Overview
overview
4Static
static
1pagefile.7z
windows7-x64
3pagefile.7z
windows10-1703-x64
3pagefile.7z
windows10-2004-x64
3pagefile.7z
windows11-21h2-x64
3pagefile.7z
android-10-x64
pagefile.7z
android-11-x64
pagefile.7z
android-13-x64
pagefile.7z
android-9-x86
pagefile.7z
macos-10.15-amd64
4pagefile.7z
debian-12-armhf
pagefile.7z
debian-12-mipsel
pagefile.7z
debian-9-armhf
pagefile.7z
debian-9-mips
pagefile.7z
debian-9-mipsel
pagefile.7z
ubuntu-18.04-amd64
pagefile.7z
ubuntu-20.04-amd64
pagefile.sys
windows7-x64
3pagefile.sys
windows10-1703-x64
3pagefile.sys
windows10-2004-x64
3pagefile.sys
windows11-21h2-x64
3pagefile.sys
android-10-x64
pagefile.sys
android-11-x64
pagefile.sys
android-13-x64
pagefile.sys
android-9-x86
pagefile.sys
macos-10.15-amd64
4pagefile.sys
debian-12-armhf
pagefile.sys
debian-12-mipsel
pagefile.sys
debian-9-armhf
pagefile.sys
debian-9-mips
pagefile.sys
debian-9-mipsel
pagefile.sys
ubuntu-18.04-amd64
pagefile.sys
ubuntu-20.04-amd64
Analysis
-
max time kernel
613s -
max time network
1588s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
21/05/2024, 00:50 UTC
Static task
static1
Behavioral task
behavioral1
Sample
pagefile.7z
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
pagefile.7z
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
pagefile.7z
Resource
win10v2004-20240426-en
Behavioral task
behavioral4
Sample
pagefile.7z
Resource
win11-20240426-en
Behavioral task
behavioral5
Sample
pagefile.7z
Resource
android-x64-20240514-en
Behavioral task
behavioral6
Sample
pagefile.7z
Resource
android-x64-arm64-20240514-en
Behavioral task
behavioral7
Sample
pagefile.7z
Resource
android-33-x64-arm64-20240514-en
Behavioral task
behavioral8
Sample
pagefile.7z
Resource
android-x86-arm-20240514-en
Behavioral task
behavioral9
Sample
pagefile.7z
Resource
macos-20240410-en
Behavioral task
behavioral10
Sample
pagefile.7z
Resource
debian12-armhf-20240221-en
Behavioral task
behavioral11
Sample
pagefile.7z
Resource
debian12-mipsel-20240418-en
Behavioral task
behavioral12
Sample
pagefile.7z
Resource
debian9-armhf-20240226-en
Behavioral task
behavioral13
Sample
pagefile.7z
Resource
debian9-mipsbe-20240418-en
Behavioral task
behavioral14
Sample
pagefile.7z
Resource
debian9-mipsel-20240418-en
Behavioral task
behavioral15
Sample
pagefile.7z
Resource
ubuntu1804-amd64-20240508-en
Behavioral task
behavioral16
Sample
pagefile.7z
Resource
ubuntu2004-amd64-20240508-en
Behavioral task
behavioral17
Sample
pagefile.sys
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
pagefile.sys
Resource
win10-20240404-en
Behavioral task
behavioral19
Sample
pagefile.sys
Resource
win10v2004-20240508-en
Behavioral task
behavioral20
Sample
pagefile.sys
Resource
win11-20240508-en
Behavioral task
behavioral21
Sample
pagefile.sys
Resource
android-x64-20240514-en
Behavioral task
behavioral22
Sample
pagefile.sys
Resource
android-x64-arm64-20240514-en
Behavioral task
behavioral23
Sample
pagefile.sys
Resource
android-33-x64-arm64-20240514-en
Behavioral task
behavioral24
Sample
pagefile.sys
Resource
android-x86-arm-20240514-en
Behavioral task
behavioral25
Sample
pagefile.sys
Resource
macos-20240410-en
Behavioral task
behavioral26
Sample
pagefile.sys
Resource
debian12-armhf-20240418-en
Behavioral task
behavioral27
Sample
pagefile.sys
Resource
debian12-mipsel-20240221-en
Behavioral task
behavioral28
Sample
pagefile.sys
Resource
debian9-armhf-20240418-en
Behavioral task
behavioral29
Sample
pagefile.sys
Resource
debian9-mipsbe-20240418-en
Behavioral task
behavioral30
Sample
pagefile.sys
Resource
debian9-mipsel-20240418-en
Behavioral task
behavioral31
Sample
pagefile.sys
Resource
ubuntu1804-amd64-20240508-en
Behavioral task
behavioral32
Sample
pagefile.sys
Resource
ubuntu2004-amd64-20240508-en
General
-
Target
pagefile.7z
-
Size
79.4MB
-
MD5
ecda4d60df1dd5a867f94f75076103ea
-
SHA1
e9e4c67cd80950f418e17ccecf699ba3e70b9201
-
SHA256
b4b96e61980599af727294cc05e85675e789f872b5c42346096f422c118de084
-
SHA512
f2f9f34158966a42e8ced2684c8febfb72973636d2e662fa4b80c2c2edec51cb0285e7a0f097fb38d8adbce2fb6b718d09a0ee015c5875d369783570a3d07133
-
SSDEEP
1572864:3qzvGjsfKKocul6DRJMawJIjK6QD//fB4cGLlR8v7qFrohUxt:30vA8KKo36DMbF603fBzKm7qFP
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe -
Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings firefox.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2624 vlc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2624 vlc.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 204 firefox.exe Token: SeDebugPrivilege 204 firefox.exe -
Suspicious use of FindShellTrayWindow 13 IoCs
pid Process 204 firefox.exe 204 firefox.exe 204 firefox.exe 204 firefox.exe 2624 vlc.exe 2624 vlc.exe 2624 vlc.exe 2624 vlc.exe 2624 vlc.exe 2624 vlc.exe 2624 vlc.exe 2624 vlc.exe 2624 vlc.exe -
Suspicious use of SendNotifyMessage 11 IoCs
pid Process 204 firefox.exe 204 firefox.exe 204 firefox.exe 2624 vlc.exe 2624 vlc.exe 2624 vlc.exe 2624 vlc.exe 2624 vlc.exe 2624 vlc.exe 2624 vlc.exe 2624 vlc.exe -
Suspicious use of SetWindowsHookEx 31 IoCs
pid Process 4576 OpenWith.exe 4576 OpenWith.exe 4576 OpenWith.exe 4576 OpenWith.exe 4576 OpenWith.exe 4576 OpenWith.exe 4576 OpenWith.exe 4576 OpenWith.exe 4576 OpenWith.exe 4576 OpenWith.exe 4576 OpenWith.exe 4576 OpenWith.exe 4576 OpenWith.exe 4576 OpenWith.exe 4576 OpenWith.exe 4576 OpenWith.exe 4576 OpenWith.exe 4576 OpenWith.exe 4576 OpenWith.exe 4576 OpenWith.exe 4576 OpenWith.exe 4576 OpenWith.exe 4576 OpenWith.exe 4576 OpenWith.exe 4576 OpenWith.exe 4576 OpenWith.exe 4576 OpenWith.exe 4576 OpenWith.exe 4576 OpenWith.exe 204 firefox.exe 2624 vlc.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4576 wrote to memory of 5076 4576 OpenWith.exe 76 PID 4576 wrote to memory of 5076 4576 OpenWith.exe 76 PID 5076 wrote to memory of 204 5076 firefox.exe 78 PID 5076 wrote to memory of 204 5076 firefox.exe 78 PID 5076 wrote to memory of 204 5076 firefox.exe 78 PID 5076 wrote to memory of 204 5076 firefox.exe 78 PID 5076 wrote to memory of 204 5076 firefox.exe 78 PID 5076 wrote to memory of 204 5076 firefox.exe 78 PID 5076 wrote to memory of 204 5076 firefox.exe 78 PID 5076 wrote to memory of 204 5076 firefox.exe 78 PID 5076 wrote to memory of 204 5076 firefox.exe 78 PID 5076 wrote to memory of 204 5076 firefox.exe 78 PID 5076 wrote to memory of 204 5076 firefox.exe 78 PID 204 wrote to memory of 2208 204 firefox.exe 79 PID 204 wrote to memory of 2208 204 firefox.exe 79 PID 204 wrote to memory of 4104 204 firefox.exe 80 PID 204 wrote to memory of 4104 204 firefox.exe 80 PID 204 wrote to memory of 4104 204 firefox.exe 80 PID 204 wrote to memory of 4104 204 firefox.exe 80 PID 204 wrote to memory of 4104 204 firefox.exe 80 PID 204 wrote to memory of 4104 204 firefox.exe 80 PID 204 wrote to memory of 4104 204 firefox.exe 80 PID 204 wrote to memory of 4104 204 firefox.exe 80 PID 204 wrote to memory of 4104 204 firefox.exe 80 PID 204 wrote to memory of 4104 204 firefox.exe 80 PID 204 wrote to memory of 4104 204 firefox.exe 80 PID 204 wrote to memory of 4104 204 firefox.exe 80 PID 204 wrote to memory of 4104 204 firefox.exe 80 PID 204 wrote to memory of 4104 204 firefox.exe 80 PID 204 wrote to memory of 4104 204 firefox.exe 80 PID 204 wrote to memory of 4104 204 firefox.exe 80 PID 204 wrote to memory of 4104 204 firefox.exe 80 PID 204 wrote to memory of 4104 204 firefox.exe 80 PID 204 wrote to memory of 4104 204 firefox.exe 80 PID 204 wrote to memory of 4104 204 firefox.exe 80 PID 204 wrote to memory of 4104 204 firefox.exe 80 PID 204 wrote to memory of 4104 204 firefox.exe 80 PID 204 wrote to memory of 4104 204 firefox.exe 80 PID 204 wrote to memory of 4104 204 firefox.exe 80 PID 204 wrote to memory of 4104 204 firefox.exe 80 PID 204 wrote to memory of 4104 204 firefox.exe 80 PID 204 wrote to memory of 4104 204 firefox.exe 80 PID 204 wrote to memory of 4104 204 firefox.exe 80 PID 204 wrote to memory of 4104 204 firefox.exe 80 PID 204 wrote to memory of 4104 204 firefox.exe 80 PID 204 wrote to memory of 4104 204 firefox.exe 80 PID 204 wrote to memory of 4104 204 firefox.exe 80 PID 204 wrote to memory of 4104 204 firefox.exe 80 PID 204 wrote to memory of 4104 204 firefox.exe 80 PID 204 wrote to memory of 4104 204 firefox.exe 80 PID 204 wrote to memory of 4104 204 firefox.exe 80 PID 204 wrote to memory of 4104 204 firefox.exe 80 PID 204 wrote to memory of 4104 204 firefox.exe 80 PID 204 wrote to memory of 4104 204 firefox.exe 80 PID 204 wrote to memory of 4104 204 firefox.exe 80 PID 204 wrote to memory of 4104 204 firefox.exe 80 PID 204 wrote to memory of 4104 204 firefox.exe 80 PID 204 wrote to memory of 4104 204 firefox.exe 80 PID 204 wrote to memory of 4104 204 firefox.exe 80 PID 204 wrote to memory of 4104 204 firefox.exe 80 PID 204 wrote to memory of 4104 204 firefox.exe 80 PID 204 wrote to memory of 4104 204 firefox.exe 80 PID 204 wrote to memory of 4104 204 firefox.exe 80 PID 204 wrote to memory of 2192 204 firefox.exe 81 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\pagefile.7z1⤵
- Modifies registry class
PID:4176
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\pagefile.7z"2⤵
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\AppData\Local\Temp\pagefile.7z3⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:204 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="204.0.1211070746\1537363916" -parentBuildID 20221007134813 -prefsHandle 1716 -prefMapHandle 1704 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {673f686a-5f7d-4d3d-ba93-4b8d966e0cd5} 204 "\\.\pipe\gecko-crash-server-pipe.204" 1680 26e6e205e58 gpu4⤵PID:2208
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="204.1.843721164\2046504232" -parentBuildID 20221007134813 -prefsHandle 2160 -prefMapHandle 2152 -prefsLen 21608 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dac1a4ba-51a6-426e-9827-06bf6cecac72} 204 "\\.\pipe\gecko-crash-server-pipe.204" 2172 26e5ab73858 socket4⤵
- Checks processor information in registry
PID:4104
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="204.2.242377595\587891987" -childID 1 -isForBrowser -prefsHandle 2860 -prefMapHandle 2952 -prefsLen 21646 -prefMapSize 233444 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e915d00f-c210-49cc-9303-6a0864d37119} 204 "\\.\pipe\gecko-crash-server-pipe.204" 2944 26e712d8b58 tab4⤵PID:2192
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="204.3.1228302131\1797576054" -childID 2 -isForBrowser -prefsHandle 3292 -prefMapHandle 3288 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {12a02b3c-466a-4ea1-8113-4d5c7a48d8be} 204 "\\.\pipe\gecko-crash-server-pipe.204" 3324 26e6f6a1358 tab4⤵PID:1428
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="204.4.1552925244\940600336" -childID 3 -isForBrowser -prefsHandle 4968 -prefMapHandle 4944 -prefsLen 26424 -prefMapSize 233444 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d9f743f7-7be5-4953-b33f-741040bf8046} 204 "\\.\pipe\gecko-crash-server-pipe.204" 4980 26e712d7658 tab4⤵PID:1956
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="204.5.1227333994\109027515" -childID 4 -isForBrowser -prefsHandle 5116 -prefMapHandle 5000 -prefsLen 26424 -prefMapSize 233444 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a38900ab-65d8-42d2-a959-a1a0155750e4} 204 "\\.\pipe\gecko-crash-server-pipe.204" 5104 26e72c8b958 tab4⤵PID:3132
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="204.6.1625037180\50457887" -childID 5 -isForBrowser -prefsHandle 5308 -prefMapHandle 5312 -prefsLen 26424 -prefMapSize 233444 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ab6da9e9-1a1b-4364-9291-cbbfb643437a} 204 "\\.\pipe\gecko-crash-server-pipe.204" 5300 26e73551058 tab4⤵PID:520
-
-
-
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" C:\Users\Admin\AppData\Local\Temp\pagefile.7z1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2624
Network
-
Remote address:8.8.8.8:53Requestcontent-signature-2.cdn.mozilla.netIN AResponsecontent-signature-2.cdn.mozilla.netIN CNAMEcontent-signature-chains.prod.autograph.services.mozaws.netcontent-signature-chains.prod.autograph.services.mozaws.netIN CNAMEprod.content-signature-chains.prod.webservices.mozgcp.netprod.content-signature-chains.prod.webservices.mozgcp.netIN A34.160.144.191
-
Remote address:8.8.8.8:53Requestpush.services.mozilla.comIN AResponsepush.services.mozilla.comIN CNAMEautopush.prod.mozaws.netautopush.prod.mozaws.netIN A34.107.243.93
-
Remote address:8.8.8.8:53Requestcontile.services.mozilla.comIN AResponsecontile.services.mozilla.comIN A34.117.188.166
-
Remote address:8.8.8.8:53Requestshavar.services.mozilla.comIN AResponseshavar.services.mozilla.comIN CNAMEshavar.prod.mozaws.netshavar.prod.mozaws.netIN A44.230.111.112shavar.prod.mozaws.netIN A35.164.250.149shavar.prod.mozaws.netIN A54.188.201.143
-
Remote address:8.8.8.8:53Requestfirefox.settings.services.mozilla.comIN AResponsefirefox.settings.services.mozilla.comIN CNAMEprod.remote-settings.prod.webservices.mozgcp.netprod.remote-settings.prod.webservices.mozgcp.netIN A34.149.100.209
-
GEThttps://firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-USfirefox.exeRemote address:34.149.100.209:443RequestGET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/2.0
host: firefox.settings.services.mozilla.com
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
accept: application/json
accept-language: en-US,en;q=0.5
accept-encoding: gzip, deflate, br
content-type: application/json
sec-fetch-dest: empty
sec-fetch-mode: cors
sec-fetch-site: cross-site
if-modified-since: Fri, 25 Mar 2022 17:45:46 GMT
if-none-match: "1648230346554"
te: trailers
-
Remote address:8.8.8.8:53Requestshavar.prod.mozaws.netIN AResponseshavar.prod.mozaws.netIN A54.188.201.143shavar.prod.mozaws.netIN A44.230.111.112shavar.prod.mozaws.netIN A35.164.250.149
-
Remote address:8.8.8.8:53Requestprod.remote-settings.prod.webservices.mozgcp.netIN AResponseprod.remote-settings.prod.webservices.mozgcp.netIN A34.149.100.209
-
Remote address:8.8.8.8:53Requestautopush.prod.mozaws.netIN AResponseautopush.prod.mozaws.netIN A34.107.243.93
-
Remote address:34.117.188.166:443RequestGET /v1/tiles HTTP/2.0
host: contile.services.mozilla.com
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
accept: */*
accept-language: en-US,en;q=0.5
accept-encoding: gzip, deflate, br
sec-fetch-dest: empty
sec-fetch-mode: cors
sec-fetch-site: cross-site
te: trailers
-
Remote address:8.8.8.8:53Requestprod.remote-settings.prod.webservices.mozgcp.netIN AAAAResponse
-
Remote address:8.8.8.8:53Requestshavar.prod.mozaws.netIN AAAAResponse
-
Remote address:8.8.8.8:53Requestautopush.prod.mozaws.netIN AAAAResponse
-
Remote address:34.107.243.93:443RequestGET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: vWQzmbT0UfG+9EFIkJijzg==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket
ResponseHTTP/1.1 101 Switching Protocols
sec-websocket-accept: 7vvY6LdauxOZi2vlX1fNzhPiKN4=
upgrade: websocket
date: Tue, 21 May 2024 00:53:50 GMT
Via: 1.1 google
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
-
Remote address:8.8.8.8:53Requestcontile.services.mozilla.comIN AResponsecontile.services.mozilla.comIN A34.117.188.166
-
Remote address:8.8.8.8:53Requestprod.content-signature-chains.prod.webservices.mozgcp.netIN AResponseprod.content-signature-chains.prod.webservices.mozgcp.netIN A34.160.144.191
-
Remote address:8.8.8.8:53Requestcontile.services.mozilla.comIN AAAAResponse
-
Remote address:8.8.8.8:53Requestprod.content-signature-chains.prod.webservices.mozgcp.netIN AAAAResponseprod.content-signature-chains.prod.webservices.mozgcp.netIN AAAA2600:1901:0:92a9::
-
Remote address:8.8.8.8:53Request166.188.117.34.in-addr.arpaIN PTRResponse166.188.117.34.in-addr.arpaIN PTR16618811734bcgoogleusercontentcom
-
Remote address:8.8.8.8:53Request112.111.230.44.in-addr.arpaIN PTRResponse112.111.230.44.in-addr.arpaIN PTRec2-44-230-111-112 us-west-2compute amazonawscom
-
Remote address:8.8.8.8:53Request122.10.44.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request172.210.232.199.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request76.234.34.23.in-addr.arpaIN PTRResponse76.234.34.23.in-addr.arpaIN PTRa23-34-234-76deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request79.121.231.20.in-addr.arpaIN PTRResponse
-
-
2.2kB 3.7kB 10 9
-
34.149.100.209:443https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-UStls, http2firefox.exe1.8kB 4.4kB 14 13
HTTP Request
GET https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US -
1.8kB 8.0kB 15 19
HTTP Request
GET https://contile.services.mozilla.com/v1/tiles -
1.6kB 4.2kB 15 16
-
1.9kB 4.5kB 12 12
HTTP Request
GET https://push.services.mozilla.com/HTTP Response
101 -
-
46 B 1
-
81 B 235 B 1 1
DNS Request
content-signature-2.cdn.mozilla.net
DNS Response
34.160.144.191
-
71 B 125 B 1 1
DNS Request
push.services.mozilla.com
DNS Response
34.107.243.93
-
74 B 90 B 1 1
DNS Request
contile.services.mozilla.com
DNS Response
34.117.188.166
-
73 B 157 B 1 1
DNS Request
shavar.services.mozilla.com
DNS Response
44.230.111.11235.164.250.14954.188.201.143
-
83 B 161 B 1 1
DNS Request
firefox.settings.services.mozilla.com
DNS Response
34.149.100.209
-
68 B 116 B 1 1
DNS Request
shavar.prod.mozaws.net
DNS Response
54.188.201.14344.230.111.11235.164.250.149
-
94 B 110 B 1 1
DNS Request
prod.remote-settings.prod.webservices.mozgcp.net
DNS Response
34.149.100.209
-
70 B 86 B 1 1
DNS Request
autopush.prod.mozaws.net
DNS Response
34.107.243.93
-
94 B 187 B 1 1
DNS Request
prod.remote-settings.prod.webservices.mozgcp.net
-
68 B 153 B 1 1
DNS Request
shavar.prod.mozaws.net
-
70 B 155 B 1 1
DNS Request
autopush.prod.mozaws.net
-
74 B 90 B 1 1
DNS Request
contile.services.mozilla.com
DNS Response
34.117.188.166
-
103 B 119 B 1 1
DNS Request
prod.content-signature-chains.prod.webservices.mozgcp.net
DNS Response
34.160.144.191
-
1.8kB 4.2kB 5 6
-
74 B 155 B 1 1
DNS Request
contile.services.mozilla.com
-
103 B 131 B 1 1
DNS Request
prod.content-signature-chains.prod.webservices.mozgcp.net
DNS Response
2600:1901:0:92a9::
-
73 B 126 B 1 1
DNS Request
166.188.117.34.in-addr.arpa
-
73 B 137 B 1 1
DNS Request
112.111.230.44.in-addr.arpa
-
71 B 145 B 1 1
DNS Request
122.10.44.20.in-addr.arpa
-
74 B 128 B 1 1
DNS Request
172.210.232.199.in-addr.arpa
-
71 B 135 B 1 1
DNS Request
76.234.34.23.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
79.121.231.20.in-addr.arpa
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\db\data.safe.bin
Filesize9KB
MD553e45eca6bdc032b6fb905cd5c1a6fd3
SHA113f6922fbbb58cae09f908151ea950cf442fde2a
SHA25625c944a373f49da640ce8728aee38b6249245054707c3df74ab473187038c215
SHA51239e55d1cc86e2d1394228b09631181e05c77c0e40d54c5ec0e89cf57d7095e89559ad242b2d4a368dabc686d4e2b8503fc6af039c422072fa78c99614373822f
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\pending_pings\866cbe70-c9e5-45f7-bf81-6bca7b50ae89
Filesize734B
MD53d5e25eedf5d73c9f4114e15d59b0741
SHA108b8e5583e15486bfbb15e7838a4c3d2625cf731
SHA2568e94e2603bd4ae52087b8228574e32758405993a27de40b8ee989f17d09ba237
SHA51232bfa9ce4fc2cb0829a9491a7f2d07ad1fb96bbbacb4f016087b0ce886dde03f36facc95ae941eff212cd1f684007a5e093475bf372d0072e75993cc395b899a
-
Filesize
6KB
MD57f963b6b01646b120956b4fdc65304d3
SHA127095cda73123255cbda93c4a35ba77ca0c370a6
SHA2563341ec10b467816ec60c1ed8082b2a17fe1ff02b3c58b7d288010670ebb7d3fc
SHA512914024ab019339869af996f723ef75ca0f3bc1caf22296208e256938e2e8744dc99ae19f76ead38c47ce7896aa44b25fe19b93aab1bc34aba28641be01a2858b
-
Filesize
6KB
MD5225da7fcfed72e27709abc5e39729253
SHA110e95a52b9826f74d37ebfe7d36dcfca1bc128aa
SHA2568f4f8b5750dbf1fd7b05a606f1641470bd8991b5d6bb388d3b9a4b0471668c09
SHA51244e43cbfa9575948cf9b2e92ad8fd2e00029aedda468f5bd39714e3bccdb499b04c09a14435e1182f4e281eda6d870a0391b420a4feb5558ead37c2ca6776004
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionCheckpoints.json.tmp
Filesize259B
MD5e6c20f53d6714067f2b49d0e9ba8030e
SHA1f516dc1084cdd8302b3e7f7167b905e603b6f04f
SHA25650a670fb78ff2712aae2c16d9499e01c15fddf24e229330d02a69b0527a38092
SHA512462415b8295c1cdcac0a7cb16bb8a027ef36ae2ce0b061071074ac3209332a7eae71de843af4b96bbbd6158ca8fd5c18147bf9a79b8a7768a9a35edce8b784bf
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4
Filesize997B
MD520fe2fd36ea393c230c008653202b465
SHA1ea413f9ec8002b5f66088f6ceb6c9e3ac57725a5
SHA256390c40d251c4fcc39131601a8e84ac40c33b246fa33ab983b1255de87dbe9fca
SHA51275d7b1f829eab67e45dee5b72fdb285c648b6ee9398ea0bcb43bf0492ab9abd6a70a25d803ccd14bd9385f9f197fa55c21fcf2a3a54d25fdda977dc5a3689e60
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore.jsonlz4
Filesize639B
MD5cd0c63d1eb9faaaaf05fcb3740dcd2b7
SHA1964724af86cd97d5640b4f59edd784f65dff2d5e
SHA25698d73ae6e1762780a2686a124001f3035ed55532d4cd85ed8f505412cfb3ea69
SHA5121bfab18842eeaeeae6d28dc005a8b211401f134348ed092fb632b3c3d2bbec1d4f14260fa97c09a66081c6766075d7ffc829596ad5a9718fdc6936b648f9f1dd
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Filesize184KB
MD57f868e557b098795d645df9ea302427f
SHA1001f3306144559b4049a8ab139b4139f51e59c0e
SHA256b228e23ecfb7965e3badefcbb031de0b4bb887634bccb34a826ac8ac89124ac5
SHA51256fd8aa514cc25db5a2c9191d665eaffe90182cc5e4f15317e0cfbc9adf7336d9ad937d20384b0504f784e5939b76b4c4b0020cb06e4a472c650355cc6c4c89a