e4eba14a008b2f1a8f374e760040f7d9cc240a00554bd88b087acb598f04f13a

Analysis

max time kernel
2333s
max time network
2328s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
26/03/2024, 03:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
benfile.vbs
Size 78B
Sample240326-d2b5qsce83
SHA256 e4eba14a008b2f1a8f374e760040f7d9cc240a00554bd88b087acb598f04f13a
MD5 003a79857978e992f9273cfc47c922ce
SHA1 80e8e32d6591d9f057244bfc6d9b93f7d6e315f3
SHA512 d4d35f7557d0767f0eead849cea3f21cc0ec974c662219198553a45d06bdf6248a234f1d255f79f45083ffbb736600b8fc658a6cd1aac6fe5d61e24a3a646432
MD5 SHA1 SHA512

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ServiceState\WinHttpAutoProxySvc\Data\cachev3.dat	svchost.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\aa-cb-50-fc-3e-e7	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\aa-cb-50-fc-3e-e7\WpadDecisionReason = "1"	svchost.exe
Set value (data)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\aa-cb-50-fc-3e-e7\WpadDecisionTime = 571dfaa6327fda01	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\aa-cb-50-fc-3e-e7\WpadDecision = "0"	svchost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	3516	firefox.exe
Token: SeDebugPrivilege	3516	firefox.exe
Token: SeDebugPrivilege	3516	firefox.exe
Token: SeDebugPrivilege	3516	firefox.exe
Token: SeDebugPrivilege	3516	firefox.exe
Token: SeDebugPrivilege	3516	firefox.exe
Token: SeShutdownPrivilege	3548	svchost.exe
Token: SeCreatePagefilePrivilege	3548	svchost.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
3516	firefox.exe
3516	firefox.exe
3516	firefox.exe
3516	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3516	firefox.exe
3516	firefox.exe
3516	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3516	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 216 wrote to memory of 3516	216	firefox.exe	132
PID 216 wrote to memory of 3516	216	firefox.exe	132
PID 216 wrote to memory of 3516	216	firefox.exe	132
PID 216 wrote to memory of 3516	216	firefox.exe	132
PID 216 wrote to memory of 3516	216	firefox.exe	132
PID 216 wrote to memory of 3516	216	firefox.exe	132
PID 216 wrote to memory of 3516	216	firefox.exe	132
PID 216 wrote to memory of 3516	216	firefox.exe	132
PID 216 wrote to memory of 3516	216	firefox.exe	132
PID 216 wrote to memory of 3516	216	firefox.exe	132
PID 216 wrote to memory of 3516	216	firefox.exe	132
PID 3516 wrote to memory of 3580	3516	firefox.exe	133
PID 3516 wrote to memory of 3580	3516	firefox.exe	133
PID 3516 wrote to memory of 3888	3516	firefox.exe	134
PID 3516 wrote to memory of 3888	3516	firefox.exe	134
PID 3516 wrote to memory of 3888	3516	firefox.exe	134
PID 3516 wrote to memory of 3888	3516	firefox.exe	134
PID 3516 wrote to memory of 3888	3516	firefox.exe	134
PID 3516 wrote to memory of 3888	3516	firefox.exe	134
PID 3516 wrote to memory of 3888	3516	firefox.exe	134
PID 3516 wrote to memory of 3888	3516	firefox.exe	134
PID 3516 wrote to memory of 3888	3516	firefox.exe	134
PID 3516 wrote to memory of 3888	3516	firefox.exe	134
PID 3516 wrote to memory of 3888	3516	firefox.exe	134
PID 3516 wrote to memory of 3888	3516	firefox.exe	134
PID 3516 wrote to memory of 3888	3516	firefox.exe	134
PID 3516 wrote to memory of 3888	3516	firefox.exe	134
PID 3516 wrote to memory of 3888	3516	firefox.exe	134
PID 3516 wrote to memory of 3888	3516	firefox.exe	134
PID 3516 wrote to memory of 3888	3516	firefox.exe	134
PID 3516 wrote to memory of 3888	3516	firefox.exe	134
PID 3516 wrote to memory of 3888	3516	firefox.exe	134
PID 3516 wrote to memory of 3888	3516	firefox.exe	134
PID 3516 wrote to memory of 3888	3516	firefox.exe	134
PID 3516 wrote to memory of 3888	3516	firefox.exe	134
PID 3516 wrote to memory of 3888	3516	firefox.exe	134
PID 3516 wrote to memory of 3888	3516	firefox.exe	134
PID 3516 wrote to memory of 3888	3516	firefox.exe	134
PID 3516 wrote to memory of 3888	3516	firefox.exe	134
PID 3516 wrote to memory of 3888	3516	firefox.exe	134
PID 3516 wrote to memory of 3888	3516	firefox.exe	134
PID 3516 wrote to memory of 3888	3516	firefox.exe	134
PID 3516 wrote to memory of 3888	3516	firefox.exe	134
PID 3516 wrote to memory of 3888	3516	firefox.exe	134
PID 3516 wrote to memory of 3888	3516	firefox.exe	134
PID 3516 wrote to memory of 3888	3516	firefox.exe	134
PID 3516 wrote to memory of 3888	3516	firefox.exe	134
PID 3516 wrote to memory of 3888	3516	firefox.exe	134
PID 3516 wrote to memory of 3888	3516	firefox.exe	134
PID 3516 wrote to memory of 3888	3516	firefox.exe	134
PID 3516 wrote to memory of 3888	3516	firefox.exe	134
PID 3516 wrote to memory of 3888	3516	firefox.exe	134
PID 3516 wrote to memory of 3888	3516	firefox.exe	134
PID 3516 wrote to memory of 3888	3516	firefox.exe	134
PID 3516 wrote to memory of 3888	3516	firefox.exe	134
PID 3516 wrote to memory of 3888	3516	firefox.exe	134
PID 3516 wrote to memory of 3888	3516	firefox.exe	134
PID 3516 wrote to memory of 3888	3516	firefox.exe	134
PID 3516 wrote to memory of 3888	3516	firefox.exe	134
PID 3516 wrote to memory of 3888	3516	firefox.exe	134
PID 3516 wrote to memory of 3888	3516	firefox.exe	134
PID 3516 wrote to memory of 1404	3516	firefox.exe	135
PID 3516 wrote to memory of 1404	3516	firefox.exe	135
PID 3516 wrote to memory of 1404	3516	firefox.exe	135

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\benfile.vbs"
1⤵
PID:624

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5248 --field-trial-handle=2236,i,5367110156796017614,12594004256180761011,262144 --variations-seed-version /prefetch:8
1⤵
PID:1692

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4748 --field-trial-handle=2236,i,5367110156796017614,12594004256180761011,262144 --variations-seed-version /prefetch:8
1⤵
PID:1588

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:216
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3516
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3516.0.435535162\1200031608" -parentBuildID 20221007134813 -prefsHandle 1880 -prefMapHandle 1872 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3403976f-ecce-4a18-a106-9bba2f513196} 3516 "\\.\pipe\gecko-crash-server-pipe.3516" 1960 283f1bee058 gpu
    3⤵
    PID:3580
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3516.1.370389014\98587461" -parentBuildID 20221007134813 -prefsHandle 2348 -prefMapHandle 2344 -prefsLen 20785 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c7cc99df-c6cc-44c3-a09e-72563fc4b8cf} 3516 "\\.\pipe\gecko-crash-server-pipe.3516" 2360 283f1afa258 socket
    3⤵
    PID:3888
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3516.2.516868854\1050741160" -childID 1 -isForBrowser -prefsHandle 3056 -prefMapHandle 2904 -prefsLen 20888 -prefMapSize 233444 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b589925e-5483-484b-b6a2-d86033ea8a9f} 3516 "\\.\pipe\gecko-crash-server-pipe.3516" 3176 283f1b60058 tab
    3⤵
    PID:1404
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3516.3.1889443257\38801343" -childID 2 -isForBrowser -prefsHandle 3616 -prefMapHandle 3612 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {16f11847-94ba-4811-8032-c2c3d1557d20} 3516 "\\.\pipe\gecko-crash-server-pipe.3516" 3624 283f43fee58 tab
    3⤵
    PID:684
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3516.4.541329000\1471264134" -childID 3 -isForBrowser -prefsHandle 3920 -prefMapHandle 3916 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ff74addd-5f72-4a03-8ad4-9fdb68cfdce6} 3516 "\\.\pipe\gecko-crash-server-pipe.3516" 3924 283f6e38458 tab
    3⤵
    PID:4816
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3516.5.89763228\495897492" -childID 4 -isForBrowser -prefsHandle 5260 -prefMapHandle 5064 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fcdd9c32-fac7-43a6-a74a-b4d4884207fb} 3516 "\\.\pipe\gecko-crash-server-pipe.3516" 4908 283f1afc958 tab
    3⤵
    PID:3172
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3516.6.791507699\1895282103" -childID 5 -isForBrowser -prefsHandle 5296 -prefMapHandle 5300 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5510fb9c-835a-4ab5-b993-d2bd557f5db0} 3516 "\\.\pipe\gecko-crash-server-pipe.3516" 5288 283f7e8f758 tab
    3⤵
    PID:2800
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3516.7.2122189868\445246261" -childID 6 -isForBrowser -prefsHandle 5488 -prefMapHandle 5492 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4d07ed2d-d4fc-4bc3-bd73-11619126470b} 3516 "\\.\pipe\gecko-crash-server-pipe.3516" 5572 283f7e91858 tab
    3⤵
    PID:4052
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3516.8.540210994\188048327" -childID 7 -isForBrowser -prefsHandle 5844 -prefMapHandle 3912 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {397996af-0795-4bc4-b23f-8d4d4d5d242b} 3516 "\\.\pipe\gecko-crash-server-pipe.3516" 4892 283e5271f58 tab
    3⤵
    PID:1344

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

20178

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4s2odj76.default-release\cache2\doomed\20178
Size 9KB
SHA256 d4bbd1e623989c3070d2488fb7bbd1e79d3771b13a98622e7d160f9832397d13
MD5 3b30620a4b129025bd1df4957eb3cfa6
SHA1 a01a05774ab843ff150777e22d6ffa244000e68b
SHA512 85173e0edd2e1850bb254afaa5e02f35c28d06f3ff6a7eafffa01dd60def83218943b7a435738a675fa200c2eac616882e328cbab1b2be907b018392dcdc9607
SSDEEP 192:KR0Re46QMJGmpOb8ohsMJGmpOb8ofC2rAl7YNCW2P8ro15j75ywpskCGdfYYpdQg:A0YjQzmm8oszmm86CmAl7YNFU8rIVy8J
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 442KB
SHA256 a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
MD5 85430baed3398695717b0263807cf97c
SHA1 fffbee923cea216f50fce5d54219a188a5100f41
SHA512 06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1
SSDEEP 12288:tESTeqTI2r4ZbCgUKWKNeRcPMb6qlV7hVZe3:tEsed2Xh9/bdzZe3
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 8.0MB
SHA256 345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42
MD5 a01c5ecd6108350ae23d2cddf0e77c17
SHA1 c6ac28a2cd979f1f9a75d56271821d5ff665e2b6
SHA512 b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72
SSDEEP 196608:945hXmP7/cvflwtf0FzVC/5lHevzc8XZbivwEiw3cFTx7z4zV:9tP7/cvflof0FzVgKRF9zw3c9x4zV
MD5 SHA1 SHA512 SSDEEP

Submit Download

6824f4a902c78fbd.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
Size 7KB
SHA256 0445192d849eb4b284b626f9f8357984ed55781e8b336fc349dcd05e6ed0d85f
MD5 fba12dfa5daea2ced3f1cd08eb09c1d6
SHA1 6217b607c8c6cef2a10fd31cd044c896e6f4de3b
SHA512 eac75fd5e024a4df3cf92730cf49e1e518bc473627beaea593c6d863d5613d18e65ab2cfe22286530dba408ade4b97ff9f3e05a382a28cd6c9a9baa811804dd5
SSDEEP 48:v2bdSEJ5UgdwHbBzL9bdSEJ/6BdwHbFNLrbdSEJ/adwHbV2oklvbdSEJIwD3e1LT:vu0v/BNt/9klpzO1GDuIlO1t
MD5 SHA1 SHA512 SSDEEP

Submit Download

addonStartup.json.lz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\addonStartup.json.lz4
Size 5KB
SHA256 9b2c48678582b72ec0a97b0420841792ffda6e7c9f2da1b01c119d4e55360400
MD5 eefc565b30b1f565871b93b959013afa
SHA1 5d8aad289d0896a37e2797607071f32118363bd5
SHA512 5c0376446b65bea560c246677c470f72a4132bc68ba9b0f93bf3b98ef07734345160215b9e8d22b8a5423ffdcb90c56c65d2877b36e229c47e46139259019077
SSDEEP 96:NESb6/hsTwrHC9NN2xWY8ig327m8mD4wB809pbjCeO+04Q83cj8VYxeec96geDAm:NECh2xK10WDJ19BjCZ83cA6eePzMm
MD5 SHA1 SHA512 SSDEEP

Submit Download

bookmarks-2024-03-26_11_8isp+gHyP3QyHg7eXV012w==.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\bookmarkbackups\bookmarks-2024-03-26_11_8isp+gHyP3QyHg7eXV012w==.jsonlz4
Size 950B
SHA256 1496d4f20935c304d2e661264713fb152b1558850d404b59353a09e7f830c264
MD5 4f250385aeaa84a357a344af5ad6354a
SHA1 4f1ca11ca083ed02b315c489223a20017a6ecbc4
SHA512 16e9f6c632ecb3f96663d06f567445f294a0195a922e9e2105893550fba609767602cbaa87dd5380c5888274d7988b25e937335f58200e91db9cce6cc375c0e5
MD5 SHA1 SHA512

Submit Download

broadcast-listeners.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\broadcast-listeners.json
Size 204B
SHA256 9cf589357fceea2f37cd1a925e5d33fd517a44d22a16c357f7fb5d4d187034aa
MD5 72c95709e1a3b27919e13d28bbe8e8a2
SHA1 00892decbee63d627057730bfc0c6a4f13099ee4
SHA512 613ca9dd2d12afe31fb2c4a8d9337eeecfb58dabaeaaba11404b9a736a4073dfd9b473ba27c1183d3cc91d5a9233a83dce5a135a81f755d978cea9e198209182
MD5 SHA1 SHA512

Submit Download

data.safe.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\datareporting\glean\db\data.safe.bin
Size 9KB
SHA256 dfa8785ceeee7624b4a94139c52b61816cd4217e71a1d5f7a7d10772c1d9148b
MD5 d282d7233a16948f93ae097cbe847a9c
SHA1 46e8fb61d4ac054b78541d998620ac0f53662848
SHA512 f3a75d68c2b3d1432c96071b844a5228dd59cc9b1050148dcb87d7e9f8ce7bac5a878cfaf3f8e322c283eeabd59cdb9d8bc93e62a69a040eb29d51e87689c42a
SSDEEP 192:Ne2WyhrMEP0bSCb3bYIbobEbNbnbQbVQnSUAtRE6MidGAx2vTbtO5hJ:Ne2Wyh4EP0bjb3bYIbobEbNbnbQbVQnM
MD5 SHA1 SHA512 SSDEEP

Submit Download

bd29dd82-1cb2-41bc-acb1-29e25c3ef351

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\datareporting\glean\pending_pings\bd29dd82-1cb2-41bc-acb1-29e25c3ef351
Size 734B
SHA256 c83242f7ff90e75abe82684cf15dbf16ade1bd9321d7aeff9867616cc017b64b
MD5 5f6da294f3b91a14f89e0568b247978c
SHA1 d2ef57568090c8828900aeadb8376f5a95a880b2
SHA512 dd68af388825ee58f9eb63e81f6b26fa1a810582d38b5df0f9d069f66fe858e2261ce14b584861816dd3e5bc4a672dce389b70db8809c3145e516df8ad28646b
MD5 SHA1 SHA512

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
Size 997KB
SHA256 1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
MD5 fe3355639648c417e8307c6d051e3e37
SHA1 f54602d4b4778da21bc97c7238fc66aa68c8ee34
SHA512 8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c
SSDEEP 12288:vYLdTfFKbNSjv92eFN+3wH+NYriA0Iq6lh6VawYIpAvwHN/Uf1h47HAfg1oet:vYLdTZ923NYrjwNpgwef1hzfg1x
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
Size 116B
SHA256 f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
MD5 3d33cdc0b3d281e67dd52e14435dd04f
SHA1 4db88689282fd4f9e9e6ab95fcbb23df6e6485db
SHA512 a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1
MD5 SHA1 SHA512

Submit Download

LICENSE.txt

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
Size 479B
SHA256 2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
MD5 49ddb419d96dceb9069018535fb2e2fc
SHA1 62aa6fea895a8b68d468a015f6e6ab400d7a7ca6
SHA512 48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
Size 372B
SHA256 e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
MD5 8be33af717bb1b67fbd61c3f4b807e9e
SHA1 7cf17656d174d951957ff36810e874a134dd49e0
SHA512 6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
Size 9.9MB
SHA256 4839c8a3ef529f4ab258727b0f6d3cc615cf2b8861f29e326ce60acef6de610b
MD5 d67131651e83e38795750a258cf93989
SHA1 694e397e77c58fbe7d6d55bbe5521e21185058ad
SHA512 dadc635320fa1d1b4a4ae4d7505c0a3273f5a39a69271f869e17efdd3a05075d265c6e947e47f832b5e1d3b6ea70c66711e4dac19314d54dd7768d16340868d9
SSDEEP 196608:lP4/vkvbdjMq4ytbko4qIUcXkhrVp1HSTDsoTn90lcGeX:lPcvyiXSWxRU/OpZXJX
MD5 SHA1 SHA512 SSDEEP

Submit Download

widevinecdm.dll.lib

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
Size 1KB
SHA256 33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
MD5 688bed3676d2104e7f17ae1cd2c59404
SHA1 952b2cdf783ac72fcb98338723e9afd38d47ad8e
SHA512 7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll.sig

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
Size 1KB
SHA256 68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
MD5 937326fead5fd401f6cca9118bd9ade9
SHA1 4526a57d4ae14ed29b37632c72aef3c408189d91
SHA512 b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2
MD5 SHA1 SHA512

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\prefs-1.js
Size 6KB
SHA256 6df8b223633816fee7ba14f48d1b40dddab075b152ce1b356fd51e65fe32eb26
MD5 e75523c7101e73ef8b7bed2d0fdb966a
SHA1 9606efa45ec5ebcf7639c857dd199e85bc78e451
SHA512 d048d432c42e3429cc22e1c9fa44c8d2f6c94e42cbde5cc2c7ca1a6ef3004be12a872cf2c8dc193d65e2257d6dc929885d729af9ba868068f331593ee6dda618
SSDEEP 96:xHGg5nUTeqGqpdIOqeOTzSWPXAnpj3HhE2u5DtABw8H7k5:35nIRpdIOqeUPXMhExXABw8H8
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\prefs-1.js
Size 7KB
SHA256 587905a568d43f1dab850640e8ec777d0711b90cb328f4e7336aab46b6b85f32
MD5 c09b3968ec0d03b47b9daa8ef69aba7f
SHA1 f367f123a4b77d9650d81b47dfaf815ecfb7b32e
SHA512 772c58d4ed9ac457d00ead45a12fdf99176b740bea2854e6b79f6d289dcab60718d680897fa71485a58079a7c051414087632128f80f195c82ae2b351829cd37
SSDEEP 96:xH5gwnUTeqGqpdIOqeOTzSWPXAnpj3HhE2u5DtLdRBw8H7mZGS:8wnIRpdIOqeUPXMhExXxRBw8Hg
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\prefs-1.js
Size 7KB
SHA256 5d93df529c3826c701b948696c2121ac0da3f10fdebca3d810ae7448c30e3ef2
MD5 0094638cb5240ba97cbef9566712add1
SHA1 5ed83f70c45714f0e80252eec855abf279b72e20
SHA512 1265b1db3040cadcd447e3d169793cca322ec96127c996dfc5a6be4dd5e27ce202fad56dc9b5b45469cfc592a05ed0deda164973dbada91f57010cade054c36a
SSDEEP 96:xH5g9nUTeqGqpdIOqeOTzSWPXAnpj3HhE2u5DtBBw8H7kZGS:89nIRpdIOqeUPXMhExXBBw8H+
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\prefs-1.js
Size 6KB
SHA256 81d7c4473668ca68553a142d630c9582e0a53d09c7844c7f034eaf91b5aa62b4
MD5 8ade06a62a852c8c188de3e15eb50a26
SHA1 b3f2da31a9c8d5787d5d19cbb620397250c5971f
SHA512 0f99cde8766a677290130d10532721fe266b3dc7caffc30f0649de20147d9a01baf631c87fca9a2cc5fe6f0cde90d6d63817ffa64f8eebec891eadfc8f6987cc
SSDEEP 96:xHGg9nUTeqGqpdIOqeOTzSWPXAnpj3HhE2u5DtJBw8H7kZGS:39nIRpdIOqeUPXMhExXJBw8H+
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\prefs.js
Size 6KB
SHA256 c186c2dd9bae6a75a7adfd99102b1a8b37126b5448ddd72e6dd0cc98eac2ea06
MD5 7403f849aa3d219a212f40e96e9cddb1
SHA1 a0cdf68bac6f411b144092192a5ceae94fc10454
SHA512 35ff315daeaf49d6d8c0f2e93f9e748c8e084bdc1a26e92e4685fe21b47609aabf9faea8c71d1c2b63d607476f44a4b05ea9c7bad2666ff1e12ad34dc920129b
SSDEEP 96:xHGg5nUTeqGqpdIV5eOTzSIPXAnpjLHhE2u5DtABw8V7k5:35nIRpdIV5e6PXEhExXABw8V8
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\prefs.js
Size 6KB
SHA256 a2f30423ab6a41e0fc8186852b4b1ebe4d88ae8ac2948d42a42f11486aa758c6
MD5 48a211b16085674f7197d1b73e6f100a
SHA1 835741c43adbc629fa204680ea3da8e1e2a7b004
SHA512 6c744ca7f18aecdc83678c451296ad6db1fa0aca3bd64ba1c4c64300f7b5ddc71d2ede358251ace6ece4b3592b7d1ade1c8d0dd6233e1ea4f22f5024b158c130
SSDEEP 96:xHGg5nUTeqGqpdIV5eOTzSWPXAnpjLHhE2u5DtABw8H7k5:35nIRpdIV5eUPXEhExXABw8H8
MD5 SHA1 SHA512 SSDEEP

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
MD5 SHA1 SHA512

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4
Size 3KB
SHA256 80efd3e22f4ad4090642b9d2768746ac915f36f33c9ba4f8fa8c7cd21fe175fa
MD5 82895ce2ca33da5ab4806de8a8010c5a
SHA1 fb88ae22030f4dcc4232d4a749a1704886f76eea
SHA512 1d5081b9af24aea6dd1d81930eedc4e0bfdd056e920d4ad3e99a02dde6901b10efbfdedd501c654f678cfa55726fb56e8e861e2848f479bef975680db47c856b
MD5 SHA1 SHA512

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4
Size 4KB
SHA256 536add5f2477cf36cc69e70d603df2f2e1c99c291b9ac56d5f8a7e0c167876de
MD5 a916307272ac949f55505ca5ab944763
SHA1 4b95cf3da00aed24243b5c86f87111ee5a593eba
SHA512 5dd9102fbb69432630e0bd9e060872a2cbd263dc04dedc3e32c46d2d8314b35a2f37edce070c12c88d50774c8091f956f3979b4f8d1b3fce10c943ad0a4e3dbf
SSDEEP 96:1i3MGSVMgr08EMJF79cMZk0zf8W8Qk3goS2EHrJw:DVMHRgFCMZkcOL4Hm
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4
Size 4KB
SHA256 cb22292f75db4c3196debc8690ad6b7af93d7cd64fecf01ad20b7692a16594b9
MD5 630bb95be55a8c7d76f21040752c4321
SHA1 b3b3b4bd02639bc237240839fa09802b2d8608c0
SHA512 0955e683bf62f491f8d0106e4d0f8959612b0d995a3611ff3a0bd59be827e2e1f96d2c5c62fa66a5f5f253e7c747e276a4543be3cd26a6bd83a7684a4df80f6e
SSDEEP 96:BGg0qMizYh08EMJF79cMZk0zf8W8Qge3ZwS2z62+4O:Z0qMV2RgFCMZkcuemf6b
MD5 SHA1 SHA512 SSDEEP

Submit Download

targeting.snapshot.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\targeting.snapshot.json
Size 3KB
SHA256 87f49658fa026104aa0582d64740a1b112584e7c6ee16007896888fd95791b30
MD5 74357ccd2055a35a14f1aa563917077b
SHA1 e05e43c43171ffd262f031a4d833ff89b56ba4a3
SHA512 ddc763658665398d5068522b84ce245e4ce3aac5aa93b3ea140f247b9de3b3ba13e759c2b77f45dc940dfab465438b689bac969e4e9ef020531bc26a8a7f7a2f
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads