1b1ea63440d7c6c9adb201f15513c9f59d2914e2644fb013f058ef86ab524429

Analysis

max time kernel
120s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15/07/2024, 03:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

6b463f5c29c6970cd66565b3680bf160N.exe
Size

1.2MB
MD5

6b463f5c29c6970cd66565b3680bf160
SHA1

903845eaea6fbba4d447254d663ac126a1ac3625
SHA256

1b1ea63440d7c6c9adb201f15513c9f59d2914e2644fb013f058ef86ab524429
SHA512

6fcbc09149909f8e70c973cb67c46cbf986a041d577cec2f63c3cc4f6b4f2b5e6e5ee4b62fd015bac59eb278af3c36a40263f9dab9e0e85afd017b46ffbb4525
SSDEEP

24576:LqDEvCTbMWu7rQYlBQcBiT6rprG8aLo2Sbly7TWEPje:LTvC/MTQYxsWR7aLo2dW

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\Control Panel\International\Geo\Nation	6b463f5c29c6970cd66565b3680bf160N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	232	firefox.exe
Token: SeDebugPrivilege	232	firefox.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3116	6b463f5c29c6970cd66565b3680bf160N.exe
3116	6b463f5c29c6970cd66565b3680bf160N.exe
3116	6b463f5c29c6970cd66565b3680bf160N.exe
3116	6b463f5c29c6970cd66565b3680bf160N.exe
3116	6b463f5c29c6970cd66565b3680bf160N.exe
3116	6b463f5c29c6970cd66565b3680bf160N.exe
3116	6b463f5c29c6970cd66565b3680bf160N.exe
232	firefox.exe
232	firefox.exe
232	firefox.exe
232	firefox.exe
232	firefox.exe
232	firefox.exe
232	firefox.exe
232	firefox.exe
232	firefox.exe
232	firefox.exe
232	firefox.exe
232	firefox.exe
232	firefox.exe
232	firefox.exe
232	firefox.exe
232	firefox.exe
232	firefox.exe
232	firefox.exe
232	firefox.exe
232	firefox.exe
232	firefox.exe
3116	6b463f5c29c6970cd66565b3680bf160N.exe
3116	6b463f5c29c6970cd66565b3680bf160N.exe
3116	6b463f5c29c6970cd66565b3680bf160N.exe
3116	6b463f5c29c6970cd66565b3680bf160N.exe
3116	6b463f5c29c6970cd66565b3680bf160N.exe
3116	6b463f5c29c6970cd66565b3680bf160N.exe
3116	6b463f5c29c6970cd66565b3680bf160N.exe
3116	6b463f5c29c6970cd66565b3680bf160N.exe
3116	6b463f5c29c6970cd66565b3680bf160N.exe
3116	6b463f5c29c6970cd66565b3680bf160N.exe
3116	6b463f5c29c6970cd66565b3680bf160N.exe
3116	6b463f5c29c6970cd66565b3680bf160N.exe
3116	6b463f5c29c6970cd66565b3680bf160N.exe
3116	6b463f5c29c6970cd66565b3680bf160N.exe
3116	6b463f5c29c6970cd66565b3680bf160N.exe
3116	6b463f5c29c6970cd66565b3680bf160N.exe
3116	6b463f5c29c6970cd66565b3680bf160N.exe
3116	6b463f5c29c6970cd66565b3680bf160N.exe
3116	6b463f5c29c6970cd66565b3680bf160N.exe
3116	6b463f5c29c6970cd66565b3680bf160N.exe
3116	6b463f5c29c6970cd66565b3680bf160N.exe
3116	6b463f5c29c6970cd66565b3680bf160N.exe
3116	6b463f5c29c6970cd66565b3680bf160N.exe
3116	6b463f5c29c6970cd66565b3680bf160N.exe
3116	6b463f5c29c6970cd66565b3680bf160N.exe
3116	6b463f5c29c6970cd66565b3680bf160N.exe
3116	6b463f5c29c6970cd66565b3680bf160N.exe
3116	6b463f5c29c6970cd66565b3680bf160N.exe
3116	6b463f5c29c6970cd66565b3680bf160N.exe
3116	6b463f5c29c6970cd66565b3680bf160N.exe
3116	6b463f5c29c6970cd66565b3680bf160N.exe
3116	6b463f5c29c6970cd66565b3680bf160N.exe
3116	6b463f5c29c6970cd66565b3680bf160N.exe
3116	6b463f5c29c6970cd66565b3680bf160N.exe
3116	6b463f5c29c6970cd66565b3680bf160N.exe
3116	6b463f5c29c6970cd66565b3680bf160N.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3116	6b463f5c29c6970cd66565b3680bf160N.exe
3116	6b463f5c29c6970cd66565b3680bf160N.exe
3116	6b463f5c29c6970cd66565b3680bf160N.exe
3116	6b463f5c29c6970cd66565b3680bf160N.exe
3116	6b463f5c29c6970cd66565b3680bf160N.exe
3116	6b463f5c29c6970cd66565b3680bf160N.exe
3116	6b463f5c29c6970cd66565b3680bf160N.exe
232	firefox.exe
232	firefox.exe
232	firefox.exe
232	firefox.exe
232	firefox.exe
232	firefox.exe
232	firefox.exe
232	firefox.exe
232	firefox.exe
232	firefox.exe
232	firefox.exe
232	firefox.exe
232	firefox.exe
232	firefox.exe
232	firefox.exe
232	firefox.exe
232	firefox.exe
232	firefox.exe
232	firefox.exe
232	firefox.exe
3116	6b463f5c29c6970cd66565b3680bf160N.exe
3116	6b463f5c29c6970cd66565b3680bf160N.exe
3116	6b463f5c29c6970cd66565b3680bf160N.exe
3116	6b463f5c29c6970cd66565b3680bf160N.exe
3116	6b463f5c29c6970cd66565b3680bf160N.exe
3116	6b463f5c29c6970cd66565b3680bf160N.exe
3116	6b463f5c29c6970cd66565b3680bf160N.exe
3116	6b463f5c29c6970cd66565b3680bf160N.exe
3116	6b463f5c29c6970cd66565b3680bf160N.exe
3116	6b463f5c29c6970cd66565b3680bf160N.exe
3116	6b463f5c29c6970cd66565b3680bf160N.exe
3116	6b463f5c29c6970cd66565b3680bf160N.exe
3116	6b463f5c29c6970cd66565b3680bf160N.exe
3116	6b463f5c29c6970cd66565b3680bf160N.exe
3116	6b463f5c29c6970cd66565b3680bf160N.exe
3116	6b463f5c29c6970cd66565b3680bf160N.exe
3116	6b463f5c29c6970cd66565b3680bf160N.exe
3116	6b463f5c29c6970cd66565b3680bf160N.exe
3116	6b463f5c29c6970cd66565b3680bf160N.exe
3116	6b463f5c29c6970cd66565b3680bf160N.exe
3116	6b463f5c29c6970cd66565b3680bf160N.exe
3116	6b463f5c29c6970cd66565b3680bf160N.exe
3116	6b463f5c29c6970cd66565b3680bf160N.exe
3116	6b463f5c29c6970cd66565b3680bf160N.exe
3116	6b463f5c29c6970cd66565b3680bf160N.exe
3116	6b463f5c29c6970cd66565b3680bf160N.exe
3116	6b463f5c29c6970cd66565b3680bf160N.exe
3116	6b463f5c29c6970cd66565b3680bf160N.exe
3116	6b463f5c29c6970cd66565b3680bf160N.exe
3116	6b463f5c29c6970cd66565b3680bf160N.exe
3116	6b463f5c29c6970cd66565b3680bf160N.exe
3116	6b463f5c29c6970cd66565b3680bf160N.exe
3116	6b463f5c29c6970cd66565b3680bf160N.exe
3116	6b463f5c29c6970cd66565b3680bf160N.exe
3116	6b463f5c29c6970cd66565b3680bf160N.exe
3116	6b463f5c29c6970cd66565b3680bf160N.exe
3116	6b463f5c29c6970cd66565b3680bf160N.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
232	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3116 wrote to memory of 2700	3116	6b463f5c29c6970cd66565b3680bf160N.exe	86
PID 3116 wrote to memory of 2700	3116	6b463f5c29c6970cd66565b3680bf160N.exe	86
PID 2700 wrote to memory of 232	2700	firefox.exe	88
PID 2700 wrote to memory of 232	2700	firefox.exe	88
PID 2700 wrote to memory of 232	2700	firefox.exe	88
PID 2700 wrote to memory of 232	2700	firefox.exe	88
PID 2700 wrote to memory of 232	2700	firefox.exe	88
PID 2700 wrote to memory of 232	2700	firefox.exe	88
PID 2700 wrote to memory of 232	2700	firefox.exe	88
PID 2700 wrote to memory of 232	2700	firefox.exe	88
PID 2700 wrote to memory of 232	2700	firefox.exe	88
PID 2700 wrote to memory of 232	2700	firefox.exe	88
PID 2700 wrote to memory of 232	2700	firefox.exe	88
PID 232 wrote to memory of 2424	232	firefox.exe	89
PID 232 wrote to memory of 2424	232	firefox.exe	89
PID 232 wrote to memory of 2424	232	firefox.exe	89
PID 232 wrote to memory of 2424	232	firefox.exe	89
PID 232 wrote to memory of 2424	232	firefox.exe	89
PID 232 wrote to memory of 2424	232	firefox.exe	89
PID 232 wrote to memory of 2424	232	firefox.exe	89
PID 232 wrote to memory of 2424	232	firefox.exe	89
PID 232 wrote to memory of 2424	232	firefox.exe	89
PID 232 wrote to memory of 2424	232	firefox.exe	89
PID 232 wrote to memory of 2424	232	firefox.exe	89
PID 232 wrote to memory of 2424	232	firefox.exe	89
PID 232 wrote to memory of 2424	232	firefox.exe	89
PID 232 wrote to memory of 2424	232	firefox.exe	89
PID 232 wrote to memory of 2424	232	firefox.exe	89
PID 232 wrote to memory of 2424	232	firefox.exe	89
PID 232 wrote to memory of 2424	232	firefox.exe	89
PID 232 wrote to memory of 2424	232	firefox.exe	89
PID 232 wrote to memory of 2424	232	firefox.exe	89
PID 232 wrote to memory of 2424	232	firefox.exe	89
PID 232 wrote to memory of 2424	232	firefox.exe	89
PID 232 wrote to memory of 2424	232	firefox.exe	89
PID 232 wrote to memory of 2424	232	firefox.exe	89
PID 232 wrote to memory of 2424	232	firefox.exe	89
PID 232 wrote to memory of 2424	232	firefox.exe	89
PID 232 wrote to memory of 2424	232	firefox.exe	89
PID 232 wrote to memory of 2424	232	firefox.exe	89
PID 232 wrote to memory of 2424	232	firefox.exe	89
PID 232 wrote to memory of 2424	232	firefox.exe	89
PID 232 wrote to memory of 2424	232	firefox.exe	89
PID 232 wrote to memory of 2424	232	firefox.exe	89
PID 232 wrote to memory of 2424	232	firefox.exe	89
PID 232 wrote to memory of 2424	232	firefox.exe	89
PID 232 wrote to memory of 2424	232	firefox.exe	89
PID 232 wrote to memory of 2424	232	firefox.exe	89
PID 232 wrote to memory of 2424	232	firefox.exe	89
PID 232 wrote to memory of 2424	232	firefox.exe	89
PID 232 wrote to memory of 2424	232	firefox.exe	89
PID 232 wrote to memory of 2424	232	firefox.exe	89
PID 232 wrote to memory of 2424	232	firefox.exe	89
PID 232 wrote to memory of 2424	232	firefox.exe	89
PID 232 wrote to memory of 2424	232	firefox.exe	89
PID 232 wrote to memory of 2424	232	firefox.exe	89
PID 232 wrote to memory of 2424	232	firefox.exe	89
PID 232 wrote to memory of 2424	232	firefox.exe	89
PID 232 wrote to memory of 2200	232	firefox.exe	90
PID 232 wrote to memory of 2200	232	firefox.exe	90
PID 232 wrote to memory of 2200	232	firefox.exe	90
PID 232 wrote to memory of 2200	232	firefox.exe	90
PID 232 wrote to memory of 2200	232	firefox.exe	90
PID 232 wrote to memory of 2200	232	firefox.exe	90

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\6b463f5c29c6970cd66565b3680bf160N.exe
"C:\Users\Admin\AppData\Local\Temp\6b463f5c29c6970cd66565b3680bf160N.exe"
1⤵
- Checks computer location settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3116
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2700
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:232
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1964 -parentBuildID 20240401114208 -prefsHandle 1892 -prefMapHandle 1884 -prefsLen 25753 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c7bceca0-c2a8-4443-bb86-2640d3216ecb} 232 "\\.\pipe\gecko-crash-server-pipe.232" gpu
      4⤵
      PID:2424
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2400 -parentBuildID 20240401114208 -prefsHandle 2376 -prefMapHandle 2372 -prefsLen 26673 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bd35d6bb-4813-4315-a516-2e49d06d1c00} 232 "\\.\pipe\gecko-crash-server-pipe.232" socket
      4⤵
      PID:2200
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2924 -childID 1 -isForBrowser -prefsHandle 2928 -prefMapHandle 2944 -prefsLen 22698 -prefMapSize 244658 -jsInitHandle 988 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7a8374bc-a647-46b9-89c6-c07815883754} 232 "\\.\pipe\gecko-crash-server-pipe.232" tab
      4⤵
      PID:4924
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3644 -childID 2 -isForBrowser -prefsHandle 3576 -prefMapHandle 1212 -prefsLen 31163 -prefMapSize 244658 -jsInitHandle 988 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1a654972-b649-42b7-a436-c9312c71954f} 232 "\\.\pipe\gecko-crash-server-pipe.232" tab
      4⤵
      PID:3236
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4632 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4588 -prefMapHandle 4548 -prefsLen 31163 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d5a31b3d-8390-4e32-bdc0-8a7046e4d765} 232 "\\.\pipe\gecko-crash-server-pipe.232" utility
      4⤵
      Checks processor information in registry
      PID:1732
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5392 -childID 3 -isForBrowser -prefsHandle 5384 -prefMapHandle 5380 -prefsLen 26990 -prefMapSize 244658 -jsInitHandle 988 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {44a74d87-2bd4-485f-af91-dff8ac20020c} 232 "\\.\pipe\gecko-crash-server-pipe.232" tab
      4⤵
      PID:4168
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5620 -childID 4 -isForBrowser -prefsHandle 5612 -prefMapHandle 5608 -prefsLen 26990 -prefMapSize 244658 -jsInitHandle 988 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bb3358ff-c448-45de-ae03-06c047e64440} 232 "\\.\pipe\gecko-crash-server-pipe.232" tab
      4⤵
      PID:4736
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5880 -childID 5 -isForBrowser -prefsHandle 5800 -prefMapHandle 5808 -prefsLen 26990 -prefMapSize 244658 -jsInitHandle 988 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a57b38cb-bd35-4a98-b3ae-0edd92f8ae78} 232 "\\.\pipe\gecko-crash-server-pipe.232" tab
      4⤵
      PID:1528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\vvc8bff9.default-release\activity-stream.discovery_stream.json.tmp

Filesize
18KB

MD5
c763c375f33e0cfda81bb560ab5e7591

SHA1
05eb982abb8753f68c806ed60652d92946bc5713

SHA256
1d1b133a31f2f4ad0c079d9feb0bd67f385b278994ee7a313f085f335b323e1d

SHA512
aab98eb47740df477a16a9e34a400323cd7e4b56027a6666ea221f48e2378b98ca531d7657b8d91b9f65972ac2cb6bf1a77016e35eb561c0cc031051c1ca07e0

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\vvc8bff9.default-release\cache2\entries\8A2034D325DC0B5C9E11EDDA3FC70A54C8DC1C0D

Filesize
13KB

MD5
594ade89f1020757d0ecba7d03a090b1

SHA1
2bf18182fc1ea7d64f31f0187fb97fc086b008f2

SHA256
e6cd38a35bf738020f8043ca276e2f8ba55ac12c2e80c56158357434ee8eebde

SHA512
2648c8709e121cfa7d20cb3135c3262f1baea6953419736471ac54e73e0f3d50f3754b3fb578aebde3f0072fe42e3c49977c48362c050105eeb543fdef3a89ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vvc8bff9.default-release\AlternateServices.bin

Filesize
8KB

MD5
1346dfbfd2707e5103544786d646436d

SHA1
5fe275e8d0d6c2143ef1c5b0f674089e1f31f346

SHA256
56195b20985f2a5ebdc1eeca0ad06a7bc0a9397668c9b85d7324746f2423b926

SHA512
1872e1603652415e4ba90aa7738afa57609a70c4594f67868832f3e3d5c6e95fe05e9a784b8ca081b87d871e0569c83d91197928ca0dde07fd245ffff1012f92

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vvc8bff9.default-release\AlternateServices.bin

Filesize
12KB

MD5
ed0f7b45f60a0e357073f060214c07bb

SHA1
d3c1e6fa4cc6f57d7173b94a33f0e697f632ea79

SHA256
c0f3bafc1a7515e226531970dae8dbcf9eefe2c6523844795b255eccb319e87b

SHA512
56433b9f2ae12773e356373ddbcdeb98db39b8686bf9c77b1fa0d19b5fe414ccf2447392e89ca75b788ac5e315c32b35c184f6f7ad043cab976472620281d70a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vvc8bff9.default-release\datareporting\glean\db\data.safe.tmp

Filesize
22KB

MD5
932ed4cbb745fd33a97d07afb0733815

SHA1
0894740ae49c1f20437ffda8f49322625d8d9c58

SHA256
bdd0b68db93a4812de4633971f8b2ee2a7cdd99b772cf0d194a048694b9161b5

SHA512
01adac6f986fcf80420ea087e7e59aff08d35be48457f001c8e33cac87fc0a0fca54cc1afa321307f793f11d6e2ae0a778fc03c479753a8cd4711f81a5c0393b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vvc8bff9.default-release\datareporting\glean\db\data.safe.tmp

Filesize
23KB

MD5
56f4cd96872b3aae9062914682caac96

SHA1
e0081693c4a5b5117a72fd09ac7bc629c71eda6b

SHA256
be9878d8991d0ef68ecd21240754eac7ea4924d3d742692a59b8abaf140d9df0

SHA512
ba2afab0134a77209485a130856a689721223f58fe4c7c5bf5dd5985a6122e98473d0dcac3453f1e6b6249a5fae93fb7327183c51cfe0e7e53d03c42b0433905

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vvc8bff9.default-release\datareporting\glean\db\data.safe.tmp

Filesize
22KB

MD5
133019d8e92a7cd23c3efa21927ab456

SHA1
5c278868177bfd483f1a1ccf044477a39c7763a4

SHA256
92f4774f4a68671f97b95a50afbf60d548305cb74e231b2b39a82450b970f23f

SHA512
b2a25e40a4064539e6deb258a868b7e316992f9549917cf262cf3a6db856111cb048bb1634f91d2013364955d2e92d599e363e837dcba1c1b6706f700e3ec2e8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vvc8bff9.default-release\datareporting\glean\db\data.safe.tmp

Filesize
25KB

MD5
943a5aa5964c571fe435dfb559c11131

SHA1
50f13051211abe2ffebd90a50ac989e32e67905d

SHA256
dc8520bf49a410204a1d075a317a4d46defae1f5afda1ba7ca008e8646edc0e0

SHA512
1e59d9781027ae5b2fd3933425e4ea22a698ad96f50a6de2fe2e847fc389558ee9c966f920ef5e9f8afd04c8e3a478f10bcc3e27a67ab3123cd71b85c1345ff7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vvc8bff9.default-release\datareporting\glean\pending_pings\94694153-2de5-4a51-9230-4f211bf539d5

Filesize
659B

MD5
0627a56f08e0192d736ca1e4bd8bc5c6

SHA1
2a74f77dee88f9ce0022333f72868554b97e1cad

SHA256
e597011d4f640f82ed25cc9acdf80ce0879d8055f2d67f931061164936b21455

SHA512
a5165b9261951216b3775d98f4794fbd6691b586ccde560cada7c4bcaf383ea660bfebd475caa2c578df907504122c93f2647917b42b8ad79e3a292cb298ec36

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vvc8bff9.default-release\datareporting\glean\pending_pings\9cae83f9-d472-4a43-96a0-8bb046f7e15b

Filesize
982B

MD5
cb36f9b37986911142d2ed4e1044214b

SHA1
fac476ccd9f84ea143182af74c252737d0ff2281

SHA256
38cc81253167c54afbcedcbeed2571e2a56c0626c19aef4006cfe8648f3f2996

SHA512
26cef11cb1e397424f513d38401840b92e8bc3951a2b069b48a9230921cd811f261e080f4004ddac10d97e2d5824cd93bcdf3f62e40785d9a9823cdfb521880e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vvc8bff9.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vvc8bff9.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vvc8bff9.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vvc8bff9.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vvc8bff9.default-release\prefs-1.js

Filesize
16KB

MD5
73aa84383bc92ce1a0421ea7731c31fe

SHA1
0753c0d8111364aa1c00cd7695ced41702d31d6f

SHA256
0265db77f3377b521c529602d7ef5d4700346d6fdb9fd6d88406913f5336e960

SHA512
646ac5021520dd0cc7f9964f8d3b8da375707b73481b1e18ee418469a749c5c61386c7627d4981830db25f8b53328e857676f3bb5c22587f3e46d2b7ab27aee0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vvc8bff9.default-release\prefs.js

Filesize
8KB

MD5
921ded91f656cc5f1217c82b6e5936a2

SHA1
e967f73f68ac91770e85033eb4a5d5854db4c154

SHA256
4770a6fdbf77d70edd62fba78f279fe10c8f19f911c4c6b3206caedab75ed5ee

SHA512
6c2fcd38da61e3979a3eb561debec6a68b85dfa5729b504ba6f14431adbee1e908baf459f7a5ab4812d6480af1db1a8b1da804de23e6669e30d53aa6ccac1604

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vvc8bff9.default-release\prefs.js

Filesize
11KB

MD5
232f047e58cd55c82dabeb9229d11324

SHA1
d2eea9b08b994037b2f99733adcd974cfd10db98

SHA256
74517d1fd5a97c3ad2d785baed3ebc2324bda983177a4aa3c217d32761f956fe

SHA512
051bde7cca1e5bfc1638e5aa642a9d5da0296900655fb7bc21eb5aa3fa4dca36fccee1cdf72ab57a75b7b339e7b754d860e86aab79e984977ec8e7979998c3c9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vvc8bff9.default-release\prefs.js

Filesize
12KB

MD5
630f67d695dd1a71bdee372099f017fa

SHA1
ecdfddd34c1a384050f154078f7f69410f9ea461

SHA256
9fd66fe884f8e10119314090fa5ebd824014418ce6da12155b4db32053c3a6c7

SHA512
b8151ac834b5518eb69950cc8c844080c365165e5570968d9723ce02a6655b23a5d99438d43cb1f22ab5b84b41e42498684ac1b18ee2b727fb41873bb47041be

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vvc8bff9.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
968KB

MD5
bf94aeb4388bb367a506e216364af4ba

SHA1
88120feeb78ab5094d45e93c2240dbcfb75a55b9

SHA256
3626d37cbe12e3cca8aeeed225d93710c6f9150bde837a1bd7287945b062cd18

SHA512
21ca7c134d357b063031df516c76cc39716fb2f1bf7945b0d83fbae5bd13bdbc172a4c3be08b84ad440df9a32a2cb0d92a4e8dbd47fbb1305b6fcfad2c4e5600

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads