amadey | a5bcb19eef5f5506fbd70b2e6ae31409d8e1affd86b2a002cdd09c262ee6bb08

Analysis

max time kernel
150s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
10/08/2024, 20:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a5bcb19eef5f5506fbd70b2e6ae31409d8e1affd86b2a002cdd09c262ee6bb08.exe
Size 1.8MB
Sample240810-ywph4azend
SHA256 a5bcb19eef5f5506fbd70b2e6ae31409d8e1affd86b2a002cdd09c262ee6bb08
MD5 f19c5b8c97857169bbfc5aea1e12d2fa
SHA1 6895c85c50e0214bb4b144067edd829a70cc5dcd
SHA512 e33440c55909fe053745c71220701663897eae4f4e57c1d80d02168cd93e15934643fba20cdd5455702c57f4c3474def52b72a13c65f51addb3a680deb21b0cb
SSDEEP 49152:CsV1VaoB9emiCynu3qskp3n96gD1nCcqn6wXclixlffFNN:CsV1FeXKqD96glC/n6RqFNN
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey stealc 0657d1 kora credential_access discovery evasion persistence stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

0657d1

http://185.215.113.19

Attributes

install_dir
0d8f5eb8a7
install_file
explorti.exe
strings_key
6c55a5f34bb433fbd933a168577b1838
url_paths
/Vi9leo/index.php

rc4.plain

Extracted

Family

stealc

Botnet

kora

http://185.215.113.100

Attributes

url_path
/e2b1563c6670f193.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Stealc
Stealc is an infostealer written in C++.
stealer stealc
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	a5bcb19eef5f5506fbd70b2e6ae31409d8e1affd86b2a002cdd09c262ee6bb08.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 8 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	a5bcb19eef5f5506fbd70b2e6ae31409d8e1affd86b2a002cdd09c262ee6bb08.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	a5bcb19eef5f5506fbd70b2e6ae31409d8e1affd86b2a002cdd09c262ee6bb08.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe

Executes dropped EXE 6 IoCs

pid	Process
1928	explorti.exe
1932	982491e3f9.exe
1660	6cd277a5c4.exe
236	explorti.exe
5064	caf888322b.exe
4016	explorti.exe

Identifies Wine through registry keys 2 TTPs 4 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000\Software\Wine	a5bcb19eef5f5506fbd70b2e6ae31409d8e1affd86b2a002cdd09c262ee6bb08.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000\Software\Microsoft\Windows\CurrentVersion\Run\982491e3f9.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000036001\\982491e3f9.exe"	explorti.exe

AutoIT Executable 13 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/1932-428-0x0000000000980000-0x0000000001467000-memory.dmp	autoit_exe
behavioral2/memory/1932-448-0x0000000000980000-0x0000000001467000-memory.dmp	autoit_exe
behavioral2/memory/1932-451-0x0000000000980000-0x0000000001467000-memory.dmp	autoit_exe
behavioral2/memory/1932-597-0x0000000000980000-0x0000000001467000-memory.dmp	autoit_exe
behavioral2/memory/1932-1338-0x0000000000980000-0x0000000001467000-memory.dmp	autoit_exe
behavioral2/memory/1932-2509-0x0000000000980000-0x0000000001467000-memory.dmp	autoit_exe
behavioral2/memory/1932-2635-0x0000000000980000-0x0000000001467000-memory.dmp	autoit_exe
behavioral2/memory/1932-2648-0x0000000000980000-0x0000000001467000-memory.dmp	autoit_exe
behavioral2/memory/1932-2652-0x0000000000980000-0x0000000001467000-memory.dmp	autoit_exe
behavioral2/memory/1932-2654-0x0000000000980000-0x0000000001467000-memory.dmp	autoit_exe
behavioral2/memory/1932-2656-0x0000000000980000-0x0000000001467000-memory.dmp	autoit_exe
behavioral2/memory/1932-2658-0x0000000000980000-0x0000000001467000-memory.dmp	autoit_exe
behavioral2/memory/1932-2660-0x0000000000980000-0x0000000001467000-memory.dmp	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 18 IoCs

pid	Process
3704	a5bcb19eef5f5506fbd70b2e6ae31409d8e1affd86b2a002cdd09c262ee6bb08.exe
1928	explorti.exe
1932	982491e3f9.exe
1932	982491e3f9.exe
236	explorti.exe
1932	982491e3f9.exe
1932	982491e3f9.exe
1932	982491e3f9.exe
1932	982491e3f9.exe
1932	982491e3f9.exe
1932	982491e3f9.exe
4016	explorti.exe
1932	982491e3f9.exe
1932	982491e3f9.exe
1932	982491e3f9.exe
1932	982491e3f9.exe
1932	982491e3f9.exe
1932	982491e3f9.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1660 set thread context of 2820	1660	6cd277a5c4.exe	91

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\explorti.job	a5bcb19eef5f5506fbd70b2e6ae31409d8e1affd86b2a002cdd09c262ee6bb08.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6cd277a5c4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	caf888322b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a5bcb19eef5f5506fbd70b2e6ae31409d8e1affd86b2a002cdd09c262ee6bb08.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorti.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	982491e3f9.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3704	a5bcb19eef5f5506fbd70b2e6ae31409d8e1affd86b2a002cdd09c262ee6bb08.exe
3704	a5bcb19eef5f5506fbd70b2e6ae31409d8e1affd86b2a002cdd09c262ee6bb08.exe
1928	explorti.exe
1928	explorti.exe
236	explorti.exe
236	explorti.exe
4016	explorti.exe
4016	explorti.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2112	firefox.exe
Token: SeDebugPrivilege	2112	firefox.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3704	a5bcb19eef5f5506fbd70b2e6ae31409d8e1affd86b2a002cdd09c262ee6bb08.exe
1932	982491e3f9.exe
1932	982491e3f9.exe
1932	982491e3f9.exe
1932	982491e3f9.exe
1932	982491e3f9.exe
1932	982491e3f9.exe
1932	982491e3f9.exe
2112	firefox.exe
2112	firefox.exe
2112	firefox.exe
2112	firefox.exe
2112	firefox.exe
2112	firefox.exe
2112	firefox.exe
2112	firefox.exe
2112	firefox.exe
2112	firefox.exe
2112	firefox.exe
2112	firefox.exe
2112	firefox.exe
2112	firefox.exe
2112	firefox.exe
2112	firefox.exe
2112	firefox.exe
2112	firefox.exe
2112	firefox.exe
2112	firefox.exe
2112	firefox.exe
1932	982491e3f9.exe
1932	982491e3f9.exe
1932	982491e3f9.exe
1932	982491e3f9.exe
1932	982491e3f9.exe
1932	982491e3f9.exe
1932	982491e3f9.exe
1932	982491e3f9.exe
1932	982491e3f9.exe
1932	982491e3f9.exe
1932	982491e3f9.exe
1932	982491e3f9.exe
1932	982491e3f9.exe
1932	982491e3f9.exe
1932	982491e3f9.exe
1932	982491e3f9.exe
1932	982491e3f9.exe
1932	982491e3f9.exe
1932	982491e3f9.exe
1932	982491e3f9.exe
1932	982491e3f9.exe
1932	982491e3f9.exe
1932	982491e3f9.exe
1932	982491e3f9.exe
1932	982491e3f9.exe
1932	982491e3f9.exe
1932	982491e3f9.exe
1932	982491e3f9.exe
1932	982491e3f9.exe
1932	982491e3f9.exe
1932	982491e3f9.exe
1932	982491e3f9.exe
1932	982491e3f9.exe
1932	982491e3f9.exe
1932	982491e3f9.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1932	982491e3f9.exe
1932	982491e3f9.exe
1932	982491e3f9.exe
1932	982491e3f9.exe
1932	982491e3f9.exe
1932	982491e3f9.exe
1932	982491e3f9.exe
1932	982491e3f9.exe
1932	982491e3f9.exe
1932	982491e3f9.exe
1932	982491e3f9.exe
1932	982491e3f9.exe
1932	982491e3f9.exe
1932	982491e3f9.exe
1932	982491e3f9.exe
1932	982491e3f9.exe
1932	982491e3f9.exe
1932	982491e3f9.exe
1932	982491e3f9.exe
1932	982491e3f9.exe
1932	982491e3f9.exe
1932	982491e3f9.exe
1932	982491e3f9.exe
1932	982491e3f9.exe
1932	982491e3f9.exe
1932	982491e3f9.exe
1932	982491e3f9.exe
1932	982491e3f9.exe
1932	982491e3f9.exe
1932	982491e3f9.exe
1932	982491e3f9.exe
1932	982491e3f9.exe
1932	982491e3f9.exe
1932	982491e3f9.exe
1932	982491e3f9.exe
1932	982491e3f9.exe
1932	982491e3f9.exe
1932	982491e3f9.exe
1932	982491e3f9.exe
1932	982491e3f9.exe
1932	982491e3f9.exe
1932	982491e3f9.exe
1932	982491e3f9.exe
1932	982491e3f9.exe
1932	982491e3f9.exe
1932	982491e3f9.exe
1932	982491e3f9.exe
1932	982491e3f9.exe
1932	982491e3f9.exe
1932	982491e3f9.exe
1932	982491e3f9.exe
1932	982491e3f9.exe
1932	982491e3f9.exe
1932	982491e3f9.exe
1932	982491e3f9.exe
1932	982491e3f9.exe
1932	982491e3f9.exe
1932	982491e3f9.exe
1932	982491e3f9.exe
1932	982491e3f9.exe
1932	982491e3f9.exe
1932	982491e3f9.exe
1932	982491e3f9.exe
1932	982491e3f9.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1932	982491e3f9.exe
2112	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3704 wrote to memory of 1928	3704	a5bcb19eef5f5506fbd70b2e6ae31409d8e1affd86b2a002cdd09c262ee6bb08.exe	82
PID 3704 wrote to memory of 1928	3704	a5bcb19eef5f5506fbd70b2e6ae31409d8e1affd86b2a002cdd09c262ee6bb08.exe	82
PID 3704 wrote to memory of 1928	3704	a5bcb19eef5f5506fbd70b2e6ae31409d8e1affd86b2a002cdd09c262ee6bb08.exe	82
PID 1928 wrote to memory of 1932	1928	explorti.exe	88
PID 1928 wrote to memory of 1932	1928	explorti.exe	88
PID 1928 wrote to memory of 1932	1928	explorti.exe	88
PID 1928 wrote to memory of 1660	1928	explorti.exe	89
PID 1928 wrote to memory of 1660	1928	explorti.exe	89
PID 1928 wrote to memory of 1660	1928	explorti.exe	89
PID 1660 wrote to memory of 2780	1660	6cd277a5c4.exe	90
PID 1660 wrote to memory of 2780	1660	6cd277a5c4.exe	90
PID 1660 wrote to memory of 2780	1660	6cd277a5c4.exe	90
PID 1660 wrote to memory of 2820	1660	6cd277a5c4.exe	91
PID 1660 wrote to memory of 2820	1660	6cd277a5c4.exe	91
PID 1660 wrote to memory of 2820	1660	6cd277a5c4.exe	91
PID 1660 wrote to memory of 2820	1660	6cd277a5c4.exe	91
PID 1660 wrote to memory of 2820	1660	6cd277a5c4.exe	91
PID 1660 wrote to memory of 2820	1660	6cd277a5c4.exe	91
PID 1660 wrote to memory of 2820	1660	6cd277a5c4.exe	91
PID 1660 wrote to memory of 2820	1660	6cd277a5c4.exe	91
PID 1660 wrote to memory of 2820	1660	6cd277a5c4.exe	91
PID 1932 wrote to memory of 4660	1932	982491e3f9.exe	92
PID 1932 wrote to memory of 4660	1932	982491e3f9.exe	92
PID 4660 wrote to memory of 2112	4660	firefox.exe	95
PID 4660 wrote to memory of 2112	4660	firefox.exe	95
PID 4660 wrote to memory of 2112	4660	firefox.exe	95
PID 4660 wrote to memory of 2112	4660	firefox.exe	95
PID 4660 wrote to memory of 2112	4660	firefox.exe	95
PID 4660 wrote to memory of 2112	4660	firefox.exe	95
PID 4660 wrote to memory of 2112	4660	firefox.exe	95
PID 4660 wrote to memory of 2112	4660	firefox.exe	95
PID 4660 wrote to memory of 2112	4660	firefox.exe	95
PID 4660 wrote to memory of 2112	4660	firefox.exe	95
PID 4660 wrote to memory of 2112	4660	firefox.exe	95
PID 2112 wrote to memory of 3704	2112	firefox.exe	97
PID 2112 wrote to memory of 3704	2112	firefox.exe	97
PID 2112 wrote to memory of 3704	2112	firefox.exe	97
PID 2112 wrote to memory of 3704	2112	firefox.exe	97
PID 2112 wrote to memory of 3704	2112	firefox.exe	97
PID 2112 wrote to memory of 3704	2112	firefox.exe	97
PID 2112 wrote to memory of 3704	2112	firefox.exe	97
PID 2112 wrote to memory of 3704	2112	firefox.exe	97
PID 2112 wrote to memory of 3704	2112	firefox.exe	97
PID 2112 wrote to memory of 3704	2112	firefox.exe	97
PID 2112 wrote to memory of 3704	2112	firefox.exe	97
PID 2112 wrote to memory of 3704	2112	firefox.exe	97
PID 2112 wrote to memory of 3704	2112	firefox.exe	97
PID 2112 wrote to memory of 3704	2112	firefox.exe	97
PID 2112 wrote to memory of 3704	2112	firefox.exe	97
PID 2112 wrote to memory of 3704	2112	firefox.exe	97
PID 2112 wrote to memory of 3704	2112	firefox.exe	97
PID 2112 wrote to memory of 3704	2112	firefox.exe	97
PID 2112 wrote to memory of 3704	2112	firefox.exe	97
PID 2112 wrote to memory of 3704	2112	firefox.exe	97
PID 2112 wrote to memory of 3704	2112	firefox.exe	97
PID 2112 wrote to memory of 3704	2112	firefox.exe	97
PID 2112 wrote to memory of 3704	2112	firefox.exe	97
PID 2112 wrote to memory of 3704	2112	firefox.exe	97
PID 2112 wrote to memory of 3704	2112	firefox.exe	97
PID 2112 wrote to memory of 3704	2112	firefox.exe	97
PID 2112 wrote to memory of 3704	2112	firefox.exe	97
PID 2112 wrote to memory of 3704	2112	firefox.exe	97
PID 2112 wrote to memory of 3704	2112	firefox.exe	97
PID 2112 wrote to memory of 3704	2112	firefox.exe	97

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\a5bcb19eef5f5506fbd70b2e6ae31409d8e1affd86b2a002cdd09c262ee6bb08.exe
"C:\Users\Admin\AppData\Local\Temp\a5bcb19eef5f5506fbd70b2e6ae31409d8e1affd86b2a002cdd09c262ee6bb08.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3704
- C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
  "C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1928
- - C:\Users\Admin\AppData\Local\Temp\1000036001\982491e3f9.exe
    "C:\Users\Admin\AppData\Local\Temp\1000036001\982491e3f9.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1932
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4660
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
        5⤵
        Checks processor information in registry
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2112
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1944 -parentBuildID 20240401114208 -prefsHandle 1864 -prefMapHandle 1856 -prefsLen 23678 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {361bff64-2828-4bd4-9e17-ff1e95ec7b86} 2112 "\\.\pipe\gecko-crash-server-pipe.2112" gpu
        6⤵
        
        PID:3704
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2348 -parentBuildID 20240401114208 -prefsHandle 2332 -prefMapHandle 2328 -prefsLen 24598 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8395943e-9daf-443e-a22b-8bbda09f4247} 2112 "\\.\pipe\gecko-crash-server-pipe.2112" socket
        6⤵
        
        PID:2308
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2992 -childID 1 -isForBrowser -prefsHandle 3004 -prefMapHandle 3000 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c72b4903-8c9a-4414-9195-b1e2c1f4f9ae} 2112 "\\.\pipe\gecko-crash-server-pipe.2112" tab
        6⤵
        
        PID:1588
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3888 -childID 2 -isForBrowser -prefsHandle 3872 -prefMapHandle 3868 -prefsLen 29088 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e71190ed-1ebc-457b-8ed4-7d1b54139b90} 2112 "\\.\pipe\gecko-crash-server-pipe.2112" tab
        6⤵
        
        PID:2232
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4760 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4736 -prefMapHandle 4624 -prefsLen 29088 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {08d1e3b3-9709-438c-bbfc-529ed62b9ea7} 2112 "\\.\pipe\gecko-crash-server-pipe.2112" utility
        6⤵
        Checks processor information in registry
        
        PID:5220
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5396 -childID 3 -isForBrowser -prefsHandle 5412 -prefMapHandle 5408 -prefsLen 26944 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2ce705cf-449b-44f1-8cd3-a0641c893332} 2112 "\\.\pipe\gecko-crash-server-pipe.2112" tab
        6⤵
        
        PID:5688
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5484 -childID 4 -isForBrowser -prefsHandle 5524 -prefMapHandle 5528 -prefsLen 26944 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4ff89537-f901-44f4-99d3-c8d3dd6fd1ef} 2112 "\\.\pipe\gecko-crash-server-pipe.2112" tab
        6⤵
        
        PID:5712
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5680 -childID 5 -isForBrowser -prefsHandle 5724 -prefMapHandle 5732 -prefsLen 26944 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {26df67f1-f79d-4d79-8694-a074f871a02c} 2112 "\\.\pipe\gecko-crash-server-pipe.2112" tab
        6⤵
        
        PID:5724
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6252 -childID 6 -isForBrowser -prefsHandle 6132 -prefMapHandle 6256 -prefsLen 27182 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1b21087a-185e-4b72-8999-00cfb319d1b9} 2112 "\\.\pipe\gecko-crash-server-pipe.2112" tab
        6⤵
        
        PID:4048
- - C:\Users\Admin\1000037002\6cd277a5c4.exe
    "C:\Users\Admin\1000037002\6cd277a5c4.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1660
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      PID:2780
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2820
- - C:\Users\Admin\AppData\Local\Temp\1000038001\caf888322b.exe
    "C:\Users\Admin\AppData\Local\Temp\1000038001\caf888322b.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5064

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:236

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6cd277a5c4.exe

Path C:\Users\Admin\1000037002\6cd277a5c4.exe
Size 196KB
SHA256 5f759610d194125cab7b8aaeba5952517c9db248daf89a9cb583fe52cbc9d06c
MD5 af462edbc2d8f1a138061c5eadecc52b
SHA1 ca5f265e7a7e87ddda5a2549226b98aa30693efb
SHA512 f9ca7495c606cb6c19486f75e4857ccdbdfcc30c6f1b5e502b3d72aae5c31d827459b92e3f19de2b0a45868c1d8d85bfc6ae60d9c5d62479acc8c4a43eeebdd9
SSDEEP 3072:S+IP/RYNPzya9zPJfDhI/21ITYiwpaT6AU2zPak70EKHw7Rp5uZyIg:G3R8Pzya9zxftvu6paTM2zClUROZyI
MD5 SHA1 SHA512 SSDEEP

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\seoxtri5.default-release\activity-stream.discovery_stream.json
Size 42KB
SHA256 cbb40b19d52d4eda61957388f1503786fd3db71289f8ff5b68f8d940d4f525d3
MD5 7c76eeb83a7a5672b4ccdf938bd97c27
SHA1 eb3f7d0a624b085b4fe922e5ba4cad28a3b16f30
SHA512 bfc9c41e0a1b5f18a8e0dc92326877682b6e0b7f6b4444bfefa9781406e144023d00388f90f007ebead4ccb48944c4e5414def05ba237dac05bc21de00f76eac
SSDEEP 768:KaoSWdhbvUkUoB48hQTGydWBZ4CvWK7/77CBVpcwuFRtynJFWKB3/0lJG:qSg8fissjvWdBRucvx
MD5 SHA1 SHA512 SSDEEP

Submit Download

E449899591A9BC91DFBA673EC0589B51E541A88B

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\seoxtri5.default-release\cache2\entries\E449899591A9BC91DFBA673EC0589B51E541A88B
Size 13KB
SHA256 1f57affd5ce0d4531b8c1a29e4e43710e690c5fd1bddb08d72d2e37b3dbb4fed
MD5 f31b3786e6acdabd0aaf54a4c3c6ee9f
SHA1 549ae76c2984241687432f1369b9c573641bf110
SHA512 b25fc565083c5dba6ba16e532108064baa8b34935575904b6a4b9a90d04b30d3b6d71c5b19bfd20b31419906309e79a2ef02589b2b7de193f3b18ba002b7dde9
SSDEEP 384:H/Fu9fiGLm4pU6ft2WlOX8lPLZZB7t0lpDIIu9n:IBi8mCU6ft2WAX8tzB7eD8t
MD5 SHA1 SHA512 SSDEEP

Submit Download

explorti.exe

Path C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
Size 1.8MB
SHA256 a5bcb19eef5f5506fbd70b2e6ae31409d8e1affd86b2a002cdd09c262ee6bb08
MD5 f19c5b8c97857169bbfc5aea1e12d2fa
SHA1 6895c85c50e0214bb4b144067edd829a70cc5dcd
SHA512 e33440c55909fe053745c71220701663897eae4f4e57c1d80d02168cd93e15934643fba20cdd5455702c57f4c3474def52b72a13c65f51addb3a680deb21b0cb
SSDEEP 49152:CsV1VaoB9emiCynu3qskp3n96gD1nCcqn6wXclixlffFNN:CsV1FeXKqD96glC/n6RqFNN
MD5 SHA1 SHA512 SSDEEP

Submit Download

982491e3f9.exe

Path C:\Users\Admin\AppData\Local\Temp\1000036001\982491e3f9.exe
Size 3.1MB
SHA256 36da02274021e1332fb9490a1c25924e3dc9b24df3e2f335957ebdccd1670954
MD5 0b080e160f6f1770c759fe3b115146cc
SHA1 3513d99220100b128dbd33bb404167a3c4cf245a
SHA512 3bc6a5495cd88fad79d32250bc42e5733a704cfa8b240a17f22261b0ca8afce104692cabe040459560614bde7536a55a1f9e9c54207f6fa617384337ef202aa8
SSDEEP 98304:hiBorSpyekvsswIpbmMN4VArTtXOPxVr0W+h:0BgGA1mEIMJXOPgW+
MD5 SHA1 SHA512 SSDEEP

Submit Download

caf888322b.exe

Path C:\Users\Admin\AppData\Local\Temp\1000038001\caf888322b.exe
Size 187KB
SHA256 37257ddb1a6f309a6e9d147b5fc2551a9cae3a0e52b191b18d9465bfcb5c18eb
MD5 278ee1426274818874556aa18fd02e3a
SHA1 185a2761330024dec52134df2c8388c461451acb
SHA512 07ec6759af5b9a00d8371b9fd9b723012dd0a1614cfcc7cd51975a004f69ffb90083735e9a871a2aa0e8d28799beac53a4748f55f4dd1e7495bc7388ebf4d6a0
SSDEEP 3072:/k9W0KFj5qj6o8KaxfE54HnnGqaKl+b2n8O43tIFmpKa:/kE/j5K62aOanGqCbAq3SFAKa
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 479KB
SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
MD5 09372174e83dbbf696ee732fd2e875bb
SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 13.8MB
SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
MD5 0a8747a2ac9ac08ae9508f36c6d75692
SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\seoxtri5.default-release\AlternateServices.bin
Size 16KB
SHA256 fe481d7a9f30f7a708c215371039c8a673579d3ec86d0b1de70f70707566cfe8
MD5 5b7c9c41738d1174c3110019147d7317
SHA1 cc9338eac950ff2d9305b09765c681127960a5b5
SHA512 a5e2e3262ac318031d889a290913c6311fcb919df7736090eadecf5b4a4f6924d9b5a9e44f612dc065512e37724ff19f4537d9a1bc56bfc2ad6f4f73cd310402
SSDEEP 48:35oWr9cOl9UXGhA7KJIqV3IVJajIseFgYajIl9eI51ajIYD:35ojNq2VQsseFgLslx5Ms
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\seoxtri5.default-release\AlternateServices.bin
Size 7KB
SHA256 8261570f2acf00c6fc093abdd054132185a4c547685187f593e9f7203fdde7b0
MD5 e81d0194476585ecbe03a24e04011e52
SHA1 4178de5943931207efd0b05045ca7f40127991d6
SHA512 15c8f1b81f123886a1538a05003d667b14cdee621c62d4d45127b271973ed6c2905ba24beefc57bbd0bc5732f2f3528213692a65f34dd173bfd55df68fd9f3d7
SSDEEP 24:kkuB1oYeWCgu1xgRbyuYpR5cO9fquhMZkZRFsh2F3LFYGE4pS9htKGTiI:GI5oe9cO94GVA7KG+I
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\seoxtri5.default-release\AlternateServices.bin
Size 10KB
SHA256 dc2e4438280aad5cd7bdd2ee184efae391d3e961cdd72bed3d9de5da1481005d
MD5 945fc783ae2d8de05722ebae05eb3d32
SHA1 6871a4be61fd50784a5ea024b639fe66204b9be0
SHA512 ecc0d26de87c43be16e8071e2254663b4947c0c374ba5e695d9f52f6ec47ef853d7e4e9b0bc6435a2e5f5cd0e03c8b36cf8be5c6b970429f931d4106b6506897
SSDEEP 24:kkuB1oYeACgu1xgRbiRQYpR5cOlRquhMZkZRFsh2F3LFYGE4tS9htKGajIg9x730:GW5oWr9cOliGRA7KGajIqV3IVJajI
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\seoxtri5.default-release\AlternateServices.bin
Size 15KB
SHA256 8cc436f5f995f00d3cb69d75cbb3c50b7f8c0ca44a767200dd771e4b93417daa
MD5 d106496eca90262a8b7916569acca03c
SHA1 0bb7e843e52a503cd6793f792613b2768974b3bd
SHA512 5a16b13aa35f95bfd9d309487b962d20783ae12c5913a258ae9143f5b56ec4c6371e399f36b83120e8b11f2bfd61cb9d4f8c56cc28420d40e45b18a6512f828e
SSDEEP 48:GW5oWr9cOl9UXGKA7KGRIqV3IVJajIseFgYajI49tI51ajIk:GW5oCEq2VQsseFgLs4g5Ms
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\seoxtri5.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 44e090cc49de12e2cef4f7e23db33391880072aad55682406d3b7b8107afe511
MD5 54d5103cfe97f399628ef0149ca44088
SHA1 7df9c4aed2cfcf3bd88d598c2dcaac729a6f79df
SHA512 8bc9df06884917fedd079b06fe84de32fa7aa777b62c685eed5df707c9ec810e95edfac25ec748d5817aa9ac93252f2508c39ba56a9aaa109fcf5179a34d0e35
SSDEEP 96:/BQ/7NZz/7K/7sX/7NFl66Joz0dzgClKtmSSkBq7YSMF9ZbkW6QX0BB770hmeAPN:INZnQsjN/66Joz0dzgCl6mSSbYrvZboJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\seoxtri5.default-release\datareporting\glean\db\data.safe.tmp
Size 16KB
SHA256 d2b62b4b3b0f512192ad474d16200ebfd64cd1920585b99542fcd99aa7af82a2
MD5 2aa4be42aa28d5eb56fd3f19b1b4dfe8
SHA1 684a7c75e73ac112dd901cba2ee33ad6adac9d0c
SHA512 08d6b22c084d0229020c5f462fcc9e8f3d4532bbffcd831f4bf69b3d41db2d7b554529867ddaaf0c195d48d167c0bd2524ee492cbd3a7ac52d872eb24db69263
SSDEEP 384:5mbon0v9UP0GF3VNjMD210gbvbXgN9QsjN/66JozQzgC1bM:5qotbrwD210gbvbXgLQ0Amm
MD5 SHA1 SHA512 SSDEEP

Submit Download

5af0383b-2e78-4d0e-a601-6f722aa43a59

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\seoxtri5.default-release\datareporting\glean\pending_pings\5af0383b-2e78-4d0e-a601-6f722aa43a59
Size 25KB
SHA256 4f749749244f990d6a1e8756a8c1c9a3a0d6e2fea9acbd23b9d66c1f27267438
MD5 a0ae431d9c5d3ccae7daea73e012de0a
SHA1 0e66d8f4abecb399a041f8d5c2ca22eda22915f9
SHA512 b6dbae8c2b76570a9643295dd0fb193434861123d04f8c073ea5023d2cc2a0e8bf57d2f51cf4eeed19b369acda0ac0a482281bb58516fd9732deb328d08051d0
SSDEEP 384:LGm78Az9wxKKRGCyOV9NLV226iAOp755Ygw:LGNAjyR5Ygw
MD5 SHA1 SHA512 SSDEEP

Submit Download

befc340a-afcd-432f-86a3-6a961f1bb3e3

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\seoxtri5.default-release\datareporting\glean\pending_pings\befc340a-afcd-432f-86a3-6a961f1bb3e3
Size 982B
SHA256 90f5ca7087cdff037783c0552ab0794104f0fdf28ad5b6d692823c78e483b792
MD5 6f8189c574b069897a66e1bf1c78cce4
SHA1 24345ee5dac51812b247fdb7d101fc7a505b2d42
SHA512 016da6c7ae5377e1dc9c0fac2a3da4eea8d301b94ce775950342a9ee0f412c02a043641e6e81b43c044dafe51b58a09dfd29580ec0e281d04294ac0226c1c4b9
MD5 SHA1 SHA512

Submit Download

cda99082-21a7-4529-9348-87e1830b7186

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\seoxtri5.default-release\datareporting\glean\pending_pings\cda99082-21a7-4529-9348-87e1830b7186
Size 671B
SHA256 bfd66d33c0ceecae22ad73599b59ecd8a4f93c0005dc3127a4e279ae20ab4674
MD5 2baa0ccb74b31d4fb6d645a23421bc6a
SHA1 72da414110cfe7d23a1b385df0805d21f541bba0
SHA512 3779199beb09d3b80edba1e658040c50fd72914f8877a324d37590a84b4f15f6493bfdc293a21730e11740b501eab845400a1e3b65dc18153aa9874cd036dc4b
MD5 SHA1 SHA512

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\seoxtri5.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Size 1.1MB
SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
MD5 842039753bf41fa5e11b3a1383061a87
SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\seoxtri5.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Size 116B
SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
MD5 2a461e9eb87fd1955cea740a3444ee7a
SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\seoxtri5.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Size 372B
SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
MD5 bf957ad58b55f64219ab3f793e374316
SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\seoxtri5.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Size 17.8MB
SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
MD5 daf7ef3acccab478aaa7d6dc1c60f865
SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\seoxtri5.default-release\prefs-1.js
Size 11KB
SHA256 546cb2e1d18219d4cb5a65f75192b8ccb7af9f6fa830b8923eedf1c8733c08b6
MD5 1bdfb900cc85f4af96152c40ea2cc77f
SHA1 3a8c319717ff5ace86a26c089d4b5c3cf0c72e40
SHA512 30da127cc87ddda2d8745938f6eb07c4f415e6d1cb38a21e9a13d152d92e3ccc578032a3f9e121bfc581775b71522c8766d750fab3166b9ed1c88cec9822919b
SSDEEP 192:n5nYR0fxEH6LaO5xn/v+7cdtcKxnLmV1I0z60TaX2cJdaiBw8Hy:VBaO5x/v+gDcKx6ANAww3
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\seoxtri5.default-release\prefs.js
Size 12KB
SHA256 717bb7c99a638614386c2959a3f9fb93f456a86fbb18e2bd1305f1b898ef05b8
MD5 a94d59ac1ea2fa9121a679e7d589aa07
SHA1 ba28044fb2e85d99ca7d6b5b7b56887f8fd0591d
SHA512 5d4b271576e4019ff4c42fbe2c9fad456c693e509b066e457500c9041da2c13642c5b7447ed294cb4137cecf68cef2b85c8b0defdb03b6f0fdb822b3151946c7
SSDEEP 192:h5nYR0fxEH6LaO5xn/v+7cdtcKxnLmV1I0z60TaX2cJdaaBw8HfK:bBaO5x/v+gDcKx6ANAowWK
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\seoxtri5.default-release\sessionstore-backups\recovery.baklz4
Size 5KB
SHA256 f55bb5ff1b8ee6a16b2451e336cfde374826e953b47b8113c1d39f2c4de5151d
MD5 6360200b58453425839b548068b09857
SHA1 238f1498a0e1f8d20baee18a5c0297eb43d1afba
SHA512 19a84672de163d71c26d0b0e62f0fd02af6749e588cdd2b8f607a73d8fe459b9634c53e1a5a49ea93f2f1fb3e6f8bb4aebea74b28a271ed316f959588dbf1bd3
SSDEEP 96:HivgfC6cCxw8C+fgEGJF7Q+MZk0zf8W8Qge3ZwS2a/i+vw84pGb:Hipsxw8C+ftiFrMZkcuem/+vv4C
MD5 SHA1 SHA512 SSDEEP

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\seoxtri5.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 1.3MB
SHA256 821a4e006d530b1d9407ead6b59042feb525efaea069474d2adbafcffda2c131
MD5 ec73e39a333ab03b30346eb60b1d19af
SHA1 b58a5a8f9e8aabd2eee6a91f09cca4140925efdf
SHA512 9d138be58bbda53dee32e1ecb779c464d8fe2f0385cf1b6f9664ee297701d0d61709e455a8b339f7ac581d431e3a3fc2711a0497e01920300b08c9109e25bb0c
SSDEEP 6144:+G0w7rIUjn393z3m3P3d65TH+YF+yA/P6bjUlBLY1hU8ARkYUbLzyuNWjPR2erU9:8W+ZabomC9mXq2eAq3FUL8bo9
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/236-73-0x0000000000D20000-0x00000000011BF000-memory.dmp

Download

memory/236-99-0x0000000000D20000-0x00000000011BF000-memory.dmp

Download

memory/1660-63-0x0000000000D90000-0x0000000000DC8000-memory.dmp

Download

memory/1928-435-0x0000000000D20000-0x00000000011BF000-memory.dmp

Download

memory/1928-1850-0x0000000000D20000-0x00000000011BF000-memory.dmp

Download

memory/1928-72-0x0000000000D20000-0x00000000011BF000-memory.dmp

Download

memory/1928-2653-0x0000000000D20000-0x00000000011BF000-memory.dmp

Download

memory/1928-2640-0x0000000000D20000-0x00000000011BF000-memory.dmp

Download

memory/1928-2634-0x0000000000D20000-0x00000000011BF000-memory.dmp

Download

memory/1928-2650-0x0000000000D20000-0x00000000011BF000-memory.dmp

Download

memory/1928-25-0x0000000000D20000-0x00000000011BF000-memory.dmp

Download

memory/1928-2655-0x0000000000D20000-0x00000000011BF000-memory.dmp

Download

memory/1928-2659-0x0000000000D20000-0x00000000011BF000-memory.dmp

Download

memory/1928-718-0x0000000000D20000-0x00000000011BF000-memory.dmp

Download

memory/1928-2657-0x0000000000D20000-0x00000000011BF000-memory.dmp

Download

memory/1928-456-0x0000000000D20000-0x00000000011BF000-memory.dmp

Download

memory/1928-24-0x0000000000D20000-0x00000000011BF000-memory.dmp

Download

memory/1928-23-0x0000000000D20000-0x00000000011BF000-memory.dmp

Download

memory/1928-22-0x0000000000D20000-0x00000000011BF000-memory.dmp

Download

memory/1928-21-0x0000000000D20000-0x00000000011BF000-memory.dmp

Download

memory/1928-20-0x0000000000D20000-0x00000000011BF000-memory.dmp

Download

memory/1928-19-0x0000000000D20000-0x00000000011BF000-memory.dmp

Download

memory/1928-18-0x0000000000D21000-0x0000000000D4F000-memory.dmp

Download

memory/1928-17-0x0000000000D20000-0x00000000011BF000-memory.dmp

Download

memory/1932-2509-0x0000000000980000-0x0000000001467000-memory.dmp

Download

memory/1932-43-0x0000000000980000-0x0000000001467000-memory.dmp

Download

memory/1932-451-0x0000000000980000-0x0000000001467000-memory.dmp

Download

memory/1932-2656-0x0000000000980000-0x0000000001467000-memory.dmp

Download

memory/1932-448-0x0000000000980000-0x0000000001467000-memory.dmp

Download

memory/1932-2660-0x0000000000980000-0x0000000001467000-memory.dmp

Download

memory/1932-2658-0x0000000000980000-0x0000000001467000-memory.dmp

Download

memory/1932-1338-0x0000000000980000-0x0000000001467000-memory.dmp

Download

memory/1932-597-0x0000000000980000-0x0000000001467000-memory.dmp

Download

memory/1932-428-0x0000000000980000-0x0000000001467000-memory.dmp

Download

memory/1932-2635-0x0000000000980000-0x0000000001467000-memory.dmp

Download

memory/1932-2652-0x0000000000980000-0x0000000001467000-memory.dmp

Download

memory/1932-2654-0x0000000000980000-0x0000000001467000-memory.dmp

Download

memory/1932-2648-0x0000000000980000-0x0000000001467000-memory.dmp

Download

memory/2820-66-0x0000000000400000-0x0000000000643000-memory.dmp

Download

memory/2820-69-0x0000000000400000-0x0000000000643000-memory.dmp

Download

memory/3704-4-0x00000000002E0000-0x000000000077F000-memory.dmp

Download

memory/3704-1-0x0000000077BE6000-0x0000000077BE8000-memory.dmp

Download

memory/3704-3-0x00000000002E0000-0x000000000077F000-memory.dmp

Download

memory/3704-2-0x00000000002E1000-0x000000000030F000-memory.dmp

Download

memory/3704-16-0x00000000002E0000-0x000000000077F000-memory.dmp

Download

memory/3704-0-0x00000000002E0000-0x000000000077F000-memory.dmp

Download

memory/4016-2644-0x0000000000D20000-0x00000000011BF000-memory.dmp

Download

memory/4016-2641-0x0000000000D20000-0x00000000011BF000-memory.dmp

Download

memory/5064-97-0x0000000000E60000-0x00000000010A3000-memory.dmp

Download

memory/5064-433-0x0000000000E60000-0x00000000010A3000-memory.dmp

Download