amadey | 1a57e34d85775c7335f37961bc07658a839d04931a31ad07380985fce3e10a09

Analysis

max time kernel
150s
max time network
145s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
17/08/2024, 20:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1a57e34d85775c7335f37961bc07658a839d04931a31ad07380985fce3e10a09.exe
Size

1.8MB
MD5

a551c4cc7296af05a51ce367e84bca6a
SHA1

b660f9ece06d72523ab860dc11d21cc516a89f88
SHA256

1a57e34d85775c7335f37961bc07658a839d04931a31ad07380985fce3e10a09
SHA512

14a8880ca3205f8d62afc8876c7015415c35ebfe530a4a1cab0f474565d3cc6fb3b54ae3cfe8faaffe96a7d8ad6a0c73b68b890fbfb950fff08ea278bc5aa03b
SSDEEP

49152:dtv4SOUyxZep9Ehgd0QPJPQ+z/fj6hTb2Jf0Z7ctAT:dF4T3ZCTd0QhPQon+hu9eP

Score

10^/10

amadey stealc c7817d kora nord credential_access discovery evasion persistence spyware stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

c7817d

http://31.41.244.10

Attributes

install_dir
0e8d0864aa
install_file
svoutse.exe
strings_key
5481b88a6ef75bcf21333988a4e47048
url_paths
/Dem7kTu/index.php

rc4.plain

Extracted

Family

stealc

Botnet

nord

http://185.215.113.100

Attributes

url_path
/e2b1563c6670f193.php

Extracted

Family

stealc

Botnet

kora

http://185.215.113.100

Attributes

url_path
/e2b1563c6670f193.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Stealc
Stealc is an infostealer written in C++.
stealer stealc
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	1a57e34d85775c7335f37961bc07658a839d04931a31ad07380985fce3e10a09.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	svoutse.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	svoutse.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	svoutse.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	svoutse.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 8 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	1a57e34d85775c7335f37961bc07658a839d04931a31ad07380985fce3e10a09.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	1a57e34d85775c7335f37961bc07658a839d04931a31ad07380985fce3e10a09.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	svoutse.exe

Executes dropped EXE 7 IoCs

pid	Process
908	svoutse.exe
1488	7e274b77aa.exe
4940	5ae61c65af.exe
340	6bb3871c05.exe
3996	svoutse.exe
2824	svoutse.exe
1028	svoutse.exe

Identifies Wine through registry keys 2 TTPs 5 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000\Software\Wine	1a57e34d85775c7335f37961bc07658a839d04931a31ad07380985fce3e10a09.exe
Key opened	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000\Software\Wine	svoutse.exe
Key opened	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000\Software\Wine	svoutse.exe
Key opened	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000\Software\Wine	svoutse.exe
Key opened	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000\Software\Wine	svoutse.exe

Loads dropped DLL 2 IoCs

pid	Process
2320	RegAsm.exe
2320	RegAsm.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000\Software\Microsoft\Windows\CurrentVersion\Run\7e274b77aa.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000001001\\7e274b77aa.exe"	svoutse.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

AutoIT Executable 3 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/3860-44-0x0000000000400000-0x000000000052D000-memory.dmp	autoit_exe
behavioral2/memory/3860-46-0x0000000000400000-0x000000000052D000-memory.dmp	autoit_exe
behavioral2/memory/3860-48-0x0000000000400000-0x000000000052D000-memory.dmp	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
2712	1a57e34d85775c7335f37961bc07658a839d04931a31ad07380985fce3e10a09.exe
908	svoutse.exe
3996	svoutse.exe
2824	svoutse.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1488 set thread context of 3860	1488	7e274b77aa.exe	85
PID 4940 set thread context of 2320	4940	5ae61c65af.exe	88

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\svoutse.job	1a57e34d85775c7335f37961bc07658a839d04931a31ad07380985fce3e10a09.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7e274b77aa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5ae61c65af.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6bb3871c05.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1a57e34d85775c7335f37961bc07658a839d04931a31ad07380985fce3e10a09.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svoutse.exe

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RegAsm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	RegAsm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2712	1a57e34d85775c7335f37961bc07658a839d04931a31ad07380985fce3e10a09.exe
2712	1a57e34d85775c7335f37961bc07658a839d04931a31ad07380985fce3e10a09.exe
908	svoutse.exe
908	svoutse.exe
2320	RegAsm.exe
2320	RegAsm.exe
3996	svoutse.exe
3996	svoutse.exe
2320	RegAsm.exe
2320	RegAsm.exe
2824	svoutse.exe
2824	svoutse.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4088	firefox.exe
Token: SeDebugPrivilege	4088	firefox.exe
Token: SeDebugPrivilege	4088	firefox.exe
Token: SeDebugPrivilege	4088	firefox.exe
Token: SeDebugPrivilege	4088	firefox.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3860	RegAsm.exe
3860	RegAsm.exe
3860	RegAsm.exe
3860	RegAsm.exe
3860	RegAsm.exe
3860	RegAsm.exe
4088	firefox.exe
4088	firefox.exe
4088	firefox.exe
4088	firefox.exe
3860	RegAsm.exe
4088	firefox.exe
4088	firefox.exe
4088	firefox.exe
4088	firefox.exe
4088	firefox.exe
4088	firefox.exe
4088	firefox.exe
4088	firefox.exe
4088	firefox.exe
4088	firefox.exe
4088	firefox.exe
4088	firefox.exe
4088	firefox.exe
4088	firefox.exe
4088	firefox.exe
4088	firefox.exe
4088	firefox.exe
3860	RegAsm.exe
3860	RegAsm.exe
3860	RegAsm.exe
3860	RegAsm.exe
3860	RegAsm.exe
3860	RegAsm.exe
3860	RegAsm.exe
3860	RegAsm.exe
3860	RegAsm.exe
3860	RegAsm.exe
3860	RegAsm.exe
3860	RegAsm.exe
3860	RegAsm.exe
3860	RegAsm.exe
3860	RegAsm.exe
3860	RegAsm.exe
3860	RegAsm.exe
3860	RegAsm.exe
3860	RegAsm.exe
3860	RegAsm.exe
3860	RegAsm.exe
3860	RegAsm.exe
3860	RegAsm.exe
3860	RegAsm.exe
3860	RegAsm.exe
3860	RegAsm.exe
3860	RegAsm.exe
3860	RegAsm.exe
3860	RegAsm.exe
3860	RegAsm.exe
3860	RegAsm.exe
3860	RegAsm.exe
3860	RegAsm.exe
3860	RegAsm.exe
3860	RegAsm.exe
3860	RegAsm.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3860	RegAsm.exe
3860	RegAsm.exe
3860	RegAsm.exe
3860	RegAsm.exe
3860	RegAsm.exe
3860	RegAsm.exe
3860	RegAsm.exe
3860	RegAsm.exe
3860	RegAsm.exe
3860	RegAsm.exe
3860	RegAsm.exe
3860	RegAsm.exe
3860	RegAsm.exe
3860	RegAsm.exe
3860	RegAsm.exe
3860	RegAsm.exe
3860	RegAsm.exe
3860	RegAsm.exe
3860	RegAsm.exe
3860	RegAsm.exe
3860	RegAsm.exe
3860	RegAsm.exe
3860	RegAsm.exe
3860	RegAsm.exe
3860	RegAsm.exe
3860	RegAsm.exe
3860	RegAsm.exe
3860	RegAsm.exe
3860	RegAsm.exe
3860	RegAsm.exe
3860	RegAsm.exe
3860	RegAsm.exe
3860	RegAsm.exe
3860	RegAsm.exe
3860	RegAsm.exe
3860	RegAsm.exe
3860	RegAsm.exe
3860	RegAsm.exe
3860	RegAsm.exe
3860	RegAsm.exe
3860	RegAsm.exe
3860	RegAsm.exe
3860	RegAsm.exe
3860	RegAsm.exe
3860	RegAsm.exe
3860	RegAsm.exe
3860	RegAsm.exe
3860	RegAsm.exe
3860	RegAsm.exe
3860	RegAsm.exe
3860	RegAsm.exe
3860	RegAsm.exe
3860	RegAsm.exe
3860	RegAsm.exe
3860	RegAsm.exe
3860	RegAsm.exe
3860	RegAsm.exe
3860	RegAsm.exe
3860	RegAsm.exe
3860	RegAsm.exe
3860	RegAsm.exe
3860	RegAsm.exe
3860	RegAsm.exe
3860	RegAsm.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4088	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2712 wrote to memory of 908	2712	1a57e34d85775c7335f37961bc07658a839d04931a31ad07380985fce3e10a09.exe	82
PID 2712 wrote to memory of 908	2712	1a57e34d85775c7335f37961bc07658a839d04931a31ad07380985fce3e10a09.exe	82
PID 2712 wrote to memory of 908	2712	1a57e34d85775c7335f37961bc07658a839d04931a31ad07380985fce3e10a09.exe	82
PID 908 wrote to memory of 1488	908	svoutse.exe	83
PID 908 wrote to memory of 1488	908	svoutse.exe	83
PID 908 wrote to memory of 1488	908	svoutse.exe	83
PID 1488 wrote to memory of 4548	1488	7e274b77aa.exe	84
PID 1488 wrote to memory of 4548	1488	7e274b77aa.exe	84
PID 1488 wrote to memory of 4548	1488	7e274b77aa.exe	84
PID 1488 wrote to memory of 3860	1488	7e274b77aa.exe	85
PID 1488 wrote to memory of 3860	1488	7e274b77aa.exe	85
PID 1488 wrote to memory of 3860	1488	7e274b77aa.exe	85
PID 1488 wrote to memory of 3860	1488	7e274b77aa.exe	85
PID 1488 wrote to memory of 3860	1488	7e274b77aa.exe	85
PID 1488 wrote to memory of 3860	1488	7e274b77aa.exe	85
PID 1488 wrote to memory of 3860	1488	7e274b77aa.exe	85
PID 1488 wrote to memory of 3860	1488	7e274b77aa.exe	85
PID 1488 wrote to memory of 3860	1488	7e274b77aa.exe	85
PID 1488 wrote to memory of 3860	1488	7e274b77aa.exe	85
PID 908 wrote to memory of 4940	908	svoutse.exe	86
PID 908 wrote to memory of 4940	908	svoutse.exe	86
PID 908 wrote to memory of 4940	908	svoutse.exe	86
PID 4940 wrote to memory of 788	4940	5ae61c65af.exe	87
PID 4940 wrote to memory of 788	4940	5ae61c65af.exe	87
PID 4940 wrote to memory of 788	4940	5ae61c65af.exe	87
PID 4940 wrote to memory of 2320	4940	5ae61c65af.exe	88
PID 4940 wrote to memory of 2320	4940	5ae61c65af.exe	88
PID 4940 wrote to memory of 2320	4940	5ae61c65af.exe	88
PID 4940 wrote to memory of 2320	4940	5ae61c65af.exe	88
PID 4940 wrote to memory of 2320	4940	5ae61c65af.exe	88
PID 4940 wrote to memory of 2320	4940	5ae61c65af.exe	88
PID 4940 wrote to memory of 2320	4940	5ae61c65af.exe	88
PID 4940 wrote to memory of 2320	4940	5ae61c65af.exe	88
PID 4940 wrote to memory of 2320	4940	5ae61c65af.exe	88
PID 908 wrote to memory of 340	908	svoutse.exe	89
PID 908 wrote to memory of 340	908	svoutse.exe	89
PID 908 wrote to memory of 340	908	svoutse.exe	89
PID 3860 wrote to memory of 4628	3860	RegAsm.exe	90
PID 3860 wrote to memory of 4628	3860	RegAsm.exe	90
PID 4628 wrote to memory of 4088	4628	firefox.exe	93
PID 4628 wrote to memory of 4088	4628	firefox.exe	93
PID 4628 wrote to memory of 4088	4628	firefox.exe	93
PID 4628 wrote to memory of 4088	4628	firefox.exe	93
PID 4628 wrote to memory of 4088	4628	firefox.exe	93
PID 4628 wrote to memory of 4088	4628	firefox.exe	93
PID 4628 wrote to memory of 4088	4628	firefox.exe	93
PID 4628 wrote to memory of 4088	4628	firefox.exe	93
PID 4628 wrote to memory of 4088	4628	firefox.exe	93
PID 4628 wrote to memory of 4088	4628	firefox.exe	93
PID 4628 wrote to memory of 4088	4628	firefox.exe	93
PID 4088 wrote to memory of 1444	4088	firefox.exe	94
PID 4088 wrote to memory of 1444	4088	firefox.exe	94
PID 4088 wrote to memory of 1444	4088	firefox.exe	94
PID 4088 wrote to memory of 1444	4088	firefox.exe	94
PID 4088 wrote to memory of 1444	4088	firefox.exe	94
PID 4088 wrote to memory of 1444	4088	firefox.exe	94
PID 4088 wrote to memory of 1444	4088	firefox.exe	94
PID 4088 wrote to memory of 1444	4088	firefox.exe	94
PID 4088 wrote to memory of 1444	4088	firefox.exe	94
PID 4088 wrote to memory of 1444	4088	firefox.exe	94
PID 4088 wrote to memory of 1444	4088	firefox.exe	94
PID 4088 wrote to memory of 1444	4088	firefox.exe	94
PID 4088 wrote to memory of 1444	4088	firefox.exe	94
PID 4088 wrote to memory of 1444	4088	firefox.exe	94

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\1a57e34d85775c7335f37961bc07658a839d04931a31ad07380985fce3e10a09.exe
"C:\Users\Admin\AppData\Local\Temp\1a57e34d85775c7335f37961bc07658a839d04931a31ad07380985fce3e10a09.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2712
- C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
  "C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:908
- - C:\Users\Admin\AppData\Local\Temp\1000001001\7e274b77aa.exe
    "C:\Users\Admin\AppData\Local\Temp\1000001001\7e274b77aa.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1488
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      PID:4548
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:3860
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4628
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
        6⤵
        Checks processor information in registry
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4088
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1940 -parentBuildID 20240401114208 -prefsHandle 1868 -prefMapHandle 1860 -prefsLen 23678 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7510a7e2-05b5-4f38-8ad3-a5ea180fe260} 4088 "\\.\pipe\gecko-crash-server-pipe.4088" gpu
        7⤵
        
        PID:1444
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2352 -parentBuildID 20240401114208 -prefsHandle 2340 -prefMapHandle 2336 -prefsLen 24598 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {af497560-d32d-431d-87e5-0fdea5bc55e7} 4088 "\\.\pipe\gecko-crash-server-pipe.4088" socket
        7⤵
        
        PID:1200
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3432 -childID 1 -isForBrowser -prefsHandle 3424 -prefMapHandle 3420 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1380 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7dad8aa9-1228-402c-968d-ec390cd0ff6a} 4088 "\\.\pipe\gecko-crash-server-pipe.4088" tab
        7⤵
        
        PID:3912
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3836 -childID 2 -isForBrowser -prefsHandle 3220 -prefMapHandle 972 -prefsLen 29088 -prefMapSize 244658 -jsInitHandle 1380 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5a6a46ef-0617-41aa-89fe-70953e9c894b} 4088 "\\.\pipe\gecko-crash-server-pipe.4088" tab
        7⤵
        
        PID:1504
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4740 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4732 -prefMapHandle 4728 -prefsLen 29088 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {caf84830-dfa6-4321-bd07-a557d81925df} 4088 "\\.\pipe\gecko-crash-server-pipe.4088" utility
        7⤵
        Checks processor information in registry
        
        PID:5024
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5580 -childID 3 -isForBrowser -prefsHandle 5564 -prefMapHandle 5568 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1380 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {da26102b-d00d-4bee-bd9e-b4478f9fe9da} 4088 "\\.\pipe\gecko-crash-server-pipe.4088" tab
        7⤵
        
        PID:2832
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5776 -childID 4 -isForBrowser -prefsHandle 5784 -prefMapHandle 5728 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1380 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d37decae-3994-48a4-abf5-1f43d0e5c8a9} 4088 "\\.\pipe\gecko-crash-server-pipe.4088" tab
        7⤵
        
        PID:4908
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5932 -childID 5 -isForBrowser -prefsHandle 5852 -prefMapHandle 5856 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1380 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e6057f8f-f45a-433b-aa07-b77f6904c57f} 4088 "\\.\pipe\gecko-crash-server-pipe.4088" tab
        7⤵
        
        PID:4316
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5896 -childID 6 -isForBrowser -prefsHandle 6252 -prefMapHandle 6256 -prefsLen 27182 -prefMapSize 244658 -jsInitHandle 1380 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7d22a82e-5419-4b4c-9c82-d9c699d38b73} 4088 "\\.\pipe\gecko-crash-server-pipe.4088" tab
        7⤵
        
        PID:2872
- - C:\Users\Admin\AppData\Local\Temp\1000002001\5ae61c65af.exe
    "C:\Users\Admin\AppData\Local\Temp\1000002001\5ae61c65af.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4940
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      PID:788
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      PID:2320
- - C:\Users\Admin\1000003002\6bb3871c05.exe
    "C:\Users\Admin\1000003002\6bb3871c05.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:340

C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3996

C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2824

C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Identifies Wine through registry keys
PID:1028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\mozglue.dll

Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
C:\ProgramData\nss3.dll

Filesize
2.0MB

MD5
1cc453cdf74f31e4d913ff9c10acdde2

SHA1
6e85eae544d6e965f15fa5c39700fa7202f3aafe

SHA256
ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

SHA512
dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

Download Submit
C:\Users\Admin\1000003002\6bb3871c05.exe

Filesize
187KB

MD5
278ee1426274818874556aa18fd02e3a

SHA1
185a2761330024dec52134df2c8388c461451acb

SHA256
37257ddb1a6f309a6e9d147b5fc2551a9cae3a0e52b191b18d9465bfcb5c18eb

SHA512
07ec6759af5b9a00d8371b9fd9b723012dd0a1614cfcc7cd51975a004f69ffb90083735e9a871a2aa0e8d28799beac53a4748f55f4dd1e7495bc7388ebf4d6a0

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\adahrqhl.default-release\activity-stream.discovery_stream.json

Filesize
34KB

MD5
470281daaa89b9f56dd66bdc7d18de9f

SHA1
c853c35b1a7bcf2ff6270ecd02c2e27a14ae1801

SHA256
22d06347a14c2bb663b7ae0bdb9ac802835d9995543463199575f3757d73dd17

SHA512
25c54fc2d47ac06a25b576bf633c0ca201db1fd15e65398c31349ca44baf662f8be6775221e9aed97532fc203e3e2e85103538ed38ab5ca8f4cc3d7fa315f0ec

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\adahrqhl.default-release\cache2\entries\E449899591A9BC91DFBA673EC0589B51E541A88B

Filesize
13KB

MD5
2d409690d863033eb2be250754e0df9c

SHA1
fb9d549b9c9be3acd2c2dd98778d12a7f99e5414

SHA256
b241f5bb5a015439f16e13c545076110489956483796ed96681e6b4659684767

SHA512
dc84b199937ea9958d5bcd6f1d8b881f73fcd7a8da9c64d65df71f2add272c9abc4345535d35ee1f99860723b87c3eb17041154997327095c50bfc69c601a172

Download Submit
C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe

Filesize
1.8MB

MD5
a551c4cc7296af05a51ce367e84bca6a

SHA1
b660f9ece06d72523ab860dc11d21cc516a89f88

SHA256
1a57e34d85775c7335f37961bc07658a839d04931a31ad07380985fce3e10a09

SHA512
14a8880ca3205f8d62afc8876c7015415c35ebfe530a4a1cab0f474565d3cc6fb3b54ae3cfe8faaffe96a7d8ad6a0c73b68b890fbfb950fff08ea278bc5aa03b

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000001001\7e274b77aa.exe

Filesize
1.2MB

MD5
839be7c9a15556648c2c0fcaa9bfc281

SHA1
90a16d02ba8d7e8d3446937d385b4bc891ed6367

SHA256
94a674f673bd386a4f192d505b7317687e15185b176c0f3e3b9df437677a961a

SHA512
26f2a50c67901b3b9fa3b1666069899ebc763437d5be7dee46a972a0f10038ef04ed9ea8a7e20f671fb86a7cd8c8ed73c4bb36441db0d24da64fa1a78fd57d00

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000002001\5ae61c65af.exe

Filesize
206KB

MD5
aa22e27c237d9c1753c1d0f5b33ed5cc

SHA1
4a2814dd180be11b9cb1ecae696d7a7d579e5d84

SHA256
ac7db8694704845e72e96199e21f95630177f59dd7139139a5d1cbe1b26334a8

SHA512
11fdc766d7ec9aeb414d1fd778b5bb58650756db081c4b8e85f1a9c0a160e13bbfcd94b5bee03cffb14c0b1f997425f0f76d8a4bf1d81c1b5a1644474c946780

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\adahrqhl.default-release\AlternateServices.bin

Filesize
7KB

MD5
f03b90d57fa687d268a1f766282d30fe

SHA1
d7afa6d9e7da6193955580f99fae02a805e4dbde

SHA256
b238517aa4e29c1dc6aa119ebb31f31b707962053163fe8661937c6ddfeb9c57

SHA512
c6dd7c52d680ae465d81b818d469e57a617fa07f4f6459d8f4f827d4e8a6e7c405be796b6e9d1df6b128147b6d2ad997544822c7b48e7726a1bab10b2bafe17b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\adahrqhl.default-release\AlternateServices.bin

Filesize
10KB

MD5
2f3a1ed0f546a9f9d58f4776fddd27d9

SHA1
f019573e8dea695d85c0d5c60133a7467617eee4

SHA256
f19d9e2175f266701589d45f5c43311252673ccb457daa88669091090b4e5691

SHA512
ed61f1493ab1f5102eaee98ed85b4f2337d3d2a786f23b20c995c2b40434a9c410f55d07c7dbb7fd0351bd612dde19be4eb86fda660fe5a69854a67897323f58

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\adahrqhl.default-release\AlternateServices.bin

Filesize
12KB

MD5
04ab9a055a29b95d2211652c4ef1888e

SHA1
9ec90d19342da999113ad40f58a4912060501059

SHA256
ae3c0d4dc24095e478df0fe1e804928de62a8ccb13b6b3a92245e782d8ff5971

SHA512
a4882538c1c542be0acb693791ffe5fd484feab1d878f739e97116c4968bbb442c7541c949570bded092af52d591ec2b27ee41ff2a7eb4e185bedbf112b177b0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\adahrqhl.default-release\cookies.sqlite

Filesize
512KB

MD5
3c8b2eea2682d21d9ea372c07fb9888d

SHA1
708f00ea37410a9efe9d289bb500a9b19f73e969

SHA256
1b415a8c2ec961c456c7d3070e2e236cf7f3292251b7055e4bb931c92ff757da

SHA512
097422e74b48c43183b302203c430e45a5dc418a5108d26c3f4227d87980bf566ea535cdf6f15db6e336d63dac038ddfa27a6a629a46df217dd58277382ea358

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\adahrqhl.default-release\cookies.sqlite-wal

Filesize
512KB

MD5
741baddcf206aac6eae41b2e888cc3ca

SHA1
13e2c4355bebaf78542b5986e749f189f0a04fab

SHA256
c1e47eafbb2e3d381f596cdb6bfd683cbb207822bda8df7e78a10d71cffd0a9e

SHA512
b927ca57169cd211df5471370c78794d35ab20d314daf12f305269d1a6577368222a64b13e9191077f0ad952c2a50f8d2c70686e0ca6af881e8cb4d6fea242af

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\adahrqhl.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
7ed512766f925f0d59aa0bdeddf0dcf1

SHA1
ca391de241954f03860114e6a29a2fe0c959a626

SHA256
5f64b056ca2c76fc71369be5d45dcd44ca2f0ad0b78fa067ce0178223d84b103

SHA512
efbfbec7576a71425b66a7008e7893183a39ec4f43e831b28ed1ecbdd4aa7b78dd17abb5af1d5765a851b0b397f727ae2cebc61e857a8e0abdea45ec4140bf58

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\adahrqhl.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
ff9988e82c8d7ee447b9b181a263eef6

SHA1
205f571a9a1b3f5a0d504555dddd0159726edf31

SHA256
2e17b4b2dac7d8729355dba1eca7e8b3a614021f7c69eb02edbf91bfb9712267

SHA512
c16371029e97a8c7fe5547bca02ef504c3f87c65d33c10fc1e52748a6f354fd0729e7a3351b85e1edb8d872565f9d32b68a5ca263fad422e584b9ce5039e0d90

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\adahrqhl.default-release\datareporting\glean\db\data.safe.tmp

Filesize
16KB

MD5
e856a8f13c4ae6f89c90f7325c6a46ad

SHA1
112fc2ed7553001d962c54a264368f68bd423095

SHA256
7fc8678b69886538ddfaac34d85b4f66890829a4d5c18e5a0e7d78ae73601b01

SHA512
f02a378ff25b0a457aca28b004b2186aeb8f0cdc73d540f5e81f25a4f87d91c52f47c76e77172e4cf2a0bb4c9521754acccc8789861b186f331ecb40dcbf0f12

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\adahrqhl.default-release\datareporting\glean\db\data.safe.tmp

Filesize
15KB

MD5
f5433c74ef7a715d4457f3fca9ad97c1

SHA1
660c0aab9368600c48b8bd2df94411a06dede36d

SHA256
1e9c4a5825d27de63fdebedc785426574f5df3a69c2fa465cd1d7585bba2b43e

SHA512
01c8741720468adfa4ab92d1a5e1a55a54cf881e0d071c5b5ad57ebb1eb1de519bec15620a46fb76b357d856c7d6e49c1dd03cd08eabc7b23d042f7026702928

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\adahrqhl.default-release\datareporting\glean\pending_pings\1d5f4017-9e69-4401-a858-ec35c8a1f496

Filesize
26KB

MD5
e6a10257779a5c978ed8b1747a4eba7f

SHA1
eec77b65a3499189dae8d3b5a67daa3297db8413

SHA256
bc8723f882967b4396fc5e15ddfca5762971435e08082c3882f198a027cb2223

SHA512
bc2cfd375460bd855ed60fadb20f6c6d78abbc1bf8e65914bd5a9e4f6a0fba1b4ecd7b34d09fc9a7ed189eeeb0ca0cb75bbd572272624fb70423bd5472e3588b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\adahrqhl.default-release\datareporting\glean\pending_pings\5c15d30a-3a2d-4ee5-b0c3-6b33385621c0

Filesize
671B

MD5
8d54412503c3b386747f979c4a1ac48b

SHA1
4fdd5f14ad6c58c9874054fcc9820a118154d574

SHA256
bde2c4ce15b950a85be5bf2064e55c5a438875ddc01bea3d4ce7007fbbb4063c

SHA512
5d34150088021dbaeb9cdd1ab0859e1491723b4364312b773d1046d65cf33a57a5b2193576b00be1f44ce3f937fb98c9d55359f5a779f1c142d81454190d552b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\adahrqhl.default-release\datareporting\glean\pending_pings\bba0487e-88d8-47a7-8fa5-ff3325dcf12c

Filesize
982B

MD5
939877227b882941ec0a0478c2f0012a

SHA1
7bb035fba4e35a7fdfa223c4b4516f4aed0963bd

SHA256
c763553dbd70d70c58fcdbc6edc13ba434cb837aae62ce7cd90530ae4c20f9fc

SHA512
1d98668bd601aa009c9d0b9ffe3dd11a07a9ee8c9480b404d282bc97b6f17ab82ffee8fc769173c6c4623c19240409913de887b9403ecc40adab56c8cf2e9fc5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\adahrqhl.default-release\formhistory.sqlite

Filesize
256KB

MD5
97c1441748d6cc3e5a7030cda7543975

SHA1
f5598a45b101a5404126cd27fbb7f4b70861ee32

SHA256
2015b584b844b091d6a6280d45e9a589ea0feacf5f4b19bdd4cc21c60dbaaf91

SHA512
29d358ec7725038c6648251d8b9c32f3a40458e9c97926e0000ab42f0369b96d1ba5216eeb7c35800c740633dfd3b1e6e6aa73859644bdb9cdccaf2a3516bcb9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\adahrqhl.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\adahrqhl.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\adahrqhl.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\adahrqhl.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\adahrqhl.default-release\places.sqlite-wal

Filesize
1.3MB

MD5
e30fc4c5c05ce1e4ddda56de405b50ab

SHA1
dfc4d3eaca4b5584c7c5dae32e3da470cb3b085e

SHA256
956009133a7695fa43e873d242957d5e0bcfc0de98c168de1a5c2ddb48d4d693

SHA512
125526c621c32227213a3a219d1e072debfe424d9fb7288b4cfc4b8e8f9869bf1a4016da21956840751bd5c96b787db83aaf04cc69a29f6322989a35a9d3e33e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\adahrqhl.default-release\prefs-1.js

Filesize
12KB

MD5
d7148ce6db293d42dde7e7d8f99def82

SHA1
e90eeed845ec67b1701483d86f1aa0a1ef72a860

SHA256
3640e3abd5fbf444bd06282a8fe8e5f2595159a3c235b21690e5d05e1af42326

SHA512
f481cbc7d14a9943441a0263153f2c4d44de7cec814786c7fc73ec32c33e9e4ec09951199bd54519b260c7d19df888039482d37db97a8ff848c0d3c19f18e31c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\adahrqhl.default-release\prefs-1.js

Filesize
15KB

MD5
54ec564cb05b2edd639de0c8453bd799

SHA1
561e13acdbd7b832d397726b4a90db45ee0d99ff

SHA256
6a5c527973b6160d49c9d5246ec074e7bc25bafa3a37137887d253d09673a3e0

SHA512
c775a956a7319a79cd62b00afbe3087782842acbc6ce0adcfd4c54db70fd38bd338e86ec95097f8bee9bb978608bd1e9aa3a52633d41c4f009fe2bc4334240a3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\adahrqhl.default-release\prefs-1.js

Filesize
14KB

MD5
0f303af499ec674b9faf75d14be61145

SHA1
312f4bb1ce370639a0a79cb9cb37c6890a28d531

SHA256
2cd8d791e22c3640065bac39fafcd6f2b4458c1988fc3d4a224abab4808704de

SHA512
0f099be9b6489d186256dd2f21623e58bbdf2c51721e025a5d521d52a7f16fc056c531676a29e1913a227f1a4410b32f816f0371aabd99d78acbfaa514432c8f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\adahrqhl.default-release\prefs.js

Filesize
16KB

MD5
8d8b86c39ff79e7c743189dee1b515fa

SHA1
3b0b21bb69d2515482daa15db2f77a88a805d124

SHA256
0edf69a1d0790595b0670849998739ed18dbf922e74152322550d3ce6a125fb0

SHA512
c7c49eab8dd2619131c9add4671ba15cfd96971dd4e47634f8cb862245d6c1124c9186e0fc7503facaa636715d735fd5a8996c0b01546e3f135effb5144af9a6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\adahrqhl.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
1.2MB

MD5
930af6f87d58949b62ef36d9d07cb58c

SHA1
ee6af16921af834756359eb2ddfdf1f85d5b5b28

SHA256
9f83c4cf227d348e29c2dd35fd18fbe363403cfca7f1e2cbe37ed3a8a90c315e

SHA512
2ddef5aee3b6a10a899609306e2f01e475d9137ec8c52d179dd28bfce967b7913bad2607f25caf1b2ca1ea7e21a151fda70e2cad9649c25b5943fad23a59bbb2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\adahrqhl.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
2.8MB

MD5
d365a973ffd6a7f2dcc208ca400e6d42

SHA1
563a284fe277df372ee9126f36ccefc51eab44f4

SHA256
873753db5c86b9f0f8f6b209a8f6f68a95485457a4a994f11985e03ed6508364

SHA512
d66ebc6b9ac2bf7242e18c5462ccdb3c30e877c9e13e3d3c1e68467dcd77e3791d42282441dd747a99c1c21e88268dabad3121e2272391053007a1fd2d89922c

Download Submit
memory/340-91-0x0000000000B90000-0x0000000000DD3000-memory.dmp

Filesize
2.3MB

Download
memory/340-3143-0x0000000000B90000-0x0000000000DD3000-memory.dmp

Filesize
2.3MB

Download
memory/908-66-0x00000000005B0000-0x0000000000A77000-memory.dmp

Filesize
4.8MB

Download
memory/908-3093-0x00000000005B0000-0x0000000000A77000-memory.dmp

Filesize
4.8MB

Download
memory/908-460-0x00000000005B0000-0x0000000000A77000-memory.dmp

Filesize
4.8MB

Download
memory/908-3190-0x00000000005B0000-0x0000000000A77000-memory.dmp

Filesize
4.8MB

Download
memory/908-3184-0x00000000005B0000-0x0000000000A77000-memory.dmp

Filesize
4.8MB

Download
memory/908-480-0x00000000005B0000-0x0000000000A77000-memory.dmp

Filesize
4.8MB

Download
memory/908-90-0x00000000005B0000-0x0000000000A77000-memory.dmp

Filesize
4.8MB

Download
memory/908-82-0x00000000005B0000-0x0000000000A77000-memory.dmp

Filesize
4.8MB

Download
memory/908-81-0x00000000005B0000-0x0000000000A77000-memory.dmp

Filesize
4.8MB

Download
memory/908-545-0x00000000005B0000-0x0000000000A77000-memory.dmp

Filesize
4.8MB

Download
memory/908-3183-0x00000000005B0000-0x0000000000A77000-memory.dmp

Filesize
4.8MB

Download
memory/908-3182-0x00000000005B0000-0x0000000000A77000-memory.dmp

Filesize
4.8MB

Download
memory/908-3181-0x00000000005B0000-0x0000000000A77000-memory.dmp

Filesize
4.8MB

Download
memory/908-3177-0x00000000005B0000-0x0000000000A77000-memory.dmp

Filesize
4.8MB

Download
memory/908-18-0x00000000005B0000-0x0000000000A77000-memory.dmp

Filesize
4.8MB

Download
memory/908-19-0x00000000005B0000-0x0000000000A77000-memory.dmp

Filesize
4.8MB

Download
memory/908-20-0x00000000005B0000-0x0000000000A77000-memory.dmp

Filesize
4.8MB

Download
memory/908-21-0x00000000005B0000-0x0000000000A77000-memory.dmp

Filesize
4.8MB

Download
memory/908-936-0x00000000005B0000-0x0000000000A77000-memory.dmp

Filesize
4.8MB

Download
memory/908-1626-0x00000000005B0000-0x0000000000A77000-memory.dmp

Filesize
4.8MB

Download
memory/908-2157-0x00000000005B0000-0x0000000000A77000-memory.dmp

Filesize
4.8MB

Download
memory/908-40-0x00000000005B0000-0x0000000000A77000-memory.dmp

Filesize
4.8MB

Download
memory/1488-42-0x0000000072C5E000-0x0000000072C5F000-memory.dmp

Filesize
4KB

Download
memory/1488-41-0x0000000000220000-0x0000000000350000-memory.dmp

Filesize
1.2MB

Download
memory/2320-406-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Filesize
972KB

Download
memory/2320-70-0x0000000000400000-0x0000000000643000-memory.dmp

Filesize
2.3MB

Download
memory/2320-72-0x0000000000400000-0x0000000000643000-memory.dmp

Filesize
2.3MB

Download
memory/2712-3-0x0000000000760000-0x0000000000C27000-memory.dmp

Filesize
4.8MB

Download
memory/2712-5-0x0000000000760000-0x0000000000C27000-memory.dmp

Filesize
4.8MB

Download
memory/2712-17-0x0000000000760000-0x0000000000C27000-memory.dmp

Filesize
4.8MB

Download
memory/2712-2-0x0000000000761000-0x000000000078F000-memory.dmp

Filesize
184KB

Download
memory/2712-1-0x0000000077296000-0x0000000077298000-memory.dmp

Filesize
8KB

Download
memory/2712-0-0x0000000000760000-0x0000000000C27000-memory.dmp

Filesize
4.8MB

Download
memory/2824-3176-0x00000000005B0000-0x0000000000A77000-memory.dmp

Filesize
4.8MB

Download
memory/3860-48-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/3860-46-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/3860-44-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/3996-479-0x00000000005B0000-0x0000000000A77000-memory.dmp

Filesize
4.8MB

Download
memory/3996-478-0x00000000005B0000-0x0000000000A77000-memory.dmp

Filesize
4.8MB

Download
memory/4940-68-0x0000000000A40000-0x0000000000A78000-memory.dmp

Filesize
224KB

Download