amadey | bbaa6d9a443b8d2c74ac44dc498347db9b1286a931dc0f7c900e0570352af52c

Analysis

max time kernel
150s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
14/08/2024, 19:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bbaa6d9a443b8d2c74ac44dc498347db9b1286a931dc0f7c900e0570352af52c.exe
Size 1.8MB
Sample240814-xtvfwstfml
SHA256 bbaa6d9a443b8d2c74ac44dc498347db9b1286a931dc0f7c900e0570352af52c
MD5 51f1d63e0011310e16b9cc937dff061c
SHA1 689bfbd2b6fc118f96bb10ab74ab486685ffa2ea
SHA512 b8a349620081882e69cdbddabf3c4add96e4397fdfc5c3c4548c678a435ae250614bae90d4e1c199c913d229e3c4fe1dba694851ee991462537b1297f03c114e
SSDEEP 49152:pIqkCmwbn/ZzKQMPs7CdcaogKtw2uFpkQUUz:KqkCPueCto+2KpXU
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey stealc 0657d1 kora nord credential_access discovery evasion persistence stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

0657d1

http://185.215.113.19

Attributes

install_dir
0d8f5eb8a7
install_file
explorti.exe
strings_key
6c55a5f34bb433fbd933a168577b1838
url_paths
/Vi9leo/index.php

rc4.plain

Extracted

Family

stealc

Botnet

nord

http://185.215.113.100

Attributes

url_path
/e2b1563c6670f193.php

Extracted

Family

stealc

Botnet

kora

http://185.215.113.100

Attributes

url_path
/e2b1563c6670f193.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Stealc
Stealc is an infostealer written in C++.
stealer stealc
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	bbaa6d9a443b8d2c74ac44dc498347db9b1286a931dc0f7c900e0570352af52c.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 8 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	bbaa6d9a443b8d2c74ac44dc498347db9b1286a931dc0f7c900e0570352af52c.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	bbaa6d9a443b8d2c74ac44dc498347db9b1286a931dc0f7c900e0570352af52c.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe

Executes dropped EXE 6 IoCs

pid	Process
4088	explorti.exe
4220	9d41b70e48.exe
1916	8a48d19e10.exe
1436	0174d3c890.exe
3400	explorti.exe
5300	explorti.exe

Identifies Wine through registry keys 2 TTPs 4 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000\Software\Wine	bbaa6d9a443b8d2c74ac44dc498347db9b1286a931dc0f7c900e0570352af52c.exe
Key opened	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000\Software\Wine	explorti.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000\Software\Microsoft\Windows\CurrentVersion\Run\9d41b70e48.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000036001\\9d41b70e48.exe"	explorti.exe

AutoIT Executable 3 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/3056-43-0x0000000000400000-0x000000000052D000-memory.dmp	autoit_exe
behavioral2/memory/3056-47-0x0000000000400000-0x000000000052D000-memory.dmp	autoit_exe
behavioral2/memory/3056-45-0x0000000000400000-0x000000000052D000-memory.dmp	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
564	bbaa6d9a443b8d2c74ac44dc498347db9b1286a931dc0f7c900e0570352af52c.exe
4088	explorti.exe
3400	explorti.exe
5300	explorti.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4220 set thread context of 3056	4220	9d41b70e48.exe	89
PID 1916 set thread context of 4888	1916	8a48d19e10.exe	94

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\explorti.job	bbaa6d9a443b8d2c74ac44dc498347db9b1286a931dc0f7c900e0570352af52c.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0174d3c890.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bbaa6d9a443b8d2c74ac44dc498347db9b1286a931dc0f7c900e0570352af52c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorti.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9d41b70e48.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8a48d19e10.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
564	bbaa6d9a443b8d2c74ac44dc498347db9b1286a931dc0f7c900e0570352af52c.exe
564	bbaa6d9a443b8d2c74ac44dc498347db9b1286a931dc0f7c900e0570352af52c.exe
4088	explorti.exe
4088	explorti.exe
3400	explorti.exe
3400	explorti.exe
5300	explorti.exe
5300	explorti.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1768	firefox.exe
Token: SeDebugPrivilege	1768	firefox.exe
Token: SeDebugPrivilege	1768	firefox.exe
Token: SeDebugPrivilege	1768	firefox.exe
Token: SeDebugPrivilege	1768	firefox.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
564	bbaa6d9a443b8d2c74ac44dc498347db9b1286a931dc0f7c900e0570352af52c.exe
3056	RegAsm.exe
3056	RegAsm.exe
3056	RegAsm.exe
3056	RegAsm.exe
3056	RegAsm.exe
3056	RegAsm.exe
3056	RegAsm.exe
1768	firefox.exe
1768	firefox.exe
1768	firefox.exe
1768	firefox.exe
1768	firefox.exe
1768	firefox.exe
1768	firefox.exe
1768	firefox.exe
1768	firefox.exe
1768	firefox.exe
1768	firefox.exe
1768	firefox.exe
1768	firefox.exe
1768	firefox.exe
1768	firefox.exe
1768	firefox.exe
1768	firefox.exe
1768	firefox.exe
1768	firefox.exe
1768	firefox.exe
1768	firefox.exe
3056	RegAsm.exe
3056	RegAsm.exe
3056	RegAsm.exe
3056	RegAsm.exe
3056	RegAsm.exe
3056	RegAsm.exe
3056	RegAsm.exe
3056	RegAsm.exe
3056	RegAsm.exe
3056	RegAsm.exe
3056	RegAsm.exe
3056	RegAsm.exe
3056	RegAsm.exe
3056	RegAsm.exe
3056	RegAsm.exe
3056	RegAsm.exe
3056	RegAsm.exe
3056	RegAsm.exe
3056	RegAsm.exe
3056	RegAsm.exe
3056	RegAsm.exe
3056	RegAsm.exe
3056	RegAsm.exe
3056	RegAsm.exe
3056	RegAsm.exe
3056	RegAsm.exe
3056	RegAsm.exe
3056	RegAsm.exe
3056	RegAsm.exe
3056	RegAsm.exe
3056	RegAsm.exe
3056	RegAsm.exe
3056	RegAsm.exe
3056	RegAsm.exe
3056	RegAsm.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3056	RegAsm.exe
3056	RegAsm.exe
3056	RegAsm.exe
3056	RegAsm.exe
3056	RegAsm.exe
3056	RegAsm.exe
3056	RegAsm.exe
3056	RegAsm.exe
3056	RegAsm.exe
3056	RegAsm.exe
3056	RegAsm.exe
3056	RegAsm.exe
3056	RegAsm.exe
3056	RegAsm.exe
3056	RegAsm.exe
3056	RegAsm.exe
3056	RegAsm.exe
3056	RegAsm.exe
3056	RegAsm.exe
3056	RegAsm.exe
3056	RegAsm.exe
3056	RegAsm.exe
3056	RegAsm.exe
3056	RegAsm.exe
3056	RegAsm.exe
3056	RegAsm.exe
3056	RegAsm.exe
3056	RegAsm.exe
3056	RegAsm.exe
3056	RegAsm.exe
3056	RegAsm.exe
3056	RegAsm.exe
3056	RegAsm.exe
3056	RegAsm.exe
3056	RegAsm.exe
3056	RegAsm.exe
3056	RegAsm.exe
3056	RegAsm.exe
3056	RegAsm.exe
3056	RegAsm.exe
3056	RegAsm.exe
3056	RegAsm.exe
3056	RegAsm.exe
3056	RegAsm.exe
3056	RegAsm.exe
3056	RegAsm.exe
3056	RegAsm.exe
3056	RegAsm.exe
3056	RegAsm.exe
3056	RegAsm.exe
3056	RegAsm.exe
3056	RegAsm.exe
3056	RegAsm.exe
3056	RegAsm.exe
3056	RegAsm.exe
3056	RegAsm.exe
3056	RegAsm.exe
3056	RegAsm.exe
3056	RegAsm.exe
3056	RegAsm.exe
3056	RegAsm.exe
3056	RegAsm.exe
3056	RegAsm.exe
3056	RegAsm.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1768	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 564 wrote to memory of 4088	564	bbaa6d9a443b8d2c74ac44dc498347db9b1286a931dc0f7c900e0570352af52c.exe	82
PID 564 wrote to memory of 4088	564	bbaa6d9a443b8d2c74ac44dc498347db9b1286a931dc0f7c900e0570352af52c.exe	82
PID 564 wrote to memory of 4088	564	bbaa6d9a443b8d2c74ac44dc498347db9b1286a931dc0f7c900e0570352af52c.exe	82
PID 4088 wrote to memory of 4220	4088	explorti.exe	85
PID 4088 wrote to memory of 4220	4088	explorti.exe	85
PID 4088 wrote to memory of 4220	4088	explorti.exe	85
PID 4220 wrote to memory of 4880	4220	9d41b70e48.exe	86
PID 4220 wrote to memory of 4880	4220	9d41b70e48.exe	86
PID 4220 wrote to memory of 4880	4220	9d41b70e48.exe	86
PID 4220 wrote to memory of 4972	4220	9d41b70e48.exe	87
PID 4220 wrote to memory of 4972	4220	9d41b70e48.exe	87
PID 4220 wrote to memory of 4972	4220	9d41b70e48.exe	87
PID 4220 wrote to memory of 3632	4220	9d41b70e48.exe	88
PID 4220 wrote to memory of 3632	4220	9d41b70e48.exe	88
PID 4220 wrote to memory of 3632	4220	9d41b70e48.exe	88
PID 4220 wrote to memory of 3056	4220	9d41b70e48.exe	89
PID 4220 wrote to memory of 3056	4220	9d41b70e48.exe	89
PID 4220 wrote to memory of 3056	4220	9d41b70e48.exe	89
PID 4220 wrote to memory of 3056	4220	9d41b70e48.exe	89
PID 4220 wrote to memory of 3056	4220	9d41b70e48.exe	89
PID 4220 wrote to memory of 3056	4220	9d41b70e48.exe	89
PID 4220 wrote to memory of 3056	4220	9d41b70e48.exe	89
PID 4220 wrote to memory of 3056	4220	9d41b70e48.exe	89
PID 4220 wrote to memory of 3056	4220	9d41b70e48.exe	89
PID 4220 wrote to memory of 3056	4220	9d41b70e48.exe	89
PID 4088 wrote to memory of 1916	4088	explorti.exe	91
PID 4088 wrote to memory of 1916	4088	explorti.exe	91
PID 4088 wrote to memory of 1916	4088	explorti.exe	91
PID 1916 wrote to memory of 1812	1916	8a48d19e10.exe	92
PID 1916 wrote to memory of 1812	1916	8a48d19e10.exe	92
PID 1916 wrote to memory of 1812	1916	8a48d19e10.exe	92
PID 1916 wrote to memory of 2000	1916	8a48d19e10.exe	93
PID 1916 wrote to memory of 2000	1916	8a48d19e10.exe	93
PID 1916 wrote to memory of 2000	1916	8a48d19e10.exe	93
PID 1916 wrote to memory of 4888	1916	8a48d19e10.exe	94
PID 1916 wrote to memory of 4888	1916	8a48d19e10.exe	94
PID 1916 wrote to memory of 4888	1916	8a48d19e10.exe	94
PID 1916 wrote to memory of 4888	1916	8a48d19e10.exe	94
PID 1916 wrote to memory of 4888	1916	8a48d19e10.exe	94
PID 1916 wrote to memory of 4888	1916	8a48d19e10.exe	94
PID 1916 wrote to memory of 4888	1916	8a48d19e10.exe	94
PID 1916 wrote to memory of 4888	1916	8a48d19e10.exe	94
PID 1916 wrote to memory of 4888	1916	8a48d19e10.exe	94
PID 4088 wrote to memory of 1436	4088	explorti.exe	96
PID 4088 wrote to memory of 1436	4088	explorti.exe	96
PID 4088 wrote to memory of 1436	4088	explorti.exe	96
PID 3056 wrote to memory of 564	3056	RegAsm.exe	97
PID 3056 wrote to memory of 564	3056	RegAsm.exe	97
PID 564 wrote to memory of 1768	564	firefox.exe	100
PID 564 wrote to memory of 1768	564	firefox.exe	100
PID 564 wrote to memory of 1768	564	firefox.exe	100
PID 564 wrote to memory of 1768	564	firefox.exe	100
PID 564 wrote to memory of 1768	564	firefox.exe	100
PID 564 wrote to memory of 1768	564	firefox.exe	100
PID 564 wrote to memory of 1768	564	firefox.exe	100
PID 564 wrote to memory of 1768	564	firefox.exe	100
PID 564 wrote to memory of 1768	564	firefox.exe	100
PID 564 wrote to memory of 1768	564	firefox.exe	100
PID 564 wrote to memory of 1768	564	firefox.exe	100
PID 1768 wrote to memory of 916	1768	firefox.exe	101
PID 1768 wrote to memory of 916	1768	firefox.exe	101
PID 1768 wrote to memory of 916	1768	firefox.exe	101
PID 1768 wrote to memory of 916	1768	firefox.exe	101
PID 1768 wrote to memory of 916	1768	firefox.exe	101

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\bbaa6d9a443b8d2c74ac44dc498347db9b1286a931dc0f7c900e0570352af52c.exe
"C:\Users\Admin\AppData\Local\Temp\bbaa6d9a443b8d2c74ac44dc498347db9b1286a931dc0f7c900e0570352af52c.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:564
- C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
  "C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4088
- - C:\Users\Admin\AppData\Local\Temp\1000036001\9d41b70e48.exe
    "C:\Users\Admin\AppData\Local\Temp\1000036001\9d41b70e48.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4220
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      PID:4880
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      PID:4972
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      PID:3632
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:3056
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:564
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
        6⤵
        Checks processor information in registry
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1768
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1992 -parentBuildID 20240401114208 -prefsHandle 1900 -prefMapHandle 1844 -prefsLen 23678 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {acc90ddd-f613-41bc-a073-1dc11983d1a4} 1768 "\\.\pipe\gecko-crash-server-pipe.1768" gpu
        7⤵
        
        PID:916
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2412 -parentBuildID 20240401114208 -prefsHandle 2404 -prefMapHandle 2400 -prefsLen 24598 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9738bf46-2548-4d20-a434-01bb573c436c} 1768 "\\.\pipe\gecko-crash-server-pipe.1768" socket
        7⤵
        
        PID:2656
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3100 -childID 1 -isForBrowser -prefsHandle 3128 -prefMapHandle 3124 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 948 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {be8bc953-bcfc-4308-a7ff-8339fa3ed82f} 1768 "\\.\pipe\gecko-crash-server-pipe.1768" tab
        7⤵
        
        PID:1096
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3860 -childID 2 -isForBrowser -prefsHandle 1072 -prefMapHandle 3780 -prefsLen 29088 -prefMapSize 244658 -jsInitHandle 948 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dccf7bb8-7b58-4a92-81a9-9f996b4a1833} 1768 "\\.\pipe\gecko-crash-server-pipe.1768" tab
        7⤵
        
        PID:4212
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1636 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 912 -prefMapHandle 4780 -prefsLen 29088 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b3b6051a-ee95-41c6-8dd2-0057f0cfeb33} 1768 "\\.\pipe\gecko-crash-server-pipe.1768" utility
        7⤵
        Checks processor information in registry
        
        PID:2896
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5564 -childID 3 -isForBrowser -prefsHandle 4284 -prefMapHandle 5612 -prefsLen 27182 -prefMapSize 244658 -jsInitHandle 948 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9a279e46-08d4-4b7f-9a08-fb96371ec5bb} 1768 "\\.\pipe\gecko-crash-server-pipe.1768" tab
        7⤵
        
        PID:4152
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5896 -childID 4 -isForBrowser -prefsHandle 5796 -prefMapHandle 5892 -prefsLen 27182 -prefMapSize 244658 -jsInitHandle 948 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a53c1451-3746-43bc-88f8-a4f7286230d9} 1768 "\\.\pipe\gecko-crash-server-pipe.1768" tab
        7⤵
        
        PID:1188
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6068 -childID 5 -isForBrowser -prefsHandle 5984 -prefMapHandle 5988 -prefsLen 27182 -prefMapSize 244658 -jsInitHandle 948 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bebc5953-9b74-4f35-9455-d78be0fec795} 1768 "\\.\pipe\gecko-crash-server-pipe.1768" tab
        7⤵
        
        PID:1912
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6176 -childID 6 -isForBrowser -prefsHandle 6184 -prefMapHandle 6188 -prefsLen 27182 -prefMapSize 244658 -jsInitHandle 948 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3ff7ac8c-52f8-49bd-acd9-a25d03ada96c} 1768 "\\.\pipe\gecko-crash-server-pipe.1768" tab
        7⤵
        
        PID:244
- - C:\Users\Admin\1000037002\8a48d19e10.exe
    "C:\Users\Admin\1000037002\8a48d19e10.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1916
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      PID:1812
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      PID:2000
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4888
- - C:\Users\Admin\AppData\Local\Temp\1000038001\0174d3c890.exe
    "C:\Users\Admin\AppData\Local\Temp\1000038001\0174d3c890.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1436

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3400

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8a48d19e10.exe

Path C:\Users\Admin\1000037002\8a48d19e10.exe
Size 330KB
SHA256 2bc4046f376f48ec3c3456cefa45279a0f187b3d5eef73768b48eafce424b807
MD5 44f3a5221b50fd602e29fd927f8b6e23
SHA1 49afe6aea1fa8ce4e6340f0b2a5f9cf50e07ca63
SHA512 c50972890fd2bfcecb6774a0629d16ff55ba0f8a3006cdbcfb088e91cd538b454e23376fe29ac871590336ab54295e7d47b24f2fb67fc24ea6755f66a3316516
SSDEEP 6144:b/hplpa4vlU4ERSxz5lQH0gW0MgT9yYKII4sX:b/hplBvlU6xa0gDIZIIZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\seoxtri5.default-release\activity-stream.discovery_stream.json
Size 32KB
SHA256 140060876bf869c1d1c68a75db82a37ef6d22a79c6e6a028eea4bf9615f6c941
MD5 3e062633c98c192f464d5d43900233d9
SHA1 43f1f7ea91b56d480898c60e90287421d4cea4ef
SHA512 92912e0cd3ee950262ad3f4e59fec9d0f23784ababb1cc8089e63f65c4122e56342c26a95685710d404f1c39f7ebc50c928e31d34dfda5e343a09fc4784adbeb
SSDEEP 768:MEm0uL7AziYiAKzXIhtgf89SAyd1vV5DLtnOJA9iBwuaEauG:MzvLc9z0X3koPvVBLtOJAIBwu7ap
MD5 SHA1 SHA512 SSDEEP

Submit Download

E449899591A9BC91DFBA673EC0589B51E541A88B

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\seoxtri5.default-release\cache2\entries\E449899591A9BC91DFBA673EC0589B51E541A88B
Size 13KB
SHA256 91a5dd838d21f5800a827088e0fa8667daa153d2b78b5ff6d592e88c373e6cc4
MD5 3c42cd9ebfd99fd91c614d271d6dd1aa
SHA1 5362ce9cac19e3568f44bea670265cc5ac20f464
SHA512 fe2349a811e565a91a0d0bc5049adc49e6d66eacf3912b793d69d785b5be30954047d34af1258024ecfe151137fe677543f884c749f585dd7d0d21524e991cd8
SSDEEP 384:H/Fu9fiGLm4pUIft2WlOX8lPLZZB7t0lpDIIBw5wU:IBi8mCUIft2WAX8tzB7eD8Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

explorti.exe

Path C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
Size 1.8MB
SHA256 bbaa6d9a443b8d2c74ac44dc498347db9b1286a931dc0f7c900e0570352af52c
MD5 51f1d63e0011310e16b9cc937dff061c
SHA1 689bfbd2b6fc118f96bb10ab74ab486685ffa2ea
SHA512 b8a349620081882e69cdbddabf3c4add96e4397fdfc5c3c4548c678a435ae250614bae90d4e1c199c913d229e3c4fe1dba694851ee991462537b1297f03c114e
SSDEEP 49152:pIqkCmwbn/ZzKQMPs7CdcaogKtw2uFpkQUUz:KqkCPueCto+2KpXU
MD5 SHA1 SHA512 SSDEEP

Submit Download

9d41b70e48.exe

Path C:\Users\Admin\AppData\Local\Temp\1000036001\9d41b70e48.exe
Size 1.3MB
SHA256 ba43aa294156e377ae6a0aaee5006b9af062533a1a6089ec873d5c091d706934
MD5 f8a0a57e59145dbc07e9eea86c379910
SHA1 d8f641d14b80d262f999b912a8fb1a6735913885
SHA512 ec556386c343c6db714b189bb404a1db161aa8d0c75768abff2a0755e21d3ac18b6212af0237dcb141d3b61ae665005bc53dc162a5bf47d49b67fbb27e5e726c
SSDEEP 24576:14RpeoKpvh1Lg4/pc6GvkZtgh5fmKQfXMCqtTFA6+xUJaJ0MI:1upUJR9i6GMZK+KQvMCqtRA6+SJaJ0M
MD5 SHA1 SHA512 SSDEEP

Submit Download

0174d3c890.exe

Path C:\Users\Admin\AppData\Local\Temp\1000038001\0174d3c890.exe
Size 187KB
SHA256 37257ddb1a6f309a6e9d147b5fc2551a9cae3a0e52b191b18d9465bfcb5c18eb
MD5 278ee1426274818874556aa18fd02e3a
SHA1 185a2761330024dec52134df2c8388c461451acb
SHA512 07ec6759af5b9a00d8371b9fd9b723012dd0a1614cfcc7cd51975a004f69ffb90083735e9a871a2aa0e8d28799beac53a4748f55f4dd1e7495bc7388ebf4d6a0
SSDEEP 3072:/k9W0KFj5qj6o8KaxfE54HnnGqaKl+b2n8O43tIFmpKa:/kE/j5K62aOanGqCbAq3SFAKa
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 479KB
SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
MD5 09372174e83dbbf696ee732fd2e875bb
SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 13.8MB
SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
MD5 0a8747a2ac9ac08ae9508f36c6d75692
SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\seoxtri5.default-release\AlternateServices.bin
Size 7KB
SHA256 1b5efcf08372bba12e58e8e61f35e12da4eed4d4bb534bbeac81f84decf7f05a
MD5 6e72a0d6ef96e902c992d8e26119089c
SHA1 ea9cf2ae5739a34a23e950fee89ba2cc5221c329
SHA512 3ded838fca82101e1d70c87c0f709b389b3382534665d75d0e17a508ac6f626498427f601722ab03aaf5da6f65c3300772ce3e647ae98e838f15e6113e53b39e
SSDEEP 24:kkuB1oYefgu1xgRbCfpR5cO9fquhMZkxFsh2F3LFAnS9htK0C:Gg5o+9cO9kA7K0C
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\seoxtri5.default-release\AlternateServices.bin
Size 10KB
SHA256 5de186b5083b6beb9ec10fe60fc7f62009e0d2f81b1d48484cfa74f4016a5e1f
MD5 4600b91072aff79d04bc38b00416dd63
SHA1 e3f2d02b619916f730c5dc85feed10f2df60030f
SHA512 521d6ffeba29ca4269e7681103bbea6c6e078c01f056c9ff6fc1bc689f73472a365dc63a285720a411ffa10594aa942d98ec2de24554526de697f33ecb6d1765
SSDEEP 24:kkuB1oYefgu1xgRbCmGpR5cOBHTuhMZhxFsh2F3LFA/mS9htK5fCe9BXfC69xzfC:Gg5onG9cOpUmA7K5fCk5fCYtfC
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\seoxtri5.default-release\AlternateServices.bin
Size 11KB
SHA256 361e1aced07a85614cf3bd0a8c1060e3411e85177d67e98aa13c04e3b92f0ac7
MD5 c0f4b313fe72a4e42fdd672dd6bca387
SHA1 6845111d0485a814d41756e5810f83fafb1eba8a
SHA512 8d25e2f1f1171983b6ec7357e41f9eba4d0ac6d24340df18da439b1f9ee78e94819caa8de6d23ff880210a8bcadfaa59ccf0a4191d5c3646c44854a93958bdcc
SSDEEP 48:Gg5onG9cOp4A7KofCk5fCYtfCdeFg6fC:Gg5oAAkAYkdeFgx
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\seoxtri5.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 afcf43ec0257cac65765543a46679f301d329b8451197b6abe1d2d3238fc99df
MD5 3a8da9a972ea7e8ffd15b838dad113f2
SHA1 5da6edc83189798fe22cdecb553383cf4ec3f3dd
SHA512 c0d3fb9434e725226669b343c7a3f2342286daaf9b099fe07fc5c37788dba470d8984ed9bff773d2e7339a1da9ae3b3a1972c3704c403fec92a0deb101df2b7a
SSDEEP 96:kBQuXQFl66Joz0dzgClKtmSSkBDSMF9ZbkW6QX0BBohmzoPP/PrWZ:P/66Joz0dzgCl6mSSQrvZboHohGePC
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\seoxtri5.default-release\datareporting\glean\db\data.safe.tmp
Size 15KB
SHA256 ce12bd050aef792f975620b06c10c15cf4b6e0f3bc1cb3a7df55ec8450382827
MD5 6c6c516ff566f0a7246ced9b49c279e4
SHA1 fee7da7f4673c4db535bd4a466663dc74ddf1d41
SHA512 dbaf0e442b138dbcb792b937daca821b57a25a51557f28ee13fd2bacc76585a6807981f11b2f8a5f3fb2a62eaf1b0b896fffd36c7a49b4e5b956e6d04e3e7515
SSDEEP 384:nNHzkNZ/Dd5Wfb0blu/66JozQzgC1bWboIxbdPb:NHzQ5Dd5Wfb0blrmAfT
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\seoxtri5.default-release\datareporting\glean\db\data.safe.tmp
Size 15KB
SHA256 bb2a9230db595b0572f46593ebf8a19e543b7814713ab14a0bfe22d28ab40c98
MD5 7d3f1d5b31947cf6c882b4907d6182a7
SHA1 41723d956cfbb6e818642e65201ba673a10b1141
SHA512 6c42b4be37dbe87159a0674a86060b6d74c9d5a743229bb4a9ba3c1ef8679ccf6afb0f74928ad6025d6ede913d0e552a5c6dd3eec501b3bf479bd6c6d48d462b
SSDEEP 384:P/66JozQzgC1blNHzkNZ/Dd5Wfb0blqboKbdPb:qmBHzQ5Dd5Wfb0bl+HT
MD5 SHA1 SHA512 SSDEEP

Submit Download

50bb0c3b-41d6-44fd-bcc7-ffcd3c156d0d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\seoxtri5.default-release\datareporting\glean\pending_pings\50bb0c3b-41d6-44fd-bcc7-ffcd3c156d0d
Size 671B
SHA256 b3f0b72df54d51a379aa04d53402fca8a1adae66f19f8d14d188e857c30ad229
MD5 cb8fa63e4d8faf20a6adf43128fec7d1
SHA1 6b3ab6201378961576d3a3f225c57473a7675b8f
SHA512 d0877393dd3320fb46a5ed4575368cf63d405d2200677a663057fe960d280df3ae47aaa5d57a61c53fe94877d94cd278f10975d1c4dba7f82dc1f4d0679550a4
MD5 SHA1 SHA512

Submit Download

58be3d75-b62d-4a0e-9a7b-b4adcdf811ba

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\seoxtri5.default-release\datareporting\glean\pending_pings\58be3d75-b62d-4a0e-9a7b-b4adcdf811ba
Size 24KB
SHA256 5d34e2efda7757fc6ff4cbb8d390d89989764a1225f889ef2684e4db513d7d20
MD5 73575e4b2dfa85066bea5ff13c9a9920
SHA1 fd886bedb1a20da3260a01cf09927ebb83d7ac16
SHA512 0dfc8f1ba65b85b4d647dc87131229423a92784dff12bc8456bae563fbb09f03682a6ebe7d05eedf6f3d4378d701ea6bda07ce0391778ba0d16442aa71df842d
SSDEEP 192:B+sOAgePn8DMVu7DX3RgU+HMBngckfnbQSIT8RKytueg2BxhXhXjyBDJZwWhvmhs:BTOQlXWTTwfeiHCo/svUnvSr/lR2S1
MD5 SHA1 SHA512 SSDEEP

Submit Download

625860f3-1fe6-4480-99d1-4bec930cea02

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\seoxtri5.default-release\datareporting\glean\pending_pings\625860f3-1fe6-4480-99d1-4bec930cea02
Size 982B
SHA256 3b71de74bf9c8d737a6546b3e9de352a8d1ec9ba27d90cda714a937e91fea6af
MD5 4d0222a0d61ce501326070a191805a5e
SHA1 03bde5ca46f947801378795e981c349be4164f24
SHA512 4cb9add0468e72610489f0fa11e3557d58e337c540e494e1d375b9c67d2f7feefe51c2a1b952f4fd83e8c3c34af379c2112493fd2bb7c68df6e5cbbc962dbb97
MD5 SHA1 SHA512

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\seoxtri5.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Size 1.1MB
SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
MD5 842039753bf41fa5e11b3a1383061a87
SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\seoxtri5.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Size 116B
SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
MD5 2a461e9eb87fd1955cea740a3444ee7a
SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\seoxtri5.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Size 372B
SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
MD5 bf957ad58b55f64219ab3f793e374316
SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\seoxtri5.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Size 17.8MB
SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
MD5 daf7ef3acccab478aaa7d6dc1c60f865
SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\seoxtri5.default-release\prefs-1.js
Size 16KB
SHA256 561a71065d008aee6510e6b5e4f70f71b37912d20a548049fcbfd3548d676b48
MD5 a4e93ba85d8458617ad3130ea25c7a5f
SHA1 c558a7965e71cad9c12e798435ac5d66816875bf
SHA512 1915b29bfcaf4bdf3893641a95fb3f003f1fd9c8072622db568737f564af6924d2af6d00479dcf449a0b8c20fb629e5978716e065703c887c28ccd290ae5202a
SSDEEP 192:hanYR0fIB7s0r4AI41ctRcd1Tcd8/I4jctKQHrq1S6085aXw+da8Bw8HJTfNKS:Wsp4Ai6d14+/gKQLq1RpAAiwyn
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\seoxtri5.default-release\prefs.js
Size 12KB
SHA256 6ae6a0c2b1fe762a7206e7e97a0befe45e280797dc615d2d4c86bef3abba658b
MD5 aa9e06cb26ab82569b38467097de53ea
SHA1 16ef57a040a0b2d4648a8def8ee28d42517fa3fe
SHA512 8551e792e33ffb974bf2e1eb8a947fd28ea247ad98bc1e07f7b842eb68721ec877bd45c18e6c21cc18215fc661468a14f749a290a9305626321371f36890ff5b
SSDEEP 192:h5nYR0fxB7s0r4AI41ctRcd1Tcd8/I4jctKQHrq1S6085aXsda8Bw8HX9:b/p4Ai6d14+/gKQLq1Rp/AiwA9
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\seoxtri5.default-release\prefs.js
Size 11KB
SHA256 5513b7e2f6b3111e173350d8dfc8d6f86ebedef35af73c399f48bd84fef88ae8
MD5 63497fefaecf5ddc6ec83a39fdfcdff8
SHA1 4f3d2f363af3156faa2baf7cdb5064aba71fcdb8
SHA512 4250a5f042b601bff45156d33d2652fad6d29ff2ba0135d8fd01116d226e5253518189af45e6b5a94eaeaedec7b97bc22cb90f9f7852d66dde64a372f191907d
SSDEEP 192:n5nYR0fxY70r4AI41ctRcd1Tcd8/I4jctKQHrq1S6085aXsdaiBw8Ht:Vv4Ai6d14+/gKQLq1Rp/Awwg
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\seoxtri5.default-release\prefs.js
Size 11KB
SHA256 9e062074c00bd444837f0680d8247f3c2e3f16f9a00645f4750ed39d1e00db24
MD5 a42dbbf3d4e99ddc7285f21fcb6015e3
SHA1 422236b61f96096f43e903f53f0e9f66a427b4e7
SHA512 aeb95cdeb26aac6e099bfb9ea10437ffec9775a6a5f6bb6d1b1bb3546723b7d8f7e3e41d1b09738fb76b5fbe0547514cf6df9e494ab796d62b516f9224f9c5b8
SSDEEP 192:n5nYR0fxB7s0r4AI41ctRcd1Tcd8/I4jctKQHrq1S6085aXsdaiBw8Ht:V/p4Ai6d14+/gKQLq1Rp/Awwg
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\seoxtri5.default-release\prefs.js
Size 11KB
SHA256 83597ced29a8c7eab843464ea1f320c8057e808f76a08127416d21ac982bdcf2
MD5 d859b0d0178c9cddb8bd0fb18fc39c29
SHA1 800202f1c546372f3392c368598560a9c118241c
SHA512 c2cd3bf4de6b29b1883f7b9526073545570ca2756e50188861816c4442abc93f904f2b30de2e4974dcf368aff2c4ca96b048a7d6d23cfb28fdb0d97dc9f29e1d
SSDEEP 192:n5nYR0fxY70dwfftvWd2cd7fVttDnjXj608aXAdaiBw8Vt:VJwdvW9FftDnqhAwwe
MD5 SHA1 SHA512 SSDEEP

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\seoxtri5.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 1.0MB
SHA256 2482a65c9086f7b9a96c7f6467c347673f3330662fba353ace051abe221b69f4
MD5 d63f4cd8eb44f01fd33e2c61846dd924
SHA1 e07c3cce5a677ac464736cd9fbec134e01a94892
SHA512 5fdfc50d2dac15fd69a010cb4ea9eceb962856cc1d458278d625fd252e7411e75545cc065a944e1680f7a4bac4b25f92e05537198a74167a86197ff4ec99de75
SSDEEP 6144:vVSe3y303y3t6Tv+H84LwfALUPFUH6uaOhNJeH+cHivsO0mlNfdY+TBhoIs:rv+H84LwfAgPujW6Nfi+16I
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/564-0-0x0000000000DF0000-0x00000000012B0000-memory.dmp

Download

memory/564-1-0x0000000077CC6000-0x0000000077CC8000-memory.dmp

Download

memory/564-2-0x0000000000DF1000-0x0000000000E1F000-memory.dmp

Download

memory/564-3-0x0000000000DF0000-0x00000000012B0000-memory.dmp

Download

memory/564-5-0x0000000000DF0000-0x00000000012B0000-memory.dmp

Download

memory/564-17-0x0000000000DF0000-0x00000000012B0000-memory.dmp

Download

memory/1436-87-0x0000000000280000-0x00000000004C3000-memory.dmp

Download

memory/1436-86-0x0000000000280000-0x00000000004C3000-memory.dmp

Download

memory/1916-66-0x0000000000F60000-0x0000000000FB8000-memory.dmp

Download

memory/3056-45-0x0000000000400000-0x000000000052D000-memory.dmp

Download

memory/3056-47-0x0000000000400000-0x000000000052D000-memory.dmp

Download

memory/3056-43-0x0000000000400000-0x000000000052D000-memory.dmp

Download

memory/3400-1591-0x0000000000D90000-0x0000000001250000-memory.dmp

Download

memory/3400-1550-0x0000000000D90000-0x0000000001250000-memory.dmp

Download

memory/4088-1281-0x0000000000D90000-0x0000000001250000-memory.dmp

Download

memory/4088-2580-0x0000000000D90000-0x0000000001250000-memory.dmp

Download

memory/4088-20-0x0000000000D90000-0x0000000001250000-memory.dmp

Download

memory/4088-463-0x0000000000D90000-0x0000000001250000-memory.dmp

Download

memory/4088-19-0x0000000000D90000-0x0000000001250000-memory.dmp

Download

memory/4088-18-0x0000000000D90000-0x0000000001250000-memory.dmp

Download

memory/4088-462-0x0000000000D90000-0x0000000001250000-memory.dmp

Download

memory/4088-457-0x0000000000D90000-0x0000000001250000-memory.dmp

Download

memory/4088-456-0x0000000000D90000-0x0000000001250000-memory.dmp

Download

memory/4088-433-0x0000000000D90000-0x0000000001250000-memory.dmp

Download

memory/4088-2588-0x0000000000D90000-0x0000000001250000-memory.dmp

Download

memory/4088-2587-0x0000000000D90000-0x0000000001250000-memory.dmp

Download

memory/4088-21-0x0000000000D90000-0x0000000001250000-memory.dmp

Download

memory/4088-2581-0x0000000000D90000-0x0000000001250000-memory.dmp

Download

memory/4088-2575-0x0000000000D90000-0x0000000001250000-memory.dmp

Download

memory/4088-2564-0x0000000000D90000-0x0000000001250000-memory.dmp

Download

memory/4088-2570-0x0000000000D90000-0x0000000001250000-memory.dmp

Download

memory/4088-2574-0x0000000000D90000-0x0000000001250000-memory.dmp

Download

memory/4088-2558-0x0000000000D90000-0x0000000001250000-memory.dmp

Download

memory/4088-2576-0x0000000000D90000-0x0000000001250000-memory.dmp

Download

memory/4220-40-0x000000007368E000-0x000000007368F000-memory.dmp

Download

memory/4220-41-0x0000000000F50000-0x00000000010A2000-memory.dmp

Download

memory/4888-70-0x0000000000400000-0x0000000000643000-memory.dmp

Download

memory/4888-68-0x0000000000400000-0x0000000000643000-memory.dmp

Download

memory/5300-2578-0x0000000000D90000-0x0000000001250000-memory.dmp

Download

memory/5300-2579-0x0000000000D90000-0x0000000001250000-memory.dmp

Download