5fccdd53fc7b1aa087c80dea2b089e8f90e190711258260df3d0271d152dd8ab

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
29/07/2024, 15:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
random.exe
Size 3.1MB
Sample240729-sn192aydmf
SHA256 5fccdd53fc7b1aa087c80dea2b089e8f90e190711258260df3d0271d152dd8ab
MD5 9fc25040185a6c2e9773f81388f214c2
SHA1 20ab8d32ea0f0df9f278374f51811280a537bacf
SHA512 1c55a5de33a2bf1fc42abff0e313da41a100a8ee9e3902836fec07914a3bb34282d72c9c2601ab7b1c5942718c244ba8c18faefdeaa38e2211bd26c6924d9be5
SSDEEP 98304:Uu6Mn5DsK1QBm4/YsIay+y4Q62g+xaz8S:eM5DsZmEYdPDrr
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\Control Panel\International\Geo\Nation	random.exe

AutoIT Executable 14 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/3560-347-0x0000000000B70000-0x000000000165D000-memory.dmp	autoit_exe
behavioral2/memory/3560-372-0x0000000000B70000-0x000000000165D000-memory.dmp	autoit_exe
behavioral2/memory/3560-411-0x0000000000B70000-0x000000000165D000-memory.dmp	autoit_exe
behavioral2/memory/3560-886-0x0000000000B70000-0x000000000165D000-memory.dmp	autoit_exe
behavioral2/memory/3560-1417-0x0000000000B70000-0x000000000165D000-memory.dmp	autoit_exe
behavioral2/memory/3560-2419-0x0000000000B70000-0x000000000165D000-memory.dmp	autoit_exe
behavioral2/memory/3560-2520-0x0000000000B70000-0x000000000165D000-memory.dmp	autoit_exe
behavioral2/memory/3560-2524-0x0000000000B70000-0x000000000165D000-memory.dmp	autoit_exe
behavioral2/memory/3560-2525-0x0000000000B70000-0x000000000165D000-memory.dmp	autoit_exe
behavioral2/memory/3560-2526-0x0000000000B70000-0x000000000165D000-memory.dmp	autoit_exe
behavioral2/memory/3560-2527-0x0000000000B70000-0x000000000165D000-memory.dmp	autoit_exe
behavioral2/memory/3560-2528-0x0000000000B70000-0x000000000165D000-memory.dmp	autoit_exe
behavioral2/memory/3560-2537-0x0000000000B70000-0x000000000165D000-memory.dmp	autoit_exe
behavioral2/memory/3560-2539-0x0000000000B70000-0x000000000165D000-memory.dmp	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 16 IoCs

pid	Process
3560	random.exe
3560	random.exe
3560	random.exe
3560	random.exe
3560	random.exe
3560	random.exe
3560	random.exe
3560	random.exe
3560	random.exe
3560	random.exe
3560	random.exe
3560	random.exe
3560	random.exe
3560	random.exe
3560	random.exe
3560	random.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	random.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2188	firefox.exe
Token: SeDebugPrivilege	2188	firefox.exe
Token: SeDebugPrivilege	2188	firefox.exe
Token: SeDebugPrivilege	2188	firefox.exe
Token: SeDebugPrivilege	2188	firefox.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3560	random.exe
3560	random.exe
3560	random.exe
3560	random.exe
3560	random.exe
3560	random.exe
3560	random.exe
2188	firefox.exe
2188	firefox.exe
2188	firefox.exe
2188	firefox.exe
2188	firefox.exe
2188	firefox.exe
2188	firefox.exe
2188	firefox.exe
2188	firefox.exe
2188	firefox.exe
2188	firefox.exe
2188	firefox.exe
2188	firefox.exe
2188	firefox.exe
2188	firefox.exe
2188	firefox.exe
3560	random.exe
2188	firefox.exe
2188	firefox.exe
2188	firefox.exe
2188	firefox.exe
2188	firefox.exe
3560	random.exe
3560	random.exe
3560	random.exe
3560	random.exe
3560	random.exe
3560	random.exe
3560	random.exe
3560	random.exe
3560	random.exe
3560	random.exe
3560	random.exe
3560	random.exe
3560	random.exe
3560	random.exe
3560	random.exe
3560	random.exe
3560	random.exe
3560	random.exe
3560	random.exe
3560	random.exe
3560	random.exe
3560	random.exe
3560	random.exe
3560	random.exe
3560	random.exe
3560	random.exe
3560	random.exe
3560	random.exe
3560	random.exe
3560	random.exe
3560	random.exe
3560	random.exe
3560	random.exe
3560	random.exe
3560	random.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3560	random.exe
3560	random.exe
3560	random.exe
3560	random.exe
3560	random.exe
3560	random.exe
3560	random.exe
2188	firefox.exe
2188	firefox.exe
2188	firefox.exe
2188	firefox.exe
2188	firefox.exe
2188	firefox.exe
2188	firefox.exe
2188	firefox.exe
2188	firefox.exe
2188	firefox.exe
2188	firefox.exe
2188	firefox.exe
2188	firefox.exe
2188	firefox.exe
2188	firefox.exe
2188	firefox.exe
3560	random.exe
2188	firefox.exe
2188	firefox.exe
2188	firefox.exe
2188	firefox.exe
3560	random.exe
3560	random.exe
3560	random.exe
3560	random.exe
3560	random.exe
3560	random.exe
3560	random.exe
3560	random.exe
3560	random.exe
3560	random.exe
3560	random.exe
3560	random.exe
3560	random.exe
3560	random.exe
3560	random.exe
3560	random.exe
3560	random.exe
3560	random.exe
3560	random.exe
3560	random.exe
3560	random.exe
3560	random.exe
3560	random.exe
3560	random.exe
3560	random.exe
3560	random.exe
3560	random.exe
3560	random.exe
3560	random.exe
3560	random.exe
3560	random.exe
3560	random.exe
3560	random.exe
3560	random.exe
3560	random.exe
3560	random.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3560	random.exe
2188	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3560 wrote to memory of 3144	3560	random.exe	90
PID 3560 wrote to memory of 3144	3560	random.exe	90
PID 3144 wrote to memory of 2188	3144	firefox.exe	92
PID 3144 wrote to memory of 2188	3144	firefox.exe	92
PID 3144 wrote to memory of 2188	3144	firefox.exe	92
PID 3144 wrote to memory of 2188	3144	firefox.exe	92
PID 3144 wrote to memory of 2188	3144	firefox.exe	92
PID 3144 wrote to memory of 2188	3144	firefox.exe	92
PID 3144 wrote to memory of 2188	3144	firefox.exe	92
PID 3144 wrote to memory of 2188	3144	firefox.exe	92
PID 3144 wrote to memory of 2188	3144	firefox.exe	92
PID 3144 wrote to memory of 2188	3144	firefox.exe	92
PID 3144 wrote to memory of 2188	3144	firefox.exe	92
PID 2188 wrote to memory of 4104	2188	firefox.exe	94
PID 2188 wrote to memory of 4104	2188	firefox.exe	94
PID 2188 wrote to memory of 4104	2188	firefox.exe	94
PID 2188 wrote to memory of 4104	2188	firefox.exe	94
PID 2188 wrote to memory of 4104	2188	firefox.exe	94
PID 2188 wrote to memory of 4104	2188	firefox.exe	94
PID 2188 wrote to memory of 4104	2188	firefox.exe	94
PID 2188 wrote to memory of 4104	2188	firefox.exe	94
PID 2188 wrote to memory of 4104	2188	firefox.exe	94
PID 2188 wrote to memory of 4104	2188	firefox.exe	94
PID 2188 wrote to memory of 4104	2188	firefox.exe	94
PID 2188 wrote to memory of 4104	2188	firefox.exe	94
PID 2188 wrote to memory of 4104	2188	firefox.exe	94
PID 2188 wrote to memory of 4104	2188	firefox.exe	94
PID 2188 wrote to memory of 4104	2188	firefox.exe	94
PID 2188 wrote to memory of 4104	2188	firefox.exe	94
PID 2188 wrote to memory of 4104	2188	firefox.exe	94
PID 2188 wrote to memory of 4104	2188	firefox.exe	94
PID 2188 wrote to memory of 4104	2188	firefox.exe	94
PID 2188 wrote to memory of 4104	2188	firefox.exe	94
PID 2188 wrote to memory of 4104	2188	firefox.exe	94
PID 2188 wrote to memory of 4104	2188	firefox.exe	94
PID 2188 wrote to memory of 4104	2188	firefox.exe	94
PID 2188 wrote to memory of 4104	2188	firefox.exe	94
PID 2188 wrote to memory of 4104	2188	firefox.exe	94
PID 2188 wrote to memory of 4104	2188	firefox.exe	94
PID 2188 wrote to memory of 4104	2188	firefox.exe	94
PID 2188 wrote to memory of 4104	2188	firefox.exe	94
PID 2188 wrote to memory of 4104	2188	firefox.exe	94
PID 2188 wrote to memory of 4104	2188	firefox.exe	94
PID 2188 wrote to memory of 4104	2188	firefox.exe	94
PID 2188 wrote to memory of 4104	2188	firefox.exe	94
PID 2188 wrote to memory of 4104	2188	firefox.exe	94
PID 2188 wrote to memory of 4104	2188	firefox.exe	94
PID 2188 wrote to memory of 4104	2188	firefox.exe	94
PID 2188 wrote to memory of 4104	2188	firefox.exe	94
PID 2188 wrote to memory of 4104	2188	firefox.exe	94
PID 2188 wrote to memory of 4104	2188	firefox.exe	94
PID 2188 wrote to memory of 4104	2188	firefox.exe	94
PID 2188 wrote to memory of 4104	2188	firefox.exe	94
PID 2188 wrote to memory of 4104	2188	firefox.exe	94
PID 2188 wrote to memory of 4104	2188	firefox.exe	94
PID 2188 wrote to memory of 4104	2188	firefox.exe	94
PID 2188 wrote to memory of 4104	2188	firefox.exe	94
PID 2188 wrote to memory of 4104	2188	firefox.exe	94
PID 2188 wrote to memory of 4800	2188	firefox.exe	96
PID 2188 wrote to memory of 4800	2188	firefox.exe	96
PID 2188 wrote to memory of 4800	2188	firefox.exe	96
PID 2188 wrote to memory of 4800	2188	firefox.exe	96
PID 2188 wrote to memory of 4800	2188	firefox.exe	96
PID 2188 wrote to memory of 4800	2188	firefox.exe	96

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\random.exe
"C:\Users\Admin\AppData\Local\Temp\random.exe"
1⤵
- Checks computer location settings
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3560
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3144
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2188
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2032 -parentBuildID 20240401114208 -prefsHandle 1948 -prefMapHandle 1940 -prefsLen 25753 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b13cd725-35d5-4659-81f0-744060300fc4} 2188 "\\.\pipe\gecko-crash-server-pipe.2188" gpu
      4⤵
      PID:4104
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2468 -parentBuildID 20240401114208 -prefsHandle 2460 -prefMapHandle 2456 -prefsLen 26673 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d18fe9d2-8f87-45ae-8926-6c49d016a58f} 2188 "\\.\pipe\gecko-crash-server-pipe.2188" socket
      4⤵
      PID:4800
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3120 -childID 1 -isForBrowser -prefsHandle 3216 -prefMapHandle 3180 -prefsLen 22698 -prefMapSize 244658 -jsInitHandle 1312 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {398554c7-c78d-4122-a5f4-24376adae978} 2188 "\\.\pipe\gecko-crash-server-pipe.2188" tab
      4⤵
      PID:736
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4176 -childID 2 -isForBrowser -prefsHandle 4188 -prefMapHandle 4184 -prefsLen 31163 -prefMapSize 244658 -jsInitHandle 1312 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b809870d-af8b-49d5-8a9e-34fd0bac07ab} 2188 "\\.\pipe\gecko-crash-server-pipe.2188" tab
      4⤵
      PID:2060
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4388 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4392 -prefMapHandle 4396 -prefsLen 31163 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {03a7ab84-9c96-461b-b487-4600367300b8} 2188 "\\.\pipe\gecko-crash-server-pipe.2188" utility
      4⤵
      Checks processor information in registry
      PID:4428
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5188 -childID 3 -isForBrowser -prefsHandle 5180 -prefMapHandle 5168 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1312 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5dc5cd0a-ab60-4cd7-ade4-9d72590ab9d4} 2188 "\\.\pipe\gecko-crash-server-pipe.2188" tab
      4⤵
      PID:5768
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5320 -childID 4 -isForBrowser -prefsHandle 5328 -prefMapHandle 5332 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1312 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {60f93e3d-7c58-446a-9ee9-8be5f138279c} 2188 "\\.\pipe\gecko-crash-server-pipe.2188" tab
      4⤵
      PID:5780
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5528 -childID 5 -isForBrowser -prefsHandle 5536 -prefMapHandle 5540 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1312 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {295b3203-455b-4e71-b310-c39d9d0933f8} 2188 "\\.\pipe\gecko-crash-server-pipe.2188" tab
      4⤵
      PID:5796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\vcc2x7ul.default-release\activity-stream.discovery_stream.json
Size 24KB
SHA256 0aa418b7d4543579714f31220327f2b565e2e64836a2a7d8de15221ae217a316
MD5 9717eab079c9d811457197cd6f259c00
SHA1 f75613dc5a9c241c9e8d99adb451ab54d60eb128
SHA512 90ff5229710dbfd7b5681880cdbf2ee8d35d12d00716a55ae8103bcd8135240e2c28ef795fa95c75e622ea431d1b59083779c146e6b3d63a68a0ccd61b93a216
SSDEEP 384:Bt6DkBbn2PG3fqXUFWs+x3zcbauDC30JmvfufeyaukcN/NtqeIjG:Bt6YBb2PG4eWtH30JwRydk2+G
MD5 SHA1 SHA512 SSDEEP

Submit Download

8A2034D325DC0B5C9E11EDDA3FC70A54C8DC1C0D

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\vcc2x7ul.default-release\cache2\entries\8A2034D325DC0B5C9E11EDDA3FC70A54C8DC1C0D
Size 13KB
SHA256 7339c1a1fc9a8a26c86bb55ce24c3edfa3a796ec64166adecdfd8218c58dbdb2
MD5 d7f661da747df17b6e2380989f27d344
SHA1 a933c34b5f130f3f79b23f780863dbf4eeaf7f1e
SHA512 23c141ba7ff0d2a77c95765c2d6120933ddf31c5f64ea0461751ef91f55a148ac4b83435ee0912a7caf147290f46954a7ca2711c1c7d2dc1f9e2b94d889798d5
SSDEEP 384:H485u9fiGLm4pUlft2WlOX8lPLZZB7t0lpDIIP/Q:nUBi8mCUlft2WAX8tzB7eD8h
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 479KB
SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
MD5 09372174e83dbbf696ee732fd2e875bb
SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 13.8MB
SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
MD5 0a8747a2ac9ac08ae9508f36c6d75692
SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vcc2x7ul.default-release\AlternateServices.bin
Size 17KB
SHA256 98063494384d7f36c4e416682e54130db28354db3ad61556cc69f93d7803ff7a
MD5 a529b96819f7cf29a9045a7f61abe4a6
SHA1 46cdebd69deae4d9657489b1b12e82ce810dbe56
SHA512 819e85cb9fbd16edc39b899cc5fa08f2261b68e084b7113c332971b788d32dfc0b05b837b7ff51135db4fd6358a33022b0c75ce3b9e3b427ff61d51645d3d9fa
SSDEEP 96:i65oZxvebOJxbLpebvpf+Vb7bDbygbgzMbqbybFblbCHV/bSb:i652Lu
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vcc2x7ul.default-release\AlternateServices.bin
Size 11KB
SHA256 968de9e3126240adc9aa9b406215ba842f1f01f5f147f908d2c4495685473c68
MD5 016e462ae2432765101ac9354b7679cd
SHA1 5a2cd766b0cfbfd4259ea9ddd535e226aafebda8
SHA512 b026edaaed0313093b06b8c6f26b8e677b2645bc0b4e355afdb836b1ef487796ef335de46c5fc526395bc53c1b0ad65561df761182f484d60b337789a2cb4945
SSDEEP 96:n5oZxvebOJxbvpebvpf+BbfbTbpgbgzXb:n52vu
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vcc2x7ul.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 fbb5c4fb9e5604411da8fb3f020705457c3e65c63e244bf5b80c7788c1e530d5
MD5 28809ac01990909c24e44b0bf91dabfd
SHA1 c33c38e654cf163820e1a38778f6849c2cab9480
SHA512 697f126ad040e8e34e18f087714375db9ccb9365d0a1b2ba15eb72d91e937d03e6c04d40182e9d1e9adc647f89623262bb7cf854e2a085ea6c29ea22bc687662
SSDEEP 96:cGQc3cglbcWFl66JozGzgClKtmSShGSMF9ZbkW6P2hmVPPP/PaxvWI:Hp/66JozGzgCl6mSSorvZboehAHP0OI
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vcc2x7ul.default-release\datareporting\glean\db\data.safe.tmp
Size 16KB
SHA256 12a3b23f5db6c1e3ac183382dd8ab7549dbc7d51adc2e444f3c39dbf9729fb3b
MD5 9dfb05c9f9f3c6eb0d7a0d0246f6c5a6
SHA1 59389172e45b56e8b93646917ea561331a3b80cc
SHA512 0c0cfa955dd57a7d95c3ee043ffb58a20ead828352fc83ca87d53c1b4e7561ea25841bdc45fcaa7b4327837d45795a5804b5098dc94cea463566b30887d4b91c
SSDEEP 384:Bbo/pgP5NtJmDleZYrQzWqDEQwCbBbPFp/66JozGzgC1bM:xJvtUD3iDEQwCbBbPOEm
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vcc2x7ul.default-release\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 6e4c5b590d9038b30cab9e9fda41cc02aea68b0bca0ad8ff16708bddb08544b6
MD5 b3a3292922c6f3b904bab98f24bf3ef0
SHA1 7541aad59e87eebd2b166699f74206df1804e277
SHA512 7f827331b2d483fa0109e8537c6efee5561e5aace88200d55a521f49d74159d978ee0f46c43a691883516d308786dc433b147d557086f875dce281670e0601cd
MD5 SHA1 SHA512

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vcc2x7ul.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 9186e5df1f1763ad9fdbbc6397b6fa9299200b1b3d2b76e69522073ea2df778d
MD5 1a81ff01d13ce32e589d8432cf00bce9
SHA1 ba3af042c06d4f7789d71293ae294c78f2b2f21a
SHA512 14c83c714a17108e59b2e56edb0d914ca1bd80321ef1b83fc82a03beccc85dbfad283883202a9698152b3bcba558faa067b806727bafaf4f2052038c4735c94d
SSDEEP 96:J1BrGSMF9ZbkW6rBBw2hmVPPP/PhxkW0GQc3cglbcWFl66JozGzgClKtmSSM:ErvZboP3hAHPDfvp/66JozGzgCl6mSSM
MD5 SHA1 SHA512 SSDEEP

Submit Download

292393af-bdec-4cb8-9f32-133e91ed397b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vcc2x7ul.default-release\datareporting\glean\pending_pings\292393af-bdec-4cb8-9f32-133e91ed397b
Size 25KB
SHA256 a95c79d33078e8c8d7b81a607ab6ad4bcf11ae8c8c90c6a982a1dfe24944234c
MD5 af1e215584736e9b44cb6447bc5719dc
SHA1 9b872014e703a0098463db0898bbf3ee63e507d3
SHA512 5ee5455bcc4c1f6f678acc78190801c82eb7704080ae800c43e4ca549c0e5ab6377c1cfabd820619a1efcdc33627142ef1b85d77abf82a01d42640e158853b2f
SSDEEP 384:rfBqxrHwleYJoJBf7lWli1Hb0IInzTgSV:WrHwleHUzMSV
MD5 SHA1 SHA512 SSDEEP

Submit Download

435a5494-2e9a-4ab4-9011-02294c35b177

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vcc2x7ul.default-release\datareporting\glean\pending_pings\435a5494-2e9a-4ab4-9011-02294c35b177
Size 671B
SHA256 bd9fbdd899414ee6d16d15c21e51cfbda8c269d82a140bf28155462f215866ab
MD5 f2638e6e63f5b70dec00cf70d4fbcabd
SHA1 b56d669f13488da5e98a196494f474e98d44f756
SHA512 350026efa10f22692a2e5e8eac66776957decf0a972720337c8badd78be2897fa65f146ff975428f75261ca112379c0f6b58c424850c4d77287fbd5626699254
MD5 SHA1 SHA512

Submit Download

f3d3efac-df3e-48c6-b7d0-08a961e31f03

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vcc2x7ul.default-release\datareporting\glean\pending_pings\f3d3efac-df3e-48c6-b7d0-08a961e31f03
Size 982B
SHA256 79f381d345a418e5c5a5a20985519619a16f213acb3adf6fee8fa97fcdac7bb4
MD5 e022520ad9c1c8af071489fe32b186ad
SHA1 b0c70a465c3136ba148495122f1df1abd61f4a17
SHA512 d82e2755208cc76a77e40b7a5ce24267bd8fb95d06c514f38e9b934c2e575ea1891e490f3260eb933de2bdf30b5d62847d1a9ec9ff77964b9926e7b473d780a3
MD5 SHA1 SHA512

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vcc2x7ul.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Size 1.1MB
SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
MD5 842039753bf41fa5e11b3a1383061a87
SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vcc2x7ul.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Size 116B
SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
MD5 2a461e9eb87fd1955cea740a3444ee7a
SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vcc2x7ul.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Size 372B
SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
MD5 bf957ad58b55f64219ab3f793e374316
SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vcc2x7ul.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Size 17.8MB
SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
MD5 daf7ef3acccab478aaa7d6dc1c60f865
SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vcc2x7ul.default-release\prefs-1.js
Size 15KB
SHA256 e43547d58e3afafc62a456a67a26b94396643b06d7ab1ad15f24d205cb606e94
MD5 bcad6bf40273ce7415d4532178cd5e4c
SHA1 af897d18df3e739d80706e1c8da17ca857925f65
SHA512 9e9d29d5cef50c30fada2605c3adc5a65fcec23b66fa1bc4114d51ceddd4ccaabdc54c159125cd3155603847847953566486b15c2628e59f0dadb6a3c540f0f2
SSDEEP 192:32nLRdf9C4wBQYud33QGcdJ8lYhddNs0OaX4+0pE48KliBw8HEffvDlOiUbT3:o0QJ4QlMz4Iwbo
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vcc2x7ul.default-release\prefs.js
Size 8KB
SHA256 b1525e88b3bcea1be0a46748291bea205bb4ee2b126e22837ed2b0d49358d8a3
MD5 53e4504617fccfbead6813203ba671ab
SHA1 ef1ef8824b5028d2b5cb62fd4559ff4f04066904
SHA512 a93e6bdec08dce68098a6d71303dd35562b5b7d6529dee731e1334db0afe89724c766f5d48202aa28db5d58488afd0104218e9f5fc08b2944ad0e1d25c2f5648
SSDEEP 192:p5nLRdf4HaZD4cd6l60qaXC0pE4DBw8Vl:T1D9AMlz4dwG
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vcc2x7ul.default-release\prefs.js
Size 10KB
SHA256 18079443a46b8ebd91d69ae7afebe2b2e016013ab219b7189c029d64defbd7fb
MD5 cba1585f0a0f90597c2bf81c10b0b4c5
SHA1 311f2a9c2185321f3597d640b719ccd54f78772c
SHA512 38c7f100715d7594479dfd5b7c251263ff14a1b30da146f4438c572e95640d9811d2e5df681fb2910ce66ed49400c8976832e34e8de2ff3622032ccdd5f023f1
SSDEEP 192:p5nLRdf4C4wBQYud33QGcdJ8lYhddNs0OaX00pE4DBw8Hl:TrQJ4Qljz4dwk
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vcc2x7ul.default-release\prefs.js
Size 11KB
SHA256 c63694660a9791bfe174cc7a2f2c4ed94ffcf5c61fd54fcc2a6f929f6ce049ef
MD5 fc6dfa44abd0a5d9f191eb5e9c18a940
SHA1 5076f6169e926797b327c7f46bebf82330fa1ec3
SHA512 e08ade4a30d9f0aab4c7676f8f6e4037086236b7afcbd5fc1540749a60cca4fd3655dfc72c195732f397dddda3402cc920f8b72cc6b8bf01b87ed6e9625ca664
SSDEEP 192:35nLRdf4C4wBQYud33QGcdJ8lYhddNs0OaX00pE4zBw8H2m:RrQJ4Qljz4NwI
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vcc2x7ul.default-release\prefs.js
Size 14KB
SHA256 2daaf4cd814b1a732ad780801983384344b83cade395ea60bd2993cb5571f894
MD5 a74ad39584c00961b704840c12d634af
SHA1 092fbdd30a614f4a0d31999e080223b41dcfba61
SHA512 fcfc4fd55bccc8f87796c0b42f8e0d6aa5c3a1bab428b70959dc062722c6d8e21d2b787cf2fc5cea7c532490c5ccfac401c6687af0470c58634e0a930baa9ceb
SSDEEP 192:32nLRdf4C4wBQYud33QGcdJ8lYhddNs0OaX00pE48KBiBw8HsvUZ:orQJ4Qljz4cwTO
MD5 SHA1 SHA512 SSDEEP

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vcc2x7ul.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 7.6MB
SHA256 47339507f03a9c8b366cbb24e7fd9a8e1952f0d9bbe010212b2b5db6066fcfdb
MD5 753826121099cc0c126d077ae0f5254f
SHA1 4f00b06cbdfa990984e61025f9c1065656a7ca30
SHA512 3a1948329236d0ecf87ebf899a68bbb57cd74c85663a9ef932f4a8cd355c8050246097c587c9edb4b3b993d1a288ef4891fe87bc944ceff9d61fc337d7da8aa0
SSDEEP 49152:pbQnahMBD3i+ybOx7fb3xizWhuYobNDOGpCVr4Ft/1kNB5BGaMUDfoyXme0VC8iB:AXLy
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3560-886-0x0000000000B70000-0x000000000165D000-memory.dmp

Download

memory/3560-2520-0x0000000000B70000-0x000000000165D000-memory.dmp

Download

memory/3560-378-0x00000000FF0E0000-0x00000000FF4B1000-memory.dmp

Download

memory/3560-347-0x0000000000B70000-0x000000000165D000-memory.dmp

Download

memory/3560-0-0x0000000000B70000-0x000000000165D000-memory.dmp

Download

memory/3560-2-0x00000000774B2000-0x00000000774B3000-memory.dmp

Download

memory/3560-411-0x0000000000B70000-0x000000000165D000-memory.dmp

Download

memory/3560-1417-0x0000000000B70000-0x000000000165D000-memory.dmp

Download

memory/3560-2419-0x0000000000B70000-0x000000000165D000-memory.dmp

Download

memory/3560-372-0x0000000000B70000-0x000000000165D000-memory.dmp

Download

memory/3560-2524-0x0000000000B70000-0x000000000165D000-memory.dmp

Download

memory/3560-2525-0x0000000000B70000-0x000000000165D000-memory.dmp

Download

memory/3560-2526-0x0000000000B70000-0x000000000165D000-memory.dmp

Download

memory/3560-2527-0x0000000000B70000-0x000000000165D000-memory.dmp

Download

memory/3560-2528-0x0000000000B70000-0x000000000165D000-memory.dmp

Download

memory/3560-1-0x00000000FF0E0000-0x00000000FF4B1000-memory.dmp

Download

memory/3560-2537-0x0000000000B70000-0x000000000165D000-memory.dmp

Download

memory/3560-2539-0x0000000000B70000-0x000000000165D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads