amadey | b653aa8a63c1a7b1545618939c165fcf6a996e8fc45e1a6442f77e37b672a117

Analysis

max time kernel
143s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
11/09/2024, 20:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b653aa8a63c1a7b1545618939c165fcf6a996e8fc45e1a6442f77e37b672a117.exe
Size 1.8MB
Sample240911-yr991azerr
SHA256 b653aa8a63c1a7b1545618939c165fcf6a996e8fc45e1a6442f77e37b672a117
MD5 28fc680cd7ce04804903263844ab3fec
SHA1 74dbf07bf5be88466023076f1b5a8192e5fb7e65
SHA512 6c7130922b5c21ffaa99b855ea6416f649b3dd91313c6d76b4273eb74281b9cb18ca806a68c34f9ed908c846983576a27b8a4d811277017e3fe4dc78d40696ba
SSDEEP 49152:KI4oWqTQFp2YFGSVHqCrlqgB0obxDJMefD5:KlDNFRHEgDmYD
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey stealc c7817d rave credential_access discovery evasion execution persistence spyware stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

c7817d

http://31.41.244.10

Attributes

install_dir
0e8d0864aa
install_file
svoutse.exe
strings_key
5481b88a6ef75bcf21333988a4e47048
url_paths
/Dem7kTu/index.php

rc4.plain

Extracted

Family

stealc

Botnet

rave

http://185.215.113.103

Attributes

url_path
/e2b1563c6670f193.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Stealc
Stealc is an infostealer written in C++.
stealer stealc
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	b653aa8a63c1a7b1545618939c165fcf6a996e8fc45e1a6442f77e37b672a117.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	svoutse.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	2c6f07f57d.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	a9e6e6f344.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	svoutse.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	svoutse.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 12 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	2c6f07f57d.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	b653aa8a63c1a7b1545618939c165fcf6a996e8fc45e1a6442f77e37b672a117.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	a9e6e6f344.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	a9e6e6f344.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	b653aa8a63c1a7b1545618939c165fcf6a996e8fc45e1a6442f77e37b672a117.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2c6f07f57d.exe

Executes dropped EXE 5 IoCs

pid	Process
3376	svoutse.exe
2584	2c6f07f57d.exe
1340	a9e6e6f344.exe
5264	svoutse.exe
1500	svoutse.exe

Identifies Wine through registry keys 2 TTPs 6 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2842058299-443432012-2465494467-1000\Software\Wine	b653aa8a63c1a7b1545618939c165fcf6a996e8fc45e1a6442f77e37b672a117.exe
Key opened	\REGISTRY\USER\S-1-5-21-2842058299-443432012-2465494467-1000\Software\Wine	svoutse.exe
Key opened	\REGISTRY\USER\S-1-5-21-2842058299-443432012-2465494467-1000\Software\Wine	2c6f07f57d.exe
Key opened	\REGISTRY\USER\S-1-5-21-2842058299-443432012-2465494467-1000\Software\Wine	a9e6e6f344.exe
Key opened	\REGISTRY\USER\S-1-5-21-2842058299-443432012-2465494467-1000\Software\Wine	svoutse.exe
Key opened	\REGISTRY\USER\S-1-5-21-2842058299-443432012-2465494467-1000\Software\Wine	svoutse.exe

Loads dropped DLL 2 IoCs

pid	Process
2584	2c6f07f57d.exe
2584	2c6f07f57d.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2842058299-443432012-2465494467-1000\Software\Microsoft\Windows\CurrentVersion\Run\a9e6e6f344.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000030001\\a9e6e6f344.exe"	svoutse.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs

pid	Process
2172	b653aa8a63c1a7b1545618939c165fcf6a996e8fc45e1a6442f77e37b672a117.exe
3376	svoutse.exe
2584	2c6f07f57d.exe
1340	a9e6e6f344.exe
5264	svoutse.exe
1500	svoutse.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\svoutse.job	b653aa8a63c1a7b1545618939c165fcf6a996e8fc45e1a6442f77e37b672a117.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2228	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b653aa8a63c1a7b1545618939c165fcf6a996e8fc45e1a6442f77e37b672a117.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svoutse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2c6f07f57d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a9e6e6f344.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks processor information in registry 2 TTPs 16 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2c6f07f57d.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2c6f07f57d.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2842058299-443432012-2465494467-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
2172	b653aa8a63c1a7b1545618939c165fcf6a996e8fc45e1a6442f77e37b672a117.exe
2172	b653aa8a63c1a7b1545618939c165fcf6a996e8fc45e1a6442f77e37b672a117.exe
3376	svoutse.exe
3376	svoutse.exe
2584	2c6f07f57d.exe
2584	2c6f07f57d.exe
1340	a9e6e6f344.exe
1340	a9e6e6f344.exe
2228	powershell.exe
2584	2c6f07f57d.exe
2584	2c6f07f57d.exe
2228	powershell.exe
2228	powershell.exe
2228	powershell.exe
2228	powershell.exe
2228	powershell.exe
2228	powershell.exe
5264	svoutse.exe
5264	svoutse.exe
1500	svoutse.exe
1500	svoutse.exe
2584	2c6f07f57d.exe
2584	2c6f07f57d.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2228	powershell.exe

Suspicious use of FindShellTrayWindow 22 IoCs

pid	Process
2172	b653aa8a63c1a7b1545618939c165fcf6a996e8fc45e1a6442f77e37b672a117.exe
1792	firefox.exe
1792	firefox.exe
1792	firefox.exe
1792	firefox.exe
1792	firefox.exe
1792	firefox.exe
1792	firefox.exe
1792	firefox.exe
1792	firefox.exe
1792	firefox.exe
1792	firefox.exe
1792	firefox.exe
1792	firefox.exe
1792	firefox.exe
1792	firefox.exe
1792	firefox.exe
1792	firefox.exe
1792	firefox.exe
1792	firefox.exe
1792	firefox.exe
1792	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1792	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 3376	2172	b653aa8a63c1a7b1545618939c165fcf6a996e8fc45e1a6442f77e37b672a117.exe	78
PID 2172 wrote to memory of 3376	2172	b653aa8a63c1a7b1545618939c165fcf6a996e8fc45e1a6442f77e37b672a117.exe	78
PID 2172 wrote to memory of 3376	2172	b653aa8a63c1a7b1545618939c165fcf6a996e8fc45e1a6442f77e37b672a117.exe	78
PID 3376 wrote to memory of 2584	3376	svoutse.exe	79
PID 3376 wrote to memory of 2584	3376	svoutse.exe	79
PID 3376 wrote to memory of 2584	3376	svoutse.exe	79
PID 3376 wrote to memory of 1340	3376	svoutse.exe	80
PID 3376 wrote to memory of 1340	3376	svoutse.exe	80
PID 3376 wrote to memory of 1340	3376	svoutse.exe	80
PID 3376 wrote to memory of 2228	3376	svoutse.exe	81
PID 3376 wrote to memory of 2228	3376	svoutse.exe	81
PID 3376 wrote to memory of 2228	3376	svoutse.exe	81
PID 2228 wrote to memory of 2932	2228	powershell.exe	83
PID 2228 wrote to memory of 2932	2228	powershell.exe	83
PID 2228 wrote to memory of 2932	2228	powershell.exe	83
PID 2228 wrote to memory of 2608	2228	powershell.exe	85
PID 2228 wrote to memory of 2608	2228	powershell.exe	85
PID 2228 wrote to memory of 2608	2228	powershell.exe	85
PID 2228 wrote to memory of 3728	2228	powershell.exe	87
PID 2228 wrote to memory of 3728	2228	powershell.exe	87
PID 2228 wrote to memory of 1792	2228	powershell.exe	88
PID 2228 wrote to memory of 1792	2228	powershell.exe	88
PID 3728 wrote to memory of 1380	3728	firefox.exe	89
PID 3728 wrote to memory of 1380	3728	firefox.exe	89
PID 3728 wrote to memory of 1380	3728	firefox.exe	89
PID 3728 wrote to memory of 1380	3728	firefox.exe	89
PID 3728 wrote to memory of 1380	3728	firefox.exe	89
PID 3728 wrote to memory of 1380	3728	firefox.exe	89
PID 3728 wrote to memory of 1380	3728	firefox.exe	89
PID 3728 wrote to memory of 1380	3728	firefox.exe	89
PID 3728 wrote to memory of 1380	3728	firefox.exe	89
PID 3728 wrote to memory of 1380	3728	firefox.exe	89
PID 3728 wrote to memory of 1380	3728	firefox.exe	89
PID 1792 wrote to memory of 3276	1792	firefox.exe	90
PID 1792 wrote to memory of 3276	1792	firefox.exe	90
PID 1792 wrote to memory of 3276	1792	firefox.exe	90
PID 1792 wrote to memory of 3276	1792	firefox.exe	90
PID 1792 wrote to memory of 3276	1792	firefox.exe	90
PID 1792 wrote to memory of 3276	1792	firefox.exe	90
PID 1792 wrote to memory of 3276	1792	firefox.exe	90
PID 1792 wrote to memory of 3276	1792	firefox.exe	90
PID 1792 wrote to memory of 3276	1792	firefox.exe	90
PID 1792 wrote to memory of 3276	1792	firefox.exe	90
PID 1792 wrote to memory of 3276	1792	firefox.exe	90
PID 1792 wrote to memory of 3276	1792	firefox.exe	90
PID 1792 wrote to memory of 3276	1792	firefox.exe	90
PID 1792 wrote to memory of 3276	1792	firefox.exe	90
PID 1792 wrote to memory of 3276	1792	firefox.exe	90
PID 1792 wrote to memory of 3276	1792	firefox.exe	90
PID 1792 wrote to memory of 3276	1792	firefox.exe	90
PID 1792 wrote to memory of 3276	1792	firefox.exe	90
PID 1792 wrote to memory of 3276	1792	firefox.exe	90
PID 1792 wrote to memory of 3276	1792	firefox.exe	90
PID 1792 wrote to memory of 3276	1792	firefox.exe	90
PID 1792 wrote to memory of 3276	1792	firefox.exe	90
PID 1792 wrote to memory of 3276	1792	firefox.exe	90
PID 1792 wrote to memory of 3276	1792	firefox.exe	90
PID 1792 wrote to memory of 3276	1792	firefox.exe	90
PID 1792 wrote to memory of 3276	1792	firefox.exe	90
PID 1792 wrote to memory of 3276	1792	firefox.exe	90
PID 1792 wrote to memory of 3276	1792	firefox.exe	90
PID 1792 wrote to memory of 3276	1792	firefox.exe	90
PID 1792 wrote to memory of 3276	1792	firefox.exe	90
PID 1792 wrote to memory of 3276	1792	firefox.exe	90

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\b653aa8a63c1a7b1545618939c165fcf6a996e8fc45e1a6442f77e37b672a117.exe
"C:\Users\Admin\AppData\Local\Temp\b653aa8a63c1a7b1545618939c165fcf6a996e8fc45e1a6442f77e37b672a117.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
  "C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3376
- - C:\Users\Admin\AppData\Roaming\1000026000\2c6f07f57d.exe
    "C:\Users\Admin\AppData\Roaming\1000026000\2c6f07f57d.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:2584
- - C:\Users\Admin\AppData\Local\Temp\1000030001\a9e6e6f344.exe
    "C:\Users\Admin\AppData\Local\Temp\1000030001\a9e6e6f344.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1340
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\Admin\AppData\Local\Temp\1000039041\do.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2228
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c start msedge https://www.youtube.com/account
      4⤵
      System Location Discovery: System Language Discovery
      PID:2932
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c start msedge https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
      4⤵
      System Location Discovery: System Language Discovery
      PID:2608
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3728
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
        5⤵
        Checks processor information in registry
        
        PID:1380
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
      4⤵
      Checks processor information in registry
      Modifies registry class
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1792
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1944 -parentBuildID 20240401114208 -prefsHandle 1520 -prefMapHandle 1700 -prefsLen 23678 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1c11553f-0637-41b4-9a41-d0d5ccd16501} 1792 "\\.\pipe\gecko-crash-server-pipe.1792" gpu
        5⤵
        
        PID:3276
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2408 -parentBuildID 20240401114208 -prefsHandle 2384 -prefMapHandle 2372 -prefsLen 24598 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {218d4882-52c7-41e3-aac7-34b55b89e892} 1792 "\\.\pipe\gecko-crash-server-pipe.1792" socket
        5⤵
        
        PID:1644
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3240 -childID 1 -isForBrowser -prefsHandle 3228 -prefMapHandle 3224 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1048 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8033b0b0-cd8a-43c8-8aa2-c1eebaf488a8} 1792 "\\.\pipe\gecko-crash-server-pipe.1792" tab
        5⤵
        
        PID:3484
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3024 -childID 2 -isForBrowser -prefsHandle 2976 -prefMapHandle 2768 -prefsLen 22693 -prefMapSize 244658 -jsInitHandle 1048 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4474f73f-59c8-411c-9260-8abd2fbaab00} 1792 "\\.\pipe\gecko-crash-server-pipe.1792" tab
        5⤵
        
        PID:4072
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4440 -childID 3 -isForBrowser -prefsHandle 2976 -prefMapHandle 2768 -prefsLen 29088 -prefMapSize 244658 -jsInitHandle 1048 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0ca96c45-91f8-445e-a0db-aa676201f937} 1792 "\\.\pipe\gecko-crash-server-pipe.1792" tab
        5⤵
        
        PID:3956
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5168 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 5164 -prefMapHandle 5136 -prefsLen 29088 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2ab57904-ddab-4d23-b59b-dbf14079c64a} 1792 "\\.\pipe\gecko-crash-server-pipe.1792" utility
        5⤵
        Checks processor information in registry
        
        PID:124
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5840 -childID 4 -isForBrowser -prefsHandle 5848 -prefMapHandle 5808 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1048 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {827290b3-1ca5-45c9-bf58-48e3a8d696bb} 1792 "\\.\pipe\gecko-crash-server-pipe.1792" tab
        5⤵
        
        PID:2604
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6028 -childID 5 -isForBrowser -prefsHandle 5948 -prefMapHandle 5952 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1048 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e39f639c-874c-438c-a4a8-78a08d710932} 1792 "\\.\pipe\gecko-crash-server-pipe.1792" tab
        5⤵
        
        PID:996
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6136 -childID 6 -isForBrowser -prefsHandle 6148 -prefMapHandle 6152 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1048 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d28e4f19-67f9-4879-a14a-a0fdbb5e9320} 1792 "\\.\pipe\gecko-crash-server-pipe.1792" tab
        5⤵
        
        PID:2284

C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5264

C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mozglue.dll

Path C:\ProgramData\mozglue.dll
Size 593KB
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
SSDEEP 12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5 SHA1 SHA512 SSDEEP

Submit Download

nss3.dll

Path C:\ProgramData\nss3.dll
Size 2.0MB
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
SSDEEP 49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5 SHA1 SHA512 SSDEEP

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\r5m741b5.default-release\activity-stream.discovery_stream.json
Size 18KB
SHA256 70411fe15ee64b22bba18bf7638cc837e2087f02ef39ef3d57d40b331317c35d
MD5 a4829227b4da98b1e900cfd785d5b73f
SHA1 8506052a8bd9f67ddbe401302c8a77c92a2d77c6
SHA512 1af1a59149290e8145cae15effac56af06427e0133a5ed62bf5094da4641100eccc6c5672674f70bdf1f6ef0eb499022b9b4d6af803793003839fe943873d19e
SSDEEP 384:+KQitmLPmfPI7/64sbQh9AdOVXVLPm+Twi0p3tLolhoKz3MvHhgyaE:rQTH7/3AdO9Tzmgyp
MD5 SHA1 SHA512 SSDEEP

Submit Download

58EFA56DB4BFFECB0EDA547894BC9A057159E22F

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\r5m741b5.default-release\cache2\entries\58EFA56DB4BFFECB0EDA547894BC9A057159E22F
Size 13KB
SHA256 7bd9e110de27e299bedc48ed988329d37ed0ab3f96d8114af13a589665ef41cc
MD5 d3a2a3b79232ebd9697e6a7fead8cc9e
SHA1 2d7902efb24532b633f759b10a49f866f12c167e
SHA512 4ca4498e833a581e298a53d30a0886e4fe1690665c146dd0a5d66eb47ab5d07e5ba8d70db309f6e8787bb9bb987805b998dc7dcc70a12baf56bd5ebe598f109a
SSDEEP 384:HvGu9fiGLm4pU3pHLFoCr/E8HPJyD3VonFcP+AWRMAC/9U:PBi8mCU3pHLGCr/E8Rg3V/+hRMFC
MD5 SHA1 SHA512 SSDEEP

Submit Download

svoutse.exe

Path C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
Size 1.8MB
SHA256 b653aa8a63c1a7b1545618939c165fcf6a996e8fc45e1a6442f77e37b672a117
MD5 28fc680cd7ce04804903263844ab3fec
SHA1 74dbf07bf5be88466023076f1b5a8192e5fb7e65
SHA512 6c7130922b5c21ffaa99b855ea6416f649b3dd91313c6d76b4273eb74281b9cb18ca806a68c34f9ed908c846983576a27b8a4d811277017e3fe4dc78d40696ba
SSDEEP 49152:KI4oWqTQFp2YFGSVHqCrlqgB0obxDJMefD5:KlDNFRHEgDmYD
MD5 SHA1 SHA512 SSDEEP

Submit Download

do.ps1

Path C:\Users\Admin\AppData\Local\Temp\1000039041\do.ps1
Size 2KB
SHA256 717c09427fa5754ba92f92961545534048d0a76528c2e95c4d5ec6cef47c612f
MD5 e05e8f072b373beafe27cc11d85f947c
SHA1 1d6daeb98893e8122b8b69287ebd9d43f3c6138e
SHA512 b3e34162e5ee43bb01f289eebc45fd3ea3e07f30be40dcf6635606540f912fe5c84d301e9f78e97dfe3ffe53e72547e50f3bcd7d4ebe5ab8da451a1989c469a0
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_0g3qqzum.odv.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0g3qqzum.odv.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 479KB
SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
MD5 09372174e83dbbf696ee732fd2e875bb
SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 13.8MB
SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
MD5 0a8747a2ac9ac08ae9508f36c6d75692
SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
MD5 SHA1 SHA512 SSDEEP

Submit Download

2c6f07f57d.exe

Path C:\Users\Admin\AppData\Roaming\1000026000\2c6f07f57d.exe
Size 1.7MB
SHA256 cc65a55c66501ede8db7f899410180caa449102982130e4ed48a45909156e3c1
MD5 0f0ef1482985e6cf9403f782e6ba6d10
SHA1 d7b44e16fc1eb2845b3db09a4fec9ba66dfcebe4
SHA512 6b484bcbba919e8c2dfc86f703196adbe065c04b93d74d47cc63f7df2e1224a62c854b5b5c03b235c48f4db3a9449d59c9a6dbed832f2e0c0f0fccf739b0a794
SSDEEP 49152:Xbr4mJ8yDaOHaxzIzfP8ncBp++1inUpG:Xbcmhiy38cT++1inUpG
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\AlternateServices.bin
Size 6KB
SHA256 1205e4174ffa96a2ad64f08895eeb6b150971d5cabe1b1bbd8e2786166198a43
MD5 b96949003f65386b6e25962aa7f9954b
SHA1 593da29ca8dad2be0945b0db07df56106e9c8494
SHA512 df2a3d3485190c19856246121a67dc1b52def16a5563d57db88a5af657c3cb1728ec163c8cdd1322079970c9aa06cc1a5d442c7720806b91e5726b5267d8fc31
SSDEEP 6:k7gidpq88gidydgid1QvSWmlkoYmHgidpqs7HgidBgidbX4SW:k7gQpB8gQWgQ1QvzSklQphMQSQL4z
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\AlternateServices.bin
Size 25KB
SHA256 f8acd6f06c435ce0660d22b5c6dacbe85ba7c7d06fd57b67f3c1c1edb9aae15b
MD5 3c3560b67bb2787da95cc641e5639e6b
SHA1 9e1cbaa33b569ef52797febc7e14ae8eeb4bad31
SHA512 4a66f3cf342bd2d4637dd4d0903026873d6716d5033926fece04fa42604bae2e1ccbf556a6ad96253032c625653d3d1706d3596b7aaf0f3d1293dfcadabea398
SSDEEP 96:0/QebOJKbBpebvpf+Lbj5o1bobUgCgbgzYbDb3bbb6bUbIeFg882v70HVubdb:UuY5
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\AlternateServices.bin
Size 10KB
SHA256 c5859618adc5de7166948928041117d3976f7479b910349c53c8fbf5fad6835f
MD5 14c5d26a8db3f2d4fbd587b045aeaa97
SHA1 8a879bfc592b2c783820f9e99219666b08abe9ef
SHA512 3564d466467ed36267e0e5925dac0ce6a852e2d4ad12264ec150e9f4c2475a6f546b74eb9c0598c058b33a280d9f27cd607b85901763ab7080426fd781a74896
SSDEEP 24:kkuB1oQ0/S9htKXO9QsJbF0JpOJbGFsh2F3LFpOeuhMZzXWKsJblxWKf+pOJbjgO:LA7KkQebOJKbWpebvpf+Kbj5oV9cO
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\AlternateServices.bin
Size 23KB
SHA256 5b1ef0c799b2ad72cd2bc6da50b4145115772c1bcc8d8451338b0b7184a0ec74
MD5 f2efb404dbb4465bb87e51b4f93edf61
SHA1 a301ad661dd50e914bc4cce6246f13f15cc49c7e
SHA512 35ccd0e989158528f60494a13741fcd34bf0b96982e49d1a7343b76ee1250b1099dfce81f0dc18a2ccbf1d7d9eb71aaf873f4af1a823f11c4f54f2034721730e
SSDEEP 96:U/QebOJKbqpebvpf+Gbj5o1bobUgCgbgzYbDb3bbb6bUbIeFg882g0FHV:TuD5
MD5 SHA1 SHA512 SSDEEP

Submit Download

cookies.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\cookies.sqlite
Size 512KB
SHA256 7d9d56f4aefeffb82ff8969cce9ecbe9e96974e9788b9e2d8c56d811e204c235
MD5 f1b7f826d6fa51b896dd324afda07379
SHA1 e3c10e7481e7a55c6c55f233c64798bee514cea1
SHA512 d4306adab198e07d596341eb29dec18da37d91504e8d129ee507d8cdea0f6f1f5f127530f30ad58d6617537fa63e95035878a51b38e419ece881b86eddca0f84
SSDEEP 48:DQzS6rh9WTrK2kxWoFU2dEGa/V6T2vBAoGUcCl8l:DQzSa3X/FU2d/EdGUcCl8l
MD5 SHA1 SHA512 SSDEEP

Submit Download

cookies.sqlite-wal

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\cookies.sqlite-wal
Size 512KB
SHA256 e9b8606b6fad2124eee2aaa280b16245ed9bd367616aa2a21779823d87c94243
MD5 e37dfd6a1a7eb2963506c926c2ae026b
SHA1 feea3d6cd427c3caef35c96a8359b7a94ca0ed35
SHA512 bb78c09402a946dbc3fef0d61fe55baba1c2c94ec085caee977fa23ffa548aa97bb6b731a09c19251c78641c185aa3ab44c5b1e7870857cc4c5ebdd161703641
SSDEEP 96:o/FU2d/gGUcCl8jO/FU2d/zGUcCl859HO/FU2d/kGUcCl8/9HOiFn2dk6GUcCoT+:iDVDrQDFLN4llDnccp
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 55bcc1af94c23eff45dd1be0b5e6b426ccf21878de1b8495a8de9808f6287ffa
MD5 d4ca65c262e39767c9ca08d488556b60
SHA1 a6824401546038eb7ea44c0133783c051ccece8a
SHA512 1eaa6f6d9f31ec466327e9246ed0f1292000a52af23b6d73406d89b56ddaa4fa9f8af06d6c55db53d20c4b3247415c60ee1ca2a9d3269ffeb8f337cf0bef27cc
SSDEEP 192:Tj8rvZboHyhtvCSPVNfSaG/66Joz0dzgCl6mSSM:aboS3hPyP/66JozQzgC1bM
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 974e962fe49ebef86d960c9b5b96ac6987de433584e8c147887ca6dac3539b27
MD5 eaa759d3555d0e0f8cabcdde34195ea6
SHA1 af1d467d742243043936dd94a9e06249b7d5a338
SHA512 ddf09d5933239ce2a5a32d5d17c459010b74a3b48eb164919fe1c4841bd66b05866e7bf162ad77b888d45cde210735ee12bab9e09aa6457ca8e6ac59f6ce5ee3
SSDEEP 192:nrvZboHthGcOZPDfTFG/66Joz0dzgCl6mSSM:dboNQlPvI/66JozQzgC1bM
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 46afd0f88ac02652ee7419bc1fb84760e5966171fccadb9affb41a242e438b01
MD5 6ee0d9d4440e4443eb552a38e34052e1
SHA1 1a084ac0d876c468de32311debfab5be5507675c
SHA512 086579e604f1edb472f14ee6f1311d66b07e9afae090ec8ab0a2548a197bb02d60ba36ce533ce1602466b9c6afa93f40ee8a146f37c97a83340099cc82736a9c
SSDEEP 96:iWQZPhOQGFl66Joz0dzgClKtmSSPSMF9ZbkW6QXNhm5FPP/PrWI:6FG/66Joz0dzgCl6mSSPrvZboKh0ZPCI
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 6653a0bb0dbd5e9ea6e25d2c611307959f20e93a8845abaf8a1e48bfff25c16b
MD5 2ba9d063661e9d64d4c329c52973f913
SHA1 8e94e50e3a0f00c245d291c57abc017ccc39e140
SHA512 c94866c66e4f94dba2c571777582667c8ca459f5837f46818d7ceaf3122fa6c0ae84d618e8d7731328b39e0d83b4405c640691663b4e3e452ec508afa7476192
SSDEEP 96:iWQZPhOQGFl66Joz0dzgClKtmSSkBcSMF9ZbkW6QX0BBthm5FPP/PrWZ:6FG/66Joz0dzgCl6mSS/rvZboHth0ZPC
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\datareporting\glean\db\data.safe.tmp
Size 15KB
SHA256 b03978370627c72848cffc21f69bd9dc966870daae431e305664a613ac07a646
MD5 043c930474049f4b73ccb58a6cdced75
SHA1 bff5ea0f1e3ed124d8c773abbaaf02122129d9da
SHA512 de75a5b3e9d76c52a1c08a963411b340feebe250c6a19a1ab64ca194dab76de32bb4b46d177bd8cb98d85c3a28795d64fb74a1d01268da138112a074351c448a
SSDEEP 384:4JgjT24XtRzDXG0cbhb32boNRW/PdI/66JozQzgC1bM:mCT/vzDXG0cbhb3ad11mm
MD5 SHA1 SHA512 SSDEEP

Submit Download

5144c841-7bc1-4123-a1ea-530f504eacdc

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\datareporting\glean\pending_pings\5144c841-7bc1-4123-a1ea-530f504eacdc
Size 671B
SHA256 cb29eba31fa785e1e3c9252e1435e908fa9a230e0a10e5f3f9941fa66e2bd447
MD5 985d28001ac9069ab5eb632dec545f8b
SHA1 7bbf7089fb6c1788c6ced675889ecb097723d3b6
SHA512 5b66d5a48c45339ee85065f257927ef130623096a57fa728486886fc5e0a6ebee808adfc0a80fdd2101cf78b238908810a21b5baa645dd9938a400115f0b6b25
MD5 SHA1 SHA512

Submit Download

5b8bc7e1-1a88-4730-9aa1-189ac8ff97e6

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\datareporting\glean\pending_pings\5b8bc7e1-1a88-4730-9aa1-189ac8ff97e6
Size 25KB
SHA256 b0054e05de686b789be23362ca6a4ff94cd3671f26299d2475a99f0473fd0be4
MD5 df4b21aec8b417e41a160a36d1c57938
SHA1 45c3ef1b8b96558aff9fab3e0a135573431be1c7
SHA512 eb60614812e38f54c5e068191380ae4dd6694fdb5fd18d3bcaa28ed19bf139292005a3738b7a6181a7c5543ad565764b6209663b925f7a97c6c12b4fdf79c4e2
SSDEEP 192:vrWbw1stqYvjMX6dWDfyPPQEpx8MOS0w/uzLQE76aM/eUgeuY8dBRHh3fmqCtclU:vr2DTCa5ZuLza8ktqeiy78R1lSC+
MD5 SHA1 SHA512 SSDEEP

Submit Download

c55f6f82-2d6d-4f90-8503-5620fef73df1

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\datareporting\glean\pending_pings\c55f6f82-2d6d-4f90-8503-5620fef73df1
Size 982B
SHA256 b298e932dfc3c4385feb266fc5f8935c607613ed5ca2a5b8e8172c79a4a47fde
MD5 6fb3614335250b7e76b582443c4654da
SHA1 411a7f0883310055b75f72e97ae5934781a7cba2
SHA512 6491a13d7b9d5701f13f73a0ea0521fa075f7223b74dc4e3330c71e56696ecabc3c9ed22cb33aac2a57b9c39f00802ca71fecbac0f152a546624796c8bf88b44
MD5 SHA1 SHA512

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Size 1.1MB
SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
MD5 842039753bf41fa5e11b3a1383061a87
SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Size 116B
SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
MD5 2a461e9eb87fd1955cea740a3444ee7a
SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Size 372B
SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
MD5 bf957ad58b55f64219ab3f793e374316
SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Size 17.8MB
SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
MD5 daf7ef3acccab478aaa7d6dc1c60f865
SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
MD5 SHA1 SHA512 SSDEEP

Submit Download

places.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\places.sqlite
Size 5.0MB
SHA256 a66336e1e7a05f1becdfd0514c2b3d257c7d1564f838fc60dc5cbd158606b7c4
MD5 097fa9abb2bfcfd3f3bff3f649cdaf7a
SHA1 f45ec3311f60a7efdfd2d6ce0f4b31be349f4214
SHA512 19cfb100a9b39ccf12f4c072571cb467f34621808cc3337badf827791a031c53765256356475865cfdd42561f92ec28b358da5723f8795e127798a43da97109c
SSDEEP 192:28rJQaXoMXp0VW9FxWNCAcx/HSoWvHe5lpOazFaKqCEZGJK:28r54w0VW3xWNTcRSoWv+7+ZCE
MD5 SHA1 SHA512 SSDEEP

Submit Download

places.sqlite-wal

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\places.sqlite-wal
Size 2.2MB
SHA256 06d740e419fd7b0e5f4ed0c2693afa00ea98d54656793ab98aa315f58ab21608
MD5 b40497c02e9b997b6b6163beb8c83a40
SHA1 5e9e288afc396f6150ddc81f05a03cd5b79155b7
SHA512 37618bd00ae8ff33faa1c79891e0ae086b1fe995b8d0914e47532b75cd06a4afc166da15cfee5dd7e257971c2985596a38998dbc8d22e1e810aedf242c512ec3
SSDEEP 384:YYTqSoWv+wm/f4SoWv+p1Wv+ccvUSoWv+vfiRSoWv+0T9ITcRSoWv+Hz1wb:NWqYNkDyfHR5cmz1wb
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\prefs-1.js
Size 12KB
SHA256 84fcd3dae6e1ed2a74c7402085ad1f019f2ff53e8cc5d84f72b92fdc173f4ea2
MD5 1025cf4d28410cc741751dfd3f8f17ba
SHA1 182fa4e9efbb73ab6956ea6ce00db4ca06a977d1
SHA512 cebb8fc0b2b7bd3a999d872c6744741fe33721747178e0cbe48363ec7e80ca3d71ffbd2c2cf519f86a2b16dc7968292d01de80e0c192af1f5d7ceb43533352ee
SSDEEP 192:h5nkRTf1Agex7fltYPVcdj80fetby1Zxy0OaXwCYQ6uJhbyuBw8HOer8k9:ccx7/Z20Uby1ZxOZ9QwS
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\prefs-1.js
Size 15KB
SHA256 69200ae689a1b292ab19bb5d7a83117061daadc6e677e613d70a704ac9c962af
MD5 3864d5fb535368c4e7743cbc048b0f40
SHA1 9b520e75f5cbda0dc7d8045ada87a8b9210d4fe1
SHA512 52266c5f30277befcde1990ea8017ec2231f404578419a4b26d4ecb36efcd8f1ad3a4c6f776aa704cc9a6bc763c1e3d8f02ce24ab0c4694d73f61ee2c6c0d0e9
SSDEEP 192:h89gxtVQnkRTfbZAgex7fltYPVcdj80fetby1Zxy0OaX0+CYQ6uJhbMGw+iBw8HL:ZMx7/Z20Uby1ZxTZ9zwg
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\prefs.js
Size 16KB
SHA256 22205bd2ce4051dbc157bf144b897ce9c00ad1be88cfe6896d08c64f88bb12ba
MD5 d6ee2b8dd5e8e42bf6527280dd7d2a60
SHA1 2cbf42793d305640e6c7f3add5a388f6a5205819
SHA512 a666ad9990602d352f766361042fccb74a56c169f35318d22a94f83d9f5a822eec69cc25869aa97a4d648800e22cecb23fdbf3e4abba3ee711fa06a66c9a80df
SSDEEP 192:h89gxtVQnkRTfbZAgex7fltYPVcdj80fetby1Zxy0OaX0+CYQ6uJhbMGw+iBw8Hr:ZMx7/Z20Uby1ZxTZ9zwng
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 2b56d0bab27cfdf417ecef9830e833a4201ee09a98149f60f84107131b4f36e6
MD5 71ddbd674a4d9b91d70c6cde7cf6bbe7
SHA1 af1735f3c72b4f7da1e939ce9fff83534e88f27e
SHA512 b17bf522a9c14d838a4cbd5a97ee70f98c898b9bd618652f6e80df8fae8d65e2bfe71fef60fb17a7dd9c884dcfde763e8684d458bc4cbc11706288f0eb46391b
MD5 SHA1 SHA512

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\sessionstore-backups\recovery.baklz4
Size 5KB
SHA256 5319caba13770ff597ee615b59f4b7b2071da2f4727d7085dad2b417a16c8745
MD5 16303917d19dfee1416c415707713d76
SHA1 0e373ecc9142c77b5673efb6a0bdc016b8583642
SHA512 58b6362f1af110e1b0b2fcf1dfbef8723b29110984ca9fb71becee344c51942abd42621081a0c2db923641c76335b4ae1e0e03eb14e22cbaddf01b37ef7af410
SSDEEP 96:OE5a3C63z2aNoDawEGJF7I/MZkKzf8W8Qge3ZwS27brTH7hdQix+lbWRy:OqbuSadiFOMZkauem3HTcl5
MD5 SHA1 SHA512 SSDEEP

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 1.4MB
SHA256 0da2ce4972a23e24e5b80f93be0e01fe71a3a3fcde3d67229949002cb9103329
MD5 76a1ab5423e2620694d99935330239bb
SHA1 3c74a7eadc9e19245d6d3ff9ed70b985fec1a773
SHA512 e102693e06ced74c03e9d7ad8690dd801d98aa0a88bc880226f294ab7bb7b4bc14890b6f0472f313e54b08a6aa50bcd21377c5e9b529cc5b1a91b4f6ac1da8d1
SSDEEP 6144:reIyeHe6u6HApv3CqUnWKQejXSUw12PD7eH2RITzlpZmz0Pu/elf3K393z3m31RO:vHApvSvNrnW//Rj/SbfPU8xOY6I
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1340-491-0x0000000000CD0000-0x0000000001346000-memory.dmp

Download

memory/1340-665-0x0000000000CD0000-0x0000000001346000-memory.dmp

Download

memory/1340-58-0x0000000000CD0000-0x0000000001346000-memory.dmp

Download

memory/1340-1057-0x0000000000CD0000-0x0000000001346000-memory.dmp

Download

memory/1340-2028-0x0000000000CD0000-0x0000000001346000-memory.dmp

Download

memory/1340-2643-0x0000000000CD0000-0x0000000001346000-memory.dmp

Download

memory/1340-2779-0x0000000000CD0000-0x0000000001346000-memory.dmp

Download

memory/1340-2012-0x0000000000CD0000-0x0000000001346000-memory.dmp

Download

memory/1340-2763-0x0000000000CD0000-0x0000000001346000-memory.dmp

Download

memory/1340-513-0x0000000000CD0000-0x0000000001346000-memory.dmp

Download

memory/1340-1384-0x0000000000CD0000-0x0000000001346000-memory.dmp

Download

memory/1500-2742-0x0000000000400000-0x00000000008AC000-memory.dmp

Download

memory/2172-0-0x0000000000950000-0x0000000000DFC000-memory.dmp

Download

memory/2172-2-0x0000000000951000-0x000000000097F000-memory.dmp

Download

memory/2172-1-0x0000000077DF6000-0x0000000077DF8000-memory.dmp

Download

memory/2172-4-0x0000000000950000-0x0000000000DFC000-memory.dmp

Download

memory/2172-3-0x0000000000950000-0x0000000000DFC000-memory.dmp

Download

memory/2172-18-0x0000000000950000-0x0000000000DFC000-memory.dmp

Download

memory/2228-71-0x0000000005530000-0x0000000005596000-memory.dmp

Download

memory/2228-86-0x0000000006050000-0x0000000006072000-memory.dmp

Download

memory/2228-67-0x0000000002260000-0x0000000002296000-memory.dmp

Download

memory/2228-68-0x0000000004D90000-0x00000000053BA000-memory.dmp

Download

memory/2228-69-0x00000000053F0000-0x0000000005412000-memory.dmp

Download

memory/2228-70-0x00000000054B0000-0x0000000005516000-memory.dmp

Download

memory/2228-80-0x00000000055A0000-0x00000000058F7000-memory.dmp

Download

memory/2228-81-0x0000000005A90000-0x0000000005AAE000-memory.dmp

Download

memory/2228-82-0x0000000005AB0000-0x0000000005AFC000-memory.dmp

Download

memory/2228-84-0x0000000006B60000-0x0000000006BF6000-memory.dmp

Download

memory/2228-87-0x00000000071B0000-0x0000000007756000-memory.dmp

Download

memory/2228-85-0x0000000005FC0000-0x0000000005FDA000-memory.dmp

Download

memory/2584-1968-0x0000000000330000-0x00000000009A6000-memory.dmp

Download

memory/2584-2578-0x0000000000330000-0x00000000009A6000-memory.dmp

Download

memory/2584-2775-0x0000000000330000-0x00000000009A6000-memory.dmp

Download

memory/2584-660-0x0000000000330000-0x00000000009A6000-memory.dmp

Download

memory/2584-460-0x0000000000330000-0x00000000009A6000-memory.dmp

Download

memory/2584-1008-0x0000000000330000-0x00000000009A6000-memory.dmp

Download

memory/2584-483-0x0000000000330000-0x00000000009A6000-memory.dmp

Download

memory/2584-38-0x0000000000330000-0x00000000009A6000-memory.dmp

Download

memory/2584-1370-0x0000000000330000-0x00000000009A6000-memory.dmp

Download

memory/2584-47-0x0000000000330000-0x00000000009A6000-memory.dmp

Download

memory/2584-48-0x0000000000330000-0x00000000009A6000-memory.dmp

Download

memory/2584-1731-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Download

memory/2584-2746-0x0000000000330000-0x00000000009A6000-memory.dmp

Download

memory/2584-512-0x0000000000330000-0x00000000009A6000-memory.dmp

Download

memory/2584-57-0x0000000000330000-0x00000000009A6000-memory.dmp

Download

memory/2584-2025-0x0000000000330000-0x00000000009A6000-memory.dmp

Download

memory/3376-1541-0x0000000000400000-0x00000000008AC000-memory.dmp

Download

memory/3376-1214-0x0000000000400000-0x00000000008AC000-memory.dmp

Download

memory/3376-2171-0x0000000000400000-0x00000000008AC000-memory.dmp

Download

memory/3376-520-0x0000000000400000-0x00000000008AC000-memory.dmp

Download

memory/3376-59-0x0000000000400000-0x00000000008AC000-memory.dmp

Download

memory/3376-2739-0x0000000000400000-0x00000000008AC000-memory.dmp

Download

memory/3376-2016-0x0000000000400000-0x00000000008AC000-memory.dmp

Download

memory/3376-2794-0x0000000000400000-0x00000000008AC000-memory.dmp

Download

memory/3376-49-0x0000000000400000-0x00000000008AC000-memory.dmp

Download

memory/3376-697-0x0000000000400000-0x00000000008AC000-memory.dmp

Download

memory/3376-499-0x0000000000400000-0x00000000008AC000-memory.dmp

Download

memory/3376-2782-0x0000000000400000-0x00000000008AC000-memory.dmp

Download

memory/3376-22-0x0000000000400000-0x00000000008AC000-memory.dmp

Download

memory/3376-21-0x0000000000400000-0x00000000008AC000-memory.dmp

Download

memory/3376-20-0x0000000000400000-0x00000000008AC000-memory.dmp

Download

memory/3376-19-0x0000000000401000-0x000000000042F000-memory.dmp

Download

memory/3376-91-0x0000000000400000-0x00000000008AC000-memory.dmp

Download

memory/3376-2776-0x0000000000400000-0x00000000008AC000-memory.dmp

Download

memory/3376-16-0x0000000000400000-0x00000000008AC000-memory.dmp

Download

memory/3376-2780-0x0000000000400000-0x00000000008AC000-memory.dmp

Download

memory/3376-2781-0x0000000000400000-0x00000000008AC000-memory.dmp

Download

memory/5264-541-0x0000000000400000-0x00000000008AC000-memory.dmp

Download

memory/5264-544-0x0000000000400000-0x00000000008AC000-memory.dmp

Download