f5d596e7487648ec9a72fc0070928a4bcb4cece4274f42009e8001580ff3b5ab

Resubmissions

19/02/2024, 04:29

240219-e399lahh253

19/02/2024, 04:26

240219-e2m3nshg965

19/02/2024, 04:23

240219-ezwl2ahe6z5

Analysis

max time kernel
1556s
max time network
1562s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
19/02/2024, 04:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Imagen de WhatsApp 2024-02-18 a las 14.48.17_ae90a7eb.jpg
Size 137KB
Sample240219-e399lahh25
SHA256 f5d596e7487648ec9a72fc0070928a4bcb4cece4274f42009e8001580ff3b5ab
MD5 bda15447362c703ad3cdf4b18581aede
SHA1 859a101ef69637ca393c7e9b3463b2363559de6a
SHA512 51f412129614f23360629a0af37790eeb4fb63e4164fdd652d2e4ac259a7d2c209603adc1ea46b8d3b8fc8f7da9ca52abf1b5c671da219a5465a3ad688bec9f6
SSDEEP 3072:PmwNlP1ISEFMqp1nk+eV5QaV4Eiv9pBTJB4UvzesfOHQ5PZCss9VOw:xNlPOSNk1d05Qdv9Lv4UvXfvJgsoVOw
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2292	firefox.exe
Token: SeDebugPrivilege	2292	firefox.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
2292	firefox.exe
2292	firefox.exe
2292	firefox.exe
2292	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2292	firefox.exe
2292	firefox.exe
2292	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 2292	2440	firefox.exe	29
PID 2440 wrote to memory of 2292	2440	firefox.exe	29
PID 2440 wrote to memory of 2292	2440	firefox.exe	29
PID 2440 wrote to memory of 2292	2440	firefox.exe	29
PID 2440 wrote to memory of 2292	2440	firefox.exe	29
PID 2440 wrote to memory of 2292	2440	firefox.exe	29
PID 2440 wrote to memory of 2292	2440	firefox.exe	29
PID 2440 wrote to memory of 2292	2440	firefox.exe	29
PID 2440 wrote to memory of 2292	2440	firefox.exe	29
PID 2440 wrote to memory of 2292	2440	firefox.exe	29
PID 2440 wrote to memory of 2292	2440	firefox.exe	29
PID 2440 wrote to memory of 2292	2440	firefox.exe	29
PID 2292 wrote to memory of 2880	2292	firefox.exe	30
PID 2292 wrote to memory of 2880	2292	firefox.exe	30
PID 2292 wrote to memory of 2880	2292	firefox.exe	30
PID 2292 wrote to memory of 1028	2292	firefox.exe	31
PID 2292 wrote to memory of 1028	2292	firefox.exe	31
PID 2292 wrote to memory of 1028	2292	firefox.exe	31
PID 2292 wrote to memory of 1028	2292	firefox.exe	31
PID 2292 wrote to memory of 1028	2292	firefox.exe	31
PID 2292 wrote to memory of 1028	2292	firefox.exe	31
PID 2292 wrote to memory of 1028	2292	firefox.exe	31
PID 2292 wrote to memory of 1028	2292	firefox.exe	31
PID 2292 wrote to memory of 1028	2292	firefox.exe	31
PID 2292 wrote to memory of 1028	2292	firefox.exe	31
PID 2292 wrote to memory of 1028	2292	firefox.exe	31
PID 2292 wrote to memory of 1028	2292	firefox.exe	31
PID 2292 wrote to memory of 1028	2292	firefox.exe	31
PID 2292 wrote to memory of 1028	2292	firefox.exe	31
PID 2292 wrote to memory of 1028	2292	firefox.exe	31
PID 2292 wrote to memory of 1028	2292	firefox.exe	31
PID 2292 wrote to memory of 1028	2292	firefox.exe	31
PID 2292 wrote to memory of 1028	2292	firefox.exe	31
PID 2292 wrote to memory of 1028	2292	firefox.exe	31
PID 2292 wrote to memory of 1028	2292	firefox.exe	31
PID 2292 wrote to memory of 1028	2292	firefox.exe	31
PID 2292 wrote to memory of 1028	2292	firefox.exe	31
PID 2292 wrote to memory of 1028	2292	firefox.exe	31
PID 2292 wrote to memory of 1028	2292	firefox.exe	31
PID 2292 wrote to memory of 1028	2292	firefox.exe	31
PID 2292 wrote to memory of 1028	2292	firefox.exe	31
PID 2292 wrote to memory of 1028	2292	firefox.exe	31
PID 2292 wrote to memory of 1028	2292	firefox.exe	31
PID 2292 wrote to memory of 1028	2292	firefox.exe	31
PID 2292 wrote to memory of 1028	2292	firefox.exe	31
PID 2292 wrote to memory of 1028	2292	firefox.exe	31
PID 2292 wrote to memory of 1028	2292	firefox.exe	31
PID 2292 wrote to memory of 1028	2292	firefox.exe	31
PID 2292 wrote to memory of 1028	2292	firefox.exe	31
PID 2292 wrote to memory of 1028	2292	firefox.exe	31
PID 2292 wrote to memory of 1028	2292	firefox.exe	31
PID 2292 wrote to memory of 1028	2292	firefox.exe	31
PID 2292 wrote to memory of 1028	2292	firefox.exe	31
PID 2292 wrote to memory of 1028	2292	firefox.exe	31
PID 2292 wrote to memory of 1028	2292	firefox.exe	31
PID 2292 wrote to memory of 1028	2292	firefox.exe	31
PID 2292 wrote to memory of 1028	2292	firefox.exe	31
PID 2292 wrote to memory of 1028	2292	firefox.exe	31
PID 2292 wrote to memory of 1028	2292	firefox.exe	31
PID 2292 wrote to memory of 2052	2292	firefox.exe	32
PID 2292 wrote to memory of 2052	2292	firefox.exe	32
PID 2292 wrote to memory of 2052	2292	firefox.exe	32
PID 2292 wrote to memory of 2052	2292	firefox.exe	32
PID 2292 wrote to memory of 2052	2292	firefox.exe	32

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen "C:\Users\Admin\AppData\Local\Temp\Imagen de WhatsApp 2024-02-18 a las 14.48.17_ae90a7eb.jpg"
1⤵
PID:1656

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2292
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2292.0.1323218670\670089315" -parentBuildID 20221007134813 -prefsHandle 1228 -prefMapHandle 1220 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4544c26b-8faf-4b79-9826-d75ac73fb77e} 2292 "\\.\pipe\gecko-crash-server-pipe.2292" 1292 a3cf558 gpu
    3⤵
    PID:2880
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2292.1.303293619\1169452049" -parentBuildID 20221007134813 -prefsHandle 1484 -prefMapHandle 1480 -prefsLen 20830 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f98d1cc7-f330-46ba-b38c-ecd724f97ba9} 2292 "\\.\pipe\gecko-crash-server-pipe.2292" 1496 d72b58 socket
    3⤵
    PID:1028
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2292.2.1117399799\633830070" -childID 1 -isForBrowser -prefsHandle 2084 -prefMapHandle 2080 -prefsLen 20933 -prefMapSize 233444 -jsInitHandle 828 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {49c3907d-3ec2-439d-ab12-704e46a9633c} 2292 "\\.\pipe\gecko-crash-server-pipe.2292" 2096 1a3a2b58 tab
    3⤵
    PID:2052
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2292.3.1531227622\301850676" -childID 2 -isForBrowser -prefsHandle 572 -prefMapHandle 860 -prefsLen 26111 -prefMapSize 233444 -jsInitHandle 828 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4965eb2c-e50c-42d2-9c92-25d1b9cea295} 2292 "\\.\pipe\gecko-crash-server-pipe.2292" 644 d63858 tab
    3⤵
    PID:532
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2292.4.1846683143\222788504" -childID 3 -isForBrowser -prefsHandle 2820 -prefMapHandle 2816 -prefsLen 26111 -prefMapSize 233444 -jsInitHandle 828 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {285acebc-c66b-4bbd-ba09-6dc4aa78f58e} 2292 "\\.\pipe\gecko-crash-server-pipe.2292" 2832 1b11be58 tab
    3⤵
    PID:676
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2292.5.1350389995\915459408" -childID 4 -isForBrowser -prefsHandle 3776 -prefMapHandle 2492 -prefsLen 26170 -prefMapSize 233444 -jsInitHandle 828 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d31088ba-fde0-40fe-bd7c-28f35f1c96ce} 2292 "\\.\pipe\gecko-crash-server-pipe.2292" 3788 1a341558 tab
    3⤵
    PID:1260
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2292.6.1715360800\1355263117" -childID 5 -isForBrowser -prefsHandle 3900 -prefMapHandle 3904 -prefsLen 26170 -prefMapSize 233444 -jsInitHandle 828 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e7137f42-ca69-48c5-8478-d9601b4339ce} 2292 "\\.\pipe\gecko-crash-server-pipe.2292" 3888 1b11df58 tab
    3⤵
    PID:760
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2292.7.430088644\76127345" -childID 6 -isForBrowser -prefsHandle 4068 -prefMapHandle 4072 -prefsLen 26170 -prefMapSize 233444 -jsInitHandle 828 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8f86ea62-2cde-4a0e-8166-de279c3b9941} 2292 "\\.\pipe\gecko-crash-server-pipe.2292" 4056 1e2e7858 tab
    3⤵
    PID:2280
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2292.8.840711193\795280977" -childID 7 -isForBrowser -prefsHandle 4480 -prefMapHandle 4476 -prefsLen 26251 -prefMapSize 233444 -jsInitHandle 828 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fa2e1f76-781a-49c4-9e6e-1e2a46860ecc} 2292 "\\.\pipe\gecko-crash-server-pipe.2292" 4492 21fefb58 tab
    3⤵
    PID:1768
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2292.9.2051402298\203740981" -childID 8 -isForBrowser -prefsHandle 3860 -prefMapHandle 3632 -prefsLen 26691 -prefMapSize 233444 -jsInitHandle 828 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c0863f93-975e-40d3-8e2f-34429859678a} 2292 "\\.\pipe\gecko-crash-server-pipe.2292" 3840 1b041758 tab
    3⤵
    PID:1408
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2292.10.1959237753\1844814147" -parentBuildID 20221007134813 -prefsHandle 3272 -prefMapHandle 2984 -prefsLen 26691 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {17df2645-c67d-4bca-b095-4e4789d3aa9e} 2292 "\\.\pipe\gecko-crash-server-pipe.2292" 3256 1f56c258 rdd
    3⤵
    PID:2256
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2292.11.1596792891\1455740228" -parentBuildID 20221007134813 -sandboxingKind 1 -prefsHandle 3272 -prefMapHandle 8516 -prefsLen 26691 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9fecd559-ca47-4358-b3f5-791b7fe8fa6e} 2292 "\\.\pipe\gecko-crash-server-pipe.2292" 8492 1f5bde58 utility
    3⤵
    PID:1604
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2292.12.2011967097\1857419688" -childID 9 -isForBrowser -prefsHandle 3484 -prefMapHandle 8304 -prefsLen 26691 -prefMapSize 233444 -jsInitHandle 828 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f0837ef0-9adc-4277-877a-72ad12dffcda} 2292 "\\.\pipe\gecko-crash-server-pipe.2292" 3516 2350ae58 tab
    3⤵
    PID:2536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

27262

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xm25i6ct.default-release\cache2\doomed\27262
Size 9KB
SHA256 4063a4be1419437aa0acd83dda7de2db1c9eca959d2543346505aa985c769cc1
MD5 1317d97df7d1918a6bc8477201c9a8fb
SHA1 cf03e84d1319cac72801eb6bf26595b12e392f25
SHA512 2e23efd9f3bb2e1f40395d2f78dff3e74486bca396b4977cfbb723940137c4412f8ca6af7408c2663ada19632d2cee778dc522e19802d1ed89361e7b651eaa5d
SSDEEP 192:bPjHvVNMJGmpOb8ohsMJGmpOb8ofC2rAl7YNCW2P8ro15j75ywpskCGdTYTld8YH:bjVNzmm8oszmm86CmAl7YNFU8rIVy8eB
MD5 SHA1 SHA512 SSDEEP

Submit Download

29723

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xm25i6ct.default-release\cache2\doomed\29723
Size 10KB
SHA256 cd3f2c74d5e47aa624b01d628b22826c1bec72e5e5ad56c40912a6380c417a5e
MD5 91c66a45a5d41c556b16edc37edebb67
SHA1 012150187e77f3f92efdac0efcafdc4cc2b8f069
SHA512 ec76f69bce43141a4a25457b7853bf7fe6431eed4802d435d1275a5c444fe7ce757e8248b107e816fd91eb6b9b6ee7f5bc3bf31e8d592a4b9278b8857bc48996
SSDEEP 192:Uf069udywJ5BS3069udywJ5BQ8e98hqrKcS+E+rW29t2B5OOjrOOjdTA+:A9udywrBST9udywrBQ8eehqrufWWCt2F
MD5 SHA1 SHA512 SSDEEP

Submit Download

30007

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xm25i6ct.default-release\cache2\doomed\30007
Size 9KB
SHA256 396d3485b47668ab220bb04e0712e694bc0fa4d4705b3b5013ad1a099ede3305
MD5 a54eaa01e053431b2eec313d034b685b
SHA1 e211e53ba48edb828793505b1072351707358745
SHA512 9fd76eaf420d43618079c418aa264b7364a0082e21e6b89ee0977ba23c744265090a3a0094c609ec8c3e2717c2e77951f1520d4e2d13462dd268a858adc80e58
SSDEEP 192:bPjHvVyZMJGmpOb8ohsMJGmpOb8ofC2rAl7YNCW2P8ro15j75ywpskCvdOYztd5A:bjVyZzmm8oszmm86CmAl7YNFU8rIVy8t
MD5 SHA1 SHA512 SSDEEP

Submit Download

A44748D01623154A469DF4E73CDD24C8E376FCE4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xm25i6ct.default-release\cache2\entries\A44748D01623154A469DF4E73CDD24C8E376FCE4
Size 35KB
SHA256 198cf487b7c4926cfe9e20048e788d2192daa4a1b59b110299336e72098f4ace
MD5 d29f47a6632d1000fc646058236fdcda
SHA1 29da0e5fe285fd6a8fbd033aa75e5789925e5612
SHA512 af147241a99e7021a493a5dafe20fff8a1f7d90ee1a77dc0b96cccd4ca5084557bc722b02b68629219bc066cec3b4de9bff53a720659dd850b10020a97c4b289
SSDEEP 768:eRn6wsd506r7Kroxm9xeoMyUmcO9pohNhTnpr1/w2Bt:ZN508S8RoMyU8El7zw2r
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 442KB
SHA256 a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
MD5 85430baed3398695717b0263807cf97c
SHA1 fffbee923cea216f50fce5d54219a188a5100f41
SHA512 06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1
SSDEEP 12288:tESTeqTI2r4ZbCgUKWKNeRcPMb6qlV7hVZe3:tEsed2Xh9/bdzZe3
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 2.3MB
SHA256 bec5cf8311bd8ac2474aefa50ab2063fd05834be0c8fe5f109849830508e295b
MD5 abb4524e3700e70fb604596dedf3351c
SHA1 27551880ed32da210c184e9ea37195c049f41dbd
SHA512 d4e6a63206d18b80ef9de31508ad48733d1b1f7d61e37b928d60b96e96f10c68c5d642d3d78cb4338c40ca28f8315ab125e13d4275f8366f60aabde0ef68db9a
SSDEEP 49152:wXQ1cJvEZR7+56mfLrZqNvniDpd1c/GA5pLPXiN6csCflASd/vol:H1U8Z456mfLrmvnit0n7G6cvflASpol
MD5 SHA1 SHA512 SSDEEP

Submit Download

6824f4a902c78fbd.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
Size 17KB
SHA256 bfda920d16196baa7829e5ec6c748e062091118c1575d41856b9926fdcc18733
MD5 553e85bd94c1777e55a6aeade99c489b
SHA1 d82f1950fa383208279ed1c8ca866a53f60bdcc4
SHA512 835372dc7b7ef62778fc3c1d424ecdca7fcb859d25ca828997377fb33157a7796fbb46c1b466908830b273f284883a1255570ca2c240eda629166d4b8056467f
SSDEEP 192:o9JMx/UxP3uyPBXuBlP9+ILrPH+5D+5cU+5t+58P7+BCcST60R:o/euXBeBF9BLzQRX
MD5 SHA1 SHA512 SSDEEP

Submit Download

SiteSecurityServiceState.txt

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xm25i6ct.default-release\SiteSecurityServiceState.txt
Size 455B
SHA256 a539699b74bd06462ace1c433a7ce5d1849290f14c860bcbb8908cc94b873627
MD5 863575dd115373ec3f08a032a30a3b83
SHA1 fb0d44cca802be22c3d8099ebfa8b3e3366447bf
SHA512 6029fe38f6fd01ab24208167143cc5c9c3d2c4c43cfb550bc5d77d3fbdc317cfa8a8c46a54914a1a4e0ec3b6f8d68dc04e96f583c7f7325d1bd24654c0d8286e
MD5 SHA1 SHA512

Submit Download

addonStartup.json.lz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xm25i6ct.default-release\addonStartup.json.lz4
Size 5KB
SHA256 a1a3f4ec31e5672ebe4fc0493f24b208874b6b7e445fd145f5c85471d18f9263
MD5 0608ae940e346d41306a0d6c7e974b00
SHA1 c4da4d29d707940ef2eb52014e3d72f622b325f4
SHA512 2c41d6dbc74f57302ba40e235a09e5ec0e2ade06d93d1157fec5b61332fc24a5450afae0feede8c82034753b8bf919ec171eb7a32f5acedcd6960e0ea916cf98
SSDEEP 96:zESb6/hsTwrHC9NN2xWY8ig327m8mD4wB809pbjCeO+04Q83cj8VYxeec96JKjNo:zECh2xK10WDJ19BjCZ83cA6eePJKjW
MD5 SHA1 SHA512 SSDEEP

Submit Download

bookmarks-2024-02-19_11_hpsfC4+CSYdwGFDzenLZWw==.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xm25i6ct.default-release\bookmarkbackups\bookmarks-2024-02-19_11_hpsfC4+CSYdwGFDzenLZWw==.jsonlz4
Size 942B
SHA256 8f2acd6ee2753d92c74e122ec9e6fa4fd9013c5b09b6a705434a319637d7d8c5
MD5 366f0f02058e89fb1849db1b05fb72c5
SHA1 2210fb917e541713686aa8a5c1bebcff661af0aa
SHA512 3c59ff7f02701ed7bf938b7e63da9a62eb8e87c3d1f8a73e07280ade076c593962c60d89511f18a3c184afc1d9cb612939fdfe7f986fb2e5bcfa194d21aa6825
MD5 SHA1 SHA512

Submit Download

broadcast-listeners.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xm25i6ct.default-release\broadcast-listeners.json
Size 204B
SHA256 9cf589357fceea2f37cd1a925e5d33fd517a44d22a16c357f7fb5d4d187034aa
MD5 72c95709e1a3b27919e13d28bbe8e8a2
SHA1 00892decbee63d627057730bfc0c6a4f13099ee4
SHA512 613ca9dd2d12afe31fb2c4a8d9337eeecfb58dabaeaaba11404b9a736a4073dfd9b473ba27c1183d3cc91d5a9233a83dce5a135a81f755d978cea9e198209182
MD5 SHA1 SHA512

Submit Download

data.safe.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xm25i6ct.default-release\datareporting\glean\db\data.safe.bin
Size 2KB
SHA256 647260fddd1322c41eb33fa989274f7694160b3638a355f9373c1ff92849adef
MD5 2e9106c46dab6c84971434a7e79bafd6
SHA1 03b053edde31fbf81c6af5b8ac9393b109553459
SHA512 481c8cddbb2fdfac48a6e3896a2fed8aa6b0b4322acf038b9fc19fe48a72ec9148a68a78bc769ed87d71cc7b307936c6e973caba6ae22a4f8d8eff6ceca66e26
MD5 SHA1 SHA512

Submit Download

data.safe.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xm25i6ct.default-release\datareporting\glean\db\data.safe.bin
Size 2KB
SHA256 e14a37235cffc677a8b05034506ba4a7b754f0e45355303d27f40b68f129e360
MD5 f468d956be69dd2297de2ef5a8fffdde
SHA1 c7a292f0672450b960b07ab65c2f0792190aa96f
SHA512 186d7135b40374683f303f817bd29690b6e2b3bfc77745a317f7083660aa1e1ebf2643a91a72f3a4471080225aa379104169bfe661b7f8d0874eb8099b45e602
MD5 SHA1 SHA512

Submit Download

47a013cc-a85e-4f23-87e9-b4ea614efb14

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xm25i6ct.default-release\datareporting\glean\pending_pings\47a013cc-a85e-4f23-87e9-b4ea614efb14
Size 12KB
SHA256 3825673f6b588d6fd66194daa1cf01a3d9ac851b0f929919797d1029c3f35341
MD5 8b110dbf797ba2027ee0b5ec961de3a8
SHA1 6269da0b815ec3cca0445614fd23240620013d74
SHA512 50a5fb9e5786779999a5d51a807374a20e3dd0b15f826d9e58676d49f348620259bdb586f00fc82b5370907af747b15eb246292144e96ff1fd874f5f90d86a26
SSDEEP 192:b8kUq04syKzQKrypi2BUmF+Kmg8qAMeLlJSX777PlcnBX3l1sGagxHjS3vqEUCkL:qKHegCEPkuTI
MD5 SHA1 SHA512 SSDEEP

Submit Download

72568137-a363-43c5-b174-97d284bdf804

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xm25i6ct.default-release\datareporting\glean\pending_pings\72568137-a363-43c5-b174-97d284bdf804
Size 745B
SHA256 cae1ae18273aa40b47063f173074d471adca56ae7fefcd4fccc0836813508a3e
MD5 7859ccc2f7101a7cff01dd135c07a885
SHA1 b9a8cbed050e13b42b1a1709cb015ceae603f976
SHA512 bd55d0a11a4714dd9797bf80f8e83137f302f582f01ab73598b4ffd2631c4f9f9bda4c10f96ad2426e5913954053cc0a7e7f91a746be7254c5d0935769300857
MD5 SHA1 SHA512

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xm25i6ct.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
Size 997KB
SHA256 1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
MD5 fe3355639648c417e8307c6d051e3e37
SHA1 f54602d4b4778da21bc97c7238fc66aa68c8ee34
SHA512 8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c
SSDEEP 12288:vYLdTfFKbNSjv92eFN+3wH+NYriA0Iq6lh6VawYIpAvwHN/Uf1h47HAfg1oet:vYLdTZ923NYrjwNpgwef1hzfg1x
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xm25i6ct.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
Size 116B
SHA256 f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
MD5 3d33cdc0b3d281e67dd52e14435dd04f
SHA1 4db88689282fd4f9e9e6ab95fcbb23df6e6485db
SHA512 a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1
MD5 SHA1 SHA512

Submit Download

LICENSE.txt

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xm25i6ct.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
Size 479B
SHA256 2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
MD5 49ddb419d96dceb9069018535fb2e2fc
SHA1 62aa6fea895a8b68d468a015f6e6ab400d7a7ca6
SHA512 48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xm25i6ct.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
Size 372B
SHA256 e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
MD5 8be33af717bb1b67fbd61c3f4b807e9e
SHA1 7cf17656d174d951957ff36810e874a134dd49e0
SHA512 6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xm25i6ct.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
Size 1.6MB
SHA256 a3cc6fdbeafed8296d9c2f26812d8202a4abe7eedc0cfb792ee8fda765896e8a
MD5 9e1d1a2c42f8f8adf1eebff63923dc37
SHA1 96876883f8aff88406a7e1824c0e6b7acb9e45c0
SHA512 18089303636d5466e475422e872829231af88ac04b4b2fac52aeb5d29b6d47940bd80c22c974fca218309570bdda68dcb74adb1dc1b242bf8e0c3d3f596093a1
SSDEEP 24576:5Xs+8hHvu59775NPalVU2eauvJl1tMvez+Wgo5/np9:5Xs+8h2DPalVFeauwvez+Wgo5x9
MD5 SHA1 SHA512 SSDEEP

Submit Download

widevinecdm.dll.lib

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xm25i6ct.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
Size 1KB
SHA256 33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
MD5 688bed3676d2104e7f17ae1cd2c59404
SHA1 952b2cdf783ac72fcb98338723e9afd38d47ad8e
SHA512 7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll.sig

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xm25i6ct.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
Size 1KB
SHA256 68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
MD5 937326fead5fd401f6cca9118bd9ade9
SHA1 4526a57d4ae14ed29b37632c72aef3c408189d91
SHA512 b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2
MD5 SHA1 SHA512

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xm25i6ct.default-release\prefs-1.js
Size 7KB
SHA256 75c05586fb2799772a02f24e6ba05570e6c2fdd2fb9be56d0a8ece636c02915f
MD5 b0be8517a60c62d3fd736678979ba2c5
SHA1 3458806f48d7cdbbfa9a4a48c9d51e1d3e0a9446
SHA512 01713ddccb42d5a6c559242c5ff5b58829b2d05f4431fd70c4022d7908b5acd6c68399285f905ae0ccd2b8b6abdae6629fa04d15d9f03bd7d5bc4d96a2b10131
SSDEEP 96:xHZvnUTeqGqPudzV0IXeOTzSbmPXAnpjoHHqoYrTHSiBw8HuqQ:PvnIRmdzV0IXeUPX1Hh8Bw8HU
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xm25i6ct.default-release\prefs-1.js
Size 6KB
SHA256 fd2584429aa3c37fc9397ed9a7aece5d6480c9b55a34598bb87177bb71da17b4
MD5 fd7162879e6914498ea8be2f7cb1f198
SHA1 c905f6597a1ef349c7f61ab69deb5ac50b6b5b3a
SHA512 5bbe153b8c66856fc1469f7991624557a21124155eeb9042814020381b617fedae84e73a5cc165793e3b7bc7293d0ba545dcfc4b3cb5370e6f04c542d070a523
SSDEEP 96:xHb5nUTeqGqPudzV0IXeOTzSbmPXAnpjoHHqoJBw8Huqu:h5nIRmdzV0IXeUPX1HhJBw8Hq
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xm25i6ct.default-release\prefs-1.js
Size 7KB
SHA256 6c262774e6d6e9d96fd2afc4894122c66c12dba37c49052569ef2ef86396fef9
MD5 05cf9fca60fd47c60c8080ee41ff5977
SHA1 3a46064f32eacc24715cf576476c73fc1b72c16e
SHA512 4c18127e7b517a84867d93fe1288e6fe4106ba7d417057f3e3f4f17dd3e858f3a876e74def1aa0d8ad5f989d2e21580ab50ff97a9bdf4bd93087a89a1d82b282
SSDEEP 96:xHZhnUTeqGqPudzV0IXeOTzSbmPXAnpjoHHqo6rTH49RBw8HuEQ:PhnIRmdzV0IXeUPX1HhrRBw8HS
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xm25i6ct.default-release\prefs-1.js
Size 6KB
SHA256 3517437fd21b7fa9b512ab713e3ebd973987d12f1aadb841a7b410ed2e63b4a7
MD5 502ce9457a19e767eb86d05f8bdd09c9
SHA1 4bff194887160b823f5d0391efabd66d6f68952a
SHA512 93f679dacf43bae87e34676133e8a18bd368ee706810a28620870636930d1529ef70fc35bdd5b35101e9de346a7aa97b34274cdea3f1a223c453b925fd642ca3
SSDEEP 96:xHbvnUTeqGqPudzV0IXeOTzSbmPXAnpjoHHqoJBw8HuqQ:hvnIRmdzV0IXeUPX1HhJBw8HU
MD5 SHA1 SHA512 SSDEEP

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xm25i6ct.default-release\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
MD5 SHA1 SHA512

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xm25i6ct.default-release\sessionstore-backups\recovery.jsonlz4
Size 4KB
SHA256 603349bca0f2d8e884a46173a7162b09937d16fe8b9517f8a556a96f9ace075f
MD5 89bde7b74f8bdb15130d1242a10ac5a9
SHA1 a6c566ac2e1fec765c8dd2548ce51a32edd80807
SHA512 54f37a91dce38fa2a9b7db94c3cf50f807a14a00e7f3ef9c7dc5d18926db52230a1b872cc04affdb55f9a2eec8cd96924efd709907d583febd4a9dadd015e9a3
SSDEEP 96:HqMPuh8EMJF7oiMZk0zf8W8Qge3ZwS27AcI821oR782E:HqM2hRgFnMZkcuem/Ab82k7E
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xm25i6ct.default-release\sessionstore-backups\recovery.jsonlz4
Size 92KB
SHA256 2f60c075906e057b65d988bac50efaf8341689e1f31a7cf18b7bc17808edd469
MD5 e90e630fbc3ca9ed98f0230f58572edc
SHA1 fa0593502d7b2ac5e88392d0f4d11a9f49132275
SHA512 f536d9d5c6484139496a68f97dd91a617698a6e00c206b7080b0f4269a33140ba7b91714e2c2f11fde9f8c53edbd68c4e4460b7e4e3b5cfad74a7353aebe7319
SSDEEP 1536:1hkNzQV0x7WAr2+KPdsJFn7abTVPK2F/O0MUNAF5w52VILbL8wVWGcyeE1HH0J1G:1hmzQWNpGPeJxabTVsoNAXHJmWGcDE1z
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xm25i6ct.default-release\sessionstore-backups\recovery.jsonlz4
Size 3KB
SHA256 cfdbdaa4dbcbd1669c1824348d074a1a18540cfc0d1e3686a5c2735a94626a0b
MD5 2302e6d94bd6eeeca9244107366f4a3e
SHA1 0747fef85ba55b24b4e38711d0cfc02e8d53b46d
SHA512 7d17540ca810159cbab171086170ac12aac777f7510e48994ca9317879c16807fcb0a0bf6f9a700b4d01ee44c0e8ec7c207acc4c9e661e146a5a3a5613aa2204
MD5 SHA1 SHA512

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xm25i6ct.default-release\sessionstore-backups\recovery.jsonlz4
Size 4KB
SHA256 b3065424a67a4ed1766d163292c4ff407f293421e9214448f44b6836222bdeb0
MD5 82c63b2a7e358474d36ad8d64222b998
SHA1 caee1346248a48abb5546f10fe3cc554fdaf903b
SHA512 fcbf23173f71655d19deffc328cabf0c91df44ae9784b53c9817a8b2b972e5171029fc8ec4cc79d36f515f3739768f57089baac914f3091a40c10156cddcd64b
SSDEEP 96:vqMPUACjAHylhA9db1i6OgNrngbwMyjrxHBSgmaeiZvv:vqMcAC8HghA9db7vNsbuv1mTiZH
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xm25i6ct.default-release\sessionstore-backups\recovery.jsonlz4
Size 96KB
SHA256 a63247f4b363adbf648f2e64a6366d5b253660e83d2ed1a848d44d5187577142
MD5 96f2d4301a3031b56ff6045762178e3c
SHA1 d25385a1c8a7f634b7563e3fa23d96c2397fdaa9
SHA512 9cead4b9df3e28c6e1e789080c00b8e4609f2daf85f3d8e6ddc62c5c1588786b159f42e9c91d883ec45528768da3a99f7bb8b788ade58596992222a56a85a068
SSDEEP 3072:uhnGQWNpGPeJxabTVsoNAXHJmWGcDE1nUMXg:ynGQWOxTVsoNAXJmqo1nUx
MD5 SHA1 SHA512 SSDEEP

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xm25i6ct.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 192KB
SHA256 d9590e6e65f434dcd609d03e171110b2d604fbf13be996ec72c3432f8e4a41ef
MD5 018e91fd05710ec9066bc0802d0db949
SHA1 0fd7cb918eccf9f8739bd406c6be93dd57a94715
SHA512 9fd810a384865abea34e34f4b9eaf99843cf81d9610684279834f3fe77ba2faee72516cb58e391218e585db2112d78cbc35c826df6431efec91d8a24de5dcb3f
SSDEEP 3072:I0cH5CQRuFPc3y3e396X6uaZ3zeHexscqU:I0cH5dR0E3y3N6uaZ3zeH2qU
MD5 SHA1 SHA512 SSDEEP

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xm25i6ct.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 184KB
SHA256 d5e36a0e7c8a3f2f54cf21be864174a5db8b7e9f7bbe06b5dd909cee4981b9ad
MD5 7403d14d6e4ec29afdb0966a97d06dc2
SHA1 8673c6ae8631aa05290590a7be895326dc3dc5a4
SHA512 cbdcd8af55b61084f29566e2dc0ed22423b5ce46f306d9962bd8e41057f67910f67a373aea0c8156cd2100ae4de98ecf078e383e1729b38b537c2af87bbe191f
SSDEEP 3072:nMcHDPRuFP+3y3gE396O6uacMKeHex7kq:nMcHDPR023y3ga6uacMKeHXq
MD5 SHA1 SHA512 SSDEEP

Submit Download

targeting.snapshot.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xm25i6ct.default-release\targeting.snapshot.json
Size 3KB
SHA256 1a664db1efdb5c44122de975c6143e4d04364e9f84e324f9fcc22d0c8df92c92
MD5 fd7e74b7267d78634d2dfd92fb2e56eb
SHA1 33ed0d6b1a74646e440f82c3f6609e27c4956e5d
SHA512 32588151f164daea28a1ff9620b1b8cd265b04c3ccd265a59f2a910619e4e4041d4dfe7d2ee4bd81de8f86cbd95f2127748e3634673b308c64fa7ccb05a2579b
MD5 SHA1 SHA512

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads