feb22401f
MD5 4fb0b50117c078965d7d4bc3d8b2e47c
SHA1 a04a2af9e47747741ef136a40dc8d416e59ebc5b
SHA512 700cbfa21f6e62a356bd8307bf9e1831623dfcb7d106195c2d0f4a50a4c1e2a9747f36de7572dd7ea0dfa8e9bce2c357a9befadf8fcab83181e3f08501b884a3
SSDEEP 3072:FDcYcIfCncG9GQcZCLmGCfugcZBCqckWpFi:FDcYcIgc4cnvcnckWC
MD5 SHA1 SHA512 SSDEEP

Submit Download

250EE2BC03AFF526F1A1C3DB212A79DE3EB60D5E

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6exu9k4v.default-release\cache2\entries\250EE2BC03AFF526F1A1C3DB212A79DE3EB60D5E
Size 14KB
SHA256 146d3cb7ecea9f2eb95665e097d5dc5dbe34447c4239dfdc9625f91838ab7e16
MD5 74c516756fdcd6b0b9897f0166efeff9
SHA1 208c42966ecb08ec7bca3ef4b9df3cbf3ff4a00c
SHA512 311572b96ee7d4b02839f29c8f46c77ef38f416509baae0cd96516c76765524b3d82e1345490b41de247cc0287ec59b166ff19b1e3d49e3438f581c26f16589b
SSDEEP 384:HrpTBu9fiGLm4pUaXNpt+3wHO86N4mlqGPUcP+AWRMACUhdvW:SBi8mCUaX1+AsNzlqkD+hRMFh
MD5 SHA1 SHA512 SSDEEP

Submit Download

F8CBD54DDA10F4286A41EC6A537240712D6C2308

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6exu9k4v.default-release\cache2\entries\F8CBD54DDA10F4286A41EC6A537240712D6C2308
Size 9KB
SHA256 5028d1659ca18b294c6e62b0c4f6db528dc345a58b62baa84630af29c13c84c6
MD5 b49c50894450e630bd84f546505c1816
SHA1 b49abddfa54f90fa726d73ecea71769475f91e6a
SHA512 15571204d6871a364539600cbf540ef23e2c8a585ebbade72b774071651e52275bb1da9fd55a8e9a81384dc1d9399bcbcfd5d778301165be693574ea89268555
SSDEEP 192:TNMPf4b0QBntsAieFPbK7H1zVl1QGphUA9P+ABoRMe3K5cUdSMkdSMU:TNMnPQhYe5bClqGPUcP+AWRMAIcESMUe
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 442KB
SHA256 a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
MD5 85430baed3398695717b0263807cf97c
SHA1 fffbee923cea216f50fce5d54219a188a5100f41
SHA512 06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1
SSDEEP 12288:tESTeqTI2r4ZbCgUKWKNeRcPMb6qlV7hVZe3:tEsed2Xh9/bdzZe3
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 8.0MB
SHA256 345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42
MD5 a01c5ecd6108350ae23d2cddf0e77c17
SHA1 c6ac28a2cd979f1f9a75d56271821d5ff665e2b6
SHA512 b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72
SSDEEP 196608:945hXmP7/cvflwtf0FzVC/5lHevzc8XZbivwEiw3cFTx7z4zV:9tP7/cvflof0FzVgKRF9zw3c9x4zV
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
Size 997KB
SHA256 1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
MD5 fe3355639648c417e8307c6d051e3e37
SHA1 f54602d4b4778da21bc97c7238fc66aa68c8ee34
SHA512 8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c
SSDEEP 12288:vYLdTfFKbNSjv92eFN+3wH+NYriA0Iq6lh6VawYIpAvwHN/Uf1h47HAfg1oet:vYLdTZ923NYrjwNpgwef1hzfg1x
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
Size 116B
SHA256 f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
MD5 3d33cdc0b3d281e67dd52e14435dd04f
SHA1 4db88689282fd4f9e9e6ab95fcbb23df6e6485db
SHA512 a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1
MD5 SHA1 SHA512

Submit Download

LICENSE.txt

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
Size 479B
SHA256 2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
MD5 49ddb419d96dceb9069018535fb2e2fc
SHA1 62aa6fea895a8b68d468a015f6e6ab400d7a7ca6
SHA512 48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
Size 372B
SHA256 e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
MD5 8be33af717bb1b67fbd61c3f4b807e9e
SHA1 7cf17656d174d951957ff36810e874a134dd49e0
SHA512 6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
Size 11.8MB
SHA256 8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e
MD5 33bf7b0439480effb9fb212efce87b13
SHA1 cee50f2745edc6dc291887b6075ca64d716f495a
SHA512 d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275
SSDEEP 196608:lP4/vkvbdjMq4ytbko4qIUcXkhrVp1HSTDsoTn90lcGeFaxJI3qLaLhFT7Uc:lPcvyiXSWxRU/OpZXJFee3qGhFMc
MD5 SHA1 SHA512 SSDEEP

Submit Download

widevinecdm.dll.lib

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
Size 1KB
SHA256 33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
MD5 688bed3676d2104e7f17ae1cd2c59404
SHA1 952b2cdf783ac72fcb98338723e9afd38d47ad8e
SHA512 7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll.sig

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
Size 1KB
SHA256 68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
MD5 937326fead5fd401f6cca9118bd9ade9
SHA1 4526a57d4ae14ed29b37632c72aef3c408189d91
SHA512 b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2
MD5 SHA1 SHA512

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\prefs-1.js
Size 6KB
SHA256 176494e0e46200d98fb280e46abf0fdff8c832b87e52cd287ce254bfbf9f2a9c
MD5 761bfa191ddbbcc636038c3db14a4bcd
SHA1 afc1e6a76555067f8757fe8097b0a3bd805cd0a8
SHA512 5d9bd63ebff6b2ba9894303672548692baacdb4f0553666f319c7df7d4b907f25ca7639ce08b8dc826e89df41eb11f03ca91d3e244ad3316c7e006777fb81caf
SSDEEP 96:xHC5nUTUQqGqXdnNZe1zSHPXAnpjSEXHF0Bw8HzXv:U5nLRXdnNZeUPXDEXGBw8Hzv
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\prefs-1.js
Size 7KB
SHA256 aa2c70bcbb04d989d588b6886f019828efe90fd1f5218d4631a9189556de1cb8
MD5 b9b61a4ffd9e6c17dd6b16ddbe516de4
SHA1 83cc9a47b0368e39f3999ef892cd1a7a08eb8e71
SHA512 a41c8c1b758124d9c28cf6a1b28f13b50835944b2d187f3cf8dd27d36274873c87f260544b865527d27b2e2f94a9f1368cb27628ea07c24c902561a0ca936f07
SSDEEP 96:xHCFnUTUQqGqXdnNZeOTzSHPXAnpjSEXHFWBw8HzXv:UFnLRXdnNZetPXDEXUBw8Hzv
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\prefs-1.js
Size 7KB
SHA256 8c2db43d7c99f93af0b625fa121d3acf7f6558e562d662ee3482f1b29edfdc5d
MD5 f6d93f36629551feea28861f54dfc0dd
SHA1 48d0d613e7b9622bf07ed39e64b3aefb219f94d5
SHA512 ea6eddd24bd8396d16c5cafcdc65a76e4d300366743400d656b862f92bddabfb6e5bba872b1dd998717dce481c41b1ee44ff84dc9faaf48190b7a93a9a0ed1ec
SSDEEP 96:xHCHnUTUQqGqXdnNZeOTzSHPXAnpjSEXHFWBw8HzuGGS:UHnLRXdnNZetPXDEXUBw8HSg
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\prefs-1.js
Size 8KB
SHA256 52929db19d8bb9848ceccfc1ad7348b12741eb3c9c6f3bf3127ba5f40e24235e
MD5 b4195f5ebae8c066394495937e783696
SHA1 1ff3985e00673baf0e5ac9f555b246a2e4f5d787
SHA512 3d1d1b2e739843d1611b879e8b3f2ba72ef91f9eca4262cac9909cf5f6db0411d189891992b1cacb9f14780d2dd779e13e9623cf58c492577bef09ed58732392
SSDEEP 96:xHfHnUTUQqGqXdnNZeOTzSHPXAnpjSEXHFUBw8HM+2uGGS:JHnLRXdnNZetPXDEXOBw8HThg
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\prefs-1.js
Size 6KB
SHA256 f8a614d690ade559f1bd43e3c809bf0aa68ba2a701cde22e8f519d6615b064b7
MD5 affe0540bacd3164d95cdc890f061e11
SHA1 6820d53b97c0f2d07038c1e95f220b5daa4d742a
SHA512 89bbeaf2d3dc760f473dfc18b74013b730c0dc21ea976f232feec9adc97945c1a0be630711f1dfc9376dbf794f06e0830e245a3ea85cc3820f1284cea3ebcbda
SSDEEP 96:xHC5nUTUQqGqXdn4We1zSHPXAnpjn3HF0Bw8HzXv:U5nLRXdn4WeUPX03GBw8Hzv
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\prefs-1.js
Size 6KB
SHA256 8782d666b2efd9397dc4c17736d7f5002fba2d78375b54d69fba83dfc5ba363e
MD5 e682f7a777e36a2646122e547fa09d02
SHA1 1fa53e561aeaae2717f983d909dc3140f9aa4981
SHA512 0c528fc0e651b60ee1494c31731299d345bf27a83e9f4b11fc62e36b92d0272bc46e28731c1ecf35ea68b740002e9579a3c113fed45008bfec18396fd7cf9c30
SSDEEP 96:xHC5nUTUQqGqXdnNZeOTzSHPXAnpjSEXHFWBw8HzXv:U5nLRXdnNZetPXDEXUBw8Hzv
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\prefs.js
Size 6KB
SHA256 c5e19d4313b524fffc4859f4fac05ea3dcf408714a736dbd0bb7fcdf5131f80e
MD5 108b97b1ff7efbdb1aecce96d55ff2e5
SHA1 bb72b2e0c3d859fe5e821632307a32df331b55e1
SHA512 e0f7678424e68957a1cb521786e9e4e54c179f9a263b04d0c6a96147cb1e242b58bda3e74e6f142dcd9b6dd313a0061c3050af334b149eab9a8040f923da84dc
SSDEEP 96:xHC5nUTUQqGqXdn4We1zvdPuAnpjc3HF0Bw8VTXv:U5nLRXdn4We/PuZ3GBw8VTv
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\sessionstore-backups\recovery.jsonlz4
Size 5KB
SHA256 4d83bf4e2ba1a6b2158f8233739090f7cf75ca2e416b83fb2dfc9cd93e1c7f9c
MD5 6a640b8eec3fe6a97bf8d0708a1c7db8
SHA1 36e7630b00fa24fa3c2fa82440957f2dc56e962f
SHA512 09ef01b12b775f5111b8e7dff2d4a19023f798e092a7539250aaefe2dcfebbbbdb4aadd8cadb7b9534cf1d22970d7c3b876226120a90976eb70b953eee94aff0
SSDEEP 96:1AVwh2nFu5m4cgP8eLxKTSJJE5xwU0MCfxg/cTYWNroJLvjv6lyAiDXKRgCk:uIrA43PrxBu5/JCjAHv6zZgCk
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\sessionstore-backups\recovery.jsonlz4
Size 5KB
SHA256 5fb98f0a5075907646c0fecf83ef2118cd7788a8a0eb7096f7ee273c170ae230
MD5 a28de0d79019dbd5d9a1bef5033999d9
SHA1 6d0687a9ceec6001c57f4ad801306159969b1a52
SHA512 874e8f9399622f172409afa497f0f7e53992e52dfe62baa29ad4d4552f9bfb3c5369977145f4cfac72b132ee17a55c40859bce309da1a141a05b8053777817d4
SSDEEP 96:P9IYL9DFpCqnFu5m4cglMeLxKTSJJEJ+wHSDU0MCfxg/cTYWNroJLvjv6lyzYBSK:FtL9DFpCXA43VxBu3HvJCjAHv6mT+YCr
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3396-430-0x000001B6685C0000-0x000001B6685C1000-memory.dmp

Download

memory/3396-457-0x000001B668120000-0x000001B668121000-memory.dmp

Download

memory/3396-451-0x000001B6681E0000-0x000001B6681E1000-memory.dmp

Download

memory/3396-469-0x000001B668320000-0x000001B668321000-memory.dmp

Download

memory/3396-471-0x000001B668330000-0x000001B668331000-memory.dmp

Download

memory/3396-472-0x000001B668330000-0x000001B668331000-memory.dmp

Download

memory/3396-473-0x000001B668440000-0x000001B668441000-memory.dmp

Download

memory/3396-446-0x000001B6681F0000-0x000001B6681F1000-memory.dmp

Download

memory/3396-444-0x000001B6681E0000-0x000001B6681E1000-memory.dmp

Download

memory/3396-443-0x000001B6681F0000-0x000001B6681F1000-memory.dmp

Download

memory/3396-442-0x000001B6685C0000-0x000001B6685C1000-memory.dmp

Download

memory/3396-441-0x000001B6685C0000-0x000001B6685C1000-memory.dmp

Download

memory/3396-435-0x000001B6685C0000-0x000001B6685C1000-memory.dmp

Download

memory/3396-434-0x000001B6685C0000-0x000001B6685C1000-memory.dmp

Download

memory/3396-433-0x000001B6685C0000-0x000001B6685C1000-memory.dmp

Download

memory/3396-432-0x000001B6685C0000-0x000001B6685C1000-memory.dmp

Download

memory/3396-431-0x000001B6685C0000-0x000001B6685C1000-memory.dmp

Download

memory/3396-429-0x000001B6685C0000-0x000001B6685C1000-memory.dmp

Download

memory/3396-428-0x000001B6685C0000-0x000001B6685C1000-memory.dmp

Download

memory/3396-427-0x000001B6685A0000-0x000001B6685A1000-memory.dmp

Download

memory/3396-406-0x000001B65FFB0000-0x000001B65FFC0000-memory.dmp

Download

memory/3396-390-0x000001B65FEB0000-0x000001B65FEC0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads