amadey | d485353a1ab1f0734f48b245a3e8c92d05e8550a9de2687dd68e3938c549ec7f

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
09/08/2024, 22:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d485353a1ab1f0734f48b245a3e8c92d05e8550a9de2687dd68e3938c549ec7f.exe
Size 1.8MB
Sample240809-11fg4a1fqj
SHA256 d485353a1ab1f0734f48b245a3e8c92d05e8550a9de2687dd68e3938c549ec7f
MD5 6fa6e118ca3d3d34b1dcbd8385fc1d4d
SHA1 104067d48e7c4705929a94a61f7a062cd2f6c334
SHA512 b2c09ce3187fac4f3ca148197d14560dd1921a94524770f60a3758b8603fea4dfc05e7d64979b204650837738a49fc9ab41c1bd8515b721aef533894d1ad3e67
SSDEEP 49152:SwhlVkiyBNBXJbAJDI0Igkf6zbkZjdZhx:lrkzXJuDIxgm1dZv
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey stealc 0657d1 kora credential_access discovery evasion persistence stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

0657d1

http://185.215.113.19

Attributes

install_dir
0d8f5eb8a7
install_file
explorti.exe
strings_key
6c55a5f34bb433fbd933a168577b1838
url_paths
/Vi9leo/index.php

rc4.plain

Extracted

Family

stealc

Botnet

kora

http://185.215.113.100

Attributes

url_path
/e2b1563c6670f193.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Stealc
Stealc is an infostealer written in C++.
stealer stealc
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	d485353a1ab1f0734f48b245a3e8c92d05e8550a9de2687dd68e3938c549ec7f.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 10 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	d485353a1ab1f0734f48b245a3e8c92d05e8550a9de2687dd68e3938c549ec7f.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	d485353a1ab1f0734f48b245a3e8c92d05e8550a9de2687dd68e3938c549ec7f.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe

Executes dropped EXE 7 IoCs

pid	Process
4396	explorti.exe
928	196e2935bd.exe
3800	c0f85cfe13.exe
3808	273c835e64.exe
5652	explorti.exe
5888	explorti.exe
860	explorti.exe

Identifies Wine through registry keys 2 TTPs 5 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000\Software\Wine	d485353a1ab1f0734f48b245a3e8c92d05e8550a9de2687dd68e3938c549ec7f.exe
Key opened	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000\Software\Wine	explorti.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000\Software\Microsoft\Windows\CurrentVersion\Run\196e2935bd.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000036001\\196e2935bd.exe"	explorti.exe

AutoIT Executable 15 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/928-431-0x0000000000670000-0x0000000001153000-memory.dmp	autoit_exe
behavioral2/memory/928-451-0x0000000000670000-0x0000000001153000-memory.dmp	autoit_exe
behavioral2/memory/928-456-0x0000000000670000-0x0000000001153000-memory.dmp	autoit_exe
behavioral2/memory/928-537-0x0000000000670000-0x0000000001153000-memory.dmp	autoit_exe
behavioral2/memory/928-1482-0x0000000000670000-0x0000000001153000-memory.dmp	autoit_exe
behavioral2/memory/928-2591-0x0000000000670000-0x0000000001153000-memory.dmp	autoit_exe
behavioral2/memory/928-2596-0x0000000000670000-0x0000000001153000-memory.dmp	autoit_exe
behavioral2/memory/928-2608-0x0000000000670000-0x0000000001153000-memory.dmp	autoit_exe
behavioral2/memory/928-2610-0x0000000000670000-0x0000000001153000-memory.dmp	autoit_exe
behavioral2/memory/928-2612-0x0000000000670000-0x0000000001153000-memory.dmp	autoit_exe
behavioral2/memory/928-2614-0x0000000000670000-0x0000000001153000-memory.dmp	autoit_exe
behavioral2/memory/928-2616-0x0000000000670000-0x0000000001153000-memory.dmp	autoit_exe
behavioral2/memory/928-2618-0x0000000000670000-0x0000000001153000-memory.dmp	autoit_exe
behavioral2/memory/928-2628-0x0000000000670000-0x0000000001153000-memory.dmp	autoit_exe
behavioral2/memory/928-2630-0x0000000000670000-0x0000000001153000-memory.dmp	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 20 IoCs

pid	Process
4592	d485353a1ab1f0734f48b245a3e8c92d05e8550a9de2687dd68e3938c549ec7f.exe
4396	explorti.exe
928	196e2935bd.exe
928	196e2935bd.exe
5652	explorti.exe
928	196e2935bd.exe
928	196e2935bd.exe
928	196e2935bd.exe
928	196e2935bd.exe
928	196e2935bd.exe
928	196e2935bd.exe
5888	explorti.exe
928	196e2935bd.exe
928	196e2935bd.exe
928	196e2935bd.exe
928	196e2935bd.exe
928	196e2935bd.exe
928	196e2935bd.exe
860	explorti.exe
928	196e2935bd.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3800 set thread context of 3344	3800	c0f85cfe13.exe	85

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\explorti.job	d485353a1ab1f0734f48b245a3e8c92d05e8550a9de2687dd68e3938c549ec7f.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorti.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	196e2935bd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c0f85cfe13.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	273c835e64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d485353a1ab1f0734f48b245a3e8c92d05e8550a9de2687dd68e3938c549ec7f.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4592	d485353a1ab1f0734f48b245a3e8c92d05e8550a9de2687dd68e3938c549ec7f.exe
4592	d485353a1ab1f0734f48b245a3e8c92d05e8550a9de2687dd68e3938c549ec7f.exe
4396	explorti.exe
4396	explorti.exe
5652	explorti.exe
5652	explorti.exe
5888	explorti.exe
5888	explorti.exe
860	explorti.exe
860	explorti.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1836	firefox.exe
Token: SeDebugPrivilege	1836	firefox.exe
Token: SeDebugPrivilege	1836	firefox.exe
Token: SeDebugPrivilege	1836	firefox.exe
Token: SeDebugPrivilege	1836	firefox.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4592	d485353a1ab1f0734f48b245a3e8c92d05e8550a9de2687dd68e3938c549ec7f.exe
928	196e2935bd.exe
928	196e2935bd.exe
928	196e2935bd.exe
928	196e2935bd.exe
928	196e2935bd.exe
928	196e2935bd.exe
928	196e2935bd.exe
1836	firefox.exe
1836	firefox.exe
1836	firefox.exe
1836	firefox.exe
1836	firefox.exe
1836	firefox.exe
1836	firefox.exe
1836	firefox.exe
1836	firefox.exe
1836	firefox.exe
1836	firefox.exe
1836	firefox.exe
1836	firefox.exe
1836	firefox.exe
1836	firefox.exe
1836	firefox.exe
1836	firefox.exe
1836	firefox.exe
1836	firefox.exe
1836	firefox.exe
1836	firefox.exe
928	196e2935bd.exe
928	196e2935bd.exe
928	196e2935bd.exe
928	196e2935bd.exe
928	196e2935bd.exe
928	196e2935bd.exe
928	196e2935bd.exe
928	196e2935bd.exe
928	196e2935bd.exe
928	196e2935bd.exe
928	196e2935bd.exe
928	196e2935bd.exe
928	196e2935bd.exe
928	196e2935bd.exe
928	196e2935bd.exe
928	196e2935bd.exe
928	196e2935bd.exe
928	196e2935bd.exe
928	196e2935bd.exe
928	196e2935bd.exe
928	196e2935bd.exe
928	196e2935bd.exe
928	196e2935bd.exe
928	196e2935bd.exe
928	196e2935bd.exe
928	196e2935bd.exe
928	196e2935bd.exe
928	196e2935bd.exe
928	196e2935bd.exe
928	196e2935bd.exe
928	196e2935bd.exe
928	196e2935bd.exe
928	196e2935bd.exe
928	196e2935bd.exe
928	196e2935bd.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
928	196e2935bd.exe
928	196e2935bd.exe
928	196e2935bd.exe
928	196e2935bd.exe
928	196e2935bd.exe
928	196e2935bd.exe
928	196e2935bd.exe
928	196e2935bd.exe
928	196e2935bd.exe
928	196e2935bd.exe
928	196e2935bd.exe
928	196e2935bd.exe
928	196e2935bd.exe
928	196e2935bd.exe
928	196e2935bd.exe
928	196e2935bd.exe
928	196e2935bd.exe
928	196e2935bd.exe
928	196e2935bd.exe
928	196e2935bd.exe
928	196e2935bd.exe
928	196e2935bd.exe
928	196e2935bd.exe
928	196e2935bd.exe
928	196e2935bd.exe
928	196e2935bd.exe
928	196e2935bd.exe
928	196e2935bd.exe
928	196e2935bd.exe
928	196e2935bd.exe
928	196e2935bd.exe
928	196e2935bd.exe
928	196e2935bd.exe
928	196e2935bd.exe
928	196e2935bd.exe
928	196e2935bd.exe
928	196e2935bd.exe
928	196e2935bd.exe
928	196e2935bd.exe
928	196e2935bd.exe
928	196e2935bd.exe
928	196e2935bd.exe
928	196e2935bd.exe
928	196e2935bd.exe
928	196e2935bd.exe
928	196e2935bd.exe
928	196e2935bd.exe
928	196e2935bd.exe
928	196e2935bd.exe
928	196e2935bd.exe
928	196e2935bd.exe
928	196e2935bd.exe
928	196e2935bd.exe
928	196e2935bd.exe
928	196e2935bd.exe
928	196e2935bd.exe
928	196e2935bd.exe
928	196e2935bd.exe
928	196e2935bd.exe
928	196e2935bd.exe
928	196e2935bd.exe
928	196e2935bd.exe
928	196e2935bd.exe
928	196e2935bd.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
928	196e2935bd.exe
1836	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4592 wrote to memory of 4396	4592	d485353a1ab1f0734f48b245a3e8c92d05e8550a9de2687dd68e3938c549ec7f.exe	82
PID 4592 wrote to memory of 4396	4592	d485353a1ab1f0734f48b245a3e8c92d05e8550a9de2687dd68e3938c549ec7f.exe	82
PID 4592 wrote to memory of 4396	4592	d485353a1ab1f0734f48b245a3e8c92d05e8550a9de2687dd68e3938c549ec7f.exe	82
PID 4396 wrote to memory of 928	4396	explorti.exe	83
PID 4396 wrote to memory of 928	4396	explorti.exe	83
PID 4396 wrote to memory of 928	4396	explorti.exe	83
PID 4396 wrote to memory of 3800	4396	explorti.exe	84
PID 4396 wrote to memory of 3800	4396	explorti.exe	84
PID 4396 wrote to memory of 3800	4396	explorti.exe	84
PID 3800 wrote to memory of 3344	3800	c0f85cfe13.exe	85
PID 3800 wrote to memory of 3344	3800	c0f85cfe13.exe	85
PID 3800 wrote to memory of 3344	3800	c0f85cfe13.exe	85
PID 3800 wrote to memory of 3344	3800	c0f85cfe13.exe	85
PID 3800 wrote to memory of 3344	3800	c0f85cfe13.exe	85
PID 3800 wrote to memory of 3344	3800	c0f85cfe13.exe	85
PID 3800 wrote to memory of 3344	3800	c0f85cfe13.exe	85
PID 3800 wrote to memory of 3344	3800	c0f85cfe13.exe	85
PID 3800 wrote to memory of 3344	3800	c0f85cfe13.exe	85
PID 4396 wrote to memory of 3808	4396	explorti.exe	86
PID 4396 wrote to memory of 3808	4396	explorti.exe	86
PID 4396 wrote to memory of 3808	4396	explorti.exe	86
PID 928 wrote to memory of 1556	928	196e2935bd.exe	87
PID 928 wrote to memory of 1556	928	196e2935bd.exe	87
PID 1556 wrote to memory of 1836	1556	firefox.exe	90
PID 1556 wrote to memory of 1836	1556	firefox.exe	90
PID 1556 wrote to memory of 1836	1556	firefox.exe	90
PID 1556 wrote to memory of 1836	1556	firefox.exe	90
PID 1556 wrote to memory of 1836	1556	firefox.exe	90
PID 1556 wrote to memory of 1836	1556	firefox.exe	90
PID 1556 wrote to memory of 1836	1556	firefox.exe	90
PID 1556 wrote to memory of 1836	1556	firefox.exe	90
PID 1556 wrote to memory of 1836	1556	firefox.exe	90
PID 1556 wrote to memory of 1836	1556	firefox.exe	90
PID 1556 wrote to memory of 1836	1556	firefox.exe	90
PID 1836 wrote to memory of 2132	1836	firefox.exe	91
PID 1836 wrote to memory of 2132	1836	firefox.exe	91
PID 1836 wrote to memory of 2132	1836	firefox.exe	91
PID 1836 wrote to memory of 2132	1836	firefox.exe	91
PID 1836 wrote to memory of 2132	1836	firefox.exe	91
PID 1836 wrote to memory of 2132	1836	firefox.exe	91
PID 1836 wrote to memory of 2132	1836	firefox.exe	91
PID 1836 wrote to memory of 2132	1836	firefox.exe	91
PID 1836 wrote to memory of 2132	1836	firefox.exe	91
PID 1836 wrote to memory of 2132	1836	firefox.exe	91
PID 1836 wrote to memory of 2132	1836	firefox.exe	91
PID 1836 wrote to memory of 2132	1836	firefox.exe	91
PID 1836 wrote to memory of 2132	1836	firefox.exe	91
PID 1836 wrote to memory of 2132	1836	firefox.exe	91
PID 1836 wrote to memory of 2132	1836	firefox.exe	91
PID 1836 wrote to memory of 2132	1836	firefox.exe	91
PID 1836 wrote to memory of 2132	1836	firefox.exe	91
PID 1836 wrote to memory of 2132	1836	firefox.exe	91
PID 1836 wrote to memory of 2132	1836	firefox.exe	91
PID 1836 wrote to memory of 2132	1836	firefox.exe	91
PID 1836 wrote to memory of 2132	1836	firefox.exe	91
PID 1836 wrote to memory of 2132	1836	firefox.exe	91
PID 1836 wrote to memory of 2132	1836	firefox.exe	91
PID 1836 wrote to memory of 2132	1836	firefox.exe	91
PID 1836 wrote to memory of 2132	1836	firefox.exe	91
PID 1836 wrote to memory of 2132	1836	firefox.exe	91
PID 1836 wrote to memory of 2132	1836	firefox.exe	91
PID 1836 wrote to memory of 2132	1836	firefox.exe	91
PID 1836 wrote to memory of 2132	1836	firefox.exe	91
PID 1836 wrote to memory of 2132	1836	firefox.exe	91

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\d485353a1ab1f0734f48b245a3e8c92d05e8550a9de2687dd68e3938c549ec7f.exe
"C:\Users\Admin\AppData\Local\Temp\d485353a1ab1f0734f48b245a3e8c92d05e8550a9de2687dd68e3938c549ec7f.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4592
- C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
  "C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4396
- - C:\Users\Admin\AppData\Local\Temp\1000036001\196e2935bd.exe
    "C:\Users\Admin\AppData\Local\Temp\1000036001\196e2935bd.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:928
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1556
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
        5⤵
        Checks processor information in registry
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1836
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1948 -parentBuildID 20240401114208 -prefsHandle 1864 -prefMapHandle 1860 -prefsLen 23678 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8aba09e3-4609-459c-8b94-75939c90c5f4} 1836 "\\.\pipe\gecko-crash-server-pipe.1836" gpu
        6⤵
        
        PID:2132
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2368 -parentBuildID 20240401114208 -prefsHandle 2256 -prefMapHandle 2252 -prefsLen 24598 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {366f8909-5440-4b83-8ac9-605efb11792c} 1836 "\\.\pipe\gecko-crash-server-pipe.1836" socket
        6⤵
        
        PID:464
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3200 -childID 1 -isForBrowser -prefsHandle 3208 -prefMapHandle 2964 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1344 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {031a5b2d-fa70-4be1-b79d-ebb9b6251287} 1836 "\\.\pipe\gecko-crash-server-pipe.1836" tab
        6⤵
        
        PID:4880
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3928 -childID 2 -isForBrowser -prefsHandle 3920 -prefMapHandle 3916 -prefsLen 29088 -prefMapSize 244658 -jsInitHandle 1344 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0cb7029b-0fb4-4044-ab0f-b374ad7428ec} 1836 "\\.\pipe\gecko-crash-server-pipe.1836" tab
        6⤵
        
        PID:4352
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4788 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4804 -prefMapHandle 4800 -prefsLen 29088 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7d97b3b0-d73e-4c51-910e-4419545ce0e1} 1836 "\\.\pipe\gecko-crash-server-pipe.1836" utility
        6⤵
        Checks processor information in registry
        
        PID:2252
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5524 -childID 3 -isForBrowser -prefsHandle 5484 -prefMapHandle 5476 -prefsLen 27182 -prefMapSize 244658 -jsInitHandle 1344 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7ca667f0-4792-4791-b222-7e717d00eb49} 1836 "\\.\pipe\gecko-crash-server-pipe.1836" tab
        6⤵
        
        PID:5972
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5848 -childID 4 -isForBrowser -prefsHandle 5516 -prefMapHandle 5712 -prefsLen 27182 -prefMapSize 244658 -jsInitHandle 1344 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cfbe8530-f54c-4b0b-b5c3-1781b0f3f737} 1836 "\\.\pipe\gecko-crash-server-pipe.1836" tab
        6⤵
        
        PID:3416
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6076 -childID 5 -isForBrowser -prefsHandle 5992 -prefMapHandle 6000 -prefsLen 27182 -prefMapSize 244658 -jsInitHandle 1344 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3afd2f56-5177-4090-84be-aac9df908346} 1836 "\\.\pipe\gecko-crash-server-pipe.1836" tab
        6⤵
        
        PID:5188
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6056 -childID 6 -isForBrowser -prefsHandle 6060 -prefMapHandle 6172 -prefsLen 27182 -prefMapSize 244658 -jsInitHandle 1344 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {423b27a2-870f-4ed5-bc6c-e122f112c4ad} 1836 "\\.\pipe\gecko-crash-server-pipe.1836" tab
        6⤵
        
        PID:4676
- - C:\Users\Admin\1000037002\c0f85cfe13.exe
    "C:\Users\Admin\1000037002\c0f85cfe13.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3800
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3344
- - C:\Users\Admin\AppData\Local\Temp\1000038001\273c835e64.exe
    "C:\Users\Admin\AppData\Local\Temp\1000038001\273c835e64.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3808

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5652

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5888

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

c0f85cfe13.exe

Path C:\Users\Admin\1000037002\c0f85cfe13.exe
Size 270KB
SHA256 c0e4e270579d7eba3deede367bf39813ef622948f872a3fc89f7468c53190f68
MD5 625055b4c1f6fb8bbee45e96534f3c3a
SHA1 1e024ae07ebb10edb7e2ae6dc69c6b597f84b2de
SHA512 28d6f4d6921c39577063e2de755ab1171b37268c8795226cd9a969072f70678f5dd027d5725cbe167072c74b3046334c6b613fd2c5bdd7a8b747e3760c7f6bd9
SSDEEP 6144:7wbjC0Ct8cHOK+zMcHr281p73qLrOJf2vsxb05iWYUdIyPUh3r5bAFYEO:8/C0CycuK+zMKp73qLmeCbQYGJUh7RAy
MD5 SHA1 SHA512 SSDEEP

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zgr882s2.default-release\activity-stream.discovery_stream.json
Size 36KB
SHA256 208ec191b4e43887eff67c02ca3345b351d992724c17ecbe1c0900006bda516f
MD5 d4f1e321b9e889ae23dc958aedf1d5ee
SHA1 07d119e9627e5686317cd85c2d83ae30bf38ddbd
SHA512 f7e9226ea327c5c8346b5813905bd1f571cd5ee391cd4ee5bfd9d07ae67dfe582d75250a55fa2bf0344b126746c000ca65b0ddf69e3211676a865413f12a3692
SSDEEP 768:JtEU6IByFE2twcrydOlQuvWh2aZW8T4BjLnfarssHxG:J+b4/wlvvWh2gW88BjLfartHQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

E449899591A9BC91DFBA673EC0589B51E541A88B

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zgr882s2.default-release\cache2\entries\E449899591A9BC91DFBA673EC0589B51E541A88B
Size 13KB
SHA256 91ad5a3762735446e765d477c301e2a481784f05657e7614819ac92af8b030b3
MD5 d995fbca451756ce5f09d356b667de18
SHA1 97fe7ce8f4358377e050ffe43537a47bdea3cf0a
SHA512 313261d5909624dd1b98907dfaa6f917f359e0b14aef6a2a3eb4c3fdf8ec23abd757c36efb8683182677fdbabaadc11f37e3c8ed67ea826743d6ca7775efe598
SSDEEP 384:H/Fu9fiGLm4pUNft2WlOX8lPLZZB7t0lpDIIG5b:IBi8mCUNft2WAX8tzB7eD8p
MD5 SHA1 SHA512 SSDEEP

Submit Download

explorti.exe

Path C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
Size 1.8MB
SHA256 d485353a1ab1f0734f48b245a3e8c92d05e8550a9de2687dd68e3938c549ec7f
MD5 6fa6e118ca3d3d34b1dcbd8385fc1d4d
SHA1 104067d48e7c4705929a94a61f7a062cd2f6c334
SHA512 b2c09ce3187fac4f3ca148197d14560dd1921a94524770f60a3758b8603fea4dfc05e7d64979b204650837738a49fc9ab41c1bd8515b721aef533894d1ad3e67
SSDEEP 49152:SwhlVkiyBNBXJbAJDI0Igkf6zbkZjdZhx:lrkzXJuDIxgm1dZv
MD5 SHA1 SHA512 SSDEEP

Submit Download

196e2935bd.exe

Path C:\Users\Admin\AppData\Local\Temp\1000036001\196e2935bd.exe
Size 3.1MB
SHA256 43d752d3bfde3831c4a731a491ff6012a4e2def4e4b3ae480c1ef90650ef11d4
MD5 b4f02dfb8291b96795163a6a224c0528
SHA1 b6f30aeb816e5c34e462597be5ff1ed476fead21
SHA512 5563691869781829f205640930df9b7fae37bd1e28c4fbe143c9c8e8ff38bb4b31906e808257f04f398eaa5cba3f51ad55b3e0e2d2bffaf5d3b06f3f39cd04b7
SSDEEP 49152:TC23mfsvqnCrf7RuSkwn71i5MKepmm6PER/KcZMAOtiTyzcGpVh3wbQsrw1b05:9MXC7Z19tHszAAist3yrEA
MD5 SHA1 SHA512 SSDEEP

Submit Download

273c835e64.exe

Path C:\Users\Admin\AppData\Local\Temp\1000038001\273c835e64.exe
Size 187KB
SHA256 37257ddb1a6f309a6e9d147b5fc2551a9cae3a0e52b191b18d9465bfcb5c18eb
MD5 278ee1426274818874556aa18fd02e3a
SHA1 185a2761330024dec52134df2c8388c461451acb
SHA512 07ec6759af5b9a00d8371b9fd9b723012dd0a1614cfcc7cd51975a004f69ffb90083735e9a871a2aa0e8d28799beac53a4748f55f4dd1e7495bc7388ebf4d6a0
SSDEEP 3072:/k9W0KFj5qj6o8KaxfE54HnnGqaKl+b2n8O43tIFmpKa:/kE/j5K62aOanGqCbAq3SFAKa
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 479KB
SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
MD5 09372174e83dbbf696ee732fd2e875bb
SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 13.8MB
SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
MD5 0a8747a2ac9ac08ae9508f36c6d75692
SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\AlternateServices.bin
Size 10KB
SHA256 687631e47cd0104ae5ca9f383db0f14a057950297cba07061aab25d0cafbeb21
MD5 8935a90db77750411b1c482b5b4a02f6
SHA1 bb96423d8df8413fee21c1ecd76ee2ea672f747a
SHA512 c83b2b6dd66ec3e4a4289ea5c78efff218e31a78f39a95f2256626aa5493fbed2141a54363e639df401ee5778142fdacbd52aa0ca2ab2ffef7eda9edc2b4b5f5
SSDEEP 24:9WuB1oYUTFsh2F3LFzvygu1xgRbV4pR5cOi/uhMZFKWS9htKUfiDC9Bzfi9P9x+i:3H5o29cO1WA7KUKDwBK913
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 95dcf5b16e3f1001bf116df2c93c451083e02a89c4be83bfb1e0f07932a63a75
MD5 a5606357cc3d76de3c3e3e59f7f5d07c
SHA1 23cbbef9e622ddb8f4736eab72710f0b508c080d
SHA512 ba77d4010fe277eeb1f68daa29fbe1238fcb66804e736a53d90bf44ce40c2806a1dd2ca29cc2f1197fce8c2e33c410a6ab7e1aa36680f1911a9ef3b9846b2780
SSDEEP 96:VBtSMF9ZbkW6QX0BBWhmlkPP/PrWZb/QLAOIFl66Joz0dzgClKtmSSM:1rvZboHWhgaPCt/66Joz0dzgCl6mSSM
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 b3bbc0bb4e3b6fd5318c5e671ab19afc201f0225d82de86c1559a3a9339d288d
MD5 68eb60abfefdb92f48913658ed3e4f90
SHA1 3f35bf131b3727103b4598b19dcb99a29d6cde3e
SHA512 b63b9ac1f745c99232e08c9d234ac7375c2773a2f78535d36fa3d8d9f9170837a95ff6fbeed30c2c9f728ef522bc10a3f4afd3ceb1d0c8c7f09c181ef1a661e3
SSDEEP 96:J1BtSMF9ZbkW6QX0BBWhmlkPP/PhxXnWi/QLAOIFl66Joz0dzgClKtmSSM:zrvZboHWhgaPDmk/66Joz0dzgCl6mSSM
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\datareporting\glean\db\data.safe.tmp
Size 16KB
SHA256 d68baa2844138e3fca66171a3580210746d56b05fa9881d962d4506f66e0d5b0
MD5 f9432283195e1767dac60c661ecc7853
SHA1 34b649139b44b6960d17e4b6f7071858112a47a2
SHA512 3d6b01afa0476b9fdec997a583abf2f682d12082baa974ead7acfcc7979cb24d43ed45bcd12b1ce939b8d82382de9772af70360617043778bf90298ea6583219
SSDEEP 384:s4jd6wx5YWDtlSCbEb3PKbo2tiPA/66JozQzgC1bM:RjdNuWDtlSCbEb/eSFmm
MD5 SHA1 SHA512 SSDEEP

Submit Download

2b4f070d-3d2f-4d65-aafd-2a57ad4bf24b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\datareporting\glean\pending_pings\2b4f070d-3d2f-4d65-aafd-2a57ad4bf24b
Size 671B
SHA256 a224976e3f1073567539d61f4c54fd959c4083fdcb1267231abffd3e77dd4b00
MD5 88650a0a487e963d636862ecd981cacb
SHA1 9be3c0bd0883bd53fe22cab79432c9cabfd07abb
SHA512 271955e4eb0c2fc370cca35487d6f978b0ebb22aca52d4a989bf4da05048b28d94fe64c39d9d1c8f12bdcc5012fb0551572b94c452de963c2a89987744e2806c
MD5 SHA1 SHA512

Submit Download

5a60f16b-0f66-46c6-a39d-de035decba51

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\datareporting\glean\pending_pings\5a60f16b-0f66-46c6-a39d-de035decba51
Size 25KB
SHA256 ed8e3c016dd91288532d87aaa642c557b38bcf49a3bea83f61dcf215fb480400
MD5 eed02b0e74143e61ac5d7ce3ec5982a9
SHA1 e11ab9c0b59d73dca4f71d15a25fc42b218c60b3
SHA512 acc47c994f86c7bd601864acc1f817b34866ce75ea33c61c43abbe2b787b3179b53d0c29225684f7623461e6ff7dbccb2618d676ccb5921e57730e1cac08858f
SSDEEP 192:wMJHJyvLs8pgyXgiNrYrTjA0yREwgoEi2nfb0Q4xc942w731u0XmM7IPj6svYVsd:wY0754eBuIQb7RjdAW574hl+N
MD5 SHA1 SHA512 SSDEEP

Submit Download

87713665-0a09-4e24-9793-a8721f091e01

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\datareporting\glean\pending_pings\87713665-0a09-4e24-9793-a8721f091e01
Size 982B
SHA256 6af3c2729417c773f70b23e5e365ba3eaab428a84e0b008a81258810958fb3ae
MD5 f0c8ec2f3926bc8394b63eec20cb7fb6
SHA1 159bc6d4f523aabf3e6146b48e5bc36bf2c06387
SHA512 adf9203b04b69b6b44915e70aa9279dabdbdabcad0b379e8f19daddec522f59c3843b2f78d8d8bb2db9238c937507419613b9f58d1fae755099482edbaf0a9e9
MD5 SHA1 SHA512

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Size 1.1MB
SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
MD5 842039753bf41fa5e11b3a1383061a87
SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Size 116B
SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
MD5 2a461e9eb87fd1955cea740a3444ee7a
SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Size 372B
SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
MD5 bf957ad58b55f64219ab3f793e374316
SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Size 17.8MB
SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
MD5 daf7ef3acccab478aaa7d6dc1c60f865
SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\prefs-1.js
Size 11KB
SHA256 cee13af9038b9a62d1aecb3e22d755b01ed3019eb6540f552402492a1c9bd0f5
MD5 5ed89eb992c9adc8a2313ccf3aafb459
SHA1 c36c11101ab8f86da7fb1a979f9dc7e3f59ab99a
SHA512 5cc9796eb46f0c5007bbab08e501e6c66811abd144576aeec58c4422db5b131e68cb973c3f8ade4d951cb75e84474197aeb7ef4ae9b4b52ea50ceb6ff430172f
SSDEEP 192:Y5nRR+fEQEvNfqtvu2McdDfMtSq58NaXHtZGBw8HOd:/ONgvFRRWSUtKwT
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\prefs-1.js
Size 12KB
SHA256 1eb7b3a22053743b406ac8d07842c71083d774f0c759b84426a1ecb211dd37d7
MD5 407cf246320e9b690c0a7f7d34d3f754
SHA1 e5a2d8c212dec12ad6982f659bed957437c89093
SHA512 724830bd34b057fc035ec1f9b7cf4d00d0cb7588b1a5f86b2945d8628d4ed46786ff073ef1af23141f3467997323730f3ef03cc46035eae4826de80ca184543a
SSDEEP 192:s5nRR+fEQEvNfqtvu2McdDfMtSq58NaXHtZaBw8HzJ0d:zONgvFRRWSUt2wY0
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\prefs-1.js
Size 15KB
SHA256 204ba00e2d6e7ae885ed0cc87e6ece6e897c68e43f70aa79809c09ede581e868
MD5 c5e97a2737c4f9669302ea287ed79d8d
SHA1 2a24654e693b07d0f011dd2c0c695af55ed41dfd
SHA512 69dffb6ab2790645204b2f0f45d9e907982f071796bcbafc31c128fc0251928544cc935120592f3f9cdd17f22b5bea62cef7a319e59b6aa4ab53b7dbf5909587
SSDEEP 192:smnRR+fiQEvNfqtvu2McdDfMtSq58NaXp+tZSiBw8HzJODXluj:gINgvFRRWSZtPwYwI
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\prefs.js
Size 11KB
SHA256 4c4a660248d7dfe79f28755c036b0099f0884bfa14296cd6782646d733540992
MD5 0b3b37ed91f2dcec65076bb97a818ce8
SHA1 d41ae88b9f690489d34f85ee23ce82430e60c59c
SHA512 5d82baee217b17e364f6985198cfe90cf4e75ff178e1721a3a3525e190cb7b5ce902aa0f5e999beef7b6bb855b66d4c40695efe65b74067761d337eb0b67d372
SSDEEP 192:Y5nRR+fEFsvNfqtvu2McdDfMtSq58NaXastZGBw8HOd:/PNgvFRRWSKtKwT
MD5 SHA1 SHA512 SSDEEP

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 1.3MB
SHA256 0a15a8f363cd3c72468b260c072325b0a0538d52286f4dbae6635e8282432ad5
MD5 bfb3a54cc6861b3bf54774205eb71dea
SHA1 bc539a18f4065407c8e4de1baa7a8ebe50935225
SHA512 b568fc5238ed1c0bdffc2ee43bb123c8fdcbfbc94fbec11a23f3af220a27ab660ec7ea202704beae4b2522e83766959a82eb9647a406f08b8fbc01939c65df5d
SSDEEP 6144:Y07rSs35333z3m3j3cTHb8h4jDbiN+HUjP0BKJUDiHdzyq8lC3j7C4ew8KUN3nek:YOg4jDqhjeNucW8w9fBvVpO
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/860-2627-0x0000000000EE0000-0x000000000139F000-memory.dmp

Download

memory/860-2621-0x0000000000EE0000-0x000000000139F000-memory.dmp

Download

memory/928-2596-0x0000000000670000-0x0000000001153000-memory.dmp

Download

memory/928-2610-0x0000000000670000-0x0000000001153000-memory.dmp

Download

memory/928-2630-0x0000000000670000-0x0000000001153000-memory.dmp

Download

memory/928-2628-0x0000000000670000-0x0000000001153000-memory.dmp

Download

memory/928-537-0x0000000000670000-0x0000000001153000-memory.dmp

Download

memory/928-1482-0x0000000000670000-0x0000000001153000-memory.dmp

Download

memory/928-2618-0x0000000000670000-0x0000000001153000-memory.dmp

Download

memory/928-431-0x0000000000670000-0x0000000001153000-memory.dmp

Download

memory/928-2616-0x0000000000670000-0x0000000001153000-memory.dmp

Download

memory/928-2614-0x0000000000670000-0x0000000001153000-memory.dmp

Download

memory/928-2612-0x0000000000670000-0x0000000001153000-memory.dmp

Download

memory/928-2591-0x0000000000670000-0x0000000001153000-memory.dmp

Download

memory/928-451-0x0000000000670000-0x0000000001153000-memory.dmp

Download

memory/928-456-0x0000000000670000-0x0000000001153000-memory.dmp

Download

memory/928-2608-0x0000000000670000-0x0000000001153000-memory.dmp

Download

memory/928-40-0x0000000000670000-0x0000000001153000-memory.dmp

Download

memory/3344-63-0x0000000000400000-0x0000000000643000-memory.dmp

Download

memory/3344-66-0x0000000000400000-0x0000000000643000-memory.dmp

Download

memory/3800-60-0x00000000003E0000-0x0000000000428000-memory.dmp

Download

memory/3808-83-0x0000000000910000-0x0000000000B53000-memory.dmp

Download

memory/3808-82-0x0000000000910000-0x0000000000B53000-memory.dmp

Download

memory/4396-862-0x0000000000EE0000-0x000000000139F000-memory.dmp

Download

memory/4396-457-0x0000000000EE0000-0x000000000139F000-memory.dmp

Download

memory/4396-18-0x0000000000EE0000-0x000000000139F000-memory.dmp

Download

memory/4396-2629-0x0000000000EE0000-0x000000000139F000-memory.dmp

Download

memory/4396-2620-0x0000000000EE0000-0x000000000139F000-memory.dmp

Download

memory/4396-427-0x0000000000EE0000-0x000000000139F000-memory.dmp

Download

memory/4396-20-0x0000000000EE0000-0x000000000139F000-memory.dmp

Download

memory/4396-21-0x0000000000EE0000-0x000000000139F000-memory.dmp

Download

memory/4396-2331-0x0000000000EE0000-0x000000000139F000-memory.dmp

Download

memory/4396-22-0x0000000000EE0000-0x000000000139F000-memory.dmp

Download

memory/4396-2595-0x0000000000EE0000-0x000000000139F000-memory.dmp

Download

memory/4396-2617-0x0000000000EE0000-0x000000000139F000-memory.dmp

Download

memory/4396-2602-0x0000000000EE0000-0x000000000139F000-memory.dmp

Download

memory/4396-437-0x0000000000EE0000-0x000000000139F000-memory.dmp

Download

memory/4396-2615-0x0000000000EE0000-0x000000000139F000-memory.dmp

Download

memory/4396-19-0x0000000000EE1000-0x0000000000F0F000-memory.dmp

Download

memory/4396-2609-0x0000000000EE0000-0x000000000139F000-memory.dmp

Download

memory/4396-450-0x0000000000EE0000-0x000000000139F000-memory.dmp

Download

memory/4396-2611-0x0000000000EE0000-0x000000000139F000-memory.dmp

Download

memory/4396-449-0x0000000000EE0000-0x000000000139F000-memory.dmp

Download

memory/4396-2613-0x0000000000EE0000-0x000000000139F000-memory.dmp

Download

memory/4396-446-0x0000000000EE0000-0x000000000139F000-memory.dmp

Download

memory/4592-0-0x00000000002D0000-0x000000000078F000-memory.dmp

Download

memory/4592-3-0x00000000002D0000-0x000000000078F000-memory.dmp

Download

memory/4592-2-0x00000000002D1000-0x00000000002FF000-memory.dmp

Download

memory/4592-5-0x00000000002D0000-0x000000000078F000-memory.dmp

Download

memory/4592-1-0x00000000770C6000-0x00000000770C8000-memory.dmp

Download

memory/4592-17-0x00000000002D0000-0x000000000078F000-memory.dmp

Download

memory/5652-397-0x0000000000EE0000-0x000000000139F000-memory.dmp

Download

memory/5652-364-0x0000000000EE0000-0x000000000139F000-memory.dmp

Download

memory/5888-2606-0x0000000000EE0000-0x000000000139F000-memory.dmp

Download

memory/5888-2604-0x0000000000EE0000-0x000000000139F000-memory.dmp

Download