hxxps://link[.]trustpilot[.]com/ls/click?upn=u001[.]Hmz6DmCHzb-2FMu3gBonAmHTtJ2cl8JZ5HnnZmJn3qvi93JgBo7xT8Yl1d0Cn1uMkpxDxJ3DpD5jguAHbsJfG3H96AcTijdElk4sZSnlaFsEU-3DSQGs_EC3OZR4bR19J5a16BNTI9XVIb96MVlvgtQjaDqvKktkDWP-2BVWf2Z7ATglIQzkK-2BD-2FgPVXegp8VqqJpk1k-2BO7QcxqaK96jSmFpQ52faUoxhyVbPvhNRjwtWW1LRtuAdr-2Fb-2BfwI30dhwTfZVN3i4Vm7gZNPs8fkMox3nbW32kkIQTRjYwDOigY5ElAEFVdHpz2-2BnvdVapryyM0qxf8U1Gq5DGKPVS-2FxQFWeFrLUsZsDGQd3FAKu8YakMEsIXy8-2F7w1gfhqUtXvjllz22MESD2nwJOgxyH7k2-2F97bYnxY6LqxhodfrsRi8RQPvp7judLrJZsOoiYleG-2BiIvi6g3GnbHN3kIqccpd7J1oshOZfWo5pcE9lJMlhuoGPO-2BREU9cQqyhEjZHDRT7-2FxebTzZrZuGP4FVadyFVYicmOC47d8-2FpbuHTwxDaN6tNxrJsCSzAG5HklRtD-2B95IG-2FYBuVgnhnlG-2F-2F3p5f-2Biq0chZarOqv66EZV-2FiyUxOpqTxzMsBKw2baisqXvBb5NruEvonu23WPffA-3D-3D

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
10/06/2024, 07:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://link.trustpilot.com/ls/click?upn=u001.Hmz6DmCHzb-2FMu3gBonAmHTtJ2cl8JZ5HnnZmJn3qvi93JgBo7xT8Yl1d0Cn1uMkpxDxJ3DpD5jguAHbsJfG3H96AcTijdElk4sZSnlaFsEU-3DSQGs_EC3OZR4bR19J5a16BNTI9XVIb96MVlvgtQjaDqvKktkDWP-2BVWf2Z7ATglIQzkK-2BD-2FgPVXegp8VqqJpk1k-2BO7QcxqaK96jSmFpQ52faUoxhyVbPvhNRjwtWW1LRtuAdr-2Fb-2BfwI30dhwTfZVN3i4Vm7gZNPs8fkMox3nbW32kkIQTRjYwDOigY5ElAEFVdHpz2-2BnvdVapryyM0qxf8U1Gq5DGKPVS-2FxQFWeFrLUsZsDGQd3FAKu8YakMEsIXy8-2F7w1gfhqUtXvjllz22MESD2nwJOgxyH7k2-2F97bYnxY6LqxhodfrsRi8RQPvp7judLrJZsOoiYleG-2BiIvi6g3GnbHN3kIqccpd7J1oshOZfWo5pcE9lJMlhuoGPO-2BREU9cQqyhEjZHDRT7-2FxebTzZrZuGP4FVadyFVYicmOC47d8-2FpbuHTwxDaN6tNxrJsCSzAG5HklRtD-2B95IG-2FYBuVgnhnlG-2F-2F3p5f-2Biq0chZarOqv66EZV-2FiyUxOpqTxzMsBKw2baisqXvBb5NruEvonu23WPffA-3D-3D
Sample240610-h4lt6sed45

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1784	firefox.exe
Token: SeDebugPrivilege	1784	firefox.exe
Token: SeDebugPrivilege	1784	firefox.exe
Token: SeDebugPrivilege	1784	firefox.exe
Token: SeDebugPrivilege	1784	firefox.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1784	firefox.exe
1784	firefox.exe
1784	firefox.exe
1784	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
1784	firefox.exe
1784	firefox.exe
1784	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1784	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 236 wrote to memory of 1784	236	firefox.exe	77
PID 236 wrote to memory of 1784	236	firefox.exe	77
PID 236 wrote to memory of 1784	236	firefox.exe	77
PID 236 wrote to memory of 1784	236	firefox.exe	77
PID 236 wrote to memory of 1784	236	firefox.exe	77
PID 236 wrote to memory of 1784	236	firefox.exe	77
PID 236 wrote to memory of 1784	236	firefox.exe	77
PID 236 wrote to memory of 1784	236	firefox.exe	77
PID 236 wrote to memory of 1784	236	firefox.exe	77
PID 236 wrote to memory of 1784	236	firefox.exe	77
PID 236 wrote to memory of 1784	236	firefox.exe	77
PID 1784 wrote to memory of 3520	1784	firefox.exe	78
PID 1784 wrote to memory of 3520	1784	firefox.exe	78
PID 1784 wrote to memory of 3520	1784	firefox.exe	78
PID 1784 wrote to memory of 3520	1784	firefox.exe	78
PID 1784 wrote to memory of 3520	1784	firefox.exe	78
PID 1784 wrote to memory of 3520	1784	firefox.exe	78
PID 1784 wrote to memory of 3520	1784	firefox.exe	78
PID 1784 wrote to memory of 3520	1784	firefox.exe	78
PID 1784 wrote to memory of 3520	1784	firefox.exe	78
PID 1784 wrote to memory of 3520	1784	firefox.exe	78
PID 1784 wrote to memory of 3520	1784	firefox.exe	78
PID 1784 wrote to memory of 3520	1784	firefox.exe	78
PID 1784 wrote to memory of 3520	1784	firefox.exe	78
PID 1784 wrote to memory of 3520	1784	firefox.exe	78
PID 1784 wrote to memory of 3520	1784	firefox.exe	78
PID 1784 wrote to memory of 3520	1784	firefox.exe	78
PID 1784 wrote to memory of 3520	1784	firefox.exe	78
PID 1784 wrote to memory of 3520	1784	firefox.exe	78
PID 1784 wrote to memory of 3520	1784	firefox.exe	78
PID 1784 wrote to memory of 3520	1784	firefox.exe	78
PID 1784 wrote to memory of 3520	1784	firefox.exe	78
PID 1784 wrote to memory of 3520	1784	firefox.exe	78
PID 1784 wrote to memory of 3520	1784	firefox.exe	78
PID 1784 wrote to memory of 3520	1784	firefox.exe	78
PID 1784 wrote to memory of 3520	1784	firefox.exe	78
PID 1784 wrote to memory of 3520	1784	firefox.exe	78
PID 1784 wrote to memory of 3520	1784	firefox.exe	78
PID 1784 wrote to memory of 3520	1784	firefox.exe	78
PID 1784 wrote to memory of 3520	1784	firefox.exe	78
PID 1784 wrote to memory of 3520	1784	firefox.exe	78
PID 1784 wrote to memory of 3520	1784	firefox.exe	78
PID 1784 wrote to memory of 3520	1784	firefox.exe	78
PID 1784 wrote to memory of 3520	1784	firefox.exe	78
PID 1784 wrote to memory of 3520	1784	firefox.exe	78
PID 1784 wrote to memory of 3520	1784	firefox.exe	78
PID 1784 wrote to memory of 3520	1784	firefox.exe	78
PID 1784 wrote to memory of 3520	1784	firefox.exe	78
PID 1784 wrote to memory of 3520	1784	firefox.exe	78
PID 1784 wrote to memory of 3520	1784	firefox.exe	78
PID 1784 wrote to memory of 3520	1784	firefox.exe	78
PID 1784 wrote to memory of 3520	1784	firefox.exe	78
PID 1784 wrote to memory of 3520	1784	firefox.exe	78
PID 1784 wrote to memory of 3520	1784	firefox.exe	78
PID 1784 wrote to memory of 880	1784	firefox.exe	79
PID 1784 wrote to memory of 880	1784	firefox.exe	79
PID 1784 wrote to memory of 880	1784	firefox.exe	79
PID 1784 wrote to memory of 880	1784	firefox.exe	79
PID 1784 wrote to memory of 880	1784	firefox.exe	79
PID 1784 wrote to memory of 880	1784	firefox.exe	79
PID 1784 wrote to memory of 880	1784	firefox.exe	79
PID 1784 wrote to memory of 880	1784	firefox.exe	79
PID 1784 wrote to memory of 880	1784	firefox.exe	79
PID 1784 wrote to memory of 880	1784	firefox.exe	79

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://link.trustpilot.com/ls/click?upn=u001.Hmz6DmCHzb-2FMu3gBonAmHTtJ2cl8JZ5HnnZmJn3qvi93JgBo7xT8Yl1d0Cn1uMkpxDxJ3DpD5jguAHbsJfG3H96AcTijdElk4sZSnlaFsEU-3DSQGs_EC3OZR4bR19J5a16BNTI9XVIb96MVlvgtQjaDqvKktkDWP-2BVWf2Z7ATglIQzkK-2BD-2FgPVXegp8VqqJpk1k-2BO7QcxqaK96jSmFpQ52faUoxhyVbPvhNRjwtWW1LRtuAdr-2Fb-2BfwI30dhwTfZVN3i4Vm7gZNPs8fkMox3nbW32kkIQTRjYwDOigY5ElAEFVdHpz2-2BnvdVapryyM0qxf8U1Gq5DGKPVS-2FxQFWeFrLUsZsDGQd3FAKu8YakMEsIXy8-2F7w1gfhqUtXvjllz22MESD2nwJOgxyH7k2-2F97bYnxY6LqxhodfrsRi8RQPvp7judLrJZsOoiYleG-2BiIvi6g3GnbHN3kIqccpd7J1oshOZfWo5pcE9lJMlhuoGPO-2BREU9cQqyhEjZHDRT7-2FxebTzZrZuGP4FVadyFVYicmOC47d8-2FpbuHTwxDaN6tNxrJsCSzAG5HklRtD-2B95IG-2FYBuVgnhnlG-2F-2F3p5f-2Biq0chZarOqv66EZV-2FiyUxOpqTxzMsBKw2baisqXvBb5NruEvonu23WPffA-3D-3D"
1⤵
- Suspicious use of WriteProcessMemory
PID:236
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://link.trustpilot.com/ls/click?upn=u001.Hmz6DmCHzb-2FMu3gBonAmHTtJ2cl8JZ5HnnZmJn3qvi93JgBo7xT8Yl1d0Cn1uMkpxDxJ3DpD5jguAHbsJfG3H96AcTijdElk4sZSnlaFsEU-3DSQGs_EC3OZR4bR19J5a16BNTI9XVIb96MVlvgtQjaDqvKktkDWP-2BVWf2Z7ATglIQzkK-2BD-2FgPVXegp8VqqJpk1k-2BO7QcxqaK96jSmFpQ52faUoxhyVbPvhNRjwtWW1LRtuAdr-2Fb-2BfwI30dhwTfZVN3i4Vm7gZNPs8fkMox3nbW32kkIQTRjYwDOigY5ElAEFVdHpz2-2BnvdVapryyM0qxf8U1Gq5DGKPVS-2FxQFWeFrLUsZsDGQd3FAKu8YakMEsIXy8-2F7w1gfhqUtXvjllz22MESD2nwJOgxyH7k2-2F97bYnxY6LqxhodfrsRi8RQPvp7judLrJZsOoiYleG-2BiIvi6g3GnbHN3kIqccpd7J1oshOZfWo5pcE9lJMlhuoGPO-2BREU9cQqyhEjZHDRT7-2FxebTzZrZuGP4FVadyFVYicmOC47d8-2FpbuHTwxDaN6tNxrJsCSzAG5HklRtD-2B95IG-2FYBuVgnhnlG-2F-2F3p5f-2Biq0chZarOqv66EZV-2FiyUxOpqTxzMsBKw2baisqXvBb5NruEvonu23WPffA-3D-3D
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1784
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1784.0.1635892172\426057672" -parentBuildID 20230214051806 -prefsHandle 1824 -prefMapHandle 1816 -prefsLen 22074 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {87c748d4-ce17-451f-bab6-01f1aeda9dad} 1784 "\\.\pipe\gecko-crash-server-pipe.1784" 1916 299f950d758 gpu
    3⤵
    PID:3520
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1784.1.1976950065\2089426921" -parentBuildID 20230214051806 -prefsHandle 2428 -prefMapHandle 2424 -prefsLen 22925 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1d4949e9-4418-4a2a-908d-7420f664e397} 1784 "\\.\pipe\gecko-crash-server-pipe.1784" 2440 299ec799c58 socket
    3⤵
    PID:880
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1784.2.1177037769\1008950437" -childID 1 -isForBrowser -prefsHandle 2768 -prefMapHandle 2716 -prefsLen 22963 -prefMapSize 235121 -jsInitHandle 1396 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {00201c2d-94aa-4cc9-8af6-2997cbac6fc9} 1784 "\\.\pipe\gecko-crash-server-pipe.1784" 1692 299fc43c858 tab
    3⤵
    PID:644
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1784.3.189862325\1794800817" -childID 2 -isForBrowser -prefsHandle 3740 -prefMapHandle 3736 -prefsLen 27614 -prefMapSize 235121 -jsInitHandle 1396 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {aa1ee69d-bb7c-41c4-ad9c-01ca1805a382} 1784 "\\.\pipe\gecko-crash-server-pipe.1784" 3752 299ec791f58 tab
    3⤵
    PID:2276
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1784.4.39308885\1194098868" -childID 3 -isForBrowser -prefsHandle 5280 -prefMapHandle 5284 -prefsLen 27614 -prefMapSize 235121 -jsInitHandle 1396 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3ad49453-e42e-47d6-855f-8385ed6c8bb4} 1784 "\\.\pipe\gecko-crash-server-pipe.1784" 5300 29a013f4458 tab
    3⤵
    PID:1496
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1784.5.254488325\1713924830" -childID 4 -isForBrowser -prefsHandle 5452 -prefMapHandle 5460 -prefsLen 27614 -prefMapSize 235121 -jsInitHandle 1396 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {70e48c1f-ddab-49b0-9ced-c10df14a46fd} 1784 "\\.\pipe\gecko-crash-server-pipe.1784" 5444 29a0171e458 tab
    3⤵
    PID:3036
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1784.6.1252997993\1750874477" -childID 5 -isForBrowser -prefsHandle 5680 -prefMapHandle 5688 -prefsLen 27614 -prefMapSize 235121 -jsInitHandle 1396 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1b764c1f-581d-4d79-95c5-cbd9df7481a7} 1784 "\\.\pipe\gecko-crash-server-pipe.1784" 5672 29a0171d858 tab
    3⤵
    PID:4916
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1784.7.647345339\622215271" -childID 6 -isForBrowser -prefsHandle 5472 -prefMapHandle 6152 -prefsLen 27695 -prefMapSize 235121 -jsInitHandle 1396 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {10feea97-ec3f-4bca-95c8-4821bfb4e76b} 1784 "\\.\pipe\gecko-crash-server-pipe.1784" 6192 29a01e1de58 tab
    3⤵
    PID:832
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1784.8.964204072\2001690226" -parentBuildID 20230214051806 -prefsHandle 5444 -prefMapHandle 6332 -prefsLen 27695 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3bf90bc5-0565-47e0-9ba3-d42cad2abfa8} 1784 "\\.\pipe\gecko-crash-server-pipe.1784" 6424 29a0222d758 rdd
    3⤵
    PID:5092
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1784.9.2072667479\2005463586" -parentBuildID 20230214051806 -sandboxingKind 1 -prefsHandle 6420 -prefMapHandle 6200 -prefsLen 27695 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4ae2e82e-fe43-434e-bd71-9dd380444b48} 1784 "\\.\pipe\gecko-crash-server-pipe.1784" 5484 29a0222fb58 utility
    3⤵
    PID:1872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.discovery_stream.json.tmp

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\mg2c1myw.default-release\activity-stream.discovery_stream.json.tmp
Size 25KB
SHA256 2948ceceed8c7d45a53101986ce51ad63a77a6564f55900103507a04998fd161
MD5 cedacad52bd257c5b2d33fb52725f6bb
SHA1 452f33e2e09402000acadb2160f2ca60b9d5d891
SHA512 149a7b531ee40f9acce3e73cc1bfd819e5569fb8fee2c65b67f364e86be14a19a0a90ea915b0b7b77c9d106690d78a7b3b4b147b8365e49abe79b151895347bf
SSDEEP 384:rGPccT0/bOJc+59/kXKP95/1aXeRCexIRmIkKyau6i/AxiAxjA:rGgf4XTjxINryd6i4tZA
MD5 SHA1 SHA512 SSDEEP

Submit Download

383A97A57B113BD106DE6984E6DBA5F537327263

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\mg2c1myw.default-release\cache2\entries\383A97A57B113BD106DE6984E6DBA5F537327263
Size 13KB
SHA256 22c2bdab3ed023b8e4be09b8e30c4dce3ea41dbe7f4884a46d56116ae805af03
MD5 a2cd643397a9cee05fc474ab2571e02c
SHA1 bc9cdf4b9d7f617394817991bf972fd324dd352f
SHA512 773206866756b046bb9180005f5a2f9a30a987d415ca4a8b2039fc92e1f338b8c6c10f5e7ba63823708cc1038369dad1fd7a8f5ee682619e048ecafb0be00597
SSDEEP 384:H7Ku9fiGLm4pU3uL6eFuFmn/4OgQ2TdlqGPUcP+AWRMACDKHKU:vBi8mCU3VewUn/4dlqkD+hRMFI
MD5 SHA1 SHA512 SSDEEP

Submit Download

F8CBD54DDA10F4286A41EC6A537240712D6C2308

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\mg2c1myw.default-release\cache2\entries\F8CBD54DDA10F4286A41EC6A537240712D6C2308
Size 9KB
SHA256 09bcc1b5477048bb37b72020ed354a9bfe15c994ba43ce1029df27b53ae3daa9
MD5 3d01e62a9363c5b5c636e3e960f2ba67
SHA1 348d6779cb618c7d7b7791818014869060d48663
SHA512 8c3ee48743a6eccdf1e8b35118911c02773a2b6ad8936cbd8125f55d06343fff011262ce72d93e002d5397363861f7e5fdb51fb0fdebcbedbc5f736773c05996
SSDEEP 192:HN8y41r0dZ4eYvnid1ZFvC2rAl7YNCW2P8ro15j75ywpskCjdS5dS3:HN8T1r0dZ4eY01HvCmAl7YNFU8rIVy8+
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 442KB
SHA256 a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
MD5 85430baed3398695717b0263807cf97c
SHA1 fffbee923cea216f50fce5d54219a188a5100f41
SHA512 06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1
SSDEEP 12288:tESTeqTI2r4ZbCgUKWKNeRcPMb6qlV7hVZe3:tEsed2Xh9/bdzZe3
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 8.0MB
SHA256 345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42
MD5 a01c5ecd6108350ae23d2cddf0e77c17
SHA1 c6ac28a2cd979f1f9a75d56271821d5ff665e2b6
SHA512 b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72
SSDEEP 196608:945hXmP7/cvflwtf0FzVC/5lHevzc8XZbivwEiw3cFTx7z4zV:9tP7/cvflof0FzVgKRF9zw3c9x4zV
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mg2c1myw.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
Size 997KB
SHA256 1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
MD5 fe3355639648c417e8307c6d051e3e37
SHA1 f54602d4b4778da21bc97c7238fc66aa68c8ee34
SHA512 8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c
SSDEEP 12288:vYLdTfFKbNSjv92eFN+3wH+NYriA0Iq6lh6VawYIpAvwHN/Uf1h47HAfg1oet:vYLdTZ923NYrjwNpgwef1hzfg1x
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mg2c1myw.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
Size 116B
SHA256 f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
MD5 3d33cdc0b3d281e67dd52e14435dd04f
SHA1 4db88689282fd4f9e9e6ab95fcbb23df6e6485db
SHA512 a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1
MD5 SHA1 SHA512

Submit Download

LICENSE.txt

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mg2c1myw.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
Size 479B
SHA256 2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
MD5 49ddb419d96dceb9069018535fb2e2fc
SHA1 62aa6fea895a8b68d468a015f6e6ab400d7a7ca6
SHA512 48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mg2c1myw.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
Size 372B
SHA256 e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
MD5 8be33af717bb1b67fbd61c3f4b807e9e
SHA1 7cf17656d174d951957ff36810e874a134dd49e0
SHA512 6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mg2c1myw.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
Size 11.8MB
SHA256 8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e
MD5 33bf7b0439480effb9fb212efce87b13
SHA1 cee50f2745edc6dc291887b6075ca64d716f495a
SHA512 d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275
SSDEEP 196608:lP4/vkvbdjMq4ytbko4qIUcXkhrVp1HSTDsoTn90lcGeFaxJI3qLaLhFT7Uc:lPcvyiXSWxRU/OpZXJFee3qGhFMc
MD5 SHA1 SHA512 SSDEEP

Submit Download

widevinecdm.dll.lib

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mg2c1myw.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
Size 1KB
SHA256 33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
MD5 688bed3676d2104e7f17ae1cd2c59404
SHA1 952b2cdf783ac72fcb98338723e9afd38d47ad8e
SHA512 7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll.sig

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mg2c1myw.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
Size 1KB
SHA256 68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
MD5 937326fead5fd401f6cca9118bd9ade9
SHA1 4526a57d4ae14ed29b37632c72aef3c408189d91
SHA512 b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2
MD5 SHA1 SHA512

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mg2c1myw.default-release\prefs-1.js
Size 8KB
SHA256 1080a3f1754dce92a4d51c2075a653bfffce540ef472447b1ae5672767e9f1f5
MD5 1fca8bc71f5f05a63d0900b30c4149b2
SHA1 f4d35649821b8b8f34370442fb7a546723aba590
SHA512 c2e68c8e08c3bb73feec27d4914486df9f8142124485a858279e6f28fa6e7d978700481d079ba4421251f9fb39e6d0edb183c1069498bb4e80540d610fc6e0e8
SSDEEP 96:xHa5nUTUrqGqmf7VTLHzSc0XlnBOjS3I2HjN1/H0GuBw8H88muh9So:M5n2Rmf7Vfx0Xb93IYLHfuBw8H88m2So
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mg2c1myw.default-release\prefs.js
Size 6KB
SHA256 a492d2dee8d3c868180c439a6ab868a1d912b9263da7b285a01a43f7b179b6b0
MD5 47e618983653d940afccccf8b16c8ade
SHA1 ac6d9f40759342a64ebb920d5e415a294893cf98
SHA512 71ee3ab913a178c016d92896ee350e68b5c9e1062320c983a91a447c00afb3f388a8246d1bd31acc33a09ed4bc9713fc49f0fa837623460d6d6d8458b494b2e9
SSDEEP 96:xHB5nUTUrqGqmf7VTLHzSc0XlnBOjS3I2HjN1/H0MBw8H8877So:z5n2Rmf7Vfx0Xb93IYLH/Bw8H88XSo
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mg2c1myw.default-release\prefs.js
Size 6KB
SHA256 ccbb49326b32adbc59a6b1ef321fc69d9caa3f421d009220008df8eacc9a18c6
MD5 b3dcbff94d81daea280cc76d596c17d6
SHA1 e32744ce41a5a71034e9232eb15ccaca9fb0bcef
SHA512 bb9d89ff333ae56a37b026ac9350e58efa712483172e007402b24870af09f1ef49d990c0f2e5154db6773c4d659f52d373df549eb5bd8bb396907809abbd7292
SSDEEP 96:xHB5nUTUrqGqmf7sCLHzSc0XlnBOja3I2HjN1/H0MBw8H8877So:z5n2Rmf7syx0Xb53IYLH/Bw8H88XSo
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mg2c1myw.default-release\prefs.js
Size 10KB
SHA256 2bb0e10599eacea3a0007398b32d02247b0b65bdb4064514dc6aabf143b0858e
MD5 5f827d8439110156771a18f8bcf08936
SHA1 d7474d8c29ad398ea30b3bdf3ce8f8586c19b736
SHA512 948f8de97d7dd266eb64d6cf809075ce62a0ae1ab66c77b295d88224af09e87ed7640385823e66ec7157e6918d2fe48834eb5afbc82fcb2a939598c15800738e
SSDEEP 192:MWn2Rmf7Vfx0Xb93IYLHfXgaRBw8H888HSo:DytIYLwRf
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mg2c1myw.default-release\sessionstore-backups\recovery.jsonlz4
Size 5KB
SHA256 21b35f920d4d28f772120b31265a3289fc761578916c217dd6dd7638b7273189
MD5 c160ac3b8c9882268795fe118216ad1d
SHA1 9c3d99db049f5394d97dc4f78e3f34e007fc73c3
SHA512 f49b69156066fc6f89e4bf59524191e5f236a112f773ba0fe580f21251710dea6d8e69521abf339c15a96596513dfd0ff775d07bad210ba383961123e2b8b40f
SSDEEP 96:2diDmMgw7I2mnp/6jD2X67CilZGplJGUfUH8bUd4JAOucuwdBiT4V6RLjY:L3mpgD2XYCilZE/GX8bUd4v7uwd4kV6m
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mg2c1myw.default-release\sessionstore-backups\recovery.jsonlz4
Size 5KB
SHA256 1c8f0c2e6d398ac29253fb7fe5fb571cf52ae38a0ff79cb2db892d5cf5344417
MD5 d27863733dbc646d894b7f8a85f7d549
SHA1 9a3bba37303fdc293bcffeb7e8590c446394cbbe
SHA512 35d33e83a67e32241c7a0a61f8d2bcbaf5343ab1d58d929ae3a7290c5a2519901bbb72c863d2fb69cecbe44804f4110d81fd2fb2a7aed9c946b28bda7a96d85d
SSDEEP 96:JiDmMgw7F2mnp/6jD2X67fqpbJGUfUH8bUd4JAQ/FcuwdEwKdjsz+W:2ImpgD2XYfINGX8bUd4/auwdEwSwz+W
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mg2c1myw.default-release\sessionstore-backups\recovery.jsonlz4
Size 5KB
SHA256 e4051707c588d482e2c82a880a3d992c8d26960d0524342e99a38505286fe2b2
MD5 1a76db3bc323c45749d8418a1102ea65
SHA1 e76315dc64a0d8ac3df529d3bd3633743780e629
SHA512 63cc80aa9fb49891fa232d79bb2ea6c47fb458c7e54f7899a78f366aea469e232875c6e5d3224d99e252fe01b411c5d335b551cf03bdf26f36a918dd46aef704
SSDEEP 96:S/iDmMgw7E2mnp/6jD293n7z5KpVJGUfUH8bUd4JAOecuwdVjoDI70:ScbmpgD2937z5ovGX8bUd4vLuwdVEk0
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mg2c1myw.default-release\sessionstore-backups\recovery.jsonlz4
Size 5KB
SHA256 59ee3d48b1055c0f24bae5157a1889fa9dbfefab78f1670a3e02489a2daf92f7
MD5 156ae6614325fe37521043f0cc6c057f
SHA1 8f36413aba7a3b38350383afd5b3edc6bcd48003
SHA512 83a1a26d3e70a335389d2d14483436c88b2ac6ca7e987408ec75fa28371b67287d7a6a40aa02711d76d6c15890a5d3e2f7e46c304c3d4d3a974ceb14628d1ed4
SSDEEP 96:2diDmMgw7Y2mnp/6jD2X67CilZGplJGUfUH8bUd4JAOucuwdBiT4f6RLjY:LHmpgD2XYCilZE/GX8bUd4v7uwd4kf6m
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mg2c1myw.default-release\sessionstore-backups\recovery.jsonlz4
Size 5KB
SHA256 6716186e70cb8d93656b76156fc4054787208859e07df9afe90680fcd5a8f48d
MD5 0c59cc25ca7016bb7dc9970210afa170
SHA1 fa9a8ece67ba4215e7a4322c062364931a983c0e
SHA512 7e7a1d678399a91215599306d52cd566d5a7b9a993e2333cc1f4eec1913b79074a3f034b74772e7797ae8db515bc6c43ef3cd4986b3a3159070ad04929c1422f
SSDEEP 96:wiDmMgw772mnp/6jD2X67uP1p3JGUfUH8bUd4JA7yQcuwdN7R49totX:1empgD2XYuP7ZGX8bUd4jVuwdN7Ytox
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mg2c1myw.default-release\sessionstore-backups\recovery.jsonlz4
Size 5KB
SHA256 05b82d6266b15ef6182993e4e6bfcf74d75cdae88def4a102f7f0e866d90d336
MD5 755fd0033a26b7a4d5a6df6b0f5a2428
SHA1 f827096682a4ad24a5e7caa1a5990333fa41f562
SHA512 79f192c77bc2668dd956bd48c0e06d46d2bf30d61365e11d40fc86e3e50d72d9441e9892e5ac539b0f663b7245b58a41217bcad4199472b21de953cf7ea911c9
SSDEEP 96:S/iDmMgw7O2mnp/6jD2X67kjpVJGUfUH8bUd4JAOecuwdVjZf970:ScNmpgD2XYkVvGX8bUd4vLuwdVdZ0
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads