amadey | f5d291799fa4b9a06d0a9ce3659e5a23d2af9a0078c41e647a39c717cc8a02a4

Analysis

max time kernel
150s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
15/08/2024, 11:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f5d291799fa4b9a06d0a9ce3659e5a23d2af9a0078c41e647a39c717cc8a02a4.exe
Size 1.8MB
Sample240815-narffstgpq
SHA256 f5d291799fa4b9a06d0a9ce3659e5a23d2af9a0078c41e647a39c717cc8a02a4
MD5 f557954b5982d5d5e5790159b77a006b
SHA1 bb1e26bd6f6c8c692e55e8af0a7bc55dc4cc8a40
SHA512 62d4bddb6cd0de21f343cb8c1a74fb2d782e42d2bea64e4b3f71ee5f669dc1bea9333d0c754b6d68a3bf6475a7d407bd4e57534cae9302f06adb3a87b9641a0f
SSDEEP 24576:M++7/TMrfIg/NbRR9kPROMDAqPyOOa4Zlq5PJJzAoh63c2ig8UwwQyGFL4/u0IDB:M1E7bT9AOMFyk4Zch6s2iEww9GFMMd3
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey stealc 0657d1 kora nord credential_access discovery evasion persistence stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

0657d1

http://185.215.113.19

Attributes

install_dir
0d8f5eb8a7
install_file
explorti.exe
strings_key
6c55a5f34bb433fbd933a168577b1838
url_paths
/Vi9leo/index.php

rc4.plain

Extracted

Family

stealc

Botnet

nord

http://185.215.113.100

Attributes

url_path
/e2b1563c6670f193.php

Extracted

Family

stealc

Botnet

kora

http://185.215.113.100

Attributes

url_path
/e2b1563c6670f193.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Stealc
Stealc is an infostealer written in C++.
stealer stealc
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	f5d291799fa4b9a06d0a9ce3659e5a23d2af9a0078c41e647a39c717cc8a02a4.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 10 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	f5d291799fa4b9a06d0a9ce3659e5a23d2af9a0078c41e647a39c717cc8a02a4.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	f5d291799fa4b9a06d0a9ce3659e5a23d2af9a0078c41e647a39c717cc8a02a4.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe

Executes dropped EXE 7 IoCs

pid	Process
1012	explorti.exe
960	explorti.exe
3240	6a6edf132c.exe
3044	c6044c27ad.exe
456	7351d56daf.exe
3328	explorti.exe
5140	explorti.exe

Identifies Wine through registry keys 2 TTPs 5 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000\Software\Wine	f5d291799fa4b9a06d0a9ce3659e5a23d2af9a0078c41e647a39c717cc8a02a4.exe
Key opened	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000\Software\Wine	explorti.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000\Software\Microsoft\Windows\CurrentVersion\Run\6a6edf132c.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000036001\\6a6edf132c.exe"	explorti.exe

AutoIT Executable 3 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/1476-48-0x0000000000400000-0x000000000052D000-memory.dmp	autoit_exe
behavioral2/memory/1476-50-0x0000000000400000-0x000000000052D000-memory.dmp	autoit_exe
behavioral2/memory/1476-52-0x0000000000400000-0x000000000052D000-memory.dmp	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

pid	Process
4664	f5d291799fa4b9a06d0a9ce3659e5a23d2af9a0078c41e647a39c717cc8a02a4.exe
1012	explorti.exe
960	explorti.exe
3328	explorti.exe
5140	explorti.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3240 set thread context of 1476	3240	6a6edf132c.exe	85
PID 3044 set thread context of 3312	3044	c6044c27ad.exe	87

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\explorti.job	f5d291799fa4b9a06d0a9ce3659e5a23d2af9a0078c41e647a39c717cc8a02a4.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7351d56daf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f5d291799fa4b9a06d0a9ce3659e5a23d2af9a0078c41e647a39c717cc8a02a4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorti.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6a6edf132c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c6044c27ad.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4664	f5d291799fa4b9a06d0a9ce3659e5a23d2af9a0078c41e647a39c717cc8a02a4.exe
4664	f5d291799fa4b9a06d0a9ce3659e5a23d2af9a0078c41e647a39c717cc8a02a4.exe
1012	explorti.exe
1012	explorti.exe
960	explorti.exe
960	explorti.exe
3328	explorti.exe
3328	explorti.exe
5140	explorti.exe
5140	explorti.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1132	firefox.exe
Token: SeDebugPrivilege	1132	firefox.exe
Token: SeDebugPrivilege	1132	firefox.exe
Token: SeDebugPrivilege	1132	firefox.exe
Token: SeDebugPrivilege	1132	firefox.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1476	RegAsm.exe
1476	RegAsm.exe
1476	RegAsm.exe
1476	RegAsm.exe
1476	RegAsm.exe
1476	RegAsm.exe
1476	RegAsm.exe
1132	firefox.exe
1132	firefox.exe
1132	firefox.exe
1132	firefox.exe
1132	firefox.exe
1132	firefox.exe
1132	firefox.exe
1132	firefox.exe
1132	firefox.exe
1132	firefox.exe
1132	firefox.exe
1132	firefox.exe
1132	firefox.exe
1132	firefox.exe
1132	firefox.exe
1132	firefox.exe
1132	firefox.exe
1132	firefox.exe
1132	firefox.exe
1132	firefox.exe
1132	firefox.exe
1476	RegAsm.exe
1476	RegAsm.exe
1476	RegAsm.exe
1476	RegAsm.exe
1476	RegAsm.exe
1476	RegAsm.exe
1476	RegAsm.exe
1476	RegAsm.exe
1476	RegAsm.exe
1476	RegAsm.exe
1476	RegAsm.exe
1476	RegAsm.exe
1476	RegAsm.exe
1476	RegAsm.exe
1476	RegAsm.exe
1476	RegAsm.exe
1476	RegAsm.exe
1476	RegAsm.exe
1476	RegAsm.exe
1476	RegAsm.exe
1476	RegAsm.exe
1476	RegAsm.exe
1476	RegAsm.exe
1476	RegAsm.exe
1476	RegAsm.exe
1476	RegAsm.exe
1476	RegAsm.exe
1476	RegAsm.exe
1476	RegAsm.exe
1476	RegAsm.exe
1476	RegAsm.exe
1476	RegAsm.exe
1476	RegAsm.exe
1476	RegAsm.exe
1476	RegAsm.exe
1476	RegAsm.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1476	RegAsm.exe
1476	RegAsm.exe
1476	RegAsm.exe
1476	RegAsm.exe
1476	RegAsm.exe
1476	RegAsm.exe
1476	RegAsm.exe
1476	RegAsm.exe
1476	RegAsm.exe
1476	RegAsm.exe
1476	RegAsm.exe
1476	RegAsm.exe
1476	RegAsm.exe
1476	RegAsm.exe
1476	RegAsm.exe
1476	RegAsm.exe
1476	RegAsm.exe
1476	RegAsm.exe
1476	RegAsm.exe
1476	RegAsm.exe
1476	RegAsm.exe
1476	RegAsm.exe
1476	RegAsm.exe
1476	RegAsm.exe
1476	RegAsm.exe
1476	RegAsm.exe
1476	RegAsm.exe
1476	RegAsm.exe
1476	RegAsm.exe
1476	RegAsm.exe
1476	RegAsm.exe
1476	RegAsm.exe
1476	RegAsm.exe
1476	RegAsm.exe
1476	RegAsm.exe
1476	RegAsm.exe
1476	RegAsm.exe
1476	RegAsm.exe
1476	RegAsm.exe
1476	RegAsm.exe
1476	RegAsm.exe
1476	RegAsm.exe
1476	RegAsm.exe
1476	RegAsm.exe
1476	RegAsm.exe
1476	RegAsm.exe
1476	RegAsm.exe
1476	RegAsm.exe
1476	RegAsm.exe
1476	RegAsm.exe
1476	RegAsm.exe
1476	RegAsm.exe
1476	RegAsm.exe
1476	RegAsm.exe
1476	RegAsm.exe
1476	RegAsm.exe
1476	RegAsm.exe
1476	RegAsm.exe
1476	RegAsm.exe
1476	RegAsm.exe
1476	RegAsm.exe
1476	RegAsm.exe
1476	RegAsm.exe
1476	RegAsm.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1132	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4664 wrote to memory of 1012	4664	f5d291799fa4b9a06d0a9ce3659e5a23d2af9a0078c41e647a39c717cc8a02a4.exe	82
PID 4664 wrote to memory of 1012	4664	f5d291799fa4b9a06d0a9ce3659e5a23d2af9a0078c41e647a39c717cc8a02a4.exe	82
PID 4664 wrote to memory of 1012	4664	f5d291799fa4b9a06d0a9ce3659e5a23d2af9a0078c41e647a39c717cc8a02a4.exe	82
PID 1012 wrote to memory of 3240	1012	explorti.exe	84
PID 1012 wrote to memory of 3240	1012	explorti.exe	84
PID 1012 wrote to memory of 3240	1012	explorti.exe	84
PID 3240 wrote to memory of 1476	3240	6a6edf132c.exe	85
PID 3240 wrote to memory of 1476	3240	6a6edf132c.exe	85
PID 3240 wrote to memory of 1476	3240	6a6edf132c.exe	85
PID 3240 wrote to memory of 1476	3240	6a6edf132c.exe	85
PID 3240 wrote to memory of 1476	3240	6a6edf132c.exe	85
PID 3240 wrote to memory of 1476	3240	6a6edf132c.exe	85
PID 3240 wrote to memory of 1476	3240	6a6edf132c.exe	85
PID 3240 wrote to memory of 1476	3240	6a6edf132c.exe	85
PID 3240 wrote to memory of 1476	3240	6a6edf132c.exe	85
PID 3240 wrote to memory of 1476	3240	6a6edf132c.exe	85
PID 1012 wrote to memory of 3044	1012	explorti.exe	86
PID 1012 wrote to memory of 3044	1012	explorti.exe	86
PID 1012 wrote to memory of 3044	1012	explorti.exe	86
PID 3044 wrote to memory of 3312	3044	c6044c27ad.exe	87
PID 3044 wrote to memory of 3312	3044	c6044c27ad.exe	87
PID 3044 wrote to memory of 3312	3044	c6044c27ad.exe	87
PID 3044 wrote to memory of 3312	3044	c6044c27ad.exe	87
PID 3044 wrote to memory of 3312	3044	c6044c27ad.exe	87
PID 3044 wrote to memory of 3312	3044	c6044c27ad.exe	87
PID 3044 wrote to memory of 3312	3044	c6044c27ad.exe	87
PID 3044 wrote to memory of 3312	3044	c6044c27ad.exe	87
PID 3044 wrote to memory of 3312	3044	c6044c27ad.exe	87
PID 1012 wrote to memory of 456	1012	explorti.exe	88
PID 1012 wrote to memory of 456	1012	explorti.exe	88
PID 1012 wrote to memory of 456	1012	explorti.exe	88
PID 1476 wrote to memory of 3568	1476	RegAsm.exe	89
PID 1476 wrote to memory of 3568	1476	RegAsm.exe	89
PID 3568 wrote to memory of 1132	3568	firefox.exe	92
PID 3568 wrote to memory of 1132	3568	firefox.exe	92
PID 3568 wrote to memory of 1132	3568	firefox.exe	92
PID 3568 wrote to memory of 1132	3568	firefox.exe	92
PID 3568 wrote to memory of 1132	3568	firefox.exe	92
PID 3568 wrote to memory of 1132	3568	firefox.exe	92
PID 3568 wrote to memory of 1132	3568	firefox.exe	92
PID 3568 wrote to memory of 1132	3568	firefox.exe	92
PID 3568 wrote to memory of 1132	3568	firefox.exe	92
PID 3568 wrote to memory of 1132	3568	firefox.exe	92
PID 3568 wrote to memory of 1132	3568	firefox.exe	92
PID 1132 wrote to memory of 4092	1132	firefox.exe	93
PID 1132 wrote to memory of 4092	1132	firefox.exe	93
PID 1132 wrote to memory of 4092	1132	firefox.exe	93
PID 1132 wrote to memory of 4092	1132	firefox.exe	93
PID 1132 wrote to memory of 4092	1132	firefox.exe	93
PID 1132 wrote to memory of 4092	1132	firefox.exe	93
PID 1132 wrote to memory of 4092	1132	firefox.exe	93
PID 1132 wrote to memory of 4092	1132	firefox.exe	93
PID 1132 wrote to memory of 4092	1132	firefox.exe	93
PID 1132 wrote to memory of 4092	1132	firefox.exe	93
PID 1132 wrote to memory of 4092	1132	firefox.exe	93
PID 1132 wrote to memory of 4092	1132	firefox.exe	93
PID 1132 wrote to memory of 4092	1132	firefox.exe	93
PID 1132 wrote to memory of 4092	1132	firefox.exe	93
PID 1132 wrote to memory of 4092	1132	firefox.exe	93
PID 1132 wrote to memory of 4092	1132	firefox.exe	93
PID 1132 wrote to memory of 4092	1132	firefox.exe	93
PID 1132 wrote to memory of 4092	1132	firefox.exe	93
PID 1132 wrote to memory of 4092	1132	firefox.exe	93
PID 1132 wrote to memory of 4092	1132	firefox.exe	93

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\f5d291799fa4b9a06d0a9ce3659e5a23d2af9a0078c41e647a39c717cc8a02a4.exe
"C:\Users\Admin\AppData\Local\Temp\f5d291799fa4b9a06d0a9ce3659e5a23d2af9a0078c41e647a39c717cc8a02a4.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4664
- C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
  "C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1012
- - C:\Users\Admin\AppData\Local\Temp\1000036001\6a6edf132c.exe
    "C:\Users\Admin\AppData\Local\Temp\1000036001\6a6edf132c.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3240
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:1476
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3568
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
        6⤵
        Checks processor information in registry
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1132
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2000 -parentBuildID 20240401114208 -prefsHandle 1916 -prefMapHandle 1908 -prefsLen 23678 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f4aec3d0-c125-4bec-ac58-2c8203a547a9} 1132 "\\.\pipe\gecko-crash-server-pipe.1132" gpu
        7⤵
        
        PID:4092
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2400 -parentBuildID 20240401114208 -prefsHandle 2392 -prefMapHandle 2380 -prefsLen 24598 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2889b02f-9168-4b45-a981-2a980be1cf95} 1132 "\\.\pipe\gecko-crash-server-pipe.1132" socket
        7⤵
        
        PID:2112
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3424 -childID 1 -isForBrowser -prefsHandle 3116 -prefMapHandle 3208 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1212 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7e1502e5-d38a-400c-8941-27a854d5801d} 1132 "\\.\pipe\gecko-crash-server-pipe.1132" tab
        7⤵
        
        PID:484
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4024 -childID 2 -isForBrowser -prefsHandle 4016 -prefMapHandle 3416 -prefsLen 29088 -prefMapSize 244658 -jsInitHandle 1212 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {91002e2b-68b6-47a8-8ef3-7931c35b73b5} 1132 "\\.\pipe\gecko-crash-server-pipe.1132" tab
        7⤵
        
        PID:712
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5020 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 5012 -prefMapHandle 5008 -prefsLen 29088 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ad7e8915-6612-4dac-a2a7-8b659b363395} 1132 "\\.\pipe\gecko-crash-server-pipe.1132" utility
        7⤵
        Checks processor information in registry
        
        PID:4216
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5540 -childID 3 -isForBrowser -prefsHandle 5548 -prefMapHandle 5372 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1212 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7f335907-a7cd-4101-bd30-7a5320458182} 1132 "\\.\pipe\gecko-crash-server-pipe.1132" tab
        7⤵
        
        PID:5720
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5560 -childID 4 -isForBrowser -prefsHandle 5704 -prefMapHandle 5708 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1212 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {faa0670a-bcc8-4004-a882-7ccaeea8564b} 1132 "\\.\pipe\gecko-crash-server-pipe.1132" tab
        7⤵
        
        PID:5732
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5884 -childID 5 -isForBrowser -prefsHandle 5892 -prefMapHandle 5896 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1212 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7de5c99c-7a2e-4bd8-8816-c274c768e2de} 1132 "\\.\pipe\gecko-crash-server-pipe.1132" tab
        7⤵
        
        PID:5748
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6284 -childID 6 -isForBrowser -prefsHandle 6296 -prefMapHandle 6292 -prefsLen 27182 -prefMapSize 244658 -jsInitHandle 1212 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ac7514d0-f5da-4aef-aaef-44be27b3619e} 1132 "\\.\pipe\gecko-crash-server-pipe.1132" tab
        7⤵
        
        PID:8
- - C:\Users\Admin\1000037002\c6044c27ad.exe
    "C:\Users\Admin\1000037002\c6044c27ad.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3044
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3312
- - C:\Users\Admin\AppData\Local\Temp\1000038001\7351d56daf.exe
    "C:\Users\Admin\AppData\Local\Temp\1000038001\7351d56daf.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:456

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:960

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3328

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

c6044c27ad.exe

Path C:\Users\Admin\1000037002\c6044c27ad.exe
Size 330KB
SHA256 f5185c63dd33074e8fb99b3fc5628e4632c325c40022396544cfc792b58dd15a
MD5 6bfbac43f2f89b755e6834525094bd7a
SHA1 ea6b15a43afffe46624aaa637fd8c797685b8a36
SHA512 f651e1a889c8fe25b54877fd22bfbe71e1f12f7db4d5b17eafb13e8981ee82a71b4b31325893defc499a053b908f15a207f938e247c9947ffafa1193887373df
SSDEEP 3072:I3D2K412o3ELrsSbKDlDUHDSZOXCzi8stmPVzKVl7o4jU0gGkSTqXFwoki22/TzI:wK3EyaHmEXClkz7hjYDuuFwweEwKFLF
MD5 SHA1 SHA512 SSDEEP

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zgr882s2.default-release\activity-stream.discovery_stream.json
Size 36KB
SHA256 81aa7ac2b7504c90cb72954c4a6d7098b98cb397487b2c7fa0e092a295312c0f
MD5 efd2dfdd52b0a097a0edc3bf2294e896
SHA1 5dc3a460c98900385d3189769e3f7a7665ed502c
SHA512 53d7516cc1935fc1b246f1d5a413f11daa4f82b9c5e65226a82ed4d0a58b4e2c19a9fae52a2cf6ad60867c5c848b6a6f5d6d9e38369ef20ad6f08ef9967e9783
SSDEEP 768:o383DieNdsEydsM96FTbcDiSH9vL8Z/+xjoG:/DieNdsfa5q+Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

E449899591A9BC91DFBA673EC0589B51E541A88B

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zgr882s2.default-release\cache2\entries\E449899591A9BC91DFBA673EC0589B51E541A88B
Size 13KB
SHA256 205cb80c5b8387d0584a380490f36df5d048443fee0b61648027ea8d191af402
MD5 bdf2e051a8a51ba025af16cb255b394a
SHA1 f6e0423234b7de2772b6948e9ff491976c5364f0
SHA512 ff17b8127d1cc520723921c6fb8de3df7b8c2652e85c810385ffcd0ec242c25229a44c681f9d7ac6ff590d7131e2c86d54e83a58cfab9b650ad3680c717c5960
SSDEEP 384:H/Fu9fiGLm4pUjft2WlOX8lPLZZB7t0lpDII0g6rg63:IBi8mCUjft2WAX8tzB7eD891r13
MD5 SHA1 SHA512 SSDEEP

Submit Download

explorti.exe

Path C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
Size 1.8MB
SHA256 f5d291799fa4b9a06d0a9ce3659e5a23d2af9a0078c41e647a39c717cc8a02a4
MD5 f557954b5982d5d5e5790159b77a006b
SHA1 bb1e26bd6f6c8c692e55e8af0a7bc55dc4cc8a40
SHA512 62d4bddb6cd0de21f343cb8c1a74fb2d782e42d2bea64e4b3f71ee5f669dc1bea9333d0c754b6d68a3bf6475a7d407bd4e57534cae9302f06adb3a87b9641a0f
SSDEEP 24576:M++7/TMrfIg/NbRR9kPROMDAqPyOOa4Zlq5PJJzAoh63c2ig8UwwQyGFL4/u0IDB:M1E7bT9AOMFyk4Zch6s2iEww9GFMMd3
MD5 SHA1 SHA512 SSDEEP

Submit Download

6a6edf132c.exe

Path C:\Users\Admin\AppData\Local\Temp\1000036001\6a6edf132c.exe
Size 1.3MB
SHA256 88fdc3cf67a6103d59c7e8f5461adbf9d9b508241304dbc4e3c66c718b7cf20e
MD5 2612734765aebd090503d35763541ec8
SHA1 ef79c796547bca330b8aa3cdbdee41f633dd4b11
SHA512 f6e17c16b5a39d38f41dc4510765e35d041ba298e92a3eb38f450d55fb5d64a3d671008cff5b922b7417c9c3584d4352f669d20cb8ad07102cfe84e51a2966c8
SSDEEP 24576:JW50H1bzO8MgNE0PgYomuCE1P7J1vF9cIerb9MBsMxttK416ESzGYl:JW5+1fhM4qmujLvQrbhEmG
MD5 SHA1 SHA512 SSDEEP

Submit Download

7351d56daf.exe

Path C:\Users\Admin\AppData\Local\Temp\1000038001\7351d56daf.exe
Size 187KB
SHA256 37257ddb1a6f309a6e9d147b5fc2551a9cae3a0e52b191b18d9465bfcb5c18eb
MD5 278ee1426274818874556aa18fd02e3a
SHA1 185a2761330024dec52134df2c8388c461451acb
SHA512 07ec6759af5b9a00d8371b9fd9b723012dd0a1614cfcc7cd51975a004f69ffb90083735e9a871a2aa0e8d28799beac53a4748f55f4dd1e7495bc7388ebf4d6a0
SSDEEP 3072:/k9W0KFj5qj6o8KaxfE54HnnGqaKl+b2n8O43tIFmpKa:/kE/j5K62aOanGqCbAq3SFAKa
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 479KB
SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
MD5 09372174e83dbbf696ee732fd2e875bb
SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 13.8MB
SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
MD5 0a8747a2ac9ac08ae9508f36c6d75692
SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\AlternateServices.bin
Size 10KB
SHA256 c45322a8154f0330de4457237171af8bc9941c8122795fd5d91eed67b77a36e8
MD5 4926f5699bc6ddc5bbb4209a09590af7
SHA1 0ca3070c56e6e1c2b86ca507d3fe45b69060e2f6
SHA512 07170ab07f6aa99d1b443a735cbd6b0aff7a70c0bb30f46b2803591428bb40fcfcb110d3ed87d709b76b4e90be2447e8db7873cf60b9151b5477554e5acefe37
SSDEEP 24:9WuB1oYUqzFsh2F3LFAjgu1xgRbe3pR5cO9cuhMZeuS9htK1Wp9BWW5o9xW:37K5oS9cO8A7K1WLEWUg
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 c460abe534e90a84552d31783dbab3170d1fba98501ed93bf304e397ceaa2e94
MD5 78d3b24a6d8e9d524a4f1e634eca527d
SHA1 b736fb1fd5ab55216ea33a550c524ede0fc42525
SHA512 ccf22f1c135bf7e8676c06f7577529faaf78fe68e1d1e0e704384be3e74c12f86538aa0804b485c38733e967d70f0714851e79d52c0f086481a670210e599673
SSDEEP 192:7l/66Joz0dzgCl6mSS6rvZboH6hDcEPSfc:h/66JozQzgC1bUboayEPT
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 16ed51caa19a5dedf9b6dc8d4db1105889c0dc0b9216048260854beb26584c91
MD5 47c155e5e07e9a9777216ecb4fd49aef
SHA1 294e5331eb5548443daf8fa45845048ae3b755f9
SHA512 a40ec645fb2a2b57454d0cd2a65c488911437fcf971c2abaef2c150d6dfb6a4781c4f95dbd142982740ae63b37ff519d6838e2adcdcab5975706da68c1f855ad
SSDEEP 192:Yh/66Joz0dzgCl6mSSIvrvZboHpBhon3PDf3:6/66JozQzgC1b8boLy3Pr
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\datareporting\glean\db\data.safe.tmp
Size 4KB
SHA256 909459e9f77a097541a3daf63fbca9d8e5426e18f151656fceca8ef9c4e0a2d0
MD5 9774072afbb928604838374cb5ba73cf
SHA1 695dc9374e3615ef6f4bc70bcf511c046248d8cc
SHA512 8513b6b23991c425123dcf2c573f6aa39faa002f0f5017b953ea063cacdf09e936be59bf8788335ea6c24cecfb026b9780dd4da4455011fad98faa4221c3e733
SSDEEP 96:ZSMF9ZbkW6QXNhmt/nfPP/GXyuFIiFl66Joz0dzgClKtmSSb:ZrvZboKhon32h/66Joz0dzgCl6mSSb
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 74212d2b319518597ab84c8c5550727df35397c629dcd622c9fa92758792875a
MD5 e1251969e23c35acfea9730b2b002d9b
SHA1 27166dcc7d72978b64218a2f774d4e135b44bd74
SHA512 0b2721195c6b206fbcfe73b13d18b5f6bff40f6df149335dd109b6458d0c746ef156cac327d1c4064730490f42128aeebfa6778b63069ce3d2264f986f3e03f4
SSDEEP 192:Yh/66Joz0dzgCl6mSScvrvZboHpBho43PDf:6/66JozQzgC1bYboLyYP
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\datareporting\glean\db\data.safe.tmp
Size 15KB
SHA256 a9bbdc2348690a79825acd18e53651bc205f140bde142e3c881af88015cfaffe
MD5 71634da0e1a4578089a12bd39485e872
SHA1 28fd7d55ff5da644dbf0cb9fd5c6dae68aa38926
SHA512 012f7c511de63c8cd0c7d463fea76bd4a102fbdc3fdf729073f792a402c8be81a922e9d2d800f5a790dded96a3df56dcabd218ad948a008f64505114f1a71dda
SSDEEP 384:6/66JozQzgC1b7boLyawP8JwndjVQDp71nbxbbP:3mJJZksj6Dp71nbxbbP
MD5 SHA1 SHA512 SSDEEP

Submit Download

252e25b6-7e13-4d06-9d72-e27f327f750f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\datareporting\glean\pending_pings\252e25b6-7e13-4d06-9d72-e27f327f750f
Size 24KB
SHA256 fe63f13d8e833b6b07242c8c20d3d7cac4a7ea9a5d245f12249d7ce981030be0
MD5 c2c1f615a41154eb37afc396182e959a
SHA1 b13285815b8fa4369fced1243ae799dab1022071
SHA512 4641f822c00376a4dd0dc4d006ea1bb143496fdd53008379fbefe13148782e3ba24d16b5fe22289fe0773bb3db42231c61508ec8d6795c84bf5bbb007d9f8ab0
SSDEEP 192:P2F961p1XlrJMjx62n0L+K4wY79GxB8ti98LkZMFbeMxcSRCnRkAkN4CWwo6EJry:ezTdwsIv+M6oI0Jqwy4bi5b3S7YJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

3c29d7b7-416f-44f6-8e24-d58c72eb05a6

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\datareporting\glean\pending_pings\3c29d7b7-416f-44f6-8e24-d58c72eb05a6
Size 671B
SHA256 22a0c658889a5769e8bd3362703d9e8502c102c4c56ff1279601c0e6cc8aefad
MD5 5590f17b4535fae9761e89ccbd5c845a
SHA1 31956564f1f8b5425ff442c591100f5fd72a15a6
SHA512 74494e512a10d934d04df5b87aab4002a9b4b411261941faec855b03f742b3ec5ed82627cabdcae2e11f0acc82552e169c11abd3b91e4f3345b86faae7a5e1b8
MD5 SHA1 SHA512

Submit Download

5273773f-cd69-4f6c-84c4-083115c3c641

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\datareporting\glean\pending_pings\5273773f-cd69-4f6c-84c4-083115c3c641
Size 982B
SHA256 d1f0605679b05d5924adbd99b7de0834ad3b1973d91f33bffb423ad86216e034
MD5 58b536988514655989826ce45bb5529a
SHA1 54402d73201e9d034f66e55dca7e6314298a4f53
SHA512 9d832bfde58cffe510405bd9dd82026d3c5bc3221bc3414e5a872e0a738fa89b916fc010e1131407e4db1a0499479c69e70a6ae96088371b9cf0b1043b318409
MD5 SHA1 SHA512

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Size 1.1MB
SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
MD5 842039753bf41fa5e11b3a1383061a87
SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Size 116B
SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
MD5 2a461e9eb87fd1955cea740a3444ee7a
SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Size 372B
SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
MD5 bf957ad58b55f64219ab3f793e374316
SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Size 17.8MB
SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
MD5 daf7ef3acccab478aaa7d6dc1c60f865
SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\prefs-1.js
Size 16KB
SHA256 9e5e932650c5aecdd19cab5c06e6a5103fb44f018aa549d91b1a448fb81c7fcb
MD5 bc2a4af7eb83ea9c15e6d79b39287698
SHA1 4936795723fb2fd45ba1b6c408fab7f13129c9a5
SHA512 5a6e028a65968d87cc8fad2706a116d299efefc48cfa82d9288d75d8b168430aa8077447529a9b3a294de71f61060d3fa506676bd0e0d8a1150e90e1d2d4a931
SSDEEP 192:sKnRR+fouAoGq8fu9t5/Jxcd8Ecfc9tTQHrE608laXKI+tZAI1liBw8H5Dv5SI:coq82vO+9kvTQLfpDt+w+N
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\prefs.js
Size 12KB
SHA256 032a6b6109e589698a4c4bfe807fa59de970dbd83372421f6ae4644be42815fd
MD5 b6ec562cb65be66bb1cb74ebe56cfedc
SHA1 afc5b64e399e6845f399b6d6579464797844bd1e
SHA512 44bd34af164e6cdf63a84e178716fc215db430784bb1ff9065b5b7ec5c1e48e14cbbf6c20cef02184dc2a748f60f315b2ee3373efa6a9a3863af87390ec0189b
SSDEEP 192:s5nRR+fEuAoGq8fu9t5/Jxcd8Ecfc9tTQHrE608laXKEtZKBw8HT:z0q82vO+9kvTQLfpetewc
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\prefs.js
Size 11KB
SHA256 b1e96b1872e6bccdb28a6cfdaa5ac29716db36e9bace6073db9a3e02d006b162
MD5 dbd0215967bc8faf83920642663f4f77
SHA1 ec4d3ebcc1f77c0e3eb458b869238a083dda5f88
SHA512 6c5eaa727ab375d6aa3e2d359f4d262b6f3768c25337794ecd21b6431566c6742351736d0d52c64937041ae60ca8d412787dfd87da22bffaf89e2e9efa62ea99
SSDEEP 192:Y5nRR+fEuAoGq8fu9t5/Jxcd8Ecfc9tTQHrE608laXKEtZGBw8H8:/0q82vO+9kvTQLfpetKwl
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\prefs.js
Size 10KB
SHA256 f0692ef09c4c5ee569d67db7b0af5136dacbdf57051a807fd90504f1f0e4758d
MD5 d4e095eaad4b030132d5aefcb38145d2
SHA1 e696bde88b09ac56238ed89ea10afc951398b534
SHA512 2b5283605c6d3b53a9843c9fc9b2bddb79e1d8a3e4fa99b6fa2eb1238f86acedadcc2f9e7f07416d9a4ae4162ad723af5e4476ce2f5e5821075dacf0c3c4daf9
SSDEEP 192:Y5nRR+fEFs2s1Rf9tv2xCJ32cdx8TfOtb5xK0xaXrtZGBw8V8:/L1R3vkQj0TUtstKwT
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/456-93-0x0000000000DB0000-0x0000000000FF3000-memory.dmp

Download

memory/456-91-0x0000000000DB0000-0x0000000000FF3000-memory.dmp

Download

memory/960-27-0x0000000000E21000-0x0000000000E4F000-memory.dmp

Download

memory/960-26-0x0000000000E20000-0x00000000012E5000-memory.dmp

Download

memory/960-23-0x0000000000E20000-0x00000000012E5000-memory.dmp

Download

memory/960-24-0x0000000000E20000-0x00000000012E5000-memory.dmp

Download

memory/1012-2556-0x0000000000E20000-0x00000000012E5000-memory.dmp

Download

memory/1012-2558-0x0000000000E20000-0x00000000012E5000-memory.dmp

Download

memory/1012-2572-0x0000000000E20000-0x00000000012E5000-memory.dmp

Download

memory/1012-2571-0x0000000000E20000-0x00000000012E5000-memory.dmp

Download

memory/1012-22-0x0000000000E20000-0x00000000012E5000-memory.dmp

Download

memory/1012-2562-0x0000000000E20000-0x00000000012E5000-memory.dmp

Download

memory/1012-21-0x0000000000E20000-0x00000000012E5000-memory.dmp

Download

memory/1012-20-0x0000000000E21000-0x0000000000E4F000-memory.dmp

Download

memory/1012-2561-0x0000000000E20000-0x00000000012E5000-memory.dmp

Download

memory/1012-430-0x0000000000E20000-0x00000000012E5000-memory.dmp

Download

memory/1012-453-0x0000000000E20000-0x00000000012E5000-memory.dmp

Download

memory/1012-458-0x0000000000E20000-0x00000000012E5000-memory.dmp

Download

memory/1012-2560-0x0000000000E20000-0x00000000012E5000-memory.dmp

Download

memory/1012-76-0x0000000000E20000-0x00000000012E5000-memory.dmp

Download

memory/1012-17-0x0000000000E20000-0x00000000012E5000-memory.dmp

Download

memory/1012-2559-0x0000000000E20000-0x00000000012E5000-memory.dmp

Download

memory/1012-99-0x0000000000E20000-0x00000000012E5000-memory.dmp

Download

memory/1012-2548-0x0000000000E20000-0x00000000012E5000-memory.dmp

Download

memory/1012-2547-0x0000000000E20000-0x00000000012E5000-memory.dmp

Download

memory/1012-1270-0x0000000000E20000-0x00000000012E5000-memory.dmp

Download

memory/1012-365-0x0000000000E20000-0x00000000012E5000-memory.dmp

Download

memory/1476-52-0x0000000000400000-0x000000000052D000-memory.dmp

Download

memory/1476-48-0x0000000000400000-0x000000000052D000-memory.dmp

Download

memory/1476-50-0x0000000000400000-0x000000000052D000-memory.dmp

Download

memory/3044-71-0x0000000000E10000-0x0000000000E68000-memory.dmp

Download

memory/3240-46-0x0000000000A50000-0x0000000000BA2000-memory.dmp

Download

memory/3312-75-0x0000000000400000-0x0000000000643000-memory.dmp

Download

memory/3312-73-0x0000000000400000-0x0000000000643000-memory.dmp

Download

memory/3328-2550-0x0000000000E20000-0x00000000012E5000-memory.dmp

Download

memory/4664-4-0x0000000000030000-0x00000000004F5000-memory.dmp

Download

memory/4664-16-0x0000000000030000-0x00000000004F5000-memory.dmp

Download

memory/4664-3-0x0000000000030000-0x00000000004F5000-memory.dmp

Download

memory/4664-0-0x0000000000030000-0x00000000004F5000-memory.dmp

Download

memory/4664-2-0x0000000000031000-0x000000000005F000-memory.dmp

Download

memory/4664-1-0x0000000077436000-0x0000000077438000-memory.dmp

Download

memory/5140-2564-0x0000000000E20000-0x00000000012E5000-memory.dmp

Download

memory/5140-2565-0x0000000000E20000-0x00000000012E5000-memory.dmp

Download