amadey | a84519749f8ad340ae767ffce46acc77280b130fcf079a0a089a18f1428dc747

Analysis

max time kernel
299s
max time network
300s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
18/07/2024, 22:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a84519749f8ad340ae767ffce46acc77280b130fcf079a0a089a18f1428dc747.exe
Size 1.1MB
Sample240718-2kv4aazfql
SHA256 a84519749f8ad340ae767ffce46acc77280b130fcf079a0a089a18f1428dc747
MD5 6c2c96d6bc678bdf4aa876a1e6253701
SHA1 2a0c1f635d233506d1311ad384d414e646200cd7
SHA512 11da76abf026323ae53db6ddef07914db63febcfe70f823f53ef08d94e0e1fe1b09d328abf5236f49a522f54d409852a3eb3d14b09542d903fb712721ad57539
SSDEEP 24576:zu+sxK0feOYuoEBEr5wA8sZVucaoRkiAUTRwqoFz:zds00mOLoEywulRNzTRhoB
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey stealc 4dd39d funny discovery evasion spyware stealer trojan

Malware Config

Extracted

Family

stealc

Botnet

funny

http://85.28.47.30

Attributes

url_path
/920475a59bac849d.php

Extracted

Family

amadey

Version

4.30

Botnet

4dd39d

http://77.91.77.82

Attributes

install_dir
ad40971b6b
install_file
explorti.exe
strings_key
a434973ad22def7137dbb5e059b7081e
url_paths
/Hun4Ko/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Stealc
Stealc is an infostealer written in C++.
stealer stealc

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	AFIIIIJKFC.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 12 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	AFIIIIJKFC.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	AFIIIIJKFC.exe

Executes dropped EXE 8 IoCs

pid	Process
2240	AFIIIIJKFC.exe
2212	explorti.exe
4572	702f14edc9.exe
4284	0de11e56e4.exe
4808	explorti.exe
3724	explorti.exe
372	explorti.exe
4548	explorti.exe

Identifies Wine through registry keys 2 TTPs 6 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Wine	AFIIIIJKFC.exe
Key opened	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Wine	explorti.exe

Loads dropped DLL 2 IoCs

pid	Process
2304	a84519749f8ad340ae767ffce46acc77280b130fcf079a0a089a18f1428dc747.exe
2304	a84519749f8ad340ae767ffce46acc77280b130fcf079a0a089a18f1428dc747.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x000800000001ac3d-101.dat	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 10 IoCs

pid	Process
2304	a84519749f8ad340ae767ffce46acc77280b130fcf079a0a089a18f1428dc747.exe
2304	a84519749f8ad340ae767ffce46acc77280b130fcf079a0a089a18f1428dc747.exe
2304	a84519749f8ad340ae767ffce46acc77280b130fcf079a0a089a18f1428dc747.exe
2304	a84519749f8ad340ae767ffce46acc77280b130fcf079a0a089a18f1428dc747.exe
2240	AFIIIIJKFC.exe
2212	explorti.exe
4808	explorti.exe
3724	explorti.exe
372	explorti.exe
4548	explorti.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4572 set thread context of 3240	4572	702f14edc9.exe	83

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\explorti.job	AFIIIIJKFC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	a84519749f8ad340ae767ffce46acc77280b130fcf079a0a089a18f1428dc747.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	a84519749f8ad340ae767ffce46acc77280b130fcf079a0a089a18f1428dc747.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
2304	a84519749f8ad340ae767ffce46acc77280b130fcf079a0a089a18f1428dc747.exe
2304	a84519749f8ad340ae767ffce46acc77280b130fcf079a0a089a18f1428dc747.exe
2304	a84519749f8ad340ae767ffce46acc77280b130fcf079a0a089a18f1428dc747.exe
2304	a84519749f8ad340ae767ffce46acc77280b130fcf079a0a089a18f1428dc747.exe
2240	AFIIIIJKFC.exe
2240	AFIIIIJKFC.exe
2212	explorti.exe
2212	explorti.exe
4808	explorti.exe
4808	explorti.exe
3724	explorti.exe
3724	explorti.exe
372	explorti.exe
372	explorti.exe
4548	explorti.exe
4548	explorti.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	1480	firefox.exe
Token: SeDebugPrivilege	1480	firefox.exe
Token: SeDebugPrivilege	1480	firefox.exe
Token: SeDebugPrivilege	1480	firefox.exe
Token: SeDebugPrivilege	1480	firefox.exe
Token: SeDebugPrivilege	1480	firefox.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
1480	firefox.exe
1480	firefox.exe
1480	firefox.exe
1480	firefox.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
1480	firefox.exe
1480	firefox.exe
1480	firefox.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe
4284	0de11e56e4.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2304	a84519749f8ad340ae767ffce46acc77280b130fcf079a0a089a18f1428dc747.exe
2688	cmd.exe
1480	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2304 wrote to memory of 3132	2304	a84519749f8ad340ae767ffce46acc77280b130fcf079a0a089a18f1428dc747.exe	74
PID 2304 wrote to memory of 3132	2304	a84519749f8ad340ae767ffce46acc77280b130fcf079a0a089a18f1428dc747.exe	74
PID 2304 wrote to memory of 3132	2304	a84519749f8ad340ae767ffce46acc77280b130fcf079a0a089a18f1428dc747.exe	74
PID 2304 wrote to memory of 2688	2304	a84519749f8ad340ae767ffce46acc77280b130fcf079a0a089a18f1428dc747.exe	75
PID 2304 wrote to memory of 2688	2304	a84519749f8ad340ae767ffce46acc77280b130fcf079a0a089a18f1428dc747.exe	75
PID 2304 wrote to memory of 2688	2304	a84519749f8ad340ae767ffce46acc77280b130fcf079a0a089a18f1428dc747.exe	75
PID 3132 wrote to memory of 2240	3132	cmd.exe	78
PID 3132 wrote to memory of 2240	3132	cmd.exe	78
PID 3132 wrote to memory of 2240	3132	cmd.exe	78
PID 2240 wrote to memory of 2212	2240	AFIIIIJKFC.exe	79
PID 2240 wrote to memory of 2212	2240	AFIIIIJKFC.exe	79
PID 2240 wrote to memory of 2212	2240	AFIIIIJKFC.exe	79
PID 2212 wrote to memory of 4572	2212	explorti.exe	80
PID 2212 wrote to memory of 4572	2212	explorti.exe	80
PID 2212 wrote to memory of 4572	2212	explorti.exe	80
PID 4572 wrote to memory of 1444	4572	702f14edc9.exe	82
PID 4572 wrote to memory of 1444	4572	702f14edc9.exe	82
PID 4572 wrote to memory of 1444	4572	702f14edc9.exe	82
PID 4572 wrote to memory of 3240	4572	702f14edc9.exe	83
PID 4572 wrote to memory of 3240	4572	702f14edc9.exe	83
PID 4572 wrote to memory of 3240	4572	702f14edc9.exe	83
PID 4572 wrote to memory of 3240	4572	702f14edc9.exe	83
PID 4572 wrote to memory of 3240	4572	702f14edc9.exe	83
PID 4572 wrote to memory of 3240	4572	702f14edc9.exe	83
PID 4572 wrote to memory of 3240	4572	702f14edc9.exe	83
PID 4572 wrote to memory of 3240	4572	702f14edc9.exe	83
PID 4572 wrote to memory of 3240	4572	702f14edc9.exe	83
PID 2212 wrote to memory of 4284	2212	explorti.exe	84
PID 2212 wrote to memory of 4284	2212	explorti.exe	84
PID 2212 wrote to memory of 4284	2212	explorti.exe	84
PID 4284 wrote to memory of 788	4284	0de11e56e4.exe	85
PID 4284 wrote to memory of 788	4284	0de11e56e4.exe	85
PID 788 wrote to memory of 1480	788	firefox.exe	87
PID 788 wrote to memory of 1480	788	firefox.exe	87
PID 788 wrote to memory of 1480	788	firefox.exe	87
PID 788 wrote to memory of 1480	788	firefox.exe	87
PID 788 wrote to memory of 1480	788	firefox.exe	87
PID 788 wrote to memory of 1480	788	firefox.exe	87
PID 788 wrote to memory of 1480	788	firefox.exe	87
PID 788 wrote to memory of 1480	788	firefox.exe	87
PID 788 wrote to memory of 1480	788	firefox.exe	87
PID 788 wrote to memory of 1480	788	firefox.exe	87
PID 788 wrote to memory of 1480	788	firefox.exe	87
PID 1480 wrote to memory of 4244	1480	firefox.exe	88
PID 1480 wrote to memory of 4244	1480	firefox.exe	88
PID 1480 wrote to memory of 3708	1480	firefox.exe	89
PID 1480 wrote to memory of 3708	1480	firefox.exe	89
PID 1480 wrote to memory of 3708	1480	firefox.exe	89
PID 1480 wrote to memory of 3708	1480	firefox.exe	89
PID 1480 wrote to memory of 3708	1480	firefox.exe	89
PID 1480 wrote to memory of 3708	1480	firefox.exe	89
PID 1480 wrote to memory of 3708	1480	firefox.exe	89
PID 1480 wrote to memory of 3708	1480	firefox.exe	89
PID 1480 wrote to memory of 3708	1480	firefox.exe	89
PID 1480 wrote to memory of 3708	1480	firefox.exe	89
PID 1480 wrote to memory of 3708	1480	firefox.exe	89
PID 1480 wrote to memory of 3708	1480	firefox.exe	89
PID 1480 wrote to memory of 3708	1480	firefox.exe	89
PID 1480 wrote to memory of 3708	1480	firefox.exe	89
PID 1480 wrote to memory of 3708	1480	firefox.exe	89
PID 1480 wrote to memory of 3708	1480	firefox.exe	89
PID 1480 wrote to memory of 3708	1480	firefox.exe	89
PID 1480 wrote to memory of 3708	1480	firefox.exe	89
PID 1480 wrote to memory of 3708	1480	firefox.exe	89

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\a84519749f8ad340ae767ffce46acc77280b130fcf079a0a089a18f1428dc747.exe
"C:\Users\Admin\AppData\Local\Temp\a84519749f8ad340ae767ffce46acc77280b130fcf079a0a089a18f1428dc747.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2304
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\AFIIIIJKFC.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3132
- - C:\Users\Admin\AppData\Local\Temp\AFIIIIJKFC.exe
    "C:\Users\Admin\AppData\Local\Temp\AFIIIIJKFC.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2240
  - - C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
      "C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2212
    - - C:\Users\Admin\AppData\Local\Temp\1000006001\702f14edc9.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000006001\702f14edc9.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:4572
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        6⤵
        
        PID:1444
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        6⤵
        
        PID:3240
    - - C:\Users\Admin\AppData\Local\Temp\1000011001\0de11e56e4.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000011001\0de11e56e4.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:4284
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:788
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
        7⤵
        Checks processor information in registry
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1480
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1480.0.1738678192\707061324" -parentBuildID 20221007134813 -prefsHandle 1740 -prefMapHandle 1732 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {82c3a76f-e737-4e9e-85a8-35b4f03b81f9} 1480 "\\.\pipe\gecko-crash-server-pipe.1480" 1828 1ff5b1d9258 gpu
        8⤵
        
        PID:4244
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1480.1.1679378470\1233952974" -parentBuildID 20221007134813 -prefsHandle 2172 -prefMapHandle 2168 -prefsLen 21608 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8089c8f5-3994-4436-b6d9-043c5a79edf3} 1480 "\\.\pipe\gecko-crash-server-pipe.1480" 2200 1ff5b0f9e58 socket
        8⤵
        
        PID:3708
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1480.2.2024352360\1795984784" -childID 1 -isForBrowser -prefsHandle 2712 -prefMapHandle 2800 -prefsLen 21711 -prefMapSize 233444 -jsInitHandle 1092 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {21e4b61c-b276-4002-8493-ad6f85ab8368} 1480 "\\.\pipe\gecko-crash-server-pipe.1480" 2884 1ff5f2d5d58 tab
        8⤵
        
        PID:4136
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1480.3.1707790739\12273078" -childID 2 -isForBrowser -prefsHandle 3660 -prefMapHandle 3656 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1092 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a27522cc-f5e2-4931-9235-675e2d64400e} 1480 "\\.\pipe\gecko-crash-server-pipe.1480" 3672 1ff48e5b258 tab
        8⤵
        
        PID:2340
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1480.4.41097630\1090367002" -childID 3 -isForBrowser -prefsHandle 4804 -prefMapHandle 4604 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1092 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3334a499-5520-4a1f-a858-d2ba7c7da5e8} 1480 "\\.\pipe\gecko-crash-server-pipe.1480" 4828 1ff62725f58 tab
        8⤵
        
        PID:4484
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1480.5.2134951873\2036072661" -childID 4 -isForBrowser -prefsHandle 4976 -prefMapHandle 4980 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1092 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ec7cab7a-7ba8-4651-9427-20b135b745a9} 1480 "\\.\pipe\gecko-crash-server-pipe.1480" 4968 1ff62726858 tab
        8⤵
        
        PID:4180
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1480.6.1633326009\13389952" -childID 5 -isForBrowser -prefsHandle 5180 -prefMapHandle 5184 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1092 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9b54ca4f-c134-43ae-8e29-03dfe9be623b} 1480 "\\.\pipe\gecko-crash-server-pipe.1480" 5172 1ff62780258 tab
        8⤵
        
        PID:4140
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\DHDHCGHDHI.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2688

C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4808

C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3724

C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:372

C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mozglue.dll

Path C:\ProgramData\mozglue.dll
Size 593KB
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
SSDEEP 12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5 SHA1 SHA512 SSDEEP

Submit Download

037778A55E1B7E9BED3390289866D09402D6C913

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\cache2\entries\037778A55E1B7E9BED3390289866D09402D6C913
Size 9KB
SHA256 ac46a329eca956870931c99baccc6b3c04a049c479cb74573e7af8b933c0c817
MD5 52bf1994f422ae1c43da7e527f535435
SHA1 665680c179b6853f47a6d6af32ed771a4070bce0
SHA512 3197f8928141241e019d5b85c83751a5906fe2872724991fc5f97496577a53899c87808f7b6b234b410dd7d1cb0ae5753aecb6f9ab2b0e702c8b0827aacbd1a6
SSDEEP 192:Y82+9EcRKAxzhVf84RSUG8BvaehOr1e0lpBNDII/daY9TdaY9B:YJcRK8zhVEOSUZB7t0lpDIIVaY9RaY9B
MD5 SHA1 SHA512 SSDEEP

Submit Download

254256B27E0C48CF9B80B695F0B3B8CA84610495

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\cache2\entries\254256B27E0C48CF9B80B695F0B3B8CA84610495
Size 9KB
SHA256 5a340510eaeddab6b4da2959cef50850a669b499fdbd316e8adc8d06d1dc9991
MD5 40aa57133c10589d634c7d3116bd02ac
SHA1 dd85940a1e6715c49b044d93db10145fa9a1050a
SHA512 428df3b3b21f09f97f9ac8e388b5a12c78271882c0f9509f1b802eb8d4f218ad1bab8f2b11531ac97c76fb965153401624ae5b25a1fa7692424f41e1ecda70cc
SSDEEP 192:vw82+9EcRKAxzhVf84RSUG8BvaehOr1e0lpBNDII/dBQxdBlT:vwJcRK8zhVEOSUZB7t0lpDIIVBQbBh
MD5 SHA1 SHA512 SSDEEP

Submit Download

4C863284CDA7F859EB300BED16DBCEF9517F1824

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\cache2\entries\4C863284CDA7F859EB300BED16DBCEF9517F1824
Size 102B
SHA256 62791e5eb308b0f4bfd4c4a8db4b5f21cfe7b741df28b9f772ef57dfa1e5e0e0
MD5 f2cc89601879d2405aa1a93179b45966
SHA1 b6f7d58874d108676fe20cc3fd56ab96db560dba
SHA512 b9714de938e1cf6db17a10d63034bb7bb4f8b7541d0616bfbc22cb7d3a98686ea3bc90f0a30eaac20dbc94912fc94ee866ca5871333fffb586f77eaf48104d53
MD5 SHA1 SHA512

Submit Download

6D89348819C8881868053197CA0754F36784BF5F

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\cache2\entries\6D89348819C8881868053197CA0754F36784BF5F
Size 15KB
SHA256 109f2e074aaeab13b5602c9d191b543db6432189a45148e1b8093ec524bf23af
MD5 f9d0824ecf5c24ebf5cf3e543453f0d6
SHA1 1aad11845ebb5467c81e3c926c7c271d3fb6e0c4
SHA512 b14c329881d93274a117e236a30b5aff34e63bf36048eae2ebe3e28fafecb87d00156b1db9bcf976b2ea1057093255cb37ff4fb9b85e45ff45b187db62fc9f83
SSDEEP 384:pbzrXMzTzjQLcx4Kzuy1ZiOiDsCvfu2ZB7t0lpDIIbdOZ:FrXMjjQL+u2+DsCvfLB7eD86S
MD5 SHA1 SHA512 SSDEEP

Submit Download

C72D4296C2EBC6FD41A9F780CD0C8F30F0FF937C

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\cache2\entries\C72D4296C2EBC6FD41A9F780CD0C8F30F0FF937C
Size 13KB
SHA256 fa85b62af077115d3853efa0da92bb13a4dd047a9f1ce5212bf4b92fcbf01fff
MD5 834555e1f3f7bb1476444a26f0d67bfb
SHA1 61f21bafff2611105f832670ef8402c261614f01
SHA512 a45f0ba1e746077b6da145bb5a8fb85e4a671f8c34646534faa93a58c3c1c348e5bd9242f49f1cc1279edd5b4e11bebcb56961f72abdb8b11c2ecded07bb9485
SSDEEP 384:HSSSu9fiGLm4pUKft2WlOX8laLft2WlOX8lo8HPJyD3VonFcP+AWRMACrnQz:y2Bi8mCUKft2WAX8wLft2WAX8O8Rg3Vg
MD5 SHA1 SHA512 SSDEEP

Submit Download

702f14edc9.exe

Path C:\Users\Admin\AppData\Local\Temp\1000006001\702f14edc9.exe
Size 370KB
SHA256 f15a1ea66357015df906e30343a67b916e8eed6f542bb9f6a53acaf5ce2849b2
MD5 0a191d15dda81d6110b4fc7c6a24515a
SHA1 50a6ed243451de7764afff537a980d93db20f898
SHA512 52119fe330a3a345c2d0108234668bf239e12875b73b98ac743d00c976de586f1ad8a05b3c9a21a0244f32932f3278f7b85885a38cf8ed9fb398df733db36751
SSDEEP 6144:UTVLdeErsZ/lyvUpo9lqXPT2OL32bkj+7Gt19y/qSp9hdqee:6LgErJ4mbdG/8zFe
MD5 SHA1 SHA512 SSDEEP

Submit Download

0de11e56e4.exe

Path C:\Users\Admin\AppData\Local\Temp\1000011001\0de11e56e4.exe
Size 1.2MB
SHA256 acb87d971a28b8c0527e93ce04d32ae16635c9a4ad2041a1979313935d1dc1e6
MD5 7f2ba04247aa67b10fc1a01daa0cac93
SHA1 658160e774cba282bc1ff3d9df1835f56e7e563a
SHA512 42bdbbfed272d381bd8f7945523ea7e04f88e22c128ad4d142a8d6743e07e23c4bc365a093cd194ccab319fafd4b81cfdd1f58c7fb7346efc40dc96bab553488
SSDEEP 24576:DqDEvCTbMWu7rQYlBQcBiT6rprG8aLf2Sbly7TWEPje:DTvC/MTQYxsWR7aLf2dW
MD5 SHA1 SHA512 SSDEEP

Submit Download

AFIIIIJKFC.exe

Path C:\Users\Admin\AppData\Local\Temp\AFIIIIJKFC.exe
Size 1.8MB
SHA256 e770104c8ed7bcb1c80bc9b102a3f359c3346c6b878fc5dfa13eb5a67f8019ac
MD5 ebe65d4bcac13c6aa9bcb1fde7c3ebf8
SHA1 48a789c68315fccc6c29ac826be1ce332dda8ee2
SHA512 8c9dffc9c8a2e75e6fdd77aa514e8b7207725d2e3839e9e01fdfc50d0af2e5a1ac1d8daae5a5f8d92bf105e5e3522895d6c1843f415b948d5970ab4e6ceec557
SSDEEP 49152:TFnAAxIw04z5A5q5xsRqsSNSiI4t/c3MDIUp1YHs:FX0yBgRqsP4tE7hs
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 442KB
SHA256 a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
MD5 85430baed3398695717b0263807cf97c
SHA1 fffbee923cea216f50fce5d54219a188a5100f41
SHA512 06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1
SSDEEP 12288:tESTeqTI2r4ZbCgUKWKNeRcPMb6qlV7hVZe3:tEsed2Xh9/bdzZe3
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 8.0MB
SHA256 345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42
MD5 a01c5ecd6108350ae23d2cddf0e77c17
SHA1 c6ac28a2cd979f1f9a75d56271821d5ff665e2b6
SHA512 b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72
SSDEEP 196608:945hXmP7/cvflwtf0FzVC/5lHevzc8XZbivwEiw3cFTx7z4zV:9tP7/cvflof0FzVgKRF9zw3c9x4zV
MD5 SHA1 SHA512 SSDEEP

Submit Download

6824f4a902c78fbd.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
Size 7KB
SHA256 d86ce9af3200d5972aba413d5384d529c6c10107484f24c4bbae1858fbdbc2f0
MD5 d21c4d3cb8971d199d400c7c1212ad13
SHA1 f66d6d006b116025a6544cbea8e6879e79e2baa1
SHA512 822c77591a87fbc6bde5daba31dc923f15e82cd3cc9ed22405c30dff9879f876e01b10b5ff0d8b350ee2d88c071fc1b5131beb17f39025c8b22c17c59692df38
SSDEEP 48:wbdC4J5UgdwBWzNbdC4J/6BdwYjbdC4J/adwamZl1bdC4J7gYD4aRADGrdwIg+R:yh/Q/tlLMC4Paa0
MD5 SHA1 SHA512 SSDEEP

Submit Download

broadcast-listeners.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\broadcast-listeners.json
Size 204B
SHA256 9cf589357fceea2f37cd1a925e5d33fd517a44d22a16c357f7fb5d4d187034aa
MD5 72c95709e1a3b27919e13d28bbe8e8a2
SHA1 00892decbee63d627057730bfc0c6a4f13099ee4
SHA512 613ca9dd2d12afe31fb2c4a8d9337eeecfb58dabaeaaba11404b9a736a4073dfd9b473ba27c1183d3cc91d5a9233a83dce5a135a81f755d978cea9e198209182
MD5 SHA1 SHA512

Submit Download

data.safe.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\datareporting\glean\db\data.safe.bin
Size 2KB
SHA256 6c8d4b4c76b1673c5b1fe5e947905db665265630b429bff7c8b17e3f71d025bc
MD5 9b0b78d5971a6a7e2003759dbf6d3432
SHA1 fc9d7ff792f1d4c1dff245ecb213afa5d812cc31
SHA512 9b1126352e510c4e7773a77ff1512dbfb751892e4015ad50cc4670ef1e6e57e03b337f0e2913a97ebaac432eb362ef173565ff63848a1bfe31269d915619d12c
MD5 SHA1 SHA512

Submit Download

483f4d12-b707-406b-84fd-9f963720195a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\datareporting\glean\pending_pings\483f4d12-b707-406b-84fd-9f963720195a
Size 746B
SHA256 2cd44d0e6e2106ffbbf11f4237aa76de85b53557d775f7f61aad04f20ac2551a
MD5 b834fdb8468de71dd0f2160842d08aae
SHA1 7da7229101d94ffc403fa6c72d29851254369ff9
SHA512 8626bfdacc04e1975834c5180ff973c88837eac9920a54d0f86e608b504b0e6d34fca007821e5dba4d2d10dd098b451cd08bc58d090188d269467095a0d305f0
MD5 SHA1 SHA512

Submit Download

4edb9476-f05e-444e-8b50-ceefd0a4c433

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\datareporting\glean\pending_pings\4edb9476-f05e-444e-8b50-ceefd0a4c433
Size 10KB
SHA256 b72694982497d8c2048a887cb6b8cedcdec61836c0fe052d10487f2e3eb86394
MD5 c6bb3a84e8feeb36c2459af565b6c483
SHA1 cbbc1b9e3ecf7b4996c9d076c334e44421c10660
SHA512 3be20a1b90adb96db794536021c7de938da2f2e72c99822bbf52ba771a76300dd3badd748fa700622f4143a53f8a206e6738d2646df0bfb9fd3c3ebc0a88f999
SSDEEP 192:oi3sce1Jxeryqr5juRc2sMhGhxQuShgwid+ouQIdsmS3ggnceeK52:oi8cySk
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
Size 997KB
SHA256 1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
MD5 fe3355639648c417e8307c6d051e3e37
SHA1 f54602d4b4778da21bc97c7238fc66aa68c8ee34
SHA512 8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c
SSDEEP 12288:vYLdTfFKbNSjv92eFN+3wH+NYriA0Iq6lh6VawYIpAvwHN/Uf1h47HAfg1oet:vYLdTZ923NYrjwNpgwef1hzfg1x
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
Size 116B
SHA256 f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
MD5 3d33cdc0b3d281e67dd52e14435dd04f
SHA1 4db88689282fd4f9e9e6ab95fcbb23df6e6485db
SHA512 a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1
MD5 SHA1 SHA512

Submit Download

LICENSE.txt

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
Size 479B
SHA256 2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
MD5 49ddb419d96dceb9069018535fb2e2fc
SHA1 62aa6fea895a8b68d468a015f6e6ab400d7a7ca6
SHA512 48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
Size 372B
SHA256 e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
MD5 8be33af717bb1b67fbd61c3f4b807e9e
SHA1 7cf17656d174d951957ff36810e874a134dd49e0
SHA512 6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
Size 11.8MB
SHA256 8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e
MD5 33bf7b0439480effb9fb212efce87b13
SHA1 cee50f2745edc6dc291887b6075ca64d716f495a
SHA512 d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275
SSDEEP 196608:lP4/vkvbdjMq4ytbko4qIUcXkhrVp1HSTDsoTn90lcGeFaxJI3qLaLhFT7Uc:lPcvyiXSWxRU/OpZXJFee3qGhFMc
MD5 SHA1 SHA512 SSDEEP

Submit Download

widevinecdm.dll.lib

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
Size 1KB
SHA256 33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
MD5 688bed3676d2104e7f17ae1cd2c59404
SHA1 952b2cdf783ac72fcb98338723e9afd38d47ad8e
SHA512 7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll.sig

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
Size 1KB
SHA256 68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
MD5 937326fead5fd401f6cca9118bd9ade9
SHA1 4526a57d4ae14ed29b37632c72aef3c408189d91
SHA512 b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2
MD5 SHA1 SHA512

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\prefs-1.js
Size 7KB
SHA256 418ca256faaa434e51bf33539a8f1d84b1e62ced3f6d4b708b7c1212284375cc
MD5 fcb786a308f79a67f38e71329dcc5c8d
SHA1 f0837f20b9b27d4be2c8d5bf86af86106f1c6259
SHA512 af3c69c04c6075ea16147405042748ca51616e2c8227f1ef78cd0ece820d8df33e59308d91a8de9f13f0b00249da95063980d2f5313c56a38875e6bd26654602
SSDEEP 96:xHql4nUTeqGqsdjl9eOTzSEPXAnpj70HnDPnKOHZYRBw8HpJ:i4nIRsdjl9eCPXsy7nRHWRBw8Hf
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\prefs-1.js
Size 6KB
SHA256 ad9a39b076120e008f47baec010c300a38f21cfc386aa5726bd854c1369f2380
MD5 811708d4d00e63980762ea380ed0c9c7
SHA1 135d94296f19d4522e965b4bc2f36365e713fae0
SHA512 2a3e4574eb8926f65a32f0fcabadd086ce32242a29b13b172e5f1b73e8b7e3f7251d64ad38295793e44984a81586b4ee26e9da4e50becbfd7db47769fe35e6ea
SSDEEP 96:xHql5nUTeqGqsdjl9eOTzSEPXAnpj70HnDPnKOHZDBw8HHY:i5nIRsdjl9eCPXsy7nRHhBw8H4
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\prefs.js
Size 6KB
SHA256 b671965eb6d62c726119d3820d7b27007f13a98a42204edc9b7075b5cbaf77da
MD5 56a209136c7f2082ee0c92f3e2d1ca57
SHA1 52fbfe85df5defa3300a3abd10d5751ac1fc6b5c
SHA512 f61502c4238466d447eea367d02ead8c19cf226f4a1854f6e410c5c832233199529d9a7118e5bf1faf049366383389f17a5248339ea5ecf80bd6b1a9c7ac24f3
SSDEEP 96:xHD5nUTeqGqsdjl9eOTzSEPXAnpj70HnDPnKOHZbBw8HHY:V5nIRsdjl9eCPXsy7nRHhBw8H4
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\prefs.js
Size 6KB
SHA256 53d47465b1537c5b6d109a41f3ec4302c841721cb04f34a64535f29926a3feb7
MD5 ff22965ec51319fcce4f3d773335e75e
SHA1 c0e467575f02b2a6bd4f01d2124a7076f650a20c
SHA512 672ad4b90abb386446ac5aaedfd580d531834b8164cd06eda50f64ae797e8688c9e117568c4d5f57a5493a6925bd3aba8726fe9a7a4a886ac3ea7f213bcaa720
SSDEEP 96:xHD5nUTeqGqsdj1FeOTzSEPXAnpj5GHnDPnKOHZjBw8HHY:V5nIRsdj1FeCPXaI7nRHVBw8H4
MD5 SHA1 SHA512 SSDEEP

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
MD5 SHA1 SHA512

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4
Size 4KB
SHA256 4efcfc66fc154cd6c8b7223dcefb4e18c283b3f9601cc799e69ee46031381af5
MD5 aa5afd08645fb00e4bed7aec40da5431
SHA1 61c54eeb6e71da2eb57e766ed29eb53516668168
SHA512 aacb99e1322dcbae7959dca4066f7345ba5b1ecf84098168734c5999c7972b6aac9dd28d4850cdf854d5601fb3e5b309205be27de333630bd177a0df7815cbc0
SSDEEP 96:Zze0fInxRPlEGJF7GtFM7k0zf8W8Qge3ZwS20X9PeFmLVwWV:NhczPCiFAFM7kcuemgXHB
MD5 SHA1 SHA512 SSDEEP

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 184KB
SHA256 06575a0a693c9e0f265fcf03ee5b6ced4dd922ac999f5d767a9a7d92fb199082
MD5 f72c2c8a738f1bdd4a5e24326ff248df
SHA1 d60277881f6b36509d709948fcf7ed3ec3da74a6
SHA512 7fa2cc3e4f6e6f9c77fc12e188a0ef4e5dfd9079e1ddd2d689669513bd2e512136ac4485b34aa0ed8587c8cd519572d31eb2496b4091e229b6c339bf25c27d6a
SSDEEP 1536:P6S6dlG6luwPcHUXVNRuFPW3y328asbPP9wR9ap6SJOrTeHWaqaZvChColUPK9:DocHUPRuFPW3y3P3969ap6SM3eH5xRK
MD5 SHA1 SHA512 SSDEEP

Submit Download

targeting.snapshot.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\targeting.snapshot.json
Size 3KB
SHA256 e205b162c697882a8271d84156e08e073e709274e6fc5c42d6f56ae6bcd43b40
MD5 e3b5497cc1383e7316bc1e385820bf22
SHA1 18bf5d439b5a482f2f597ef63866613a7c02e445
SHA512 e67e41ddd9d4c175e771de81906f33573f98d7238a63ebe89e801d4fa3778ab1640615b2986505b9e3ee2d73237db5f344f809e821aecd9c58460e31bb58c144
MD5 SHA1 SHA512

Submit Download

nss3.dll

Path \ProgramData\nss3.dll
Size 2.0MB
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
SSDEEP 49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/372-360-0x00000000013C0000-0x0000000001884000-memory.dmp

Download

memory/372-362-0x00000000013C0000-0x0000000001884000-memory.dmp

Download

memory/2212-334-0x00000000013C0000-0x0000000001884000-memory.dmp

Download

memory/2212-369-0x00000000013C0000-0x0000000001884000-memory.dmp

Download

memory/2212-443-0x00000000013C0000-0x0000000001884000-memory.dmp

Download

memory/2212-442-0x00000000013C0000-0x0000000001884000-memory.dmp

Download

memory/2212-431-0x00000000013C0000-0x0000000001884000-memory.dmp

Download

memory/2212-335-0x00000000013C0000-0x0000000001884000-memory.dmp

Download

memory/2212-337-0x00000000013C0000-0x0000000001884000-memory.dmp

Download

memory/2212-342-0x00000000013C0000-0x0000000001884000-memory.dmp

Download

memory/2212-344-0x00000000013C0000-0x0000000001884000-memory.dmp

Download

memory/2212-430-0x00000000013C0000-0x0000000001884000-memory.dmp

Download

memory/2212-80-0x00000000013C0000-0x0000000001884000-memory.dmp

Download

memory/2212-348-0x00000000013C0000-0x0000000001884000-memory.dmp

Download

memory/2212-349-0x00000000013C0000-0x0000000001884000-memory.dmp

Download

memory/2212-350-0x00000000013C0000-0x0000000001884000-memory.dmp

Download

memory/2212-351-0x00000000013C0000-0x0000000001884000-memory.dmp

Download

memory/2212-357-0x00000000013C0000-0x0000000001884000-memory.dmp

Download

memory/2212-358-0x00000000013C0000-0x0000000001884000-memory.dmp

Download

memory/2212-242-0x00000000013C0000-0x0000000001884000-memory.dmp

Download

memory/2212-233-0x00000000013C0000-0x0000000001884000-memory.dmp

Download

memory/2212-363-0x00000000013C0000-0x0000000001884000-memory.dmp

Download

memory/2212-368-0x00000000013C0000-0x0000000001884000-memory.dmp

Download

memory/2212-255-0x00000000013C0000-0x0000000001884000-memory.dmp

Download

memory/2212-370-0x00000000013C0000-0x0000000001884000-memory.dmp

Download

memory/2212-372-0x00000000013C0000-0x0000000001884000-memory.dmp

Download

memory/2212-373-0x00000000013C0000-0x0000000001884000-memory.dmp

Download

memory/2212-230-0x00000000013C0000-0x0000000001884000-memory.dmp

Download

memory/2212-378-0x00000000013C0000-0x0000000001884000-memory.dmp

Download

memory/2212-377-0x00000000013C0000-0x0000000001884000-memory.dmp

Download

memory/2240-82-0x0000000000200000-0x00000000006C4000-memory.dmp

Download

memory/2240-71-0x0000000000200000-0x00000000006C4000-memory.dmp

Download

memory/2304-2-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Download

memory/2304-67-0x0000000000AB0000-0x0000000001041000-memory.dmp

Download

memory/2304-31-0x0000000000AB0000-0x0000000001041000-memory.dmp

Download

memory/2304-0-0x0000000000AB0000-0x0000000001041000-memory.dmp

Download

memory/2304-1-0x0000000000AB0000-0x0000000001041000-memory.dmp

Download

memory/3240-95-0x0000000000400000-0x000000000063C000-memory.dmp

Download

memory/3240-96-0x0000000000400000-0x000000000063C000-memory.dmp

Download

memory/3724-347-0x00000000013C0000-0x0000000001884000-memory.dmp

Download

memory/3724-346-0x00000000013C0000-0x0000000001884000-memory.dmp

Download

memory/4548-375-0x00000000013C0000-0x0000000001884000-memory.dmp

Download

memory/4548-376-0x00000000013C0000-0x0000000001884000-memory.dmp

Download

memory/4808-253-0x00000000013C0000-0x0000000001884000-memory.dmp

Download

memory/4808-254-0x00000000013C0000-0x0000000001884000-memory.dmp

Download