amadey | 400c2e1e4df55d79e8df9dae523e969c5cc005782012732c8e57babe63fc9240

Analysis

max time kernel
299s
max time network
298s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
08-08-2024 22:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

400c2e1e4df55d79e8df9dae523e969c5cc005782012732c8e57babe63fc9240.exe
Size

1.8MB
MD5

c3675e31f1618e7fa33b1aa6a16f1f83
SHA1

a759529be3c61c3e13f68ab46e85f4fe4b431fd3
SHA256

400c2e1e4df55d79e8df9dae523e969c5cc005782012732c8e57babe63fc9240
SHA512

1acdaf8d3cc4684af47c7814832e2213732cac4a4322e34c363f7ac108815f08376248f689e0d3a4f341f33eb1e7139133210859ebafc946931b31989c88e6e1
SSDEEP

24576:iZf4O7YwDB2+xUxM36AvYVUcDZjAp05dJiI0t5PKKHn7AxysCWnLCY5p2NVI:axtB2+xUi6VUcddiPL1sYQL75kb

Score

10^/10

amadey stealc 0657d1 default kora credential_access discovery evasion persistence stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

0657d1

http://185.215.113.19

Attributes

install_dir
0d8f5eb8a7
install_file
explorti.exe
strings_key
6c55a5f34bb433fbd933a168577b1838
url_paths
/Vi9leo/index.php

rc4.plain

Extracted

Family

stealc

Botnet

default

http://185.215.113.24

Attributes

url_path
/e2b1563c6670f193.php

Extracted

Family

stealc

Botnet

kora

http://185.215.113.100

Attributes

url_path
/e2b1563c6670f193.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Stealc
Stealc is an infostealer written in C++.
stealer stealc
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	400c2e1e4df55d79e8df9dae523e969c5cc005782012732c8e57babe63fc9240.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	400c2e1e4df55d79e8df9dae523e969c5cc005782012732c8e57babe63fc9240.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	400c2e1e4df55d79e8df9dae523e969c5cc005782012732c8e57babe63fc9240.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe

Executes dropped EXE 4 IoCs

pid	Process
2808	explorti.exe
856	8765c103e3.exe
1952	107a91a3e1.exe
1788	12f662ddb1.exe

Identifies Wine through registry keys 2 TTPs 2 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Wine	400c2e1e4df55d79e8df9dae523e969c5cc005782012732c8e57babe63fc9240.exe
Key opened	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Wine	explorti.exe

Loads dropped DLL 6 IoCs

pid	Process
3056	400c2e1e4df55d79e8df9dae523e969c5cc005782012732c8e57babe63fc9240.exe
2808	explorti.exe
2808	explorti.exe
2808	explorti.exe
2808	explorti.exe
2808	explorti.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\8765c103e3.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000036001\\8765c103e3.exe"	explorti.exe

AutoIT Executable 30 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/856-231-0x0000000000380000-0x0000000000E65000-memory.dmp	autoit_exe
behavioral1/memory/856-244-0x0000000000380000-0x0000000000E65000-memory.dmp	autoit_exe
behavioral1/memory/856-245-0x0000000000380000-0x0000000000E65000-memory.dmp	autoit_exe
behavioral1/memory/856-286-0x0000000000380000-0x0000000000E65000-memory.dmp	autoit_exe
behavioral1/memory/856-331-0x0000000000380000-0x0000000000E65000-memory.dmp	autoit_exe
behavioral1/memory/856-335-0x0000000000380000-0x0000000000E65000-memory.dmp	autoit_exe
behavioral1/memory/856-341-0x0000000000380000-0x0000000000E65000-memory.dmp	autoit_exe
behavioral1/memory/856-350-0x0000000000380000-0x0000000000E65000-memory.dmp	autoit_exe
behavioral1/memory/856-352-0x0000000000380000-0x0000000000E65000-memory.dmp	autoit_exe
behavioral1/memory/856-354-0x0000000000380000-0x0000000000E65000-memory.dmp	autoit_exe
behavioral1/memory/856-356-0x0000000000380000-0x0000000000E65000-memory.dmp	autoit_exe
behavioral1/memory/856-358-0x0000000000380000-0x0000000000E65000-memory.dmp	autoit_exe
behavioral1/memory/856-360-0x0000000000380000-0x0000000000E65000-memory.dmp	autoit_exe
behavioral1/memory/856-369-0x0000000000380000-0x0000000000E65000-memory.dmp	autoit_exe
behavioral1/memory/856-371-0x0000000000380000-0x0000000000E65000-memory.dmp	autoit_exe
behavioral1/memory/856-373-0x0000000000380000-0x0000000000E65000-memory.dmp	autoit_exe
behavioral1/memory/856-379-0x0000000000380000-0x0000000000E65000-memory.dmp	autoit_exe
behavioral1/memory/856-381-0x0000000000380000-0x0000000000E65000-memory.dmp	autoit_exe
behavioral1/memory/856-383-0x0000000000380000-0x0000000000E65000-memory.dmp	autoit_exe
behavioral1/memory/856-386-0x0000000000380000-0x0000000000E65000-memory.dmp	autoit_exe
behavioral1/memory/856-388-0x0000000000380000-0x0000000000E65000-memory.dmp	autoit_exe
behavioral1/memory/856-390-0x0000000000380000-0x0000000000E65000-memory.dmp	autoit_exe
behavioral1/memory/856-392-0x0000000000380000-0x0000000000E65000-memory.dmp	autoit_exe
behavioral1/memory/856-462-0x0000000000380000-0x0000000000E65000-memory.dmp	autoit_exe
behavioral1/memory/856-467-0x0000000000380000-0x0000000000E65000-memory.dmp	autoit_exe
behavioral1/memory/856-477-0x0000000000380000-0x0000000000E65000-memory.dmp	autoit_exe
behavioral1/memory/856-479-0x0000000000380000-0x0000000000E65000-memory.dmp	autoit_exe
behavioral1/memory/856-481-0x0000000000380000-0x0000000000E65000-memory.dmp	autoit_exe
behavioral1/memory/856-487-0x0000000000380000-0x0000000000E65000-memory.dmp	autoit_exe
behavioral1/memory/856-496-0x0000000000380000-0x0000000000E65000-memory.dmp	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 34 IoCs

pid	Process
3056	400c2e1e4df55d79e8df9dae523e969c5cc005782012732c8e57babe63fc9240.exe
2808	explorti.exe
856	8765c103e3.exe
856	8765c103e3.exe
1952	107a91a3e1.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\explorti.job	400c2e1e4df55d79e8df9dae523e969c5cc005782012732c8e57babe63fc9240.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	107a91a3e1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	12f662ddb1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	400c2e1e4df55d79e8df9dae523e969c5cc005782012732c8e57babe63fc9240.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorti.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8765c103e3.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3056	400c2e1e4df55d79e8df9dae523e969c5cc005782012732c8e57babe63fc9240.exe
2808	explorti.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2240	firefox.exe
Token: SeDebugPrivilege	2240	firefox.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3056	400c2e1e4df55d79e8df9dae523e969c5cc005782012732c8e57babe63fc9240.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
2240	firefox.exe
2240	firefox.exe
2240	firefox.exe
2240	firefox.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
2240	firefox.exe
2240	firefox.exe
2240	firefox.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe
856	8765c103e3.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
856	8765c103e3.exe
1952	107a91a3e1.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3056 wrote to memory of 2808	3056	400c2e1e4df55d79e8df9dae523e969c5cc005782012732c8e57babe63fc9240.exe	31
PID 3056 wrote to memory of 2808	3056	400c2e1e4df55d79e8df9dae523e969c5cc005782012732c8e57babe63fc9240.exe	31
PID 3056 wrote to memory of 2808	3056	400c2e1e4df55d79e8df9dae523e969c5cc005782012732c8e57babe63fc9240.exe	31
PID 3056 wrote to memory of 2808	3056	400c2e1e4df55d79e8df9dae523e969c5cc005782012732c8e57babe63fc9240.exe	31
PID 2808 wrote to memory of 856	2808	explorti.exe	33
PID 2808 wrote to memory of 856	2808	explorti.exe	33
PID 2808 wrote to memory of 856	2808	explorti.exe	33
PID 2808 wrote to memory of 856	2808	explorti.exe	33
PID 2808 wrote to memory of 1952	2808	explorti.exe	34
PID 2808 wrote to memory of 1952	2808	explorti.exe	34
PID 2808 wrote to memory of 1952	2808	explorti.exe	34
PID 2808 wrote to memory of 1952	2808	explorti.exe	34
PID 2808 wrote to memory of 1788	2808	explorti.exe	35
PID 2808 wrote to memory of 1788	2808	explorti.exe	35
PID 2808 wrote to memory of 1788	2808	explorti.exe	35
PID 2808 wrote to memory of 1788	2808	explorti.exe	35
PID 856 wrote to memory of 2456	856	8765c103e3.exe	36
PID 856 wrote to memory of 2456	856	8765c103e3.exe	36
PID 856 wrote to memory of 2456	856	8765c103e3.exe	36
PID 856 wrote to memory of 2456	856	8765c103e3.exe	36
PID 2456 wrote to memory of 2240	2456	firefox.exe	37
PID 2456 wrote to memory of 2240	2456	firefox.exe	37
PID 2456 wrote to memory of 2240	2456	firefox.exe	37
PID 2456 wrote to memory of 2240	2456	firefox.exe	37
PID 2456 wrote to memory of 2240	2456	firefox.exe	37
PID 2456 wrote to memory of 2240	2456	firefox.exe	37
PID 2456 wrote to memory of 2240	2456	firefox.exe	37
PID 2456 wrote to memory of 2240	2456	firefox.exe	37
PID 2456 wrote to memory of 2240	2456	firefox.exe	37
PID 2456 wrote to memory of 2240	2456	firefox.exe	37
PID 2456 wrote to memory of 2240	2456	firefox.exe	37
PID 2456 wrote to memory of 2240	2456	firefox.exe	37
PID 2240 wrote to memory of 1328	2240	firefox.exe	38
PID 2240 wrote to memory of 1328	2240	firefox.exe	38
PID 2240 wrote to memory of 1328	2240	firefox.exe	38
PID 2240 wrote to memory of 1288	2240	firefox.exe	39
PID 2240 wrote to memory of 1288	2240	firefox.exe	39
PID 2240 wrote to memory of 1288	2240	firefox.exe	39
PID 2240 wrote to memory of 1288	2240	firefox.exe	39
PID 2240 wrote to memory of 1288	2240	firefox.exe	39
PID 2240 wrote to memory of 1288	2240	firefox.exe	39
PID 2240 wrote to memory of 1288	2240	firefox.exe	39
PID 2240 wrote to memory of 1288	2240	firefox.exe	39
PID 2240 wrote to memory of 1288	2240	firefox.exe	39
PID 2240 wrote to memory of 1288	2240	firefox.exe	39
PID 2240 wrote to memory of 1288	2240	firefox.exe	39
PID 2240 wrote to memory of 1288	2240	firefox.exe	39
PID 2240 wrote to memory of 1288	2240	firefox.exe	39
PID 2240 wrote to memory of 1288	2240	firefox.exe	39
PID 2240 wrote to memory of 1288	2240	firefox.exe	39
PID 2240 wrote to memory of 1288	2240	firefox.exe	39
PID 2240 wrote to memory of 1288	2240	firefox.exe	39
PID 2240 wrote to memory of 1288	2240	firefox.exe	39
PID 2240 wrote to memory of 1288	2240	firefox.exe	39
PID 2240 wrote to memory of 1288	2240	firefox.exe	39
PID 2240 wrote to memory of 1288	2240	firefox.exe	39
PID 2240 wrote to memory of 1288	2240	firefox.exe	39
PID 2240 wrote to memory of 1288	2240	firefox.exe	39
PID 2240 wrote to memory of 1288	2240	firefox.exe	39
PID 2240 wrote to memory of 1288	2240	firefox.exe	39
PID 2240 wrote to memory of 1288	2240	firefox.exe	39
PID 2240 wrote to memory of 1288	2240	firefox.exe	39
PID 2240 wrote to memory of 1288	2240	firefox.exe	39
PID 2240 wrote to memory of 1288	2240	firefox.exe	39

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\400c2e1e4df55d79e8df9dae523e969c5cc005782012732c8e57babe63fc9240.exe
"C:\Users\Admin\AppData\Local\Temp\400c2e1e4df55d79e8df9dae523e969c5cc005782012732c8e57babe63fc9240.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
  "C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2808
- - C:\Users\Admin\AppData\Local\Temp\1000036001\8765c103e3.exe
    "C:\Users\Admin\AppData\Local\Temp\1000036001\8765c103e3.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:856
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2456
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
        5⤵
        Checks processor information in registry
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:2240
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2240.0.2036979943\526012263" -parentBuildID 20221007134813 -prefsHandle 1224 -prefMapHandle 1216 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {299a58b8-7279-42e8-b3fe-9de350ddeed9} 2240 "\\.\pipe\gecko-crash-server-pipe.2240" 1288 11df5c58 gpu
        6⤵
        
        PID:1328
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2240.1.1092122846\1527461609" -parentBuildID 20221007134813 -prefsHandle 1492 -prefMapHandle 1488 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {01cb1552-05e0-4916-a89f-5bcb2bf2bf7c} 2240 "\\.\pipe\gecko-crash-server-pipe.2240" 1504 e72758 socket
        6⤵
        
        PID:1288
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2240.2.1319858316\100464706" -childID 1 -isForBrowser -prefsHandle 1824 -prefMapHandle 1724 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 860 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5b266b09-5ea5-48ad-847b-d682b2d0e021} 2240 "\\.\pipe\gecko-crash-server-pipe.2240" 2176 1a4a4f58 tab
        6⤵
        
        PID:1808
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2240.3.264803574\572267513" -childID 2 -isForBrowser -prefsHandle 2712 -prefMapHandle 2708 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 860 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2da19aaf-0a5a-45e9-9d46-b8014bef10cb} 2240 "\\.\pipe\gecko-crash-server-pipe.2240" 2724 e64858 tab
        6⤵
        
        PID:2932
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2240.4.89068877\1378985543" -childID 3 -isForBrowser -prefsHandle 3784 -prefMapHandle 3864 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 860 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9104dc30-50f9-4d18-9abc-94cea2ac9261} 2240 "\\.\pipe\gecko-crash-server-pipe.2240" 3876 210edc58 tab
        6⤵
        
        PID:2332
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2240.5.755126609\1101541790" -childID 4 -isForBrowser -prefsHandle 3992 -prefMapHandle 3996 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 860 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {41814324-d136-4c7e-ad62-53a4d9012c9f} 2240 "\\.\pipe\gecko-crash-server-pipe.2240" 3980 21131858 tab
        6⤵
        
        PID:2752
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2240.6.468807762\571169145" -childID 5 -isForBrowser -prefsHandle 4160 -prefMapHandle 4164 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 860 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b21bb960-ac55-4a30-9be1-f6b541fa18bd} 2240 "\\.\pipe\gecko-crash-server-pipe.2240" 4148 21133358 tab
        6⤵
        
        PID:1128
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2240.7.196288340\304215287" -childID 6 -isForBrowser -prefsHandle 4252 -prefMapHandle 4368 -prefsLen 26450 -prefMapSize 233444 -jsInitHandle 860 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a6c71206-97de-4c67-b0cc-02a6dec1023d} 2240 "\\.\pipe\gecko-crash-server-pipe.2240" 4380 209a1a58 tab
        6⤵
        
        PID:2856
- - C:\Users\Admin\1000037002\107a91a3e1.exe
    "C:\Users\Admin\1000037002\107a91a3e1.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1952
- - C:\Users\Admin\AppData\Local\Temp\1000038001\12f662ddb1.exe
    "C:\Users\Admin\AppData\Local\Temp\1000038001\12f662ddb1.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\1000037002\107a91a3e1.exe

Filesize
2.4MB

MD5
0ba6b7ef538b30997ed3f2dc6b69c534

SHA1
b210bee5380a6edfdda30cd203ea84835c6479ba

SHA256
f0ae1731e5ab53d57601e839a64b105b821d77de6e3645d5d2156c3172ac0f17

SHA512
45d41c2e674269ef68cbff393aa731a57337ffe52d19476e5e259167b1b751885184a93f5ff56d35b3558020d0ad9d58ca0a53a514eb828aea5a8104a7c3d98d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nndpnsl0.default-release\activity-stream.discovery_stream.json.tmp

Filesize
25KB

MD5
21f89d123f21b58e556166f70fb1c367

SHA1
00250c076767200500d36f8e0cd1cb7b7f0fe449

SHA256
76942fc90cd3982a40fd7a1625f1a3b76a6f62d5243dbb51154b31dd2f8d3c83

SHA512
57364200ac366b2592f5be33422bbc2a727b6a1ae0efb9d4843e35d0d16ca555da2c724842ceb872c80f18fface6a4a63dbe2298e374682ceecda4853c7f6a51

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nndpnsl0.default-release\cache2\entries\037778A55E1B7E9BED3390289866D09402D6C913

Filesize
9KB

MD5
1798a45c42d361894202e637e8e949c0

SHA1
261766def11ad061661abe19632f792e043f046e

SHA256
e343b2e0e23b0c47615b7b2a67f98598b7ac42e48fb635aa8fcc0e6c8ad0b765

SHA512
004bc6cab398febda1466cec30c2bb4ba26ffe3ddb2e0e81fae83ba07cd8149e52d493b019021a238a1e1390c06a79c2ba699333503d93c71c6af168c06bb5a4

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nndpnsl0.default-release\cache2\entries\099EB2BF8827A4F91EAB3E38B14650D0205226F2

Filesize
15KB

MD5
4bff563a530d18a245be8bb2ad7865d6

SHA1
6d0288a03189baed23ce934f07268ccc3d3a2e0b

SHA256
e2f914f49dc08efb3fbc3ac38e6e3f818667ae4f6428f7006270beeede7792aa

SHA512
16c2bbb13ae4e896fbc87cb50ee8d3cabdcc60b6481883a397164c5b1402736d27304860c4b14e6308bf3cfcdb0f73d004698686d18f60711c2d6b2352bdc4d9

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nndpnsl0.default-release\cache2\entries\254256B27E0C48CF9B80B695F0B3B8CA84610495

Filesize
9KB

MD5
b250167b54b5ae9343659f5bfdf9fbcd

SHA1
1b6287482f7aa2dbef9e563672055460481349c4

SHA256
a9d67e6ee09ba5e4fd0d9d70907d48262d565c6f071164ad0e513a849fec3030

SHA512
95da2606c6620df2432bf2b23d17b475247f339dec8578da060ab0481994ee80043c5314f6efcd988d14e4f51220cc1738fe15e4750c4a105c7ab8f2b0d0afac

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nndpnsl0.default-release\cache2\entries\5CD1EBDF6B57F13C7E783CE5E6D8E9C44014FE1A

Filesize
13KB

MD5
3d6b1cf164e4bcedcb43b431a59d06e3

SHA1
8db831a8fa141bd42de6fba81c113f7c3f8d3db8

SHA256
f13f63ec21dbe35b6f5f28fc041a46786794ca3f495759edb1736f97782f5175

SHA512
41ed7b2276a85c208a7fa09e4b57707e0d8e7580f9ee3991b6af46fb8018c3bb0b6a51be534fb0533a4450bcf4fac929c2434824612a1e54cb9d30046b60f2f0

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nndpnsl0.default-release\cache2\entries\6D89348819C8881868053197CA0754F36784BF5F

Filesize
15KB

MD5
4f20aba6e7af643b5d1ae9a2024397b6

SHA1
c23a05af9bcb72cccc2c40de225574833d72c4d4

SHA256
3f06d238e818967f27b385be14af8b788a56465ee30098cf86c2156b07adea44

SHA512
a6723935f28b9ce6486b805f616b021b6c58c504f1698a794aa3609e2cf7c8d295485b4547c83c0f49df40aa7aeba098b2a47ed54c375086bf189ee0d26213ad

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nndpnsl0.default-release\cache2\entries\E092DC679479274DE55982D7AD98498EECB36E3C

Filesize
11KB

MD5
f2d1ab6cb3398657f15a6b000769eadd

SHA1
c52e5f7ee8f5e24260e8ad397fdb2c3319b7778d

SHA256
f84662bdedf95adcf132bf9a5b3b6180cc00b28f4390520f3c7a5008e2c0e0a2

SHA512
2ec10ca1861a00fea035835c109aa73d2f000bca04966a837f759fb243e0cce161cb706de12f535914150e9be23ff4fd9d41d395b2670eea076e83bbbd16024b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nndpnsl0.default-release\cache2\entries\E449899591A9BC91DFBA673EC0589B51E541A88B

Filesize
13KB

MD5
dbaf045d2ac75d4d0acd723c7d5a0a1d

SHA1
28ca69ae050ada516a2b9032c22945cb258ccc0e

SHA256
32f885351cbcd00a2aa510baf6cb555236d1bb8744905b728570450758ae70ac

SHA512
d9ead54abf58cd94b73e8432acf1261fac4dc11178eb75c9ba7b21e20dc10c9df20d5021389ae50a03e582fd599786b523da24824ad73bf91215254a2299dab0

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nndpnsl0.default-release\cache2\entries\F210D48319A1879FD1C5213FA010C613B99BA085

Filesize
11KB

MD5
728fd524c5d10c89951f0eb289c9c335

SHA1
894886dac129bbc132ce5c22aa766b3144f6c628

SHA256
ea1595cd45809d9f17aae5bd4f5407d55201fd1545b45886bf7248da548ed760

SHA512
c3e29074eeed4add1168274fd0328f1eb718fc3d9309f3a7fa0a38352e5103c294fc22c34df899e58392e86ebc5fc4ef0a592db6609720a2b25a65fe715b2ff4

Download Submit
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Filesize
1.8MB

MD5
c3675e31f1618e7fa33b1aa6a16f1f83

SHA1
a759529be3c61c3e13f68ab46e85f4fe4b431fd3

SHA256
400c2e1e4df55d79e8df9dae523e969c5cc005782012732c8e57babe63fc9240

SHA512
1acdaf8d3cc4684af47c7814832e2213732cac4a4322e34c363f7ac108815f08376248f689e0d3a4f341f33eb1e7139133210859ebafc946931b31989c88e6e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000036001\8765c103e3.exe

Filesize
3.1MB

MD5
25bcb7ebee3f1cadce066f73f8bf68e6

SHA1
0f645fe8aacf8ed50efa28d10fcb1e6f7f9eabd1

SHA256
9a0d9cd287dd60d8f4aafdcd7020e0ad897fe721a428049c435c24dbcb29bbfc

SHA512
235259094a566e4810aaccbab04c73222c18fa0dc25f6ab72802d69c9cf76b06f142d30eca90e31bee6b1ea778a234fe4782e74542fc2e226eaad9476f86cdc4

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000038001\12f662ddb1.exe

Filesize
187KB

MD5
278ee1426274818874556aa18fd02e3a

SHA1
185a2761330024dec52134df2c8388c461451acb

SHA256
37257ddb1a6f309a6e9d147b5fc2551a9cae3a0e52b191b18d9465bfcb5c18eb

SHA512
07ec6759af5b9a00d8371b9fd9b723012dd0a1614cfcc7cd51975a004f69ffb90083735e9a871a2aa0e8d28799beac53a4748f55f4dd1e7495bc7388ebf4d6a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
8.0MB

MD5
a01c5ecd6108350ae23d2cddf0e77c17

SHA1
c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

SHA256
345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

SHA512
b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
7KB

MD5
979474abc4738efb4188180ac8fd7e54

SHA1
296338d392b0d0e65cd5d14a163157a175d6ce1d

SHA256
87bdbe6698f51ecaa4a166d373704385ce3911a3df86a94aa6ca84d3723c20fa

SHA512
23bafb4e10b276c5e97e0808e9bfed3e1a28d8b0cc141702a3bf395b09886ebaac6177ebe0912e397c1bc71dfebc461506911d7419b2b80664c36c994b101dbf

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\bookmarkbackups\bookmarks-2024-08-08_11_5h7eKW0pE3Aq-pSa2dI0OA==.jsonlz4

Filesize
946B

MD5
895682c2fc2c07cda215ba62e57261b6

SHA1
fb66e4eea346617848114284d5f3c788ce3276af

SHA256
c156c613aaeda19ab4baead86896360c173d4af91d03c030b179fbda8372b4e5

SHA512
00a3f07045bed64190797c18db731015afb997f378005c0acda45f6e6ed412a5ae1d20590a3376e4a32a6eb12289e611ce60543702c078090a20ac7ca8914317

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\broadcast-listeners.json

Filesize
204B

MD5
72c95709e1a3b27919e13d28bbe8e8a2

SHA1
00892decbee63d627057730bfc0c6a4f13099ee4

SHA256
9cf589357fceea2f37cd1a925e5d33fd517a44d22a16c357f7fb5d4d187034aa

SHA512
613ca9dd2d12afe31fb2c4a8d9337eeecfb58dabaeaaba11404b9a736a4073dfd9b473ba27c1183d3cc91d5a9233a83dce5a135a81f755d978cea9e198209182

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
c4282e44d9928433e420fe50890c8cec

SHA1
2126c3d76b27e6aaf992caf4dee3c3aadc49913a

SHA256
8c57b1683c76c0e830418d6d5fc10921390ff6bd62a84f9dc5f835e343634a32

SHA512
6cf892b786b60e5f9bed8cec7b5400a2cb254caf2ace29b390a33f768dfe4193ab8df6bdf4d90436c0f913cb4b5384d9d1c92ed98f1b4a67de86cc6b3a282ed8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\datareporting\glean\pending_pings\036e9416-04a9-4a32-8721-c38649fe7a51

Filesize
10KB

MD5
7b3fc7165b66044240e8d601c32a4abd

SHA1
265ae36f15e413c3f8e365e8edaeeb1d1826fcc6

SHA256
208659eba8b0324283639659c16eb42d01fcbe5c85ac376984ebbf0a86e75d84

SHA512
397f783a2b62b7fa6c81db5428786d092a5c5dc94286ce45719040748fe4e494cd8aefc3f04474f0e3aa7b229a7a99923765ea5ac1cbfba5d3e44efb42cad507

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\datareporting\glean\pending_pings\c2cfd280-42a7-4b5c-ac5f-49d741044193

Filesize
745B

MD5
a0b599dd629bc273e5262f33ea25e4ec

SHA1
be001c7675e8e980063fc5652945949c249e6162

SHA256
fcc09bb63cf7b0782ff54fffb93659e160baee0735faea29454a9a5ef78ab41a

SHA512
6213adffeed8853d54b19b5755589f1ff0142b92c875ccc3b70c1a20fa29c8ea5e29a6a4fc2af2791c2b66749b1ec29f1e25687be19cdb40b39efb22b41b897a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

Filesize
11.8MB

MD5
33bf7b0439480effb9fb212efce87b13

SHA1
cee50f2745edc6dc291887b6075ca64d716f495a

SHA256
8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

SHA512
d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\prefs-1.js

Filesize
7KB

MD5
a20b791cc91844f6c036e96387693bda

SHA1
09cb03af262c3f88893cefa9212a92da03ba1f68

SHA256
345c00aa6ffba9b701ac9bd7cf01feaae2d24675e0cced2ef7e21fa0ff33c7d4

SHA512
a893158b8fbd3105d51cc0515fb22eec1c70c4b552783911e4b909b4e1c85847e228c9e149dc4f40ba0ead8a6b651fe137d0493982d7a1682686699df18dab8b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\prefs-1.js

Filesize
6KB

MD5
8d1e0c725d4dce7daa71bffd1c3a9a18

SHA1
3de0f58662a1aa70429c9a8af92f4931e6d798ea

SHA256
216c2cb6aeb856ad3d8a1e34a557e5f9280661df145f52d8a63d7bc864fff36e

SHA512
58462f512902f511c2c262ad86996f4cf52be610569dca359b37a02dbe1e38ebde64a505887506856ae5f1f20f5e4be19a8b7fe080d231161ef5cf028ebb56cd

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\prefs-1.js

Filesize
7KB

MD5
868ba47926fa02aadc099edf73bca246

SHA1
206219ad06c9c59949820f84013017070dba6515

SHA256
e0f5911e6c0ab09618451577a0457caf1c7606e2dc335b2c84b8be9efdb87dd5

SHA512
62e22300092e78be73d2facb4d5993b82e6d5f77fd5789d7c8c041da5fcd609ca0115e752d86b9cd96eb7315b6761433909d5522d61a84f9d45e0333ca5f2189

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\prefs.js

Filesize
6KB

MD5
05e314fd8388a2d1d04ef357553029c2

SHA1
415e74e4997d5c5c85a538546aebcf17539dd821

SHA256
042190f1bb69fccb18d46249dca5eeec9348bbe9336b2b7011919dba3eef3336

SHA512
2732e36c4265b4cd983040a028f703ed27a2c3b7ac979b0a57aac53225370eb2ce6757ab09cffccc98fda47cde78c9d8c003521cd9abe81cf8aabafc5763095a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\sessionCheckpoints.json

Filesize
90B

MD5
c4ab2ee59ca41b6d6a6ea911f35bdc00

SHA1
5942cd6505fc8a9daba403b082067e1cdefdfbc4

SHA256
00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2

SHA512
71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
6a636bd7abcbdb249c3755b33df2da96

SHA1
07709981e7f76b8e353587282e6bf059e09cff24

SHA256
2f00c88924333dc1345d94115624e7c54778b74d14ed38b936a85ef45a6bdea5

SHA512
c8830a6f7d49e9d83c601a39a70dbb694d11d8007665bc553a88770e79d381a6c8739c28eb990fe193ba56b46bf37d6249a2feb07123aac46adc6f31ecaca30e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\targeting.snapshot.json

Filesize
4KB

MD5
d60727cb11e30e551168cef71c4056dd

SHA1
8384b2cb4b7e7c95ed9a0bb7fd7f96d94d1be8f5

SHA256
3ab17a4451eacb02a4adc19b8ae5816f265cf3cbaa41c76f539c1f03d6da6d1a

SHA512
c18640301ea0d8a21fd218ff2fc1cf0a1c73850b25c5635ea55a2219963621a7e578ed97deed987c98e25ec82f37fc7ce69e73a0d38d5adaa4ffdd1846b6c8f2

Download Submit
memory/856-231-0x0000000000380000-0x0000000000E65000-memory.dmp

Filesize
10.9MB

Download
memory/856-341-0x0000000000380000-0x0000000000E65000-memory.dmp

Filesize
10.9MB

Download
memory/856-467-0x0000000000380000-0x0000000000E65000-memory.dmp

Filesize
10.9MB

Download
memory/856-392-0x0000000000380000-0x0000000000E65000-memory.dmp

Filesize
10.9MB

Download
memory/856-390-0x0000000000380000-0x0000000000E65000-memory.dmp

Filesize
10.9MB

Download
memory/856-244-0x0000000000380000-0x0000000000E65000-memory.dmp

Filesize
10.9MB

Download
memory/856-245-0x0000000000380000-0x0000000000E65000-memory.dmp

Filesize
10.9MB

Download
memory/856-462-0x0000000000380000-0x0000000000E65000-memory.dmp

Filesize
10.9MB

Download
memory/856-388-0x0000000000380000-0x0000000000E65000-memory.dmp

Filesize
10.9MB

Download
memory/856-477-0x0000000000380000-0x0000000000E65000-memory.dmp

Filesize
10.9MB

Download
memory/856-479-0x0000000000380000-0x0000000000E65000-memory.dmp

Filesize
10.9MB

Download
memory/856-481-0x0000000000380000-0x0000000000E65000-memory.dmp

Filesize
10.9MB

Download
memory/856-39-0x0000000000380000-0x0000000000E65000-memory.dmp

Filesize
10.9MB

Download
memory/856-286-0x0000000000380000-0x0000000000E65000-memory.dmp

Filesize
10.9MB

Download
memory/856-487-0x0000000000380000-0x0000000000E65000-memory.dmp

Filesize
10.9MB

Download
memory/856-358-0x0000000000380000-0x0000000000E65000-memory.dmp

Filesize
10.9MB

Download
memory/856-496-0x0000000000380000-0x0000000000E65000-memory.dmp

Filesize
10.9MB

Download
memory/856-360-0x0000000000380000-0x0000000000E65000-memory.dmp

Filesize
10.9MB

Download
memory/856-356-0x0000000000380000-0x0000000000E65000-memory.dmp

Filesize
10.9MB

Download
memory/856-369-0x0000000000380000-0x0000000000E65000-memory.dmp

Filesize
10.9MB

Download
memory/856-386-0x0000000000380000-0x0000000000E65000-memory.dmp

Filesize
10.9MB

Download
memory/856-331-0x0000000000380000-0x0000000000E65000-memory.dmp

Filesize
10.9MB

Download
memory/856-383-0x0000000000380000-0x0000000000E65000-memory.dmp

Filesize
10.9MB

Download
memory/856-335-0x0000000000380000-0x0000000000E65000-memory.dmp

Filesize
10.9MB

Download
memory/856-381-0x0000000000380000-0x0000000000E65000-memory.dmp

Filesize
10.9MB

Download
memory/856-354-0x0000000000380000-0x0000000000E65000-memory.dmp

Filesize
10.9MB

Download
memory/856-379-0x0000000000380000-0x0000000000E65000-memory.dmp

Filesize
10.9MB

Download
memory/856-350-0x0000000000380000-0x0000000000E65000-memory.dmp

Filesize
10.9MB

Download
memory/856-373-0x0000000000380000-0x0000000000E65000-memory.dmp

Filesize
10.9MB

Download
memory/856-352-0x0000000000380000-0x0000000000E65000-memory.dmp

Filesize
10.9MB

Download
memory/856-371-0x0000000000380000-0x0000000000E65000-memory.dmp

Filesize
10.9MB

Download
memory/1788-80-0x0000000001130000-0x0000000001373000-memory.dmp

Filesize
2.3MB

Download
memory/1788-81-0x0000000001130000-0x0000000001373000-memory.dmp

Filesize
2.3MB

Download
memory/1952-69-0x0000000000400000-0x0000000000FED000-memory.dmp

Filesize
11.9MB

Download
memory/1952-59-0x0000000000400000-0x0000000000FED000-memory.dmp

Filesize
11.9MB

Download
memory/2808-336-0x0000000000F90000-0x0000000001439000-memory.dmp

Filesize
4.7MB

Download
memory/2808-226-0x0000000000F90000-0x0000000001439000-memory.dmp

Filesize
4.7MB

Download
memory/2808-357-0x0000000000F90000-0x0000000001439000-memory.dmp

Filesize
4.7MB

Download
memory/2808-363-0x0000000006410000-0x0000000006653000-memory.dmp

Filesize
2.3MB

Download
memory/2808-362-0x0000000006410000-0x0000000006653000-memory.dmp

Filesize
2.3MB

Download
memory/2808-361-0x0000000000F90000-0x0000000001439000-memory.dmp

Filesize
4.7MB

Download
memory/2808-355-0x0000000000F90000-0x0000000001439000-memory.dmp

Filesize
4.7MB

Download
memory/2808-370-0x0000000000F90000-0x0000000001439000-memory.dmp

Filesize
4.7MB

Download
memory/2808-353-0x0000000000F90000-0x0000000001439000-memory.dmp

Filesize
4.7MB

Download
memory/2808-372-0x0000000000F90000-0x0000000001439000-memory.dmp

Filesize
4.7MB

Download
memory/2808-351-0x0000000000F90000-0x0000000001439000-memory.dmp

Filesize
4.7MB

Download
memory/2808-374-0x0000000000F90000-0x0000000001439000-memory.dmp

Filesize
4.7MB

Download
memory/2808-345-0x0000000000F90000-0x0000000001439000-memory.dmp

Filesize
4.7MB

Download
memory/2808-380-0x0000000000F90000-0x0000000001439000-memory.dmp

Filesize
4.7MB

Download
memory/2808-488-0x0000000000F90000-0x0000000001439000-memory.dmp

Filesize
4.7MB

Download
memory/2808-382-0x0000000000F90000-0x0000000001439000-memory.dmp

Filesize
4.7MB

Download
memory/2808-333-0x0000000000F90000-0x0000000001439000-memory.dmp

Filesize
4.7MB

Download
memory/2808-384-0x0000000000F90000-0x0000000001439000-memory.dmp

Filesize
4.7MB

Download
memory/2808-325-0x0000000000F90000-0x0000000001439000-memory.dmp

Filesize
4.7MB

Download
memory/2808-387-0x0000000000F90000-0x0000000001439000-memory.dmp

Filesize
4.7MB

Download
memory/2808-251-0x0000000000F90000-0x0000000001439000-memory.dmp

Filesize
4.7MB

Download
memory/2808-389-0x0000000000F90000-0x0000000001439000-memory.dmp

Filesize
4.7MB

Download
memory/2808-242-0x0000000006960000-0x0000000007445000-memory.dmp

Filesize
10.9MB

Download
memory/2808-391-0x0000000000F90000-0x0000000001439000-memory.dmp

Filesize
4.7MB

Download
memory/2808-241-0x0000000000F90000-0x0000000001439000-memory.dmp

Filesize
4.7MB

Download
memory/2808-393-0x0000000000F90000-0x0000000001439000-memory.dmp

Filesize
4.7MB

Download
memory/2808-232-0x0000000000F90000-0x0000000001439000-memory.dmp

Filesize
4.7MB

Download
memory/2808-359-0x0000000000F90000-0x0000000001439000-memory.dmp

Filesize
4.7MB

Download
memory/2808-195-0x0000000000F90000-0x0000000001439000-memory.dmp

Filesize
4.7MB

Download
memory/2808-196-0x0000000000F90000-0x0000000001439000-memory.dmp

Filesize
4.7MB

Download
memory/2808-78-0x0000000006410000-0x0000000006653000-memory.dmp

Filesize
2.3MB

Download
memory/2808-79-0x0000000006410000-0x0000000006653000-memory.dmp

Filesize
2.3MB

Download
memory/2808-58-0x0000000006960000-0x000000000754D000-memory.dmp

Filesize
11.9MB

Download
memory/2808-57-0x0000000006960000-0x000000000754D000-memory.dmp

Filesize
11.9MB

Download
memory/2808-37-0x0000000006960000-0x0000000007445000-memory.dmp

Filesize
10.9MB

Download
memory/2808-23-0x0000000000F90000-0x0000000001439000-memory.dmp

Filesize
4.7MB

Download
memory/2808-22-0x0000000000F90000-0x0000000001439000-memory.dmp

Filesize
4.7MB

Download
memory/2808-20-0x0000000000F90000-0x0000000001439000-memory.dmp

Filesize
4.7MB

Download
memory/2808-19-0x0000000000F90000-0x0000000001439000-memory.dmp

Filesize
4.7MB

Download
memory/2808-463-0x0000000000F90000-0x0000000001439000-memory.dmp

Filesize
4.7MB

Download
memory/2808-482-0x0000000000F90000-0x0000000001439000-memory.dmp

Filesize
4.7MB

Download
memory/2808-468-0x0000000000F90000-0x0000000001439000-memory.dmp

Filesize
4.7MB

Download
memory/2808-17-0x0000000000F90000-0x0000000001439000-memory.dmp

Filesize
4.7MB

Download
memory/2808-480-0x0000000000F90000-0x0000000001439000-memory.dmp

Filesize
4.7MB

Download
memory/2808-478-0x0000000000F90000-0x0000000001439000-memory.dmp

Filesize
4.7MB

Download
memory/3056-14-0x0000000001130000-0x00000000015D9000-memory.dmp

Filesize
4.7MB

Download
memory/3056-15-0x0000000001130000-0x00000000015D9000-memory.dmp

Filesize
4.7MB

Download
memory/3056-5-0x0000000001130000-0x00000000015D9000-memory.dmp

Filesize
4.7MB

Download
memory/3056-18-0x0000000006C90000-0x0000000007139000-memory.dmp

Filesize
4.7MB

Download
memory/3056-3-0x0000000001130000-0x00000000015D9000-memory.dmp

Filesize
4.7MB

Download
memory/3056-0-0x0000000001130000-0x00000000015D9000-memory.dmp

Filesize
4.7MB

Download
memory/3056-2-0x0000000001131000-0x000000000115F000-memory.dmp

Filesize
184KB

Download
memory/3056-1-0x0000000077A80000-0x0000000077A82000-memory.dmp

Filesize
8KB

Download