hxxps://rb[.]gy/hlzihx

Resubmissions

06/04/2024, 19:20

240406-x2gj1ahd3610

06/04/2024, 19:12

240406-xwxzsshb8610

Analysis

max time kernel
65s
max time network
74s
platform
windows10-1703_x64
resource
win10-20240404-es
resource tags

arch:x64arch:x86image:win10-20240404-eslocale:es-esos:windows10-1703-x64systemwindows
submitted
06/04/2024, 19:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://rb.gy/hlzihx
Sample240406-xwxzsshb86

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-81807878-2351072935-4259904108-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4864	firefox.exe
Token: SeDebugPrivilege	4864	firefox.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
4864	firefox.exe
4864	firefox.exe
4864	firefox.exe
4864	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4864	firefox.exe
4864	firefox.exe
4864	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4864	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3640 wrote to memory of 4864	3640	firefox.exe	73
PID 3640 wrote to memory of 4864	3640	firefox.exe	73
PID 3640 wrote to memory of 4864	3640	firefox.exe	73
PID 3640 wrote to memory of 4864	3640	firefox.exe	73
PID 3640 wrote to memory of 4864	3640	firefox.exe	73
PID 3640 wrote to memory of 4864	3640	firefox.exe	73
PID 3640 wrote to memory of 4864	3640	firefox.exe	73
PID 3640 wrote to memory of 4864	3640	firefox.exe	73
PID 3640 wrote to memory of 4864	3640	firefox.exe	73
PID 3640 wrote to memory of 4864	3640	firefox.exe	73
PID 3640 wrote to memory of 4864	3640	firefox.exe	73
PID 4864 wrote to memory of 4396	4864	firefox.exe	74
PID 4864 wrote to memory of 4396	4864	firefox.exe	74
PID 4864 wrote to memory of 2904	4864	firefox.exe	75
PID 4864 wrote to memory of 2904	4864	firefox.exe	75
PID 4864 wrote to memory of 2904	4864	firefox.exe	75
PID 4864 wrote to memory of 2904	4864	firefox.exe	75
PID 4864 wrote to memory of 2904	4864	firefox.exe	75
PID 4864 wrote to memory of 2904	4864	firefox.exe	75
PID 4864 wrote to memory of 2904	4864	firefox.exe	75
PID 4864 wrote to memory of 2904	4864	firefox.exe	75
PID 4864 wrote to memory of 2904	4864	firefox.exe	75
PID 4864 wrote to memory of 2904	4864	firefox.exe	75
PID 4864 wrote to memory of 2904	4864	firefox.exe	75
PID 4864 wrote to memory of 2904	4864	firefox.exe	75
PID 4864 wrote to memory of 2904	4864	firefox.exe	75
PID 4864 wrote to memory of 2904	4864	firefox.exe	75
PID 4864 wrote to memory of 2904	4864	firefox.exe	75
PID 4864 wrote to memory of 2904	4864	firefox.exe	75
PID 4864 wrote to memory of 2904	4864	firefox.exe	75
PID 4864 wrote to memory of 2904	4864	firefox.exe	75
PID 4864 wrote to memory of 2904	4864	firefox.exe	75
PID 4864 wrote to memory of 2904	4864	firefox.exe	75
PID 4864 wrote to memory of 2904	4864	firefox.exe	75
PID 4864 wrote to memory of 2904	4864	firefox.exe	75
PID 4864 wrote to memory of 2904	4864	firefox.exe	75
PID 4864 wrote to memory of 2904	4864	firefox.exe	75
PID 4864 wrote to memory of 2904	4864	firefox.exe	75
PID 4864 wrote to memory of 2904	4864	firefox.exe	75
PID 4864 wrote to memory of 2904	4864	firefox.exe	75
PID 4864 wrote to memory of 2904	4864	firefox.exe	75
PID 4864 wrote to memory of 2904	4864	firefox.exe	75
PID 4864 wrote to memory of 2904	4864	firefox.exe	75
PID 4864 wrote to memory of 2904	4864	firefox.exe	75
PID 4864 wrote to memory of 2904	4864	firefox.exe	75
PID 4864 wrote to memory of 2904	4864	firefox.exe	75
PID 4864 wrote to memory of 2904	4864	firefox.exe	75
PID 4864 wrote to memory of 2904	4864	firefox.exe	75
PID 4864 wrote to memory of 2904	4864	firefox.exe	75
PID 4864 wrote to memory of 2904	4864	firefox.exe	75
PID 4864 wrote to memory of 2904	4864	firefox.exe	75
PID 4864 wrote to memory of 2904	4864	firefox.exe	75
PID 4864 wrote to memory of 2904	4864	firefox.exe	75
PID 4864 wrote to memory of 2904	4864	firefox.exe	75
PID 4864 wrote to memory of 2904	4864	firefox.exe	75
PID 4864 wrote to memory of 2904	4864	firefox.exe	75
PID 4864 wrote to memory of 2904	4864	firefox.exe	75
PID 4864 wrote to memory of 2904	4864	firefox.exe	75
PID 4864 wrote to memory of 2904	4864	firefox.exe	75
PID 4864 wrote to memory of 2904	4864	firefox.exe	75
PID 4864 wrote to memory of 2904	4864	firefox.exe	75
PID 4864 wrote to memory of 3760	4864	firefox.exe	76
PID 4864 wrote to memory of 3760	4864	firefox.exe	76
PID 4864 wrote to memory of 3760	4864	firefox.exe	76

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://rb.gy/hlzihx"
1⤵
- Suspicious use of WriteProcessMemory
PID:3640
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://rb.gy/hlzihx
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4864
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4864.0.1165434098\1165576529" -parentBuildID 20221007134813 -prefsHandle 1716 -prefMapHandle 1704 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {25a804ca-52ac-4367-b091-dde089795d3a} 4864 "\\.\pipe\gecko-crash-server-pipe.4864" 1808 150d72d1958 gpu
    3⤵
    PID:4396
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4864.1.2141733747\341705124" -parentBuildID 20221007134813 -prefsHandle 2172 -prefMapHandle 2168 -prefsLen 21608 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {59e3b312-5f6f-44b9-b3bf-2a42a3541a39} 4864 "\\.\pipe\gecko-crash-server-pipe.4864" 2184 150d71f0158 socket
    3⤵
    PID:2904
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4864.2.1022630312\1047100344" -childID 1 -isForBrowser -prefsHandle 2704 -prefMapHandle 2824 -prefsLen 21711 -prefMapSize 233444 -jsInitHandle 1168 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {beac57d8-5dcb-451f-976c-919112374a4e} 4864 "\\.\pipe\gecko-crash-server-pipe.4864" 2712 150d725ae58 tab
    3⤵
    PID:3760
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4864.3.1392256276\1250427845" -childID 2 -isForBrowser -prefsHandle 3620 -prefMapHandle 3616 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1168 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0e802856-5a49-4842-9892-54f029fa19e3} 4864 "\\.\pipe\gecko-crash-server-pipe.4864" 3628 150cc262858 tab
    3⤵
    PID:3104
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4864.4.146994798\1531785786" -childID 3 -isForBrowser -prefsHandle 4688 -prefMapHandle 4708 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1168 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {312938ae-0f13-4103-bfd1-ee5af6c21dc7} 4864 "\\.\pipe\gecko-crash-server-pipe.4864" 4664 150ddf90e58 tab
    3⤵
    PID:4116
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4864.5.276767969\779456735" -childID 4 -isForBrowser -prefsHandle 4828 -prefMapHandle 4832 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1168 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ceb35fb5-37ad-41cd-9ec4-b88676470af2} 4864 "\\.\pipe\gecko-crash-server-pipe.4864" 4820 150ddf8e158 tab
    3⤵
    PID:3076
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4864.6.2087006620\1094894515" -childID 5 -isForBrowser -prefsHandle 5020 -prefMapHandle 5024 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1168 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {348586f8-152d-4b92-9dc1-1feb277c82ec} 4864 "\\.\pipe\gecko-crash-server-pipe.4864" 5012 150ddf8ea58 tab
    3⤵
    PID:4892
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4864.7.1596649878\1006807951" -childID 6 -isForBrowser -prefsHandle 2684 -prefMapHandle 2816 -prefsLen 26249 -prefMapSize 233444 -jsInitHandle 1168 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {571d6c12-e1aa-4161-814f-94c6a1abf610} 4864 "\\.\pipe\gecko-crash-server-pipe.4864" 5380 150dea8ef58 tab
    3⤵
    PID:2376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1254

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\gk3spf86.default-release\cache2\doomed\1254
Size 15KB
SHA256 bbd244b0fa07fee94fdf1a1c62ebf1abc7b63dc3df33246e8bd005896e0259ad
MD5 be5204bf8a7e30e2c061f35a75472b80
SHA1 615659e19942c4dc2f9d035cf237eeb833eb470f
SHA512 2f51c253a23094ffb46ee96ed1cddfc6bbe7bc22bf239b245c704da8916d22fb8debff9a903bb945e3e1c1d6c295053d025f4210efbb98fcab099a7bc29f3a1e
SSDEEP 384:MtCflpffUd8NNSxI8hbW82JL9epgpyIq2epgpyIP5gE6baAC5Sp5n2:x9pkK3SKf86R4gpyIq24gpyIP5gEwaN
MD5 SHA1 SHA512 SSDEEP

Submit Download

12969

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\gk3spf86.default-release\cache2\doomed\12969
Size 10KB
SHA256 a56837bcf5ad7b8b62c9a0a464db9cb6fffb12757716f16782199b537dd9dcd9
MD5 3b4eceb3245f3092a3b9a0ad32d4fddd
SHA1 84fad4268bda612f768b7af287b0c8e208f67009
SHA512 67e1d07051096acfbae6614bac9fdae2a3ce67514f2ca36d56850f77a097575a88a0f606cd67d0e06022c2127e2d17e1908d745ac99c4ac6acbd2486027c7602
SSDEEP 192:WStY1N2J93azBMzpgpyIrMdoBMzpgpyIrMKXkkJguvpbYbmDAOfFn3OFnTt:q1NVNepgpyIq2epgpyIP5gE6baAOd3EJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

14316

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\gk3spf86.default-release\cache2\doomed\14316
Size 68KB
SHA256 4a6b2ce5919ef791e3bec8a6e1993c23db391dc3e86866fda2166f17d1abd0f2
MD5 a022f64b50a7647972791461634545d3
SHA1 7a43791df9f03cdf5ad6a51cdd150afb0e0fe0d2
SHA512 78776090b7f512d9b2a72ca8df9dda8ac425de9f9bfac2cbc65b15e99624a8cd05711e78bc99a766a65af3c7ff40951034773e59de91e7aeda082ca3fcd01b94
SSDEEP 1536:EDifdotWjvSdvgjVnomfvx6BB/hQn6c5E2lgu/Y2Ymx:Og6tWDbVnoWvxIGjgu/R5x
MD5 SHA1 SHA512 SSDEEP

Submit Download

20959

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\gk3spf86.default-release\cache2\doomed\20959
Size 38KB
SHA256 b57024f651af097bada7a729e5e290484c8d7aaae210f06844d1676ee388e768
MD5 8573cbf52ebcccc2ba87cf6509d2d6e4
SHA1 e246116971748fd010a139e31c900c9f04cbf31b
SHA512 287396c3fe8e015417a23e97d8f64a51f7d09c38504b8c00ad07588a85054b95f0e403df7045bc26813ec9f837cdab0d0c5234b1e12d1cab44a17c73f3d701f7
SSDEEP 768:b/3CUhI77vs+sGE0WZDg8lJZpJq6o3eQqFl5D4gpyIq24gpyIP5gEwaB:b6UhSvTQ0WZ08bJtZjF4Y2Yme
MD5 SHA1 SHA512 SSDEEP

Submit Download

26032

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\gk3spf86.default-release\cache2\doomed\26032
Size 9KB
SHA256 bba0b8884193dfc3e9c0855257cb3375c6cd8fcf52c9cbc9dec525ade4b27573
MD5 db4a656ba58e11e87b1fabeb441eec3a
SHA1 cc545d4442a8fa3ad95d08cf638ef43ff7788128
SHA512 bee81b96f7480b7ba70327fd23c1a49f158edbc0197860b062736cb01dcefacae37a61e8fc98fe666bb41f576fcae73d00559d730180c27ace3a70bf57249233
SSDEEP 192:rJFeyBMzpgpyIrMdoBMzpgpyIrMKXkkJguvpbYbmDAH5FnR5FnZ:ds0epgpyIq2epgpyIP5gE6baAHzRzZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

2717

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\gk3spf86.default-release\cache2\doomed\2717
Size 10KB
SHA256 85f003d79f9012646581fd2b4e64c2342a506f13b16756237388cf24d1c7d82c
MD5 5e2e60bd9a0719dbf1fe233c8e41bbda
SHA1 832b961a3ef5e8ef20b660f8f7c8d2dce285461d
SHA512 5e980ecc3fec9aaa953dba85844fd343f73558fd12fba0582bb8817977922a134d51ab1be9fc1c623eda61b9cb9cfab3dc4e99834c7fa2b7c89d6defe22ebbb7
SSDEEP 192:/zBNMfBMzpgpyIrMdoBMzpgpyIrMKXkkJguvpbYbmDA4MFntxFnl:lyepgpyIq2epgpyIP5gE6baA4Otrl
MD5 SHA1 SHA512 SSDEEP

Submit Download

27307

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\gk3spf86.default-release\cache2\doomed\27307
Size 10KB
SHA256 9a410f126c9227680eff75f0913cd05a1c78078bf68ad0fbdef0bab9dc0bb3d6
MD5 338c28d275908a1cd51d2802fcecb49b
SHA1 e7ae4d337ff45daa9d48d5157ee04cb5a3e4a50a
SHA512 6b2dab835fa566dadcc70076fd8da5981049a5e6cebd53ac9f23b645f1d2f608d4343afdbc776de4e78f8e6f29658e2c953f399fab4c928dbb702bb59bc8927e
SSDEEP 192:Ek5LgDM0IBMzpgpyIrMdoBMzpgpyIrMKXkkJguvpbYbmDAS5LFnD56FnH:Ekn0WepgpyIq2epgpyIP5gE6baAS5ZDq
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\gk3spf86.default-release\cache2\doomed\29
Size 10KB
SHA256 d43d3f0b55c3f5b68a02d78d4b5ba49b8e9212b575591c6a76d59a96531b4d8b
MD5 8bca19a523a89f64e4d192dc2eb25382
SHA1 a9c9f095db91d7fe6e597c1c97e265eee02940e9
SHA512 e6297254481cbab564a28de5ce1bced21d9e8093a73b9b51b6c265edc96102bf03b55d3721bf9470d174fb0fffd1c673517cb5a263847fd18655095afe8895cb
SSDEEP 192:T5pdmBMzpgpyIrMdoBMzpgpyIrMKXkkJguvpbYbmDArMPFnyJPFnTU:TtoepgpyIq2epgpyIP5gE6baArmyvw
MD5 SHA1 SHA512 SSDEEP

Submit Download

30195

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\gk3spf86.default-release\cache2\doomed\30195
Size 11KB
SHA256 db772af5b1e46a893d34a015754ab8dddad84ca9e84a2d4e82c8ee5909e8abd7
MD5 3e1812a10d8de4eb6102a09b72bb372a
SHA1 d6dc248fa25b251a39b80be91981deea7683ed58
SHA512 71038ed2a54b62d9b974da8359cdf21ff5bf28af6d1959e988925e82e83e5772d2ef3d44e3802e10ae3d957a560db6f1ae483e8a416c4bcccb11eb4b0c7a1b0a
SSDEEP 192:OWBuMQ+OOM0BMzpgpyIrMdoBMzpgpyIrMKXkkJguvpbYbmDA2MrFntMaFnp:OW9Q7SepgpyIq2epgpyIP5gE6baA2M5h
MD5 SHA1 SHA512 SSDEEP

Submit Download

30487

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\gk3spf86.default-release\cache2\doomed\30487
Size 9KB
SHA256 3427f79d0909681038b87d5585b9c6a5b098367ae2ebfc0ef6895539b266fbbd
MD5 dc3ec153e5d028a3edb30318dc3e5597
SHA1 0de456033a13d63cb470b5afde50b2941bb1f6ef
SHA512 554970764648a0761caad80b87eb701f4f6a39e5d24556dcdba3360ce32de58a4229e48d52a92a89d790254c433aa5ccc74693751d00294a73fd67f41f5bc885
SSDEEP 192:DhBMzpgpyIrMdoBMzpgpyIrMKXkkJguvpbYbmDAkAFnddFnTM:7epgpyIq2epgpyIP5gE6baAkSdnTM
MD5 SHA1 SHA512 SSDEEP

Submit Download

4726

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\gk3spf86.default-release\cache2\doomed\4726
Size 9KB
SHA256 33734c2a328d33998e5924ec80410ab65717a4873a70afd33aeb4db3b30ee1d7
MD5 da2dab9b842d0f69b3d35f331059ed44
SHA1 8385e16176df25daf524725dadcf5e6cd6b76a8c
SHA512 2b012ec3dc23309e421e62b69ce3d7a2ff8acc24d6762dc3bd3bebb28af1ed602df27212f3952510a4bd96fd3620da0ecd1f2fda5162966a57b1b18f67873f85
SSDEEP 192:aJFpBMzpgpyIrMdoBMzpgpyIrMKXkkJguvpbYbmDANmFnfmFnW:4FepgpyIq2epgpyIP5gE6baAN8f8W
MD5 SHA1 SHA512 SSDEEP

Submit Download

5957

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\gk3spf86.default-release\cache2\doomed\5957
Size 16KB
SHA256 1fd450896d5abfc1ef1059f4eabfec65d379715d4f75be0b2c87d84add104978
MD5 bfef0fa1e8cce070a72e64e60db67dfc
SHA1 a66844ddfe1ca29f1f4bd063f0e71388744ce16a
SHA512 df5cdde1b521d43de6ab353097e72e8f5b509386a484863faa7f4fa69bfb86c239c76dd2366b04a652a981773b1334eee710acdc1a4d3827b4fd071ec8b7d481
SSDEEP 384:EwC7lXdDjMUiMXwIPoKffyYpIQ4ShUepgpyIq2epgpyIP5gE6baAIb52h:I7l9dxwMoKirQfhU4gpyIq24gpyIP5g1
MD5 SHA1 SHA512 SSDEEP

Submit Download

6326

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\gk3spf86.default-release\cache2\doomed\6326
Size 9KB
SHA256 3e68c9782269ac6416e4ec9a45ea260ec58ae3f8cdf862abeb9c276fd9b6c2c2
MD5 a10c2c57ae7ac90317ac3438134ad3a4
SHA1 f3bc0937cc0e3103935d141ea7d75ea6b5c2ff9f
SHA512 55dc57844b6a6a42bbf71c87d265b0c1d3ca01aba4c13add79c6b4b957c9edcacf54f1ce947e983de62fe78f88f94ba7f287ba20f9c19af7b210202e95b5eb44
SSDEEP 192:5BMzpgpyIrMdoBMzpgpyIrMKXkkJguvpbYbmDA8fbFnrfWFnj:fepgpyIq2epgpyIP5gE6baA8fJrfMj
MD5 SHA1 SHA512 SSDEEP

Submit Download

6736

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\gk3spf86.default-release\cache2\doomed\6736
Size 9KB
SHA256 e5db152984c07b5d2c90b4ed36e74e315b100ce4147be22765f5280c351abef1
MD5 0c15e7c5c85f1cb59d535ec4224911e1
SHA1 428909e26b6a4974cf0b661f7945361171efeab5
SHA512 1b4e968aa8adc954537abf6d2cb6146f5e47d1868e3785c6139242ce4edb0bd31df97033478c2f0a71b50b02bdf1ba175bcf84d5d7c84749ae726151035e041a
SSDEEP 192:kYdBMzpgpyIrMdoBMzpgpyIrMKXkkJguvpbYbmDAld1Fn6dIFn8:FjepgpyIq2epgpyIP5gE6baAldf6da8
MD5 SHA1 SHA512 SSDEEP

Submit Download

692

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\gk3spf86.default-release\cache2\doomed\692
Size 94KB
SHA256 016bfda8a2e01c058b5eb001f8d5a030a910fbf06b82152fc7a5a70821549c57
MD5 0258bdd94ee0fc0fb63672c90e27b415
SHA1 0fd715eacf6e4931cda7dc21c61fadc78b1585cb
SHA512 71ecf4f84f315c9c532fb179ca8227e83edaf761539a25fc9d23b9354499fae5219bbcfd4861d866e71129badbf451e710857b8bdb15238af686a535a947f2e3
SSDEEP 1536:6Rb4KLWDv+rmPMm3lPJnMNBN0Ds+n4Ke0RTyzPnmIalIY2YmB:6d4LmrlNz0DVn4Ky+IyIR5B
MD5 SHA1 SHA512 SSDEEP

Submit Download

7897

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\gk3spf86.default-release\cache2\doomed\7897
Size 8KB
SHA256 567a447d54d0e809cb7ed9ce996570685918ce0fb6636146ee73d9ec17549baa
MD5 a901d1e7faf61377da7f2743bb4f4885
SHA1 97fb61e84e60d15bcd3a0f61f92503851aa5a6ea
SHA512 415909f4d9e16ec5fab9b922f9deace6183a0473b19e6c341bffe27317872cbfa39746b30e231d440c14d8dfe1e230b4bf37e138a066c6f69cd2e5ca730548ed
SSDEEP 192:Mq3K6ilw8XvtHToFNKCpaeEFZNkR41DtEj7Cx:9KXljXvxsFNB9EFZNke12jc
MD5 SHA1 SHA512 SSDEEP

Submit Download

9842

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\gk3spf86.default-release\cache2\doomed\9842
Size 10KB
SHA256 34c211f359d99d112d7cb1700022ed2329b31fdf2523392860f2d3309d52ae26
MD5 142a68aa9003bff025400eec89067a42
SHA1 3c123b29d180cb32405c9383e2a38a5ae86714bb
SHA512 7ef22f4e41f054e1427f2315f1bd82d9157258edd18f8c98d9724898953591c321ef46e0f858bfc674c3d04809372fdfc9f611faeab5cd1966b57a1965642a9b
SSDEEP 192:r1alNiPJBMzpgpyIrMdoBMzpgpyIrMKXkkJguvpbYbmDAGYFnvNFnP:8lsepgpyIq2epgpyIP5gE6baAGKv3P
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 442KB
SHA256 a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
MD5 85430baed3398695717b0263807cf97c
SHA1 fffbee923cea216f50fce5d54219a188a5100f41
SHA512 06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1
SSDEEP 12288:tESTeqTI2r4ZbCgUKWKNeRcPMb6qlV7hVZe3:tEsed2Xh9/bdzZe3
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 8.0MB
SHA256 345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42
MD5 a01c5ecd6108350ae23d2cddf0e77c17
SHA1 c6ac28a2cd979f1f9a75d56271821d5ff665e2b6
SHA512 b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72
SSDEEP 196608:945hXmP7/cvflwtf0FzVC/5lHevzc8XZbivwEiw3cFTx7z4zV:9tP7/cvflof0FzVgKRF9zw3c9x4zV
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gk3spf86.default-release\datareporting\glean\db\data.safe.bin
Size 2KB
SHA256 cdd8d624413f2aa19401d1bf802a7ecb99dcab19fc2641b614797ef6f0b408c8
MD5 2ba6324feffc10a3dd59599e5e745cc1
SHA1 8e6bdf1f43051cf57b0677f609bc831a47bb18f6
SHA512 9f689213a02b1f4162ff77908e1eecbb4d6a3fb804f8d81eb01ed45688e184700b53d15b2f035341d37ffa369aeaa10dcf46b11bddf03c7cfad436445129bac7
MD5 SHA1 SHA512

Submit Download

b9dc79d0-3805-4524-89b2-fd3b9d3a031f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gk3spf86.default-release\datareporting\glean\pending_pings\b9dc79d0-3805-4524-89b2-fd3b9d3a031f
Size 746B
SHA256 a1e4dab5e8ffebb4a9d1c6f59dbc432179a7d6c1ac6781fdb58cc1984775c22f
MD5 e30b059343f062a8186dcdebe9d41f3f
SHA1 3e408aab43323546d83c47849b691c1aa8c0b765
SHA512 bbf7d0a67ee6e24d78f3a4f6eeeb7346a57f143e0848d458270643a84d8f5fdb6239986093a13552f991ab34d13721042c984a255e78cb565a0b82d28b76a4f8
MD5 SHA1 SHA512

Submit Download

d944e729-a560-464d-bc10-144e1543dadc

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gk3spf86.default-release\datareporting\glean\pending_pings\d944e729-a560-464d-bc10-144e1543dadc
Size 11KB
SHA256 b5cb06ff3979cc096ef4a0ecc7c9504949429710a012be3642c61227f393e369
MD5 0a24778cafb4304c3032610733e680ad
SHA1 fa0bef30a8eedb93cfe70b8629eb473e1cfc6739
SHA512 fa35ec8488290755a0c3044a370637b22aae04eaff2632000595e727f4722bc396ec859f592ea58e900349d6fa1c827e75821c49c3875a82b2216d6e2eb8cb49
SSDEEP 192:JR0S+lxmwINUyB2QxvwYWjp1qXmgWReMi19kytVxpYkR6MUVe/pZMpbevc9mx27d:JoiXgC6
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gk3spf86.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
Size 997KB
SHA256 1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
MD5 fe3355639648c417e8307c6d051e3e37
SHA1 f54602d4b4778da21bc97c7238fc66aa68c8ee34
SHA512 8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c
SSDEEP 12288:vYLdTfFKbNSjv92eFN+3wH+NYriA0Iq6lh6VawYIpAvwHN/Uf1h47HAfg1oet:vYLdTZ923NYrjwNpgwef1hzfg1x
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gk3spf86.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
Size 116B
SHA256 f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
MD5 3d33cdc0b3d281e67dd52e14435dd04f
SHA1 4db88689282fd4f9e9e6ab95fcbb23df6e6485db
SHA512 a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1
MD5 SHA1 SHA512

Submit Download

LICENSE.txt

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gk3spf86.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
Size 479B
SHA256 2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
MD5 49ddb419d96dceb9069018535fb2e2fc
SHA1 62aa6fea895a8b68d468a015f6e6ab400d7a7ca6
SHA512 48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gk3spf86.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
Size 372B
SHA256 e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
MD5 8be33af717bb1b67fbd61c3f4b807e9e
SHA1 7cf17656d174d951957ff36810e874a134dd49e0
SHA512 6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gk3spf86.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
Size 11.8MB
SHA256 8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e
MD5 33bf7b0439480effb9fb212efce87b13
SHA1 cee50f2745edc6dc291887b6075ca64d716f495a
SHA512 d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275
SSDEEP 196608:lP4/vkvbdjMq4ytbko4qIUcXkhrVp1HSTDsoTn90lcGeFaxJI3qLaLhFT7Uc:lPcvyiXSWxRU/OpZXJFee3qGhFMc
MD5 SHA1 SHA512 SSDEEP

Submit Download

widevinecdm.dll.lib

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gk3spf86.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
Size 1KB
SHA256 33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
MD5 688bed3676d2104e7f17ae1cd2c59404
SHA1 952b2cdf783ac72fcb98338723e9afd38d47ad8e
SHA512 7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll.sig

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gk3spf86.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
Size 1KB
SHA256 68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
MD5 937326fead5fd401f6cca9118bd9ade9
SHA1 4526a57d4ae14ed29b37632c72aef3c408189d91
SHA512 b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2
MD5 SHA1 SHA512

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gk3spf86.default-release\prefs-1.js
Size 6KB
SHA256 4d86313ded7338ffe147117cb254604dbc0b5e3bff8fad956a795f724cec72b1
MD5 137a29d9b39ba932b5a2e9b91c7430fb
SHA1 692a911b368ce157903d3073b661cc6958d99e3c
SHA512 a1074450ce8cfd28eb0e55a4285007270158cb49cf903acb6fc7f2e33f326088a3e44e00ab66faf2e9b0c2dd92e4ed16b4063236003a88aa995da5c7e1da11cb
SSDEEP 96:xHA5nUTeqGqvBNdp3MUeOTzS1PXAnpj+HwvBZjmVBw8H96/:i5nIRvBNdp3MUebPXXwvBkVBw8H9U
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gk3spf86.default-release\prefs-1.js
Size 7KB
SHA256 f72911210bff504ff2268aa6546a67248cd5c033264ee47c6e0480a264db7a9e
MD5 8e189b7e021c69b0cd9fda148e494a76
SHA1 6cc30f0af111b89f11ae6cb852c3975995c2a4cf
SHA512 0dd4dbbeb581af08608a310e13e3f9ed544487fbaed77a1927440dc537a3b5ca7778083755c523d46c83f27d1b68f4012181b8a84bfaebe35d6d392d295dddf3
SSDEEP 96:xHtSnUTeqGqvBNdp3MUeOTzS1PXAnpj+HwvBZjmSBw8H96J:rSnIRvBNdp3MUebPXXwvBkSBw8H9C
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gk3spf86.default-release\prefs-1.js
Size 6KB
SHA256 f1fd815e30f772d2377d62390dad8ad8d706bb8d62d645d35fe8506dc8524159
MD5 460426ef35a086573e30e323521b8bc9
SHA1 f5627a0c4243a66b8ac0caf35c8d85335a838a6a
SHA512 619364491591ee486ef85bf448dc1b0ccaade38516cd5a10d74b48a1f8c2b0fc839be6a0e46dc454e0427559b372f16f9a7afd25bad006a306dae7e1c094c497
SSDEEP 96:xHASnUTeqGqvBNdp3MUeOTzS1PXAnpj+HwvBZjmVBw8H96J:iSnIRvBNdp3MUebPXXwvBkVBw8H9C
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gk3spf86.default-release\sessionstore-backups\recovery.jsonlz4
Size 6KB
SHA256 dfb28a8174932e03b0868cfa0e206549f65cdde0b84101fae5b1d4da8e127d1c
MD5 adc485e3940219bb7fc9bf46b4b302fe
SHA1 ad38ff942b0aa27449ef11a5f6f720d4936b87c1
SHA512 8715613af1edb86a2d45b4f51e2e0da6c58c61db91a5cf77d051ac2af2224ec561e217f61e58d97703ff88ebd2aaf95432383599c60f6847a78417253baa2cf7
SSDEEP 96:+FAavs4r9gOz3MISdNLOf2HhiJGC421PdZaBiiLxPp0WR4j8qCAYRG:mvdr933MZOf7JGCL1ZaIMxPSLv7
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gk3spf86.default-release\sessionstore-backups\recovery.jsonlz4
Size 5KB
SHA256 600b90e079aa11fa9ee5a4f28e2740870cfcc667b32c73c05ddb34ea63092500
MD5 8f5fd615a66eb3621a85d797f955e3d1
SHA1 6161f95c2b5dc8cc2643d6d7c7d8a42e7e58d13d
SHA512 d9062cfd420c8c9ddbbabf8eca7e482020faf5282883306966a1af4e28a758edb4587a05c410b7517924300b6d5a59784b5b4ec3c5b8a5be2de8eee1ff41c9d1
SSDEEP 96:dFAavs4r9gYQM0rlpOfnH5L6JGC421aZaBiSLsPpmWR4gIKpC0eTiX5:vvdr9EJOfgJGCLaZaI8sPgoIyh
MD5 SHA1 SHA512 SSDEEP

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gk3spf86.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 192KB
SHA256 09089afb133f1a8665be5211adc64c2375e31f7af417a36e5b4adb12e60b9e56
MD5 4b8813a6dff0b852d218207e278e9e95
SHA1 fc5f8c1b1b8fdcb767460ecb7d432fc35a8375b3
SHA512 bad27de981a403cf96933a86a4c773fcb63e33e3a35596e87cd513b25035bfa68e4fced3cad1e6d3a0066f01ac0c637a2753f2524db67b4152244161d07dd87e
SSDEEP 3072:V0cH6EQRuFPc3y3e396X6uaZ3zeHYxUKN:V0cH6rR0E3y3V6uaZ3zeHZKN
MD5 SHA1 SHA512 SSDEEP

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads