amadey | e9f315ca8e73dcdd580cfe25f9f231e73178bb876202112806ca5b65a45e93a1

Analysis

max time kernel
147s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
11/09/2024, 09:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e9f315ca8e73dcdd580cfe25f9f231e73178bb876202112806ca5b65a45e93a1.exe
Size 1.8MB
Sample240911-lpna8svarf
SHA256 e9f315ca8e73dcdd580cfe25f9f231e73178bb876202112806ca5b65a45e93a1
MD5 4f810a4d5286bf5189823ad3cfacd8a2
SHA1 c5c060728031b48834ff5a2739cb173a1879320d
SHA512 2557369861653779d600bba276e0507e3652da0578f0f40f6a47d2f28b9138cfc39929ec6b20cbe262f36b1a8a4fe1362592a02a936dd07a1eb9a569b1ed6937
SSDEEP 49152:SaI6wd/oTMAIR6LNwU+N9UNXx+ameYlJjZA:BedGI8poNeyhZ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey stealc c7817d rave credential_access discovery evasion execution persistence stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

c7817d

http://31.41.244.10

Attributes

install_dir
0e8d0864aa
install_file
svoutse.exe
strings_key
5481b88a6ef75bcf21333988a4e47048
url_paths
/Dem7kTu/index.php

rc4.plain

Extracted

Family

stealc

Botnet

rave

http://185.215.113.103

Attributes

url_path
/e2b1563c6670f193.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Stealc
Stealc is an infostealer written in C++.
stealer stealc
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	svoutse.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	svoutse.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	e9f315ca8e73dcdd580cfe25f9f231e73178bb876202112806ca5b65a45e93a1.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	svoutse.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	e8d6e61f4c.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	47ee257e79.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	svoutse.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 14 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	e9f315ca8e73dcdd580cfe25f9f231e73178bb876202112806ca5b65a45e93a1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	e8d6e61f4c.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	e9f315ca8e73dcdd580cfe25f9f231e73178bb876202112806ca5b65a45e93a1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	e8d6e61f4c.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	47ee257e79.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	47ee257e79.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	svoutse.exe

Executes dropped EXE 6 IoCs

pid	Process
2736	svoutse.exe
2012	e8d6e61f4c.exe
1460	47ee257e79.exe
836	svoutse.exe
3424	svoutse.exe
1464	svoutse.exe

Identifies Wine through registry keys 2 TTPs 7 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000\Software\Wine	svoutse.exe
Key opened	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000\Software\Wine	svoutse.exe
Key opened	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000\Software\Wine	e9f315ca8e73dcdd580cfe25f9f231e73178bb876202112806ca5b65a45e93a1.exe
Key opened	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000\Software\Wine	svoutse.exe
Key opened	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000\Software\Wine	e8d6e61f4c.exe
Key opened	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000\Software\Wine	47ee257e79.exe
Key opened	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000\Software\Wine	svoutse.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000\Software\Microsoft\Windows\CurrentVersion\Run\47ee257e79.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000030001\\47ee257e79.exe"	svoutse.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs

pid	Process
232	e9f315ca8e73dcdd580cfe25f9f231e73178bb876202112806ca5b65a45e93a1.exe
2736	svoutse.exe
2012	e8d6e61f4c.exe
1460	47ee257e79.exe
836	svoutse.exe
3424	svoutse.exe
1464	svoutse.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\svoutse.job	e9f315ca8e73dcdd580cfe25f9f231e73178bb876202112806ca5b65a45e93a1.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3372	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e9f315ca8e73dcdd580cfe25f9f231e73178bb876202112806ca5b65a45e93a1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svoutse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e8d6e61f4c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	47ee257e79.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks processor information in registry 2 TTPs 14 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
232	e9f315ca8e73dcdd580cfe25f9f231e73178bb876202112806ca5b65a45e93a1.exe
232	e9f315ca8e73dcdd580cfe25f9f231e73178bb876202112806ca5b65a45e93a1.exe
2736	svoutse.exe
2736	svoutse.exe
2012	e8d6e61f4c.exe
2012	e8d6e61f4c.exe
1460	47ee257e79.exe
1460	47ee257e79.exe
3372	powershell.exe
3372	powershell.exe
3372	powershell.exe
3372	powershell.exe
3372	powershell.exe
3372	powershell.exe
3372	powershell.exe
836	svoutse.exe
836	svoutse.exe
3424	svoutse.exe
3424	svoutse.exe
1464	svoutse.exe
1464	svoutse.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	3372	powershell.exe
Token: SeDebugPrivilege	432	firefox.exe
Token: SeDebugPrivilege	432	firefox.exe
Token: SeDebugPrivilege	432	firefox.exe
Token: SeDebugPrivilege	432	firefox.exe
Token: SeDebugPrivilege	432	firefox.exe

Suspicious use of FindShellTrayWindow 21 IoCs

pid	Process
432	firefox.exe
432	firefox.exe
432	firefox.exe
432	firefox.exe
432	firefox.exe
432	firefox.exe
432	firefox.exe
432	firefox.exe
432	firefox.exe
432	firefox.exe
432	firefox.exe
432	firefox.exe
432	firefox.exe
432	firefox.exe
432	firefox.exe
432	firefox.exe
432	firefox.exe
432	firefox.exe
432	firefox.exe
432	firefox.exe
432	firefox.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
432	firefox.exe
432	firefox.exe
432	firefox.exe
432	firefox.exe
432	firefox.exe
432	firefox.exe
432	firefox.exe
432	firefox.exe
432	firefox.exe
432	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 232 wrote to memory of 2736	232	e9f315ca8e73dcdd580cfe25f9f231e73178bb876202112806ca5b65a45e93a1.exe	79
PID 232 wrote to memory of 2736	232	e9f315ca8e73dcdd580cfe25f9f231e73178bb876202112806ca5b65a45e93a1.exe	79
PID 232 wrote to memory of 2736	232	e9f315ca8e73dcdd580cfe25f9f231e73178bb876202112806ca5b65a45e93a1.exe	79
PID 2736 wrote to memory of 2012	2736	svoutse.exe	80
PID 2736 wrote to memory of 2012	2736	svoutse.exe	80
PID 2736 wrote to memory of 2012	2736	svoutse.exe	80
PID 2736 wrote to memory of 1460	2736	svoutse.exe	81
PID 2736 wrote to memory of 1460	2736	svoutse.exe	81
PID 2736 wrote to memory of 1460	2736	svoutse.exe	81
PID 2736 wrote to memory of 3372	2736	svoutse.exe	82
PID 2736 wrote to memory of 3372	2736	svoutse.exe	82
PID 2736 wrote to memory of 3372	2736	svoutse.exe	82
PID 3372 wrote to memory of 5032	3372	powershell.exe	84
PID 3372 wrote to memory of 5032	3372	powershell.exe	84
PID 3372 wrote to memory of 5032	3372	powershell.exe	84
PID 3372 wrote to memory of 4764	3372	powershell.exe	85
PID 3372 wrote to memory of 4764	3372	powershell.exe	85
PID 3372 wrote to memory of 4764	3372	powershell.exe	85
PID 3372 wrote to memory of 1440	3372	powershell.exe	88
PID 3372 wrote to memory of 1440	3372	powershell.exe	88
PID 3372 wrote to memory of 3308	3372	powershell.exe	89
PID 3372 wrote to memory of 3308	3372	powershell.exe	89
PID 1440 wrote to memory of 432	1440	firefox.exe	90
PID 1440 wrote to memory of 432	1440	firefox.exe	90
PID 1440 wrote to memory of 432	1440	firefox.exe	90
PID 1440 wrote to memory of 432	1440	firefox.exe	90
PID 1440 wrote to memory of 432	1440	firefox.exe	90
PID 1440 wrote to memory of 432	1440	firefox.exe	90
PID 1440 wrote to memory of 432	1440	firefox.exe	90
PID 1440 wrote to memory of 432	1440	firefox.exe	90
PID 1440 wrote to memory of 432	1440	firefox.exe	90
PID 1440 wrote to memory of 432	1440	firefox.exe	90
PID 1440 wrote to memory of 432	1440	firefox.exe	90
PID 432 wrote to memory of 3592	432	firefox.exe	91
PID 432 wrote to memory of 3592	432	firefox.exe	91
PID 432 wrote to memory of 3592	432	firefox.exe	91
PID 432 wrote to memory of 3592	432	firefox.exe	91
PID 432 wrote to memory of 3592	432	firefox.exe	91
PID 432 wrote to memory of 3592	432	firefox.exe	91
PID 432 wrote to memory of 3592	432	firefox.exe	91
PID 432 wrote to memory of 3592	432	firefox.exe	91
PID 432 wrote to memory of 3592	432	firefox.exe	91
PID 432 wrote to memory of 3592	432	firefox.exe	91
PID 432 wrote to memory of 3592	432	firefox.exe	91
PID 432 wrote to memory of 3592	432	firefox.exe	91
PID 432 wrote to memory of 3592	432	firefox.exe	91
PID 432 wrote to memory of 3592	432	firefox.exe	91
PID 432 wrote to memory of 3592	432	firefox.exe	91
PID 432 wrote to memory of 3592	432	firefox.exe	91
PID 432 wrote to memory of 3592	432	firefox.exe	91
PID 432 wrote to memory of 3592	432	firefox.exe	91
PID 432 wrote to memory of 3592	432	firefox.exe	91
PID 432 wrote to memory of 3592	432	firefox.exe	91
PID 432 wrote to memory of 3592	432	firefox.exe	91
PID 432 wrote to memory of 3592	432	firefox.exe	91
PID 432 wrote to memory of 3592	432	firefox.exe	91
PID 432 wrote to memory of 3592	432	firefox.exe	91
PID 432 wrote to memory of 3592	432	firefox.exe	91
PID 432 wrote to memory of 3592	432	firefox.exe	91
PID 432 wrote to memory of 3592	432	firefox.exe	91
PID 432 wrote to memory of 3592	432	firefox.exe	91
PID 432 wrote to memory of 3592	432	firefox.exe	91
PID 432 wrote to memory of 3592	432	firefox.exe	91
PID 432 wrote to memory of 3592	432	firefox.exe	91

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\e9f315ca8e73dcdd580cfe25f9f231e73178bb876202112806ca5b65a45e93a1.exe
"C:\Users\Admin\AppData\Local\Temp\e9f315ca8e73dcdd580cfe25f9f231e73178bb876202112806ca5b65a45e93a1.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:232
- C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
  "C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2736
- - C:\Users\Admin\AppData\Roaming\1000026000\e8d6e61f4c.exe
    "C:\Users\Admin\AppData\Roaming\1000026000\e8d6e61f4c.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2012
- - C:\Users\Admin\AppData\Local\Temp\1000030001\47ee257e79.exe
    "C:\Users\Admin\AppData\Local\Temp\1000030001\47ee257e79.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1460
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\Admin\AppData\Local\Temp\1000039041\do.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3372
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c start msedge https://www.youtube.com/account
      4⤵
      System Location Discovery: System Language Discovery
      PID:5032
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c start msedge https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
      4⤵
      System Location Discovery: System Language Discovery
      PID:4764
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1440
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
        5⤵
        Checks processor information in registry
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:432
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1892 -parentBuildID 20240401114208 -prefsHandle 1820 -prefMapHandle 1812 -prefsLen 23678 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fcc82183-7261-4fcf-842b-7ae8552ccd93} 432 "\\.\pipe\gecko-crash-server-pipe.432" gpu
        6⤵
        
        PID:3592
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2360 -parentBuildID 20240401114208 -prefsHandle 2344 -prefMapHandle 2340 -prefsLen 24598 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3c50f398-face-4c3c-a33e-6ce6a7b92be1} 432 "\\.\pipe\gecko-crash-server-pipe.432" socket
        6⤵
        
        PID:4732
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3328 -childID 1 -isForBrowser -prefsHandle 2608 -prefMapHandle 2900 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 928 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1a61381c-b299-44ae-b07c-b624eccbe160} 432 "\\.\pipe\gecko-crash-server-pipe.432" tab
        6⤵
        
        PID:1232
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3464 -childID 2 -isForBrowser -prefsHandle 3308 -prefMapHandle 2912 -prefsLen 22693 -prefMapSize 244658 -jsInitHandle 928 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c39f31fc-d546-4371-abc7-a167502c6b31} 432 "\\.\pipe\gecko-crash-server-pipe.432" tab
        6⤵
        
        PID:1180
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4180 -childID 3 -isForBrowser -prefsHandle 4172 -prefMapHandle 4168 -prefsLen 29088 -prefMapSize 244658 -jsInitHandle 928 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ae082f25-cafc-4378-9925-f170460655d5} 432 "\\.\pipe\gecko-crash-server-pipe.432" tab
        6⤵
        
        PID:3664
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5028 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4980 -prefMapHandle 2792 -prefsLen 29088 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {980cdd6d-f571-4fe9-afba-d2124e0e115d} 432 "\\.\pipe\gecko-crash-server-pipe.432" utility
        6⤵
        Checks processor information in registry
        
        PID:3748
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5936 -childID 4 -isForBrowser -prefsHandle 5916 -prefMapHandle 5908 -prefsLen 27182 -prefMapSize 244658 -jsInitHandle 928 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9dbc8319-3ada-42f8-9b5b-ed7d410ed149} 432 "\\.\pipe\gecko-crash-server-pipe.432" tab
        6⤵
        
        PID:3296
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6060 -childID 5 -isForBrowser -prefsHandle 6068 -prefMapHandle 6072 -prefsLen 27182 -prefMapSize 244658 -jsInitHandle 928 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b2e7ba23-e1ad-455e-8c69-151f81419b31} 432 "\\.\pipe\gecko-crash-server-pipe.432" tab
        6⤵
        
        PID:2620
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6244 -childID 6 -isForBrowser -prefsHandle 6252 -prefMapHandle 6256 -prefsLen 27182 -prefMapSize 244658 -jsInitHandle 928 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9a547f62-52b9-4f8f-b170-700459f77df8} 432 "\\.\pipe\gecko-crash-server-pipe.432" tab
        6⤵
        
        PID:1440
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
      4⤵
      Checks processor information in registry
      PID:3308

C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:836

C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3424

C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6o52671h.default-release\activity-stream.discovery_stream.json
Size 26KB
SHA256 db2b96378460a3cd9ed857ea8316c476028ea8c9b5271b6b6ca883319dd9832d
MD5 879753165c1a015b4937a968fde9de18
SHA1 e4799cf20d1aa13672093e03732635506b803e68
SHA512 43927feb1d4946983004a66ae82d5cf4c0d6fce57fdf8474322efacbf95ec0e97655d6a8b0e31fd35cf955c7f004fedf237ec49f531c2f505962da7c91ab2f10
SSDEEP 384:RfFQyw29nI7/6BQidcLYze1+/31olM0oWmLPzVJI+TV62WtYBl4mGyauwYEgZBrA:zQSI7/idBPn1W8LGydKgZBrFZqzRD
MD5 SHA1 SHA512 SSDEEP

Submit Download

58EFA56DB4BFFECB0EDA547894BC9A057159E22F

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6o52671h.default-release\cache2\entries\58EFA56DB4BFFECB0EDA547894BC9A057159E22F
Size 13KB
SHA256 407cca4772a04fb67cd479d50161aa26b8f8fb9fadef91cc3210103b9df8213f
MD5 c20a5a68aeea18e1f91ec90b0708b0d4
SHA1 d4b69f8dca4bd1882304308b3360e5761ac07286
SHA512 ef8f0952c619a18379ded3a178c645ba2f1dda2b98afa08ef538597d580f35c0330d8af61b5575610d9a03e0522362a38f08493028536eb1df7bd90f7204ccbc
SSDEEP 384:HvGu9fiGLm4pUbpHLFoCr/E8HPJyD3VonFcP+AWRMAC4zd:PBi8mCUbpHLGCr/E8Rg3V/+hRMFe
MD5 SHA1 SHA512 SSDEEP

Submit Download

svoutse.exe

Path C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
Size 1.8MB
SHA256 e9f315ca8e73dcdd580cfe25f9f231e73178bb876202112806ca5b65a45e93a1
MD5 4f810a4d5286bf5189823ad3cfacd8a2
SHA1 c5c060728031b48834ff5a2739cb173a1879320d
SHA512 2557369861653779d600bba276e0507e3652da0578f0f40f6a47d2f28b9138cfc39929ec6b20cbe262f36b1a8a4fe1362592a02a936dd07a1eb9a569b1ed6937
SSDEEP 49152:SaI6wd/oTMAIR6LNwU+N9UNXx+ameYlJjZA:BedGI8poNeyhZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

do.ps1

Path C:\Users\Admin\AppData\Local\Temp\1000039041\do.ps1
Size 2KB
SHA256 717c09427fa5754ba92f92961545534048d0a76528c2e95c4d5ec6cef47c612f
MD5 e05e8f072b373beafe27cc11d85f947c
SHA1 1d6daeb98893e8122b8b69287ebd9d43f3c6138e
SHA512 b3e34162e5ee43bb01f289eebc45fd3ea3e07f30be40dcf6635606540f912fe5c84d301e9f78e97dfe3ffe53e72547e50f3bcd7d4ebe5ab8da451a1989c469a0
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_53amve4g.jqn.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_53amve4g.jqn.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 479KB
SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
MD5 09372174e83dbbf696ee732fd2e875bb
SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 13.8MB
SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
MD5 0a8747a2ac9ac08ae9508f36c6d75692
SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
MD5 SHA1 SHA512 SSDEEP

Submit Download

e8d6e61f4c.exe

Path C:\Users\Admin\AppData\Roaming\1000026000\e8d6e61f4c.exe
Size 1.7MB
SHA256 aee2dcc810b97f1bd7809146f7f33887e806561329c0b6288ecb1d315e4f6740
MD5 2436f5bc4146385648a72a27897ab578
SHA1 daf603434b49d4bf2866a3f53069845f05130fcb
SHA512 e32cede58485391ee8621b939f28e7234095391ad67f944929b8475528f8a08f801d3997138c0935f40d17ec3e703d0d499e7427bcc570102636e1ea8cff2a92
SSDEEP 24576:GgeQlF4+kLpUneDsY4UkgvFpPFINtkSI6ZlLC8yvoSCXocu:/dc+kqn9U77ePXIqlyU
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6o52671h.default-release\AlternateServices.bin
Size 6KB
SHA256 f717f8d001434e49d84d9e13b456c51b42edffc40cf0bdd0fbbc1be6fe2dc2b9
MD5 0922cd20e6a3a48fbedb34831f790623
SHA1 54285baa7aedd8a5cf3c690875d51c7106190376
SHA512 fe896afc859cb28c98de0ac25777f441fb91e22965a56109fa04955c282c8ff8ce0bc6858412b92e3fe44e5e8b8ee0953720063e3046182d490d5647f591be2d
SSDEEP 6:9Rgidpq88gidydgidBu45Hgidpqs7HgidBgidnu4:9RgQpB8gQWgQBu4OQphMQSQnu4
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6o52671h.default-release\AlternateServices.bin
Size 25KB
SHA256 6f3b2e9abc5b6fe267a51906a2e297f7a72e2e063f16f0ce40d21debf0c3ff4b
MD5 e9c5e0c765b5e4da8a60ce26c6c54f08
SHA1 1167acf787f96af81d4bb1fb0a7f38b928bcdc34
SHA512 336f258dafceb6d03891cd1d4eeede9becb5c785a0f0ef43252d8bbb7ed8068d1b4734589fa85c6cb3f2c433fab0126f82b79fd92034c97a9a575dbc6c8214d0
SSDEEP 96:webOJ9bJOcfpebvpf+Fbn5ooV77+bONb9bxbGgbgz4bEeFgQxbJbUIVxT7Qbkb:+uW557
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6o52671h.default-release\AlternateServices.bin
Size 10KB
SHA256 929c1d404b8dd78dbdc71332111b5de74def33bfc1d1b29bf6facb6437f73926
MD5 ab4d576e80dd9db75fc423f070431ed7
SHA1 6c32fce29557b0011770af2b36da54afea86ad13
SHA512 e3319fae9d85bfa1ab1a8623ea5c681c5e46eaee959a0cbd4e2ead50e2595eff6e163c0bc174d67d1eab1b7868642c6f19b8775e514e735458a63ad946662ab2
SSDEEP 48:QebOJ9bKA7K6jGpebvpf+gnbn5oq29cOf:QebOJ9bTfGpebvpf+Gbn5o
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6o52671h.default-release\AlternateServices.bin
Size 13KB
SHA256 483e99f379c21676ca79650cbc1f8fe086962eeda0192ed915ecd6b66ef1c0f6
MD5 0690f1b13b2691ce31916cc9be8a7c17
SHA1 242a70c28e2133ab641471e9e036017acc68a37d
SHA512 f538ce484a295ef27352326480b5f8f56096cfbe6b2442734a46935b8e20477c95b7c10125f9edd20c19786d35d25567638b23c7f3241f730ac344bb8d3fe1f1
SSDEEP 48:QebOJ9bRAA7K6jGpebvpf+gnbn5oqd9cOfh7j7vjYbHIb:QebOJ9bzfGpebvpf+Gbn5omf77Ybob
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6o52671h.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 64bedc705c82a09f6aa25520a62eae11aa373f2f6ce4de77c60ccee9b7c281ba
MD5 b3b110571bb4e7eacf1b4c696fdaf348
SHA1 5fcf7da86094d10d2561a9195de7378d003fe77a
SHA512 900c1bff878d16fc79b93abbc43e6a3940763d7b92183123b108d8e51bd799b4d1b424e893e7b9c5e44f77fceb81ada4b9df8fd78bae4045188d4ef1576dfcd2
SSDEEP 96:CWAfQgGvGaFl66Joz0dzgClKtmSSLSMF9ZbkW6QX6hmWrPP/PrWI:S6/66Joz0dzgCl6mSSLrvZboth3DPCI
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6o52671h.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 4cc6e74e80e242eaa75a2bc7c4b2169c61289f00039a746fce4508ae171841b3
MD5 aa7a55517f3af5b65614d5d4882a1782
SHA1 28a54d5003b7cf9bf0a1a69082276c51c5692dd8
SHA512 f030c2f93dad1aaffe991c44e00d4f82e7b1205c5d776453b2dc1f269c702fb40b56044ca72f4519d36b2fffa5518432199d58a054e95d237cd96866081d42c0
SSDEEP 96:qBvSMF9ZbkW6QX0BB0hmWrPP/PrWZCWAfQgGvGaFl66Joz0dzgClKtmSSM:GrvZboH0h3DPCc6/66Joz0dzgCl6mSSM
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6o52671h.default-release\datareporting\glean\db\data.safe.tmp
Size 16KB
SHA256 899c41071488b9c79cbb497f8f97d8f9d7ae7b405aa6a8020b0370c8f4bc173b
MD5 7c97717fee2a52e266e45eabaf43f1ea
SHA1 c25d1ad40ec25fcbe7c9df7fe85454a2b921306f
SHA512 0ea3926fc3a9089fb8dd2d8ebb0fd4e16e765a543792026e0b12ead61bcac5533e930f5d22a09732c5d476ccab3c79639224d34e7b8f363d7667b4b9f1cc76b1
SSDEEP 384:8/66JozQzgC1bL6fVlxqLtD5JSPblbnj03boU4eUJPrh:ZmwfJOtD5JSPblbnoGl
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6o52671h.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 47a60dc19e02fb9a05e92f8018e1895a52e11d62526f8dc3bf81c95ecebe3a52
MD5 afa847962497f033a05b9d25b7cc04c1
SHA1 84d8ecdc103df1ce8c8a41ff011e3a5732d9958f
SHA512 c7ad9b3eedcf3ce524b85598ab878c225b0ddb2fb78efc428155994973e823d6c2b4a3e6bad8a420e1cf1a3f225f28293d04d446df529cdf2cf27e8b1082cce0
SSDEEP 192:R6/66Joz0dzgCl6mSSurvZboH0hkcMDPDtY:8/66JozQzgC1bIboUy9Py
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6o52671h.default-release\datareporting\glean\db\data.safe.tmp
Size 16KB
SHA256 2fb57d8a360abb73d8e6d92b0bfe22232ab55f8ac3720ae92f042f2d895f816f
MD5 5f6ad7b2391a543e8ba519afd01bbe93
SHA1 0c424a05ef7ba92bec110261aa749239359977b4
SHA512 686c6b9230c0284fd725e472ee5cdffd84302681a26e2cf6f59cbd0e55120f93bda98fd041a53a48e482589fee82fb6adcbce11ceb9547f2e7a8bdf93f0f45ea
SSDEEP 384:p6fVlxqLtD5JSPblbny03bobeUJPrl/66JozQzgC1bM:cfJOtD5JSPblbnJe0mm
MD5 SHA1 SHA512 SSDEEP

Submit Download

2db5da34-62ca-44b3-a708-7327b2a0204b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6o52671h.default-release\datareporting\glean\pending_pings\2db5da34-62ca-44b3-a708-7327b2a0204b
Size 982B
SHA256 5e8e972867f792aab56ec1125e1c92a8067a7b21781fe44f5edd193714914933
MD5 64289ac984faaf8a214d09a2f4296bb0
SHA1 43ef623355e17331a0b965a5a1c7d56f4bf00555
SHA512 95785f8bf4d3be19eb038d294cc93847ecfc92801d99a2e838dfa89d32f5ca0b165a0731133e67c4bfe61ee88545d93806bd888520bc584993d52900674ac8a4
MD5 SHA1 SHA512

Submit Download

95ab4c7c-6d10-4d12-8b63-8cfdaba3eef2

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6o52671h.default-release\datareporting\glean\pending_pings\95ab4c7c-6d10-4d12-8b63-8cfdaba3eef2
Size 26KB
SHA256 ec32927c9fddd99dd41013769f30f01ee550680abe656ad23c6a7711f2a9c176
MD5 c25c0d8039a888a6ddd53067681a8965
SHA1 72e364152b18d2a4d2df9d2757746ea4364cd933
SHA512 fc7c198c24a2c2360df0ce88ccfa75ad29071991340fd88993034a74462794dfd2f174aaf579447c73cdded8feaa33a8e2b62c18fbf6e048178c5e2180305399
SSDEEP 384:1KS+yLkBxueRQa0lIM+w3foRC0K830Tnnc:YVXxueR183Lnc
MD5 SHA1 SHA512 SSDEEP

Submit Download

f720c149-62bc-4447-ade3-8a8afae84bac

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6o52671h.default-release\datareporting\glean\pending_pings\f720c149-62bc-4447-ade3-8a8afae84bac
Size 671B
SHA256 3193c2da4e12d7a342ef52739515d50aa38ed50ac41bce986aeb42fa7db04d17
MD5 88a42c0bb9a2543a542c1a0052c00ff5
SHA1 054b0f156d43ebf445ef216504aba67334067fb0
SHA512 98cc865fff8aaea8dcba3786ad5d5aa967ad7b6b0ca6aa0a4945be83c9a28861e2c059b00b5a154eb8a9855d73beb475b9503d3475c32bd7cd99109a22b3e063
MD5 SHA1 SHA512

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6o52671h.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Size 1.1MB
SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
MD5 842039753bf41fa5e11b3a1383061a87
SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6o52671h.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Size 116B
SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
MD5 2a461e9eb87fd1955cea740a3444ee7a
SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6o52671h.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Size 372B
SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
MD5 bf957ad58b55f64219ab3f793e374316
SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6o52671h.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Size 17.8MB
SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
MD5 daf7ef3acccab478aaa7d6dc1c60f865
SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6o52671h.default-release\prefs-1.js
Size 10KB
SHA256 dd12fc2564a128e1e3eef50f9a1fd37c9833f9eeeada00e14c4f00a12a514ef6
MD5 14ccbd41e37ad7ac0b223db0e8640f9e
SHA1 eaf4bdaefb362c88a383a02a24a380c130f95cd7
SHA512 e1181bd4f22628fb5bf12bdb0e606b16c04f2070e18ff217c79a67d319d7ea18c1de74ba1bc0a697190070a7184829f4b21764cb441a758935aed0fe9c00e30d
SSDEEP 192:B5nlR+ft/a28xnzIRJYcdOxnfDEz/BL8NEgaXn5wnDBw8Ho:qN8xzuAxroWdwN
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6o52671h.default-release\prefs-1.js
Size 15KB
SHA256 00da7e8f7e29260cd9398f87dd71fa2564b66a5ca0774563f669e4290eb4a76d
MD5 ad135fe319ade5e1fd361c021c792c86
SHA1 e98b752547a4cb32472fbf8369b2a55e9ed3e5b0
SHA512 514f26692c60b863ef2aee3d708d82138384f7ce8c6400e8ec1f482db0adf9ce22dc6b2e21c240dacec2b6cd775de1bca854c7059ab59ce0ef884910c2ca71e7
SSDEEP 192:KinlR+fV/a28xnzIRJYcdOxnfDEz/BL8NEgaXJ+5wnyiBw8HphBahW:yF8xzuAxrVWJwwX
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6o52671h.default-release\prefs-1.js
Size 12KB
SHA256 9f8abcf64c92173278b07d628bd96f36551b769a0d4c1a59455c7dfbd5085a17
MD5 42ff4af2e6270ad9fb78bcc4fc2e7e75
SHA1 78082344b08b7b315c7df6397a7f9bf16347f76a
SHA512 0e985babc13d7af39282a5dc8f0ae7e17dea52876bf98e9b677cc25ec4e3efcddd30d4b9b7dcaa975c03247201a14b0bf09edb4fa8cb75711de5ba0d5df84a46
SSDEEP 192:K5nlR+ft/a28xnzIRJYcdOxnfDEz/BL8NEgaXn5wnEBw8H9:1N8xzuAxroWKwY
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6o52671h.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 45a66da2ce5bb02264c855b3b308ccbf0057a48505bd626fec0c74e4836fa1f0
MD5 56a208cedda2368ffdace47373b70316
SHA1 36e1cc40abe35870dc8d11d6beaacbddf44b11ca
SHA512 315176502f1f43152dd80a1bdd834b1a9283bf8d96f69cbb63f810035e8113484957e88009d1e690b0d7ec081458894818e0e6794363e817864dc11bcb6e12bb
MD5 SHA1 SHA512

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6o52671h.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 392KB
SHA256 9b14b0d8f9ed1414221a5ca7fc9a9385ce0e857bd429bb1b342f208b9114aa83
MD5 bba31576cadd7695b5ac582301b88ef2
SHA1 e65d99b7da2be3355caf84e22de28bab1e046db2
SHA512 17f67646d1d2dd261a10911d800473059aebe6907f9094b847fb7cbc5cc194044fb57b6e9706bfd5bb0e04bc64baafc548456a480e1ee270b8982914cac8d862
SSDEEP 3072:8cHbincHi3y3W97VtCeH4SDCgmrg6uaC8iT9pztFzzbWGR5dyB:8cHunSi3y3XeH4SDCq6uauIB
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/232-3-0x0000000000670000-0x0000000000B38000-memory.dmp

Download

memory/232-5-0x0000000000670000-0x0000000000B38000-memory.dmp

Download

memory/232-0-0x0000000000670000-0x0000000000B38000-memory.dmp

Download

memory/232-17-0x0000000000670000-0x0000000000B38000-memory.dmp

Download

memory/232-2-0x0000000000671000-0x000000000069F000-memory.dmp

Download

memory/232-1-0x00000000778A6000-0x00000000778A8000-memory.dmp

Download

memory/836-506-0x0000000000020000-0x00000000004E8000-memory.dmp

Download

memory/836-502-0x0000000000020000-0x00000000004E8000-memory.dmp

Download

memory/1460-57-0x00000000009B0000-0x0000000001030000-memory.dmp

Download

memory/1460-83-0x00000000009B0000-0x0000000001030000-memory.dmp

Download

memory/1464-2670-0x0000000000020000-0x00000000004E8000-memory.dmp

Download

memory/2012-37-0x0000000000E80000-0x0000000001500000-memory.dmp

Download

memory/2012-60-0x0000000000E80000-0x0000000001500000-memory.dmp

Download

memory/2012-52-0x0000000000E80000-0x0000000001500000-memory.dmp

Download

memory/2012-47-0x0000000000E81000-0x0000000000E95000-memory.dmp

Download

memory/2736-1398-0x0000000000020000-0x00000000004E8000-memory.dmp

Download

memory/2736-2650-0x0000000000020000-0x00000000004E8000-memory.dmp

Download

memory/2736-20-0x0000000000020000-0x00000000004E8000-memory.dmp

Download

memory/2736-2671-0x0000000000020000-0x00000000004E8000-memory.dmp

Download

memory/2736-478-0x0000000000020000-0x00000000004E8000-memory.dmp

Download

memory/2736-46-0x0000000000020000-0x00000000004E8000-memory.dmp

Download

memory/2736-58-0x0000000000020000-0x00000000004E8000-memory.dmp

Download

memory/2736-507-0x0000000000020000-0x00000000004E8000-memory.dmp

Download

memory/2736-2661-0x0000000000020000-0x00000000004E8000-memory.dmp

Download

memory/2736-514-0x0000000000020000-0x00000000004E8000-memory.dmp

Download

memory/2736-19-0x0000000000021000-0x000000000004F000-memory.dmp

Download

memory/2736-18-0x0000000000020000-0x00000000004E8000-memory.dmp

Download

memory/2736-2660-0x0000000000020000-0x00000000004E8000-memory.dmp

Download

memory/2736-2659-0x0000000000020000-0x00000000004E8000-memory.dmp

Download

memory/2736-2658-0x0000000000020000-0x00000000004E8000-memory.dmp

Download

memory/2736-2657-0x0000000000020000-0x00000000004E8000-memory.dmp

Download

memory/2736-97-0x0000000000020000-0x00000000004E8000-memory.dmp

Download

memory/2736-2656-0x0000000000020000-0x00000000004E8000-memory.dmp

Download

memory/2736-21-0x0000000000020000-0x00000000004E8000-memory.dmp

Download

memory/2736-2644-0x0000000000020000-0x00000000004E8000-memory.dmp

Download

memory/2736-2637-0x0000000000020000-0x00000000004E8000-memory.dmp

Download

memory/2736-56-0x0000000000020000-0x00000000004E8000-memory.dmp

Download

memory/3372-84-0x0000000005E40000-0x0000000005E5E000-memory.dmp

Download

memory/3372-72-0x0000000005910000-0x0000000005976000-memory.dmp

Download

memory/3372-71-0x00000000058A0000-0x0000000005906000-memory.dmp

Download

memory/3372-68-0x0000000002670000-0x00000000026A6000-memory.dmp

Download

memory/3372-81-0x0000000005980000-0x0000000005CD7000-memory.dmp

Download

memory/3372-70-0x0000000004F90000-0x0000000004FB2000-memory.dmp

Download

memory/3372-85-0x0000000005E80000-0x0000000005ECC000-memory.dmp

Download

memory/3372-87-0x0000000006EA0000-0x0000000006F36000-memory.dmp

Download

memory/3372-88-0x00000000063B0000-0x00000000063CA000-memory.dmp

Download

memory/3372-89-0x0000000006420000-0x0000000006442000-memory.dmp

Download

memory/3372-69-0x0000000005100000-0x000000000572A000-memory.dmp

Download

memory/3372-90-0x0000000007510000-0x0000000007AB6000-memory.dmp

Download

memory/3424-2655-0x0000000000020000-0x00000000004E8000-memory.dmp

Download