amadey | 5b5bf668ffd5c6c115b5246fdbfca8028a5e829131badd1fa3202422afe8c73e

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
09/08/2024, 08:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5b5bf668ffd5c6c115b5246fdbfca8028a5e829131badd1fa3202422afe8c73e.exe
Size 1.9MB
Sample240809-kcj8dasdjd
SHA256 5b5bf668ffd5c6c115b5246fdbfca8028a5e829131badd1fa3202422afe8c73e
MD5 aa4aab8298312c5c17ba324505bf20ba
SHA1 ee67c0085a120b23f8340d8931743e2e218a2b78
SHA512 ad1305ca5b5f652ceda23f74bd4d4fea4e5dec627fab9611e225a3ec48d172f873bfd10b975b20ace62b267da468e3e0832e4fe82d696ce3da6ae9aab454ac0a
SSDEEP 24576:247AQ071P/0cnSWs9mYUtTZSuDSZEhlSyiDBb4h6nvJJssxBW1A49uPy4:29b7Z0cnnbYeSGOb4hasII0y
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey stealc 0657d1 default kora credential_access discovery evasion persistence stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

0657d1

http://185.215.113.19

Attributes

install_dir
0d8f5eb8a7
install_file
explorti.exe
strings_key
6c55a5f34bb433fbd933a168577b1838
url_paths
/Vi9leo/index.php

rc4.plain

Extracted

Family

stealc

Botnet

kora

http://185.215.113.100

Attributes

url_path
/e2b1563c6670f193.php

Extracted

Family

stealc

Botnet

default

http://185.215.113.24

Attributes

url_path
/e2b1563c6670f193.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Stealc
Stealc is an infostealer written in C++.
stealer stealc
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	5b5bf668ffd5c6c115b5246fdbfca8028a5e829131badd1fa3202422afe8c73e.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 8 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	5b5bf668ffd5c6c115b5246fdbfca8028a5e829131badd1fa3202422afe8c73e.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	5b5bf668ffd5c6c115b5246fdbfca8028a5e829131badd1fa3202422afe8c73e.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe

Executes dropped EXE 6 IoCs

pid	Process
2780	explorti.exe
3260	534c809a61.exe
1308	1622666777.exe
3624	4b486a023b.exe
4312	explorti.exe
5952	explorti.exe

Identifies Wine through registry keys 2 TTPs 4 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Wine	5b5bf668ffd5c6c115b5246fdbfca8028a5e829131badd1fa3202422afe8c73e.exe
Key opened	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Wine	explorti.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Windows\CurrentVersion\Run\534c809a61.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000036001\\534c809a61.exe"	explorti.exe

AutoIT Executable 14 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/3260-435-0x00000000004E0000-0x0000000000FCE000-memory.dmp	autoit_exe
behavioral2/memory/3260-451-0x00000000004E0000-0x0000000000FCE000-memory.dmp	autoit_exe
behavioral2/memory/3260-589-0x00000000004E0000-0x0000000000FCE000-memory.dmp	autoit_exe
behavioral2/memory/3260-1882-0x00000000004E0000-0x0000000000FCE000-memory.dmp	autoit_exe
behavioral2/memory/3260-2602-0x00000000004E0000-0x0000000000FCE000-memory.dmp	autoit_exe
behavioral2/memory/3260-2606-0x00000000004E0000-0x0000000000FCE000-memory.dmp	autoit_exe
behavioral2/memory/3260-2613-0x00000000004E0000-0x0000000000FCE000-memory.dmp	autoit_exe
behavioral2/memory/3260-2616-0x00000000004E0000-0x0000000000FCE000-memory.dmp	autoit_exe
behavioral2/memory/3260-2618-0x00000000004E0000-0x0000000000FCE000-memory.dmp	autoit_exe
behavioral2/memory/3260-2623-0x00000000004E0000-0x0000000000FCE000-memory.dmp	autoit_exe
behavioral2/memory/3260-2625-0x00000000004E0000-0x0000000000FCE000-memory.dmp	autoit_exe
behavioral2/memory/3260-2627-0x00000000004E0000-0x0000000000FCE000-memory.dmp	autoit_exe
behavioral2/memory/3260-2637-0x00000000004E0000-0x0000000000FCE000-memory.dmp	autoit_exe
behavioral2/memory/3260-2640-0x00000000004E0000-0x0000000000FCE000-memory.dmp	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 21 IoCs

pid	Process
3604	5b5bf668ffd5c6c115b5246fdbfca8028a5e829131badd1fa3202422afe8c73e.exe
2780	explorti.exe
3260	534c809a61.exe
1308	1622666777.exe
3260	534c809a61.exe
1308	1622666777.exe
3260	534c809a61.exe
3260	534c809a61.exe
4312	explorti.exe
3260	534c809a61.exe
3260	534c809a61.exe
3260	534c809a61.exe
3260	534c809a61.exe
3260	534c809a61.exe
3260	534c809a61.exe
5952	explorti.exe
3260	534c809a61.exe
3260	534c809a61.exe
3260	534c809a61.exe
3260	534c809a61.exe
3260	534c809a61.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\explorti.job	5b5bf668ffd5c6c115b5246fdbfca8028a5e829131badd1fa3202422afe8c73e.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3828	1308	WerFault.exe	85

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	534c809a61.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1622666777.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4b486a023b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5b5bf668ffd5c6c115b5246fdbfca8028a5e829131badd1fa3202422afe8c73e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorti.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3604	5b5bf668ffd5c6c115b5246fdbfca8028a5e829131badd1fa3202422afe8c73e.exe
3604	5b5bf668ffd5c6c115b5246fdbfca8028a5e829131badd1fa3202422afe8c73e.exe
2780	explorti.exe
2780	explorti.exe
4312	explorti.exe
4312	explorti.exe
5952	explorti.exe
5952	explorti.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2784	firefox.exe
Token: SeDebugPrivilege	2784	firefox.exe
Token: SeDebugPrivilege	2784	firefox.exe
Token: SeDebugPrivilege	2784	firefox.exe
Token: SeDebugPrivilege	2784	firefox.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3604	5b5bf668ffd5c6c115b5246fdbfca8028a5e829131badd1fa3202422afe8c73e.exe
3260	534c809a61.exe
3260	534c809a61.exe
3260	534c809a61.exe
3260	534c809a61.exe
3260	534c809a61.exe
3260	534c809a61.exe
3260	534c809a61.exe
2784	firefox.exe
2784	firefox.exe
2784	firefox.exe
2784	firefox.exe
2784	firefox.exe
2784	firefox.exe
2784	firefox.exe
2784	firefox.exe
2784	firefox.exe
2784	firefox.exe
2784	firefox.exe
2784	firefox.exe
2784	firefox.exe
2784	firefox.exe
2784	firefox.exe
2784	firefox.exe
2784	firefox.exe
2784	firefox.exe
2784	firefox.exe
2784	firefox.exe
2784	firefox.exe
3260	534c809a61.exe
3260	534c809a61.exe
3260	534c809a61.exe
3260	534c809a61.exe
3260	534c809a61.exe
3260	534c809a61.exe
3260	534c809a61.exe
3260	534c809a61.exe
3260	534c809a61.exe
3260	534c809a61.exe
3260	534c809a61.exe
3260	534c809a61.exe
3260	534c809a61.exe
3260	534c809a61.exe
3260	534c809a61.exe
3260	534c809a61.exe
3260	534c809a61.exe
3260	534c809a61.exe
3260	534c809a61.exe
3260	534c809a61.exe
3260	534c809a61.exe
3260	534c809a61.exe
3260	534c809a61.exe
3260	534c809a61.exe
3260	534c809a61.exe
3260	534c809a61.exe
3260	534c809a61.exe
3260	534c809a61.exe
3260	534c809a61.exe
3260	534c809a61.exe
3260	534c809a61.exe
3260	534c809a61.exe
3260	534c809a61.exe
3260	534c809a61.exe
3260	534c809a61.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3260	534c809a61.exe
3260	534c809a61.exe
3260	534c809a61.exe
3260	534c809a61.exe
3260	534c809a61.exe
3260	534c809a61.exe
3260	534c809a61.exe
3260	534c809a61.exe
3260	534c809a61.exe
3260	534c809a61.exe
3260	534c809a61.exe
3260	534c809a61.exe
3260	534c809a61.exe
3260	534c809a61.exe
3260	534c809a61.exe
3260	534c809a61.exe
3260	534c809a61.exe
3260	534c809a61.exe
3260	534c809a61.exe
3260	534c809a61.exe
3260	534c809a61.exe
3260	534c809a61.exe
3260	534c809a61.exe
3260	534c809a61.exe
3260	534c809a61.exe
3260	534c809a61.exe
3260	534c809a61.exe
3260	534c809a61.exe
3260	534c809a61.exe
3260	534c809a61.exe
3260	534c809a61.exe
3260	534c809a61.exe
3260	534c809a61.exe
3260	534c809a61.exe
3260	534c809a61.exe
3260	534c809a61.exe
3260	534c809a61.exe
3260	534c809a61.exe
3260	534c809a61.exe
3260	534c809a61.exe
3260	534c809a61.exe
3260	534c809a61.exe
3260	534c809a61.exe
3260	534c809a61.exe
3260	534c809a61.exe
3260	534c809a61.exe
3260	534c809a61.exe
3260	534c809a61.exe
3260	534c809a61.exe
3260	534c809a61.exe
3260	534c809a61.exe
3260	534c809a61.exe
3260	534c809a61.exe
3260	534c809a61.exe
3260	534c809a61.exe
3260	534c809a61.exe
3260	534c809a61.exe
3260	534c809a61.exe
3260	534c809a61.exe
3260	534c809a61.exe
3260	534c809a61.exe
3260	534c809a61.exe
3260	534c809a61.exe
3260	534c809a61.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3260	534c809a61.exe
1308	1622666777.exe
2784	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3604 wrote to memory of 2780	3604	5b5bf668ffd5c6c115b5246fdbfca8028a5e829131badd1fa3202422afe8c73e.exe	82
PID 3604 wrote to memory of 2780	3604	5b5bf668ffd5c6c115b5246fdbfca8028a5e829131badd1fa3202422afe8c73e.exe	82
PID 3604 wrote to memory of 2780	3604	5b5bf668ffd5c6c115b5246fdbfca8028a5e829131badd1fa3202422afe8c73e.exe	82
PID 2780 wrote to memory of 3260	2780	explorti.exe	84
PID 2780 wrote to memory of 3260	2780	explorti.exe	84
PID 2780 wrote to memory of 3260	2780	explorti.exe	84
PID 2780 wrote to memory of 1308	2780	explorti.exe	85
PID 2780 wrote to memory of 1308	2780	explorti.exe	85
PID 2780 wrote to memory of 1308	2780	explorti.exe	85
PID 3260 wrote to memory of 3556	3260	534c809a61.exe	86
PID 3260 wrote to memory of 3556	3260	534c809a61.exe	86
PID 2780 wrote to memory of 3624	2780	explorti.exe	88
PID 2780 wrote to memory of 3624	2780	explorti.exe	88
PID 2780 wrote to memory of 3624	2780	explorti.exe	88
PID 3556 wrote to memory of 2784	3556	firefox.exe	90
PID 3556 wrote to memory of 2784	3556	firefox.exe	90
PID 3556 wrote to memory of 2784	3556	firefox.exe	90
PID 3556 wrote to memory of 2784	3556	firefox.exe	90
PID 3556 wrote to memory of 2784	3556	firefox.exe	90
PID 3556 wrote to memory of 2784	3556	firefox.exe	90
PID 3556 wrote to memory of 2784	3556	firefox.exe	90
PID 3556 wrote to memory of 2784	3556	firefox.exe	90
PID 3556 wrote to memory of 2784	3556	firefox.exe	90
PID 3556 wrote to memory of 2784	3556	firefox.exe	90
PID 3556 wrote to memory of 2784	3556	firefox.exe	90
PID 2784 wrote to memory of 1648	2784	firefox.exe	91
PID 2784 wrote to memory of 1648	2784	firefox.exe	91
PID 2784 wrote to memory of 1648	2784	firefox.exe	91
PID 2784 wrote to memory of 1648	2784	firefox.exe	91
PID 2784 wrote to memory of 1648	2784	firefox.exe	91
PID 2784 wrote to memory of 1648	2784	firefox.exe	91
PID 2784 wrote to memory of 1648	2784	firefox.exe	91
PID 2784 wrote to memory of 1648	2784	firefox.exe	91
PID 2784 wrote to memory of 1648	2784	firefox.exe	91
PID 2784 wrote to memory of 1648	2784	firefox.exe	91
PID 2784 wrote to memory of 1648	2784	firefox.exe	91
PID 2784 wrote to memory of 1648	2784	firefox.exe	91
PID 2784 wrote to memory of 1648	2784	firefox.exe	91
PID 2784 wrote to memory of 1648	2784	firefox.exe	91
PID 2784 wrote to memory of 1648	2784	firefox.exe	91
PID 2784 wrote to memory of 1648	2784	firefox.exe	91
PID 2784 wrote to memory of 1648	2784	firefox.exe	91
PID 2784 wrote to memory of 1648	2784	firefox.exe	91
PID 2784 wrote to memory of 1648	2784	firefox.exe	91
PID 2784 wrote to memory of 1648	2784	firefox.exe	91
PID 2784 wrote to memory of 1648	2784	firefox.exe	91
PID 2784 wrote to memory of 1648	2784	firefox.exe	91
PID 2784 wrote to memory of 1648	2784	firefox.exe	91
PID 2784 wrote to memory of 1648	2784	firefox.exe	91
PID 2784 wrote to memory of 1648	2784	firefox.exe	91
PID 2784 wrote to memory of 1648	2784	firefox.exe	91
PID 2784 wrote to memory of 1648	2784	firefox.exe	91
PID 2784 wrote to memory of 1648	2784	firefox.exe	91
PID 2784 wrote to memory of 1648	2784	firefox.exe	91
PID 2784 wrote to memory of 1648	2784	firefox.exe	91
PID 2784 wrote to memory of 1648	2784	firefox.exe	91
PID 2784 wrote to memory of 1648	2784	firefox.exe	91
PID 2784 wrote to memory of 1648	2784	firefox.exe	91
PID 2784 wrote to memory of 1648	2784	firefox.exe	91
PID 2784 wrote to memory of 1648	2784	firefox.exe	91
PID 2784 wrote to memory of 1648	2784	firefox.exe	91
PID 2784 wrote to memory of 1648	2784	firefox.exe	91
PID 2784 wrote to memory of 1648	2784	firefox.exe	91
PID 2784 wrote to memory of 1648	2784	firefox.exe	91

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\5b5bf668ffd5c6c115b5246fdbfca8028a5e829131badd1fa3202422afe8c73e.exe
"C:\Users\Admin\AppData\Local\Temp\5b5bf668ffd5c6c115b5246fdbfca8028a5e829131badd1fa3202422afe8c73e.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3604
- C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
  "C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2780
- - C:\Users\Admin\AppData\Local\Temp\1000036001\534c809a61.exe
    "C:\Users\Admin\AppData\Local\Temp\1000036001\534c809a61.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3260
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3556
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
        5⤵
        Checks processor information in registry
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2784
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1948 -parentBuildID 20240401114208 -prefsHandle 1876 -prefMapHandle 1868 -prefsLen 23678 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {99b66fb1-8da1-41e3-9001-7947a90c5f8d} 2784 "\\.\pipe\gecko-crash-server-pipe.2784" gpu
        6⤵
        
        PID:1648
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2280 -parentBuildID 20240401114208 -prefsHandle 2352 -prefMapHandle 2348 -prefsLen 24598 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a9d04d41-cddc-45a5-bedd-622763062bcf} 2784 "\\.\pipe\gecko-crash-server-pipe.2784" socket
        6⤵
        
        PID:4036
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2836 -childID 1 -isForBrowser -prefsHandle 3148 -prefMapHandle 3152 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1396 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {80b98677-e407-4182-9769-8621b226235f} 2784 "\\.\pipe\gecko-crash-server-pipe.2784" tab
        6⤵
        
        PID:1860
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1168 -childID 2 -isForBrowser -prefsHandle 3800 -prefMapHandle 3828 -prefsLen 29088 -prefMapSize 244658 -jsInitHandle 1396 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {22ac2723-f9ff-45c9-af2b-8719aec73b70} 2784 "\\.\pipe\gecko-crash-server-pipe.2784" tab
        6⤵
        
        PID:3812
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4644 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 2764 -prefMapHandle 2760 -prefsLen 29088 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d60a5811-cdd1-47ef-9f1b-3fda36a666ec} 2784 "\\.\pipe\gecko-crash-server-pipe.2784" utility
        6⤵
        Checks processor information in registry
        
        PID:1256
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5520 -childID 3 -isForBrowser -prefsHandle 5512 -prefMapHandle 5508 -prefsLen 27182 -prefMapSize 244658 -jsInitHandle 1396 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {47d4446a-220d-402a-b024-21bcdf34508f} 2784 "\\.\pipe\gecko-crash-server-pipe.2784" tab
        6⤵
        
        PID:6076
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5840 -childID 4 -isForBrowser -prefsHandle 5844 -prefMapHandle 5832 -prefsLen 27182 -prefMapSize 244658 -jsInitHandle 1396 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7694797f-20f7-4b3b-959b-7b9cf7abe2b1} 2784 "\\.\pipe\gecko-crash-server-pipe.2784" tab
        6⤵
        
        PID:3944
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5792 -childID 5 -isForBrowser -prefsHandle 5984 -prefMapHandle 5988 -prefsLen 27182 -prefMapSize 244658 -jsInitHandle 1396 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1d360e70-9efd-48b3-86a4-10ecdb3bdd48} 2784 "\\.\pipe\gecko-crash-server-pipe.2784" tab
        6⤵
        
        PID:1636
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6060 -childID 6 -isForBrowser -prefsHandle 5984 -prefMapHandle 5988 -prefsLen 27182 -prefMapSize 244658 -jsInitHandle 1396 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2382ee43-d6d6-4502-a62a-75964e255b7c} 2784 "\\.\pipe\gecko-crash-server-pipe.2784" tab
        6⤵
        
        PID:2864
- - C:\Users\Admin\1000037002\1622666777.exe
    "C:\Users\Admin\1000037002\1622666777.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1308
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1308 -s 1452
      4⤵
      Program crash
      PID:3828
- - C:\Users\Admin\AppData\Local\Temp\1000038001\4b486a023b.exe
    "C:\Users\Admin\AppData\Local\Temp\1000038001\4b486a023b.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1308 -ip 1308
1⤵
PID:832

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4312

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1622666777.exe

Path C:\Users\Admin\1000037002\1622666777.exe
Size 2.5MB
SHA256 1f4373f4a1d1655f2e52ff75ad9c9805e6c0332126f8d561b79dec41088e1065
MD5 14be4db1d97b50efc974bc352bf326e2
SHA1 ced26748d9c6f58d06c5113d14f2635b8ff95c3c
SHA512 478ddd9f148fb1be611c1620a2ffd781fc037cdd6f980ff5b89bfe8c2d1967a3f3b37c4fe184cc82863f88d682e55046595d027c8ef3d996a57548aaa8d08284
SSDEEP 49152:ItwTvIPE53mw6mLzcxx9BHYHtiYFX/9HM8nhmA8vhMrsWjqK0iQ:I2TX3V6mExx9uNiIHhZqK0i
MD5 SHA1 SHA512 SSDEEP

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5vinb3pw.default-release\activity-stream.discovery_stream.json
Size 26KB
SHA256 75d53ed0696c076bbd0c87f5e33e9b552beab92297824a97f6fb5ffa68e9ebca
MD5 e743fe201a0dc12ec8804d852ee33af2
SHA1 a048fe357ecdab793251b785499ab973d1422ceb
SHA512 88c148329ae16180ac24800f855b5fe7e47f609ee89443db55f540ec39716b34df60a5b98b86483b6f98ec55d72188a041ecee982a0f4e3334b2b63add9327ad
SSDEEP 384:1yauZz55CLtWXjQzeWns4C0fYSocBPMl5Uj6f8y+u0hr40mcdAY8jUyWNnRi81qD:1ydZLCoMrQLZ60Xqr3lWWiEqD
MD5 SHA1 SHA512 SSDEEP

Submit Download

activity-stream.discovery_stream.json.tmp

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5vinb3pw.default-release\activity-stream.discovery_stream.json.tmp
Size 21KB
SHA256 0762dd2fe6053eba0b236a44c82f05a087bb40d24c31a8e94d915c2e6782c2e7
MD5 c2f08eb6df317ce4fac167413443453e
SHA1 fbe43cbe53d13cc2bec285bc066216819951838e
SHA512 b8f606739e08ebae458c4087a842142a2b5fd65679c92dadeaefbdf38372905d727f31a1679e8766a1ebe639bbb618dc9a8a5735f9d730696c96d5a5a259dc2b
SSDEEP 384:Nyau8sx/sxkFpRmYDbqQ3zRUJb195oXOY8gYZ+lMf49yOPcbCYYjlGCaqg5:Nydfi+FpRbVyUrqh4A+RGCaZ5
MD5 SHA1 SHA512 SSDEEP

Submit Download

E449899591A9BC91DFBA673EC0589B51E541A88B

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5vinb3pw.default-release\cache2\entries\E449899591A9BC91DFBA673EC0589B51E541A88B
Size 13KB
SHA256 892c27ae6c55630f3343667853815f88541d2be1f6a20140593e937b5e567f66
MD5 b6842c362b74cd331a944d5325dfaede
SHA1 712485fd6a285fbb734f6d4bf6a195b4dd3adad1
SHA512 11084a31b09261da88a8884e5d6770316e347e04c9bcdae2e4c8333b364c70f5840bae361d23abd66c6f0cf70b2fecf0feaaf38800067db18a0837018977bbe4
SSDEEP 384:H/Fu9fiGLm4pU0ft2WlOX8lPLZZB7t0lpDII7qN:IBi8mCU0ft2WAX8tzB7eD8R
MD5 SHA1 SHA512 SSDEEP

Submit Download

explorti.exe

Path C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
Size 1.9MB
SHA256 5b5bf668ffd5c6c115b5246fdbfca8028a5e829131badd1fa3202422afe8c73e
MD5 aa4aab8298312c5c17ba324505bf20ba
SHA1 ee67c0085a120b23f8340d8931743e2e218a2b78
SHA512 ad1305ca5b5f652ceda23f74bd4d4fea4e5dec627fab9611e225a3ec48d172f873bfd10b975b20ace62b267da468e3e0832e4fe82d696ce3da6ae9aab454ac0a
SSDEEP 24576:247AQ071P/0cnSWs9mYUtTZSuDSZEhlSyiDBb4h6nvJJssxBW1A49uPy4:29b7Z0cnnbYeSGOb4hasII0y
MD5 SHA1 SHA512 SSDEEP

Submit Download

534c809a61.exe

Path C:\Users\Admin\AppData\Local\Temp\1000036001\534c809a61.exe
Size 3.1MB
SHA256 535e1bcef23130848bcd5c8ec79a3a6e14e7a40d47d53efccba708779321c2aa
MD5 d29113e0fc35efd62159aed75d283948
SHA1 51400c04ca4f0b9e92fd7d2f6b2278f241924b56
SHA512 3f36eb85765a15fa0370cfe5f1c6c21a4b24fbd2088ea6de3a6cbc97e14b4d8c518d881bddd72c39141dc0ffe36b1da9f2219eba88edb65cdb7b596d35678aa7
SSDEEP 49152:ZubM2XmJYVmDCAyNHH2AT5O5hLs9UQhP/ZvqwC0+yX+Rewsn+HE:ZlufHWAT5SU7hH4Plmk0/
MD5 SHA1 SHA512 SSDEEP

Submit Download

4b486a023b.exe

Path C:\Users\Admin\AppData\Local\Temp\1000038001\4b486a023b.exe
Size 187KB
SHA256 37257ddb1a6f309a6e9d147b5fc2551a9cae3a0e52b191b18d9465bfcb5c18eb
MD5 278ee1426274818874556aa18fd02e3a
SHA1 185a2761330024dec52134df2c8388c461451acb
SHA512 07ec6759af5b9a00d8371b9fd9b723012dd0a1614cfcc7cd51975a004f69ffb90083735e9a871a2aa0e8d28799beac53a4748f55f4dd1e7495bc7388ebf4d6a0
SSDEEP 3072:/k9W0KFj5qj6o8KaxfE54HnnGqaKl+b2n8O43tIFmpKa:/kE/j5K62aOanGqCbAq3SFAKa
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 479KB
SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
MD5 09372174e83dbbf696ee732fd2e875bb
SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 13.8MB
SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
MD5 0a8747a2ac9ac08ae9508f36c6d75692
SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5vinb3pw.default-release\AlternateServices.bin
Size 16KB
SHA256 8fdf51aa6236e31ad33961a66ea32c0216e8f35a5cb0e03182173854ad56accf
MD5 a6e15ac8f9498b7aad087fa7812e9156
SHA1 e9447db007bb2525fe9f81b406c0d9e6384632b7
SHA512 e644de0eb46839791e98d557ba0b788c1274424a85430856bcfb5de29e4b1723a8c28646f75e424d7c3a9d057a48e45004aaa60ecafef40d390c4bd32ed90330
SSDEEP 48:69cOtf75okn7WA7KUtvSwbvO1duvbCeFg8v3F9/vWOPvPx91:Mf75oknrjNrj2dc2eFgKVZjX
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5vinb3pw.default-release\AlternateServices.bin
Size 10KB
SHA256 03d4fe42a831d8b36b45756d318ed582b38480800d05933b8b5a6c792420a386
MD5 b3b2751a4b685b648a0a33f34f804033
SHA1 4f345978194bd5f3ef182cbb586562a33c86659c
SHA512 3e721cbbd0051be6738960718a1b4ec095cc540ba2f37f33cf807e5e439d3dd0f5be840e9ed1d05b9823ebd9328e180969c0dae0fa9f62e878f53326c3630001
SSDEEP 24:kkuB1oaL5lpR5cObBL58Fsh2F3LFMBL5pgu1xgRbaBL53+uhMZaBL5UWS9htKmBw:G9cOtf75okniWA7KUuvJwBuvO1duv
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5vinb3pw.default-release\datareporting\glean\db\data.safe.tmp
Size 16KB
SHA256 909acaed2b2628f03b9a5d75a80d823c93d6e127c410a6ce31652b7d3df5c14b
MD5 c71b469e86e68701d9e6c4da09709629
SHA1 16993625d1fdbadf55341b1b74400ac0f4169366
SHA512 ec2289b26c1b886fa770c8c21daa3a9513c75937ff418975de01009547780c1596c74fa486a7f7b08bd0236f586b6bfd4ffcac981764027cb07d48b149bacfff
SSDEEP 384:EX/66JozQzgC1bGtBSKYGDUZvibGbE/bo8ofPh:Eym2bFDUZvibGbEjs5
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5vinb3pw.default-release\datareporting\glean\db\data.safe.tmp
Size 16KB
SHA256 59bfbe6b70bd4869a685b3e815452b7dfeb7bf771e1d5e26d0a4569405a728e0
MD5 a9584d2654aa9cbfe443645e1cb11fb3
SHA1 e8822cdfb57347ffcae60771c28f210a96c65b73
SHA512 08b90aaa3b8fbd9d3a194cf8629a9f2e1e7f54bcf69e06c34e401301b9475ff2487e427eb37a9db40b7c8c64a1f3b40b67b55503c2a1329332fb8e35e1a597ac
SSDEEP 384:gbo8yfPztBSKYGDUZvibGbElX/66JozQzgC1bM:IGxbFDUZvibGbElymm
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5vinb3pw.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 b4a45203f3de89208e41e6c28e6625c5729b84bd6eeb995590e1963acea95941
MD5 1cc7e5540702851d6f7d7fe5516be441
SHA1 e7728453cc56906c5b0adb824fd049413d3172cc
SHA512 b14599f1c344c45d9e4148db1e5ea564c26ee7cf75bb913058f5e825ea241af0ec85632a6fe8af287ce501ad7a37e5bc7922663ea617d42dec0e5648d292e8a8
SSDEEP 96:VBvSMF9ZbkW6QX0BBchmfyPP/PrWZqkQegFXFl66Joz0dzgClKtmSSM:3rvZboHcha0PCOX/66Joz0dzgCl6mSSM
MD5 SHA1 SHA512 SSDEEP

Submit Download

1c05608f-ea00-471d-8288-2d3662cc811e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5vinb3pw.default-release\datareporting\glean\pending_pings\1c05608f-ea00-471d-8288-2d3662cc811e
Size 982B
SHA256 baaede5959ab959ff52a7cedd4306c2d379f6a94724d1576f5d6dd380ac21d35
MD5 5845d0c1d12b087e3734f16b00167004
SHA1 7cac2941f1a1366e816d15f65fab3eec414efb96
SHA512 a2fa24fb921d3898a7a4c38eaa5970cfc51342502ad8ebe16dd4007821c93d34596ec1ac9698963a084f4ea347db2ef34766397dadf51c51e8001a2136d8910e
MD5 SHA1 SHA512

Submit Download

50f0670b-1548-4e35-b942-63bc973d414d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5vinb3pw.default-release\datareporting\glean\pending_pings\50f0670b-1548-4e35-b942-63bc973d414d
Size 25KB
SHA256 41eb50dd700527bd4ee21341aea010b547aa60f7ad1b59d2197dbbf27180a99b
MD5 c66369dad7cab6f51e409af0656605b7
SHA1 f8061347b3cf204a3a14f15542ac540cbf0707f1
SHA512 fec466f61854b8cd829791e5d413de478e99c812643f7f6d2cc4e824492e4b336edef8a8af45613590193398e2b164a4c3c58f6f897d86bd7347a33f050b8cd4
SSDEEP 192:+WFaGsVybw3spZaIp4c38vLzrMh9q8iEuZEFMUmBij8CuHu5kTw/Bd5fCyDHo6R5:+WpOZHQ1aIe0KtSRmbrEV56fnU/
MD5 SHA1 SHA512 SSDEEP

Submit Download

d02d8531-fe30-47cc-bd5d-56156fe63921

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5vinb3pw.default-release\datareporting\glean\pending_pings\d02d8531-fe30-47cc-bd5d-56156fe63921
Size 671B
SHA256 e68902f6eeabb8be97c37265304a60bfacf17b640f7f172eb1d48a843fb3ea3a
MD5 90b1bb720044e0070db700f74d7e1ed2
SHA1 e3135a37f867fdebe33a48da99e4c215bae35b57
SHA512 550cf26bf96d6eb2d49a5f41673d496decd29c6029075152c449f37b998aeb57940aba845790c75d9d051ae11fa9dceac6ecb95e59962e061e8e41306968c588
MD5 SHA1 SHA512

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5vinb3pw.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Size 1.1MB
SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
MD5 842039753bf41fa5e11b3a1383061a87
SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5vinb3pw.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Size 116B
SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
MD5 2a461e9eb87fd1955cea740a3444ee7a
SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5vinb3pw.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Size 372B
SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
MD5 bf957ad58b55f64219ab3f793e374316
SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5vinb3pw.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Size 17.8MB
SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
MD5 daf7ef3acccab478aaa7d6dc1c60f865
SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5vinb3pw.default-release\prefs-1.js
Size 12KB
SHA256 199f8d9ba33cac2e451df7316375e31e6b8265bc5551294d8e43c459f4d8342b
MD5 8a2e683e273d66d82c7e2fc1cd509b14
SHA1 f0bb22a392b618726f98dbb5c27c2996568a20fd
SHA512 def00ffa1004780060f12dc2bb7d99b8b1cbc6fd29e31b330a37ecc3a4fb7c6486660e5810362f2083533361e4630992b920d49fd64f8bd68bc9d67766305f76
SSDEEP 192:G25n4R9fwWF4lfRtvgQddrcdA2f3t6BQHre60AxaXiJVel1XbBw8Hu:GRal7vDWe2l6BQL9bvVeBwD
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5vinb3pw.default-release\prefs.js
Size 10KB
SHA256 8b903082f47846d784020643983b9cb59192f12759c2a5cbef315cad3be629b4
MD5 279074472b78d89918dc554a1253ba9a
SHA1 53dcebe2dc98f46559aad5e55710b61a398b7443
SHA512 b619c0da82d313c867b537b07753a24ca3644bdc53a3eb7edb224412242b00b6fc45355784b2ca08189c3213b357462b054fe0ddd55c56a7b73a861ee2c1059b
SSDEEP 192:r5n4R9fwSBacb1Rf9tv2xCJ32cdx8TfOtb5xK0gGaXXIVel1X+Bw8V3:AAe1R3vkQj0TUtIEVe4wE
MD5 SHA1 SHA512 SSDEEP

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5vinb3pw.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 1.3MB
SHA256 22804eab702adab94bf6cde5c5b1d9beaf0fe7316910f1224b56d1412515c735
MD5 2f12e0a329b85a8d65041311f4ac7f3a
SHA1 f19c456ad3527ca42979ac5b61ed06f30404aa24
SHA512 ace4f1eb811b2f3615077273939b240f58fbe72e31657cbc19193defeda78f209bee407824d01cd0eb9265cfb506af2b43ec0415c4fae31926a5524878f8c3c3
SSDEEP 6144:I7rSAx3S393z3m3ITHf6u9AVD34njM5qUWAQUtUHpmtMSfCKzyXiEoqBg9AZmz00:jAVD3W0qJABm2x5rqCaKD6HY
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1308-424-0x0000000000400000-0x0000000000FED000-memory.dmp

Download

memory/1308-56-0x0000000000400000-0x0000000000FED000-memory.dmp

Download

memory/2780-448-0x0000000000BC0000-0x0000000001091000-memory.dmp

Download

memory/2780-1078-0x0000000000BC0000-0x0000000001091000-memory.dmp

Download

memory/2780-436-0x0000000000BC0000-0x0000000001091000-memory.dmp

Download

memory/2780-2639-0x0000000000BC0000-0x0000000001091000-memory.dmp

Download

memory/2780-447-0x0000000000BC0000-0x0000000001091000-memory.dmp

Download

memory/2780-2636-0x0000000000BC0000-0x0000000001091000-memory.dmp

Download

memory/2780-2626-0x0000000000BC0000-0x0000000001091000-memory.dmp

Download

memory/2780-456-0x0000000000BC0000-0x0000000001091000-memory.dmp

Download

memory/2780-2624-0x0000000000BC0000-0x0000000001091000-memory.dmp

Download

memory/2780-16-0x0000000000BC0000-0x0000000001091000-memory.dmp

Download

memory/2780-19-0x0000000000BC1000-0x0000000000BEF000-memory.dmp

Download

memory/2780-2622-0x0000000000BC0000-0x0000000001091000-memory.dmp

Download

memory/2780-20-0x0000000000BC0000-0x0000000001091000-memory.dmp

Download

memory/2780-2617-0x0000000000BC0000-0x0000000001091000-memory.dmp

Download

memory/2780-21-0x0000000000BC0000-0x0000000001091000-memory.dmp

Download

memory/2780-2615-0x0000000000BC0000-0x0000000001091000-memory.dmp

Download

memory/2780-2611-0x0000000000BC0000-0x0000000001091000-memory.dmp

Download

memory/2780-2603-0x0000000000BC0000-0x0000000001091000-memory.dmp

Download

memory/2780-2601-0x0000000000BC0000-0x0000000001091000-memory.dmp

Download

memory/2780-422-0x0000000000BC0000-0x0000000001091000-memory.dmp

Download

memory/3260-1882-0x00000000004E0000-0x0000000000FCE000-memory.dmp

Download

memory/3260-2606-0x00000000004E0000-0x0000000000FCE000-memory.dmp

Download

memory/3260-2640-0x00000000004E0000-0x0000000000FCE000-memory.dmp

Download

memory/3260-435-0x00000000004E0000-0x0000000000FCE000-memory.dmp

Download

memory/3260-39-0x00000000004E0000-0x0000000000FCE000-memory.dmp

Download

memory/3260-2602-0x00000000004E0000-0x0000000000FCE000-memory.dmp

Download

memory/3260-2637-0x00000000004E0000-0x0000000000FCE000-memory.dmp

Download

memory/3260-2623-0x00000000004E0000-0x0000000000FCE000-memory.dmp

Download

memory/3260-2627-0x00000000004E0000-0x0000000000FCE000-memory.dmp

Download

memory/3260-451-0x00000000004E0000-0x0000000000FCE000-memory.dmp

Download

memory/3260-2613-0x00000000004E0000-0x0000000000FCE000-memory.dmp

Download

memory/3260-589-0x00000000004E0000-0x0000000000FCE000-memory.dmp

Download

memory/3260-2616-0x00000000004E0000-0x0000000000FCE000-memory.dmp

Download

memory/3260-2625-0x00000000004E0000-0x0000000000FCE000-memory.dmp

Download

memory/3260-2618-0x00000000004E0000-0x0000000000FCE000-memory.dmp

Download

memory/3604-4-0x0000000000600000-0x0000000000AD1000-memory.dmp

Download

memory/3604-0-0x0000000000600000-0x0000000000AD1000-memory.dmp

Download

memory/3604-18-0x0000000000600000-0x0000000000AD1000-memory.dmp

Download

memory/3604-1-0x0000000077E66000-0x0000000077E68000-memory.dmp

Download

memory/3604-3-0x0000000000600000-0x0000000000AD1000-memory.dmp

Download

memory/3604-2-0x0000000000601000-0x000000000062F000-memory.dmp

Download

memory/3624-80-0x0000000000A40000-0x0000000000C83000-memory.dmp

Download

memory/3624-72-0x0000000000A40000-0x0000000000C83000-memory.dmp

Download

memory/4312-814-0x0000000000BC0000-0x0000000001091000-memory.dmp

Download

memory/4312-743-0x0000000000BC0000-0x0000000001091000-memory.dmp

Download

memory/5952-2621-0x0000000000BC0000-0x0000000001091000-memory.dmp

Download

memory/5952-2620-0x0000000000BC0000-0x0000000001091000-memory.dmp

Download