hxxps://www[.]office[.]com/

Resubmissions

17/08/2024, 05:31

240817-f78r1asfnq9

17/08/2024, 05:25

240817-f4g5wayhrd9

17/08/2024, 05:25

240817-f4gt4ssdrm

17/08/2024, 05:10

240817-ftstmayelc9

Analysis

max time kernel
273s
max time network
294s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
17/08/2024, 05:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.office.com/
Sample240817-ftstmayelc

Score

9^/10

microsoft credential_access discovery phishing stealer

Malware Config

Signatures

Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003
Detected potential entity reuse from brand microsoft.
phishing microsoft
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	4452	firefox.exe
Token: SeDebugPrivilege	4452	firefox.exe
Token: SeDebugPrivilege	4452	firefox.exe
Token: SeDebugPrivilege	4452	firefox.exe
Token: SeDebugPrivilege	4452	firefox.exe
Token: SeDebugPrivilege	4452	firefox.exe

Suspicious use of FindShellTrayWindow 21 IoCs

pid	Process
4452	firefox.exe
4452	firefox.exe
4452	firefox.exe
4452	firefox.exe
4452	firefox.exe
4452	firefox.exe
4452	firefox.exe
4452	firefox.exe
4452	firefox.exe
4452	firefox.exe
4452	firefox.exe
4452	firefox.exe
4452	firefox.exe
4452	firefox.exe
4452	firefox.exe
4452	firefox.exe
4452	firefox.exe
4452	firefox.exe
4452	firefox.exe
4452	firefox.exe
4452	firefox.exe

Suspicious use of SendNotifyMessage 20 IoCs

pid	Process
4452	firefox.exe
4452	firefox.exe
4452	firefox.exe
4452	firefox.exe
4452	firefox.exe
4452	firefox.exe
4452	firefox.exe
4452	firefox.exe
4452	firefox.exe
4452	firefox.exe
4452	firefox.exe
4452	firefox.exe
4452	firefox.exe
4452	firefox.exe
4452	firefox.exe
4452	firefox.exe
4452	firefox.exe
4452	firefox.exe
4452	firefox.exe
4452	firefox.exe

Suspicious use of SetWindowsHookEx 16 IoCs

pid	Process
4452	firefox.exe
4452	firefox.exe
4452	firefox.exe
4452	firefox.exe
4452	firefox.exe
4452	firefox.exe
4452	firefox.exe
4452	firefox.exe
4452	firefox.exe
4452	firefox.exe
4452	firefox.exe
4452	firefox.exe
4452	firefox.exe
4452	firefox.exe
4452	firefox.exe
4452	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3544 wrote to memory of 4452	3544	firefox.exe	84
PID 3544 wrote to memory of 4452	3544	firefox.exe	84
PID 3544 wrote to memory of 4452	3544	firefox.exe	84
PID 3544 wrote to memory of 4452	3544	firefox.exe	84
PID 3544 wrote to memory of 4452	3544	firefox.exe	84
PID 3544 wrote to memory of 4452	3544	firefox.exe	84
PID 3544 wrote to memory of 4452	3544	firefox.exe	84
PID 3544 wrote to memory of 4452	3544	firefox.exe	84
PID 3544 wrote to memory of 4452	3544	firefox.exe	84
PID 3544 wrote to memory of 4452	3544	firefox.exe	84
PID 3544 wrote to memory of 4452	3544	firefox.exe	84
PID 4452 wrote to memory of 3732	4452	firefox.exe	85
PID 4452 wrote to memory of 3732	4452	firefox.exe	85
PID 4452 wrote to memory of 3732	4452	firefox.exe	85
PID 4452 wrote to memory of 3732	4452	firefox.exe	85
PID 4452 wrote to memory of 3732	4452	firefox.exe	85
PID 4452 wrote to memory of 3732	4452	firefox.exe	85
PID 4452 wrote to memory of 3732	4452	firefox.exe	85
PID 4452 wrote to memory of 3732	4452	firefox.exe	85
PID 4452 wrote to memory of 3732	4452	firefox.exe	85
PID 4452 wrote to memory of 3732	4452	firefox.exe	85
PID 4452 wrote to memory of 3732	4452	firefox.exe	85
PID 4452 wrote to memory of 3732	4452	firefox.exe	85
PID 4452 wrote to memory of 3732	4452	firefox.exe	85
PID 4452 wrote to memory of 3732	4452	firefox.exe	85
PID 4452 wrote to memory of 3732	4452	firefox.exe	85
PID 4452 wrote to memory of 3732	4452	firefox.exe	85
PID 4452 wrote to memory of 3732	4452	firefox.exe	85
PID 4452 wrote to memory of 3732	4452	firefox.exe	85
PID 4452 wrote to memory of 3732	4452	firefox.exe	85
PID 4452 wrote to memory of 3732	4452	firefox.exe	85
PID 4452 wrote to memory of 3732	4452	firefox.exe	85
PID 4452 wrote to memory of 3732	4452	firefox.exe	85
PID 4452 wrote to memory of 3732	4452	firefox.exe	85
PID 4452 wrote to memory of 3732	4452	firefox.exe	85
PID 4452 wrote to memory of 3732	4452	firefox.exe	85
PID 4452 wrote to memory of 3732	4452	firefox.exe	85
PID 4452 wrote to memory of 3732	4452	firefox.exe	85
PID 4452 wrote to memory of 3732	4452	firefox.exe	85
PID 4452 wrote to memory of 3732	4452	firefox.exe	85
PID 4452 wrote to memory of 3732	4452	firefox.exe	85
PID 4452 wrote to memory of 3732	4452	firefox.exe	85
PID 4452 wrote to memory of 3732	4452	firefox.exe	85
PID 4452 wrote to memory of 3732	4452	firefox.exe	85
PID 4452 wrote to memory of 3732	4452	firefox.exe	85
PID 4452 wrote to memory of 3732	4452	firefox.exe	85
PID 4452 wrote to memory of 3732	4452	firefox.exe	85
PID 4452 wrote to memory of 3732	4452	firefox.exe	85
PID 4452 wrote to memory of 3732	4452	firefox.exe	85
PID 4452 wrote to memory of 3732	4452	firefox.exe	85
PID 4452 wrote to memory of 3732	4452	firefox.exe	85
PID 4452 wrote to memory of 3732	4452	firefox.exe	85
PID 4452 wrote to memory of 3732	4452	firefox.exe	85
PID 4452 wrote to memory of 3732	4452	firefox.exe	85
PID 4452 wrote to memory of 3732	4452	firefox.exe	85
PID 4452 wrote to memory of 3732	4452	firefox.exe	85
PID 4452 wrote to memory of 216	4452	firefox.exe	87
PID 4452 wrote to memory of 216	4452	firefox.exe	87
PID 4452 wrote to memory of 216	4452	firefox.exe	87
PID 4452 wrote to memory of 216	4452	firefox.exe	87
PID 4452 wrote to memory of 216	4452	firefox.exe	87
PID 4452 wrote to memory of 216	4452	firefox.exe	87
PID 4452 wrote to memory of 216	4452	firefox.exe	87
PID 4452 wrote to memory of 216	4452	firefox.exe	87

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://www.office.com/"
1⤵
- Suspicious use of WriteProcessMemory
PID:3544
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://www.office.com/
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4452
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2044 -parentBuildID 20240401114208 -prefsHandle 1968 -prefMapHandle 1964 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {98c69e43-2ce6-40cf-befd-b8fe7431e6e8} 4452 "\\.\pipe\gecko-crash-server-pipe.4452" gpu
    3⤵
    PID:3732
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2464 -parentBuildID 20240401114208 -prefsHandle 2440 -prefMapHandle 2436 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4444657b-217a-43ab-805f-ed5709ada179} 4452 "\\.\pipe\gecko-crash-server-pipe.4452" socket
    3⤵
    PID:216
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3420 -childID 1 -isForBrowser -prefsHandle 3424 -prefMapHandle 3212 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 888 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5149e4a3-9e5e-4a1b-9e01-c96869b6381a} 4452 "\\.\pipe\gecko-crash-server-pipe.4452" tab
    3⤵
    PID:1840
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3660 -childID 2 -isForBrowser -prefsHandle 3096 -prefMapHandle 3060 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 888 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b0c7d797-23f4-410c-be7b-ab02784e8da8} 4452 "\\.\pipe\gecko-crash-server-pipe.4452" tab
    3⤵
    PID:5036
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4568 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4560 -prefMapHandle 4552 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2086e534-9c34-4822-8678-b841901eb01b} 4452 "\\.\pipe\gecko-crash-server-pipe.4452" utility
    3⤵
    - Checks processor information in registry
    PID:4576
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5084 -childID 3 -isForBrowser -prefsHandle 5076 -prefMapHandle 5064 -prefsLen 26944 -prefMapSize 244658 -jsInitHandle 888 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ac65a87d-5c83-49a9-918f-ed4fe38b7e6d} 4452 "\\.\pipe\gecko-crash-server-pipe.4452" tab
    3⤵
    PID:3080
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5232 -childID 4 -isForBrowser -prefsHandle 5320 -prefMapHandle 5316 -prefsLen 26944 -prefMapSize 244658 -jsInitHandle 888 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b1b46aaf-7773-44c0-85f5-0e2d07925794} 4452 "\\.\pipe\gecko-crash-server-pipe.4452" tab
    3⤵
    PID:2220
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5096 -childID 5 -isForBrowser -prefsHandle 5216 -prefMapHandle 5224 -prefsLen 26944 -prefMapSize 244658 -jsInitHandle 888 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ef28f8df-dc27-4208-9e84-a12c0f280c08} 4452 "\\.\pipe\gecko-crash-server-pipe.4452" tab
    3⤵
    PID:1392
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6100 -childID 6 -isForBrowser -prefsHandle 3432 -prefMapHandle 2700 -prefsLen 27079 -prefMapSize 244658 -jsInitHandle 888 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {57e64b0f-7d49-4369-93ac-d8e0a2ec3d99} 4452 "\\.\pipe\gecko-crash-server-pipe.4452" tab
    3⤵
    PID:2144
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6304 -childID 7 -isForBrowser -prefsHandle 6272 -prefMapHandle 6300 -prefsLen 27129 -prefMapSize 244658 -jsInitHandle 888 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c1c45d9b-e8cc-40c7-a750-f05a04109130} 4452 "\\.\pipe\gecko-crash-server-pipe.4452" tab
    3⤵
    PID:4136
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2944 -childID 8 -isForBrowser -prefsHandle 3640 -prefMapHandle 5276 -prefsLen 28329 -prefMapSize 244658 -jsInitHandle 888 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dde68d4c-fbc7-4568-a935-01b864617781} 4452 "\\.\pipe\gecko-crash-server-pipe.4452" tab
    3⤵
    PID:4120
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6092 -childID 9 -isForBrowser -prefsHandle 5796 -prefMapHandle 1896 -prefsLen 28329 -prefMapSize 244658 -jsInitHandle 888 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {50affa1d-3da0-4a40-a956-af1dec15c05b} 4452 "\\.\pipe\gecko-crash-server-pipe.4452" tab
    3⤵
    PID:3020
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5080 -childID 10 -isForBrowser -prefsHandle 5124 -prefMapHandle 5100 -prefsLen 28329 -prefMapSize 244658 -jsInitHandle 888 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a60d3fcf-505e-41ae-88a9-d0e95d81b142} 4452 "\\.\pipe\gecko-crash-server-pipe.4452" tab
    3⤵
    PID:3972
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6328 -childID 11 -isForBrowser -prefsHandle 5024 -prefMapHandle 2756 -prefsLen 28329 -prefMapSize 244658 -jsInitHandle 888 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6c9fdb20-83f3-4a9a-a067-fbbb59ab723c} 4452 "\\.\pipe\gecko-crash-server-pipe.4452" tab
    3⤵
    PID:3316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 479KB
SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
MD5 09372174e83dbbf696ee732fd2e875bb
SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 13.8MB
SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
MD5 0a8747a2ac9ac08ae9508f36c6d75692
SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
MD5 SHA1 SHA512 SSDEEP

Submit Download

BWA8PFE9HEQ1HWML2CB8.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\BWA8PFE9HEQ1HWML2CB8.temp
Size 13KB
SHA256 3b355fa90e829686d83d45e0296625316e795b6ef73d304204e7333bedb4eb59
MD5 5f880a853f337ac755b12eab887a7c96
SHA1 f45a9985deadba66a28c117c56ba929cb2ede75a
SHA512 9a5573cf9bca668c1c7471ca97a30a3bc70ad97ce96974a29c9b7fdcf914f629e3c5cf51cd2c2e91f985525aa0b7bce2a350d0112053c92f62a8e9bd8de29663
SSDEEP 96:c1l+NgBl/zNgxl/DNgulODrIerM/N11Ngul+IzJ4+eZAq+j67HFVHi6ohGNgFXlG:cnN4/ROAerM/N1z3zG+eZf+6SxKf
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\AlternateServices.bin
Size 10KB
SHA256 46dd5627c5f1a8bb6406f98b1542d944a2b3b431a8af4988af95a6e50ba751e6
MD5 6e3ec46e89a28f9dc4e114de9b4e1678
SHA1 ec81582fc108ced562b6ad3a424a3f01e9092965
SHA512 bf6f7599e62662da69abf472dc2a0a0a57ecf38acaeb736990737c92d57c4f2f76b61e5709c91fae21efc9e1afac6f0b96fcbda00be59e40a042be105fa86b57
SSDEEP 24:u2uB1oJw9lKpR5cOA98n4Ugu1xgRbH9WzuhMZa9ZWXFsh2F3LFJOZqSGVHE5zzRZ:rSo9cOi65oJ3ZyrRE5U
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 59632b55d810d8d5a06340c9159c2b01ca61874988bc228313807b2f4c43fb8e
MD5 bcf52f1582faae57d0e5500271a897eb
SHA1 86e510b63b9d5ec907b091ffdeb0a2627b2e5923
SHA512 13faba9a70b559da23b3de5b98847f66a609ad3561847405333b3fc438e70ee65222e27b7a7a6ad624018dd0ca64d83536813323e333f3ce50126ad92d248aa1
SSDEEP 96:ESMF9ZbkW6ShmlrPP/PrWZ99RQWZV9UFl66JozGzgClKtmSSM:ErvZboShADPCrU/66JozGzgCl6mSSM
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\datareporting\glean\db\data.safe.tmp
Size 71KB
SHA256 dec08896ece120809f3cc428a2464c0fc553a2657b6c3f13ca452d78477223dc
MD5 1d8ac389eb4c4779034d47b3d1dffa5a
SHA1 42be454bbe56720471a4e81a85d308aa47ad15d6
SHA512 e21baabb766952cd3ddd4f0c20e59366c85adf624a3af543be9eec98bac9e005fdca6e4981f9fc9de9f240719e5b9a26dd63fe2c2156cae0013b831aa38c42af
SSDEEP 1536:NkP7rWZmyDQikhqbSCBilBMctjGR+kTGozaFQ82vZjrmCff7FItl:NAqQy0PCUTuXCJ2xvZjrmCff7FItl
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 9381290c423a3bc78c48648c903b0d1b7c9d4545d7cfed0670726c4f3abb1d63
MD5 ac29d01ca0f519bda3298e8423b18017
SHA1 2e84f4286def2b3e40947e4d88b7245d152b9b7e
SHA512 82e102d03d4f0924f330ef1184d5940948bb30925c52a9901ef2db775c91a9544cb0cbe54c7c99a9c7a6cbf262f0f70213f8295407506198516645437ede7ef5
SSDEEP 96:W9RQWZV9UFl66JozGzgClKtmSSMBQSMF9ZbkW6rBB9hmTtrPP/PrWI:EU/66JozGzgCl6mSS/rvZboP9heDPCI
MD5 SHA1 SHA512 SSDEEP

Submit Download

330dc8e4-60bb-4213-87b5-6a4c45a11786

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\datareporting\glean\pending_pings\330dc8e4-60bb-4213-87b5-6a4c45a11786
Size 26KB
SHA256 dfb35f75cc80f1ed50e936e68f34247808ae2762ec675013a9968ad968997baf
MD5 e2e870551064daa28fdb8cac80a3d5ab
SHA1 4fba80f03265fa93f0187bc7d91df48a29492db2
SHA512 0e86b48d2da53650f15048847c98435912b9e267a11846998144ed12002526d05585c03dbbbfeb2488dd2e1d9a6b82ed5cdeeae73de3caaa221623f778af6709
SSDEEP 192:J0LdNDi/7+TuR7z6GJAw7KlVjRSB5FdidViWnaCSibFP/x9B5s00G2TI5q0XGJA4:JkLDi/7pR71WVjUBVcaWcpLzq8HFd
MD5 SHA1 SHA512 SSDEEP

Submit Download

52fd6089-8f93-44c3-a240-02658b67dff2

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\datareporting\glean\pending_pings\52fd6089-8f93-44c3-a240-02658b67dff2
Size 982B
SHA256 682e3bda0e45b36bf9d3f050005f441e2a3c9734c4462c052e3cc7fe701f8a1b
MD5 771afb6644d2c6104b354b6a94d2cd80
SHA1 88e72efeadd7ae66c3c7c53cedcf57080994fc87
SHA512 d0558162cc7b91f26c6a24f1749b33a97356702e68980cf162c50e14ea9703282025296566401985c48f270e1f5b6fbc38742955d92428878d982975443a6726
MD5 SHA1 SHA512

Submit Download

937a58ba-ed11-4376-920c-8191e1cd877f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\datareporting\glean\pending_pings\937a58ba-ed11-4376-920c-8191e1cd877f
Size 671B
SHA256 8d6bdc681d27cab7e45ef7b006f44ff754860089b3405a30935fb7c4e5e54e4b
MD5 b6515385d81fea621b0dd542d31b6574
SHA1 30e950f7bf910c9c1b776cfdb84d2d5a289f3e66
SHA512 f20957ba7796c8fccf4af35955d0b9a1b18eef49d3ebf267044dd5a9e8206849a5aa377ba10512fcc774ec086e3e8c9999a005b1b3ce1a366533a924f45a5900
MD5 SHA1 SHA512

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Size 1.1MB
SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
MD5 842039753bf41fa5e11b3a1383061a87
SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Size 116B
SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
MD5 2a461e9eb87fd1955cea740a3444ee7a
SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Size 372B
SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
MD5 bf957ad58b55f64219ab3f793e374316
SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Size 17.8MB
SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
MD5 daf7ef3acccab478aaa7d6dc1c60f865
SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\prefs-1.js
Size 11KB
SHA256 14142a29fcfa3b060ff54d3cdda0c75363da4611927b215bb0c8b13d23fa2861
MD5 164be8d7f071007e1b5f301307199211
SHA1 7fcf636fc38fa8b1d4ea51688dd5d31a50d94d3b
SHA512 8ad5a4137f1e8439730982046ba2ea2fb373fc3e58f2f4502cbf44652b54c9358bab68ad9391648077e029527ae8f332cc19f8b0bb2d5e5afd24b6ad778d9bb0
SSDEEP 192:C5nLRnrfUnCoaLf8tv1R1zcdjrf+tPDnjXl60oaXCVDDBw8H7:UrTLmv1AxrUPDnYf7w6
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\prefs-1.js
Size 12KB
SHA256 6135e21e912edc9b277194f2fcce8185c8ae41c074053651085195a1284b0a47
MD5 030c8fa4a05008461cf982846d8f84b0
SHA1 5b32467014782f01271a176e35a74f5970e3a2bf
SHA512 5ddc81e3271854fa0c0f53d669648dca9c6f84a6f57bc5362210a8ac0c9300aa53936235651ed6a05a73c035965e68bcfab4545dde377849f4199b0d65be11cb
SSDEEP 192:C+nLRnrf9DQnCoaLf8tv1R1zcdjrf+tPDnjXl60oaXCVD6Bw8Hh:NrlLmv1AxrUPDnYfKwk
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\prefs-1.js
Size 11KB
SHA256 2d4daff7782cd5f80d5fd117746ada0d9fdd2f6ffe6329dd06885c3cb9275644
MD5 f18218999997e17ee6bacd1e45650e3a
SHA1 1ab97a36f5efba3a1be78ba54212b0b59d7da787
SHA512 312a4f1b35b3ac335db5c7cd45651ec9c8f7196f6cb6984692a2c67c0e79fd03ca3f9ac14398c22eb4d2a07eafd38e13de59efe337d8bd87634ccc9b03504ecb
SSDEEP 192:C+nLRnrfUnCoaLf8tv1R1zcdjrf+tPDnjXl60oaXCVDDBw8Hh:NrTLmv1AxrUPDnYf7wk
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\prefs-1.js
Size 11KB
SHA256 490de505c3195410e9725e95459e1448ae1ca6212ef63256cf75596bc26e6180
MD5 2cd4a04d923384f521ba183a527d89d6
SHA1 eab5d5c786738c259f2844cc29e3721a0dc3dff9
SHA512 c6236e9a6599c955fe6846fd5c26f14464dbe94322ea90d4e0492dd7db4867bd9617a1314eb6e57183149c7b22a39cf70d45f2d4677b19b700e26c8d762d0b67
SSDEEP 192:C5nLRnrfU8DoaLf8tv1R1zcdjrf+tPDnjXl60oaXqVDDBw8HU:UrlLmv1AxrUPDnYD7wx
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\sessionstore-backups\recovery.baklz4
Size 5KB
SHA256 d14a94b8a5608a646aa7b95fbff1ab87f77af0f22e07f0b6721443cb6089e109
MD5 bfefb0ea44cc5fc8bdb7a086cef3cd35
SHA1 40701708d6069789f77c55621ef7540578ca02d0
SHA512 82c491a2cb085c88e7e985440d477b18b4514de914613ccba4a4afe5127a9386b71faee75b03028716c362eed69ea4126b781b527cb35fe85e1b6e0ab7ac29ee
SSDEEP 96:Z0dzl/wFKFnapOc9YCa9OYnHBGrjPPTloEC0aOglKZbRAFbw/+9MChfc5+:czlzFnGd9YyYHWdo50iKiw29F
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\sessionstore-backups\recovery.baklz4
Size 6KB
SHA256 81720ba8c3893432980641d186ea6f9a8c42f75392be46bbe117f2d244ca0dee
MD5 ce9e01b7493af55b54d240fd35a9feaa
SHA1 8f227cc3c9741768078cddd97b5eead4179b2353
SHA512 6c16531624be6a6b0a0356db7a6995399dcb3ba92ad15f87a4f00189c66893127c966e81ef631182959cb94adaa0a24b464ce620d6ff982154426c07cd677a5a
SSDEEP 96:6D0dzl/wFKFnapOc9YCa9OYnHBGrjPW7s0QOzHL0Zn2PxUmwgdVvzChfc5S:dzlzFnGd9YyYHW10RXymwgjvM
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\sessionstore-backups\recovery.baklz4
Size 9KB
SHA256 795038fc64637f764b2a178910776797e20533942eb1d8f07787bb00f981e993
MD5 431ad78db868460871de5a83d285f23e
SHA1 1f6c749f79011564ec897106b3a4e7f9331df11d
SHA512 4594dc2426365551c1ada8b5daf9c3769cd3cd73bead8d2d82c983da85a14bc09d2ca3ee7849cf4284fe43942977aeab28a7c8cdf6ac95d58b82205c0e00ac43
SSDEEP 192:S/Fn7g9QL7VWdqOChduy8ES7BRZt1vh59lHM9wV1cKpw11IUGgV:SR7gGL3O+S1pu0xwIs
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\sessionstore-backups\recovery.baklz4
Size 6KB
SHA256 8b88045d5fecf685e4bd58dd388c0706a8961500bf36419d1f06d0e17f49c96e
MD5 91cce9c8ae2a08670ddf0c81c3dd2f14
SHA1 c6ef8653fc6b226d1f674fd4c6cc25be1d207ec9
SHA512 23f012e9a7e4649e69d8aa775df41a6dbd214333bcd3ea676bc2c27c688e2f96011fbf618be27659ed1907731daaf9c0969d0eaca10b02af46aec5b3b7f4654e
SSDEEP 96:P0dzl/wFKFnapOc9YCa9OYnHBGrjPLqMcr0nOtbnSn/ZnFwZ+AuChfc52:qzlzFnGd9YyYHWqME0uLgFw4Az
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\sessionstore-backups\recovery.baklz4
Size 6KB
SHA256 aa7d95f105d64f7ceff101928586bee6f36b6dab07280a2e0a0d7c87c0f9bb21
MD5 bdd3bb0f9a91475ae5748a2241116bb5
SHA1 ce88389ff1df63901699e877f3a78692ddc8db57
SHA512 f870ca8d7d791325ed427df34c791eed935364c6e793ddb88360228db310f37d01d2a686c1075a9cf3e26e99c70065bd9a993a847479bd0123f964a0d21acd76
SSDEEP 96:frEtwNkFnAYKn9Q0Piu297zCdqOZ0DhdJoPUZxMQh41c+D9HfAnIRwsesSwdC0ci:Y/Fn7g9QL7VWdqOChduPwh41bHFwBLcP
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\sessionstore-backups\recovery.baklz4
Size 10KB
SHA256 f64225abe3ec15dae880be34a3299ecc73bc9f6c564c91a4ace3c00ea9846d3c
MD5 c88db07aca44cd6e2a4df3d66d854534
SHA1 971aff07616a52b0f3d9de7a662d88b5fecbf9e2
SHA512 10de103b0b1256d5d66863da473d79dea2ec2c27dd36e80ace8fe403b5445624dcd6d824e236554931901086664397a77e95189da7a063a973cb433561b30196
SSDEEP 192:6/Fn7g9QL7VWdqOChduy8EKFBARZtSlDf9afe4hD6fHZS4wZdTcKpw11IUIfg:6R7gGL3O+kB3lKAD+djweo
MD5 SHA1 SHA512 SSDEEP

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads