Malware Analysis Report

2025-01-19 00:14

Sample ID 240530-hqw3zsaa81
Target https://solutions.lseg.com/Marketing-Opt-out?utm_source=Eloqua&utm_medium=email&utm_campaign=3003965_CryptoWhitePaper&utm_content=3003965_CryptoWhitePaper%2BEmail01&elqCampaignId=24924&cid=11989902&email_group=ThoughtLeadership&email=sokleng.chan%40jtrustroyal.com&elqTrackId=cdef482c60c646b9b5ee40dc10cff726&elq=9dd00be1b5234f8096258e08d3456c5e&elqaid=131215&elqat=1&elqCampaignId=24924
Tags
phishing
score
8/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
8/10

Threat Level: Likely malicious

The file https://solutions.lseg.com/Marketing-Opt-out?utm_source=Eloqua&utm_medium=email&utm_campaign=3003965_CryptoWhitePaper&utm_content=3003965_CryptoWhitePaper%2BEmail01&elqCampaignId=24924&cid=11989902&email_group=ThoughtLeadership&email=sokleng.chan%40jtrustroyal.com&elqTrackId=cdef482c60c646b9b5ee40dc10cff726&elq=9dd00be1b5234f8096258e08d3456c5e&elqaid=131215&elqat=1&elqCampaignId=24924 was found to be: Likely malicious.

Malicious Activity Summary

phishing

A potential corporate email address has been identified in the URL: [email protected]

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Checks processor information in registry

Modifies registry class

Uses Task Scheduler COM API

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-30 06:57

Signatures

A potential corporate email address has been identified in the URL: [email protected]

phishing

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-30 06:57

Reported

2024-05-30 06:59

Platform

win10v2004-20240426-en

Max time kernel

80s

Max time network

85s

Command Line

"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://solutions.lseg.com/Marketing-Opt-out?utm_source=Eloqua&utm_medium=email&utm_campaign=3003965_CryptoWhitePaper&utm_content=3003965_CryptoWhitePaper%2BEmail01&elqCampaignId=24924&cid=11989902&email_group=ThoughtLeadership&email=sokleng.chan%40jtrustroyal.com&elqTrackId=cdef482c60c646b9b5ee40dc10cff726&elq=9dd00be1b5234f8096258e08d3456c5e&elqaid=131215&elqat=1&elqCampaignId=24924"

Signatures

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Mozilla Firefox\firefox.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings C:\Program Files\Mozilla Firefox\firefox.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2388 wrote to memory of 3040 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2388 wrote to memory of 3040 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2388 wrote to memory of 3040 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2388 wrote to memory of 3040 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2388 wrote to memory of 3040 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2388 wrote to memory of 3040 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2388 wrote to memory of 3040 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2388 wrote to memory of 3040 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2388 wrote to memory of 3040 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2388 wrote to memory of 3040 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2388 wrote to memory of 3040 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3040 wrote to memory of 2156 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3040 wrote to memory of 2156 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3040 wrote to memory of 2156 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3040 wrote to memory of 2156 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3040 wrote to memory of 2156 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3040 wrote to memory of 2156 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3040 wrote to memory of 2156 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3040 wrote to memory of 2156 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3040 wrote to memory of 2156 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3040 wrote to memory of 2156 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3040 wrote to memory of 2156 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3040 wrote to memory of 2156 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3040 wrote to memory of 2156 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3040 wrote to memory of 2156 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3040 wrote to memory of 2156 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3040 wrote to memory of 2156 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3040 wrote to memory of 2156 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3040 wrote to memory of 2156 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3040 wrote to memory of 2156 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3040 wrote to memory of 2156 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3040 wrote to memory of 2156 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3040 wrote to memory of 2156 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3040 wrote to memory of 2156 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3040 wrote to memory of 2156 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3040 wrote to memory of 2156 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3040 wrote to memory of 2156 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3040 wrote to memory of 2156 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3040 wrote to memory of 2156 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3040 wrote to memory of 2156 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3040 wrote to memory of 2156 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3040 wrote to memory of 2156 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3040 wrote to memory of 2156 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3040 wrote to memory of 2156 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3040 wrote to memory of 2156 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3040 wrote to memory of 2156 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3040 wrote to memory of 2156 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3040 wrote to memory of 2156 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3040 wrote to memory of 2156 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3040 wrote to memory of 2156 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3040 wrote to memory of 2156 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3040 wrote to memory of 2156 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3040 wrote to memory of 2156 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3040 wrote to memory of 2156 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3040 wrote to memory of 1812 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3040 wrote to memory of 1812 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3040 wrote to memory of 1812 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3040 wrote to memory of 1812 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3040 wrote to memory of 1812 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3040 wrote to memory of 1812 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3040 wrote to memory of 1812 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3040 wrote to memory of 1812 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3040 wrote to memory of 1812 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3040 wrote to memory of 1812 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://solutions.lseg.com/Marketing-Opt-out?utm_source=Eloqua&utm_medium=email&utm_campaign=3003965_CryptoWhitePaper&utm_content=3003965_CryptoWhitePaper%2BEmail01&elqCampaignId=24924&cid=11989902&email_group=ThoughtLeadership&email=sokleng.chan%40jtrustroyal.com&elqTrackId=cdef482c60c646b9b5ee40dc10cff726&elq=9dd00be1b5234f8096258e08d3456c5e&elqaid=131215&elqat=1&elqCampaignId=24924"

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://solutions.lseg.com/Marketing-Opt-out?utm_source=Eloqua&utm_medium=email&utm_campaign=3003965_CryptoWhitePaper&utm_content=3003965_CryptoWhitePaper%2BEmail01&elqCampaignId=24924&cid=11989902&email_group=ThoughtLeadership&email=sokleng.chan%40jtrustroyal.com&elqTrackId=cdef482c60c646b9b5ee40dc10cff726&elq=9dd00be1b5234f8096258e08d3456c5e&elqaid=131215&elqat=1&elqCampaignId=24924

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3040.0.1017659252\1507359109" -parentBuildID 20230214051806 -prefsHandle 1760 -prefMapHandle 1752 -prefsLen 22076 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {36fce96a-4338-47bb-8380-0ac633a0f277} 3040 "\\.\pipe\gecko-crash-server-pipe.3040" 1576 1d7f6b0f658 gpu

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3040.1.1484350785\1007370717" -parentBuildID 20230214051806 -prefsHandle 2384 -prefMapHandle 2372 -prefsLen 22927 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {47474b22-58de-4bb1-a696-3a2f2cde1d46} 3040 "\\.\pipe\gecko-crash-server-pipe.3040" 2412 1d7e9e91d58 socket

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3040.2.387133888\1321957418" -childID 1 -isForBrowser -prefsHandle 2992 -prefMapHandle 2812 -prefsLen 22965 -prefMapSize 235121 -jsInitHandle 1296 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {981d5376-9b5b-4be1-9ee2-ae98188ef4b2} 3040 "\\.\pipe\gecko-crash-server-pipe.3040" 2872 1d7f9a3d558 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3040.3.514681606\1167358468" -childID 2 -isForBrowser -prefsHandle 3664 -prefMapHandle 3660 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1296 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {52e6457b-78ac-46e7-971e-ed099be64018} 3040 "\\.\pipe\gecko-crash-server-pipe.3040" 3676 1d7fb6b7a58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3040.4.1574854061\1494373382" -childID 3 -isForBrowser -prefsHandle 5136 -prefMapHandle 5132 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1296 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ff429ded-6bc8-4f57-a438-d6dd603dd0ce} 3040 "\\.\pipe\gecko-crash-server-pipe.3040" 5148 1d7fc5dd458 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3040.5.1576908386\1931003800" -childID 4 -isForBrowser -prefsHandle 5312 -prefMapHandle 5320 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1296 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {de8c7469-78df-47e9-b9d7-b71989755c3d} 3040 "\\.\pipe\gecko-crash-server-pipe.3040" 5268 1d7f943dd58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3040.6.621784875\196455683" -childID 5 -isForBrowser -prefsHandle 5492 -prefMapHandle 5496 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1296 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5427fc5c-2b46-4ce0-a608-f1c7e4744c94} 3040 "\\.\pipe\gecko-crash-server-pipe.3040" 5480 1d7f9a3ff58 tab

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
N/A 127.0.0.1:60767 tcp
US 8.8.8.8:53 solutions.lseg.com udp
US 8.8.8.8:53 contile.services.mozilla.com udp
US 8.8.8.8:53 spocs.getpocket.com udp
US 34.117.188.166:443 spocs.getpocket.com tcp
US 8.8.8.8:53 contile.services.mozilla.com udp
US 8.8.8.8:53 getpocket.cdn.mozilla.net udp
US 34.117.188.166:443 contile.services.mozilla.com tcp
US 8.8.8.8:53 content-signature-2.cdn.mozilla.net udp
US 8.8.8.8:53 shavar.services.mozilla.com udp
US 8.8.8.8:53 push.services.mozilla.com udp
US 8.8.8.8:53 prod.ads.prod.webservices.mozgcp.net udp
CA 192.29.10.243:443 solutions.lseg.com tcp
US 8.8.8.8:53 p01c.hs.eloqua.com udp
US 44.230.111.112:443 shavar.services.mozilla.com tcp
US 8.8.8.8:53 p01c.hs.eloqua.com udp
US 34.160.144.191:443 content-signature-2.cdn.mozilla.net tcp
US 8.8.8.8:53 prod.ads.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 contile.services.mozilla.com udp
US 34.120.5.221:443 getpocket.cdn.mozilla.net tcp
US 8.8.8.8:53 firefox.settings.services.mozilla.com udp
US 34.107.243.93:443 push.services.mozilla.com tcp
US 8.8.8.8:53 shavar.prod.mozaws.net udp
US 8.8.8.8:53 prod.content-signature-chains.prod.webservices.mozgcp.net udp
US 34.149.100.209:443 firefox.settings.services.mozilla.com tcp
US 8.8.8.8:53 prod.pocket.prod.cloudops.mozgcp.net udp
US 8.8.8.8:53 prod.pocket.prod.cloudops.mozgcp.net udp
US 34.117.188.166:443 prod.ads.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 shavar.prod.mozaws.net udp
US 8.8.8.8:53 prod.content-signature-chains.prod.webservices.mozgcp.net udp
US 34.107.243.93:443 push.services.mozilla.com tcp
US 8.8.8.8:53 autopush.prod.mozaws.net udp
US 8.8.8.8:53 prod.remote-settings.prod.webservices.mozgcp.net udp
US 34.117.188.166:443 prod.ads.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 prod.remote-settings.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 autopush.prod.mozaws.net udp
US 8.8.8.8:53 112.111.230.44.in-addr.arpa udp
US 34.107.243.93:443 autopush.prod.mozaws.net udp
US 8.8.8.8:53 img.en25.com udp
US 8.8.8.8:53 ajax.googleapis.com udp
GB 23.59.67.49:443 img.en25.com tcp
US 8.8.8.8:53 e5763.x.akamaiedge.net udp
GB 142.250.178.10:443 ajax.googleapis.com tcp
US 8.8.8.8:53 ajax.googleapis.com udp
GB 23.59.67.49:443 e5763.x.akamaiedge.net tcp
US 8.8.8.8:53 e5763.x.akamaiedge.net udp
US 8.8.8.8:53 ajax.googleapis.com udp
GB 23.59.67.49:443 e5763.x.akamaiedge.net tcp
US 8.8.8.8:53 images.communications.lseg.com udp
US 34.149.100.209:443 prod.remote-settings.prod.webservices.mozgcp.net tcp
US 8.8.8.8:53 s530566577.t.eloqua.com udp
GB 142.250.178.10:443 ajax.googleapis.com udp
NL 23.62.61.90:443 images.communications.lseg.com tcp
NL 23.62.61.90:443 images.communications.lseg.com tcp
NL 23.62.61.90:443 images.communications.lseg.com tcp
NL 23.62.61.90:443 images.communications.lseg.com tcp
US 8.8.8.8:53 e29814.x.akamaiedge.net udp
US 8.8.8.8:53 p01c.t.eloqua.com udp
US 8.8.8.8:53 e29814.x.akamaiedge.net udp
US 8.8.8.8:53 p01c.t.eloqua.com udp
US 8.8.8.8:53 img04.en25.com udp
US 8.8.8.8:53 images.marketing.refinitiv.com udp
NL 23.62.61.59:443 images.marketing.refinitiv.com tcp
GB 23.59.67.49:443 img04.en25.com tcp
US 8.8.8.8:53 138.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 49.67.59.23.in-addr.arpa udp
US 8.8.8.8:53 10.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 90.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 59.61.62.23.in-addr.arpa udp
CA 192.29.13.138:443 p01c.t.eloqua.com tcp
CA 192.29.13.138:443 p01c.t.eloqua.com tcp
N/A 127.0.0.1:60775 tcp
US 8.8.8.8:53 138.13.29.192.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 code.jquery.com udp
US 8.8.8.8:53 code.jquery.com udp
US 151.101.2.137:443 code.jquery.com tcp
US 8.8.8.8:53 code.jquery.com udp
US 8.8.8.8:53 137.2.101.151.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 aus5.mozilla.org udp
US 35.244.181.201:443 aus5.mozilla.org tcp
US 8.8.8.8:53 prod.balrog.prod.cloudops.mozgcp.net udp
US 8.8.8.8:53 prod.balrog.prod.cloudops.mozgcp.net udp
US 8.8.8.8:53 ciscobinary.openh264.org udp
NL 2.18.121.72:80 ciscobinary.openh264.org tcp
US 8.8.8.8:53 a19.dscg10.akamai.net udp
US 8.8.8.8:53 a19.dscg10.akamai.net udp
US 8.8.8.8:53 redirector.gvt1.com udp
GB 142.250.187.206:443 redirector.gvt1.com tcp
US 8.8.8.8:53 redirector.gvt1.com udp
US 8.8.8.8:53 redirector.gvt1.com udp
US 8.8.8.8:53 201.181.244.35.in-addr.arpa udp
US 8.8.8.8:53 72.121.18.2.in-addr.arpa udp
US 8.8.8.8:53 206.187.250.142.in-addr.arpa udp
GB 142.250.187.206:443 redirector.gvt1.com udp
US 8.8.8.8:53 r1---sn-aigl6ney.gvt1.com udp
GB 173.194.183.166:443 r1---sn-aigl6ney.gvt1.com tcp
US 8.8.8.8:53 r1.sn-aigl6ney.gvt1.com udp
US 8.8.8.8:53 r1.sn-aigl6ney.gvt1.com udp
GB 173.194.183.166:443 r1.sn-aigl6ney.gvt1.com udp
US 8.8.8.8:53 166.183.194.173.in-addr.arpa udp
US 8.8.8.8:53 firefox-settings-attachments.cdn.mozilla.net udp
US 34.117.121.53:443 firefox-settings-attachments.cdn.mozilla.net tcp
US 34.117.121.53:443 firefox-settings-attachments.cdn.mozilla.net tcp
US 34.117.121.53:443 firefox-settings-attachments.cdn.mozilla.net tcp
US 34.117.121.53:443 firefox-settings-attachments.cdn.mozilla.net tcp
US 34.117.121.53:443 firefox-settings-attachments.cdn.mozilla.net tcp
US 34.117.121.53:443 firefox-settings-attachments.cdn.mozilla.net tcp
US 8.8.8.8:53 attachments.prod.remote-settings.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 attachments.prod.remote-settings.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 53.121.117.34.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\h6dhg2l4.default-release\activity-stream.discovery_stream.json.tmp

MD5 c4bafe1b384195e16a20feaaa78c3c37
SHA1 b9c4fd7b84950cd0a08c55a232f5bcd81dc3b978
SHA256 8b959acf00e81876b4e67a60006d9e971d4ed5eaac00b63df0d65ee1fbdece59
SHA512 840da9a789f45b48af2cfe562be8f4bdfed378af17498efd1d494ff9a603e5c753ee8d4a91355eda5de949dcc7fe270dda68757680a1f94c3fe43e2ba33380bb

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h6dhg2l4.default-release\prefs.js

MD5 22117995f677e6aed2378fa138457f9d
SHA1 60e40f8aac9b0cce016ff9cb3241a5468b170fe3
SHA256 b9201223636b2aecbdca22194cb9a6cf1ae3bde581fb7d088b873963bb97573f
SHA512 6b77858942a9fdd979d1b1fff8aab60d48341bcbcc1d55a88c417df6659b399e2048017645ccb10c3fb06c97cbb1b5772bf30aac556128a64432b026946a14aa

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h6dhg2l4.default-release\sessionstore-backups\recovery.jsonlz4

MD5 29e45473bdd1080d0027a0dc6f2ccf8f
SHA1 bfff18be7791eaf04d773d159dbce1949181d4f0
SHA256 57cec1beb4960db56ee9b18553d2421048ac4f501382818a9565a677f55d8d8c
SHA512 c8105698f8580159b9623def406f552bc4baf51bc4c9f278fa2d559d971a0bbcc7f589dd5e5d39051190f7a1378fcbdfaa6a503c8f98c32675c2329b0d2f4b1c

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h6dhg2l4.default-release\prefs.js

MD5 8761fc52f55a8d48f071220ee1e390e3
SHA1 27bb8e65c98902683850b34af6a82aa058a1ae1c
SHA256 f4d4a9650c325f64f9b61866d1af2aa8da6673519005a517d0f9932723ba095a
SHA512 35e7f4760813598b3820715b87f403b12497526f18ecb5a4e213f3358a2ec6b93e68b2c8a1371c789b6ceafefd86af36e9300cc5f8a666fda9d6f985ed79b2ef

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h6dhg2l4.default-release\prefs-1.js

MD5 db2dbc0a2b6eb237b19c99d5ad3587de
SHA1 32fddc56175be16005e307d7b38d37b2a41e9d14
SHA256 12fcbc0479993b19864e95d10d947e0148d0e2b04c7432a8ffaeea9c587862ab
SHA512 99dddc3f2870ec26e0b6ced5d3faec261c5ace59475114d5cd63722db323288b4de5095b719b9c8adc21500ef7cbcc0430c0ad221252f8e320adf9470ca45ca9

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\h6dhg2l4.default-release\cache2\entries\F4EFE37A30D0F14C6AC03FF7949A51CBC2EBC649

MD5 b58bf8a1844b88947f215ca2de7d5738
SHA1 9cad3554a14eddc751d675394ba21e53db60a5ca
SHA256 68990e75e4d8d0ee6091d1cfd26710c2feb69e56fa04be3fdf1ba5ce7e635d4c
SHA512 1182708ad2de80564fd687261593c523e6bb64dce07084e49068a35217eb1621165d718c93e55d4c5460bc9d9726ef2a731bc73609d0c1d8625e570faf8482b2

C:\Users\Admin\AppData\Local\Temp\tmpaddon

MD5 85430baed3398695717b0263807cf97c
SHA1 fffbee923cea216f50fce5d54219a188a5100f41
SHA256 a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
SHA512 06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h6dhg2l4.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

MD5 fe3355639648c417e8307c6d051e3e37
SHA1 f54602d4b4778da21bc97c7238fc66aa68c8ee34
SHA256 1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
SHA512 8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h6dhg2l4.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

MD5 3d33cdc0b3d281e67dd52e14435dd04f
SHA1 4db88689282fd4f9e9e6ab95fcbb23df6e6485db
SHA256 f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
SHA512 a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h6dhg2l4.default-release\prefs-1.js

MD5 11843aa086127c38fee96b35ddf16c89
SHA1 cfbe00b1568e69cf336dac5e97b36fdef3a745a6
SHA256 908cd0c62a86c223781c560a1e7eef4758add052b0927ae94f03bb004da28d0a
SHA512 3679b0324a98c6ad2f0b96e968d22f662081fa9c3a389a427f07a9b21d62be2abd69eb33c6431e5219609106ac8c1022761ab3da90eaeb8e2da8051c0e98d641