revengerat | 1da358ed457821cee339e16bf4ca809d938d7822b53147a46445ec3e336d73dd

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
03-01-2025 16:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_6df0ecc5cec9ab536e7ca5c5e0670cd0.exe
Size

604KB
MD5

6df0ecc5cec9ab536e7ca5c5e0670cd0
SHA1

e936d8ad2a84605dec3274fd3ef16c98f2882a9d
SHA256

1da358ed457821cee339e16bf4ca809d938d7822b53147a46445ec3e336d73dd
SHA512

9cadf4d6f978175f42874ee400254a076677f185fa6b54082280096bcd1ff69d62ef5109122ce4f08135bca36632da97ff1e802056ef0512a53805dff34b64f7
SSDEEP

12288:L7lw1DxCp0YUfX9F59l3N8aF7ysgfBnnl2JK:L7m1DjFDl3maF7ysgpnncU

Score

10^/10

revengerat discovery stealer trojan

Malware Config

Signatures

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat
Revengerat family
revengerat

RevengeRat Executable 1 IoCs

stealer

resource	yara_rule
behavioral2/files/0x0007000000023cae-6.dat	revengerat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	ocs_v7d.exe

Executes dropped EXE 1 IoCs

pid	Process
2664	ocs_v7d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_6df0ecc5cec9ab536e7ca5c5e0670cd0.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2664	ocs_v7d.exe
Token: SeDebugPrivilege	1200	firefox.exe
Token: SeDebugPrivilege	1200	firefox.exe
Token: SeDebugPrivilege	1200	firefox.exe
Token: SeDebugPrivilege	1200	firefox.exe
Token: SeDebugPrivilege	1200	firefox.exe

Suspicious use of FindShellTrayWindow 21 IoCs

pid	Process
1200	firefox.exe
1200	firefox.exe
1200	firefox.exe
1200	firefox.exe
1200	firefox.exe
1200	firefox.exe
1200	firefox.exe
1200	firefox.exe
1200	firefox.exe
1200	firefox.exe
1200	firefox.exe
1200	firefox.exe
1200	firefox.exe
1200	firefox.exe
1200	firefox.exe
1200	firefox.exe
1200	firefox.exe
1200	firefox.exe
1200	firefox.exe
1200	firefox.exe
1200	firefox.exe

Suspicious use of SendNotifyMessage 20 IoCs

pid	Process
1200	firefox.exe
1200	firefox.exe
1200	firefox.exe
1200	firefox.exe
1200	firefox.exe
1200	firefox.exe
1200	firefox.exe
1200	firefox.exe
1200	firefox.exe
1200	firefox.exe
1200	firefox.exe
1200	firefox.exe
1200	firefox.exe
1200	firefox.exe
1200	firefox.exe
1200	firefox.exe
1200	firefox.exe
1200	firefox.exe
1200	firefox.exe
1200	firefox.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2760	JaffaCakes118_6df0ecc5cec9ab536e7ca5c5e0670cd0.exe
2664	ocs_v7d.exe
2664	ocs_v7d.exe
1200	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2760 wrote to memory of 2664	2760	JaffaCakes118_6df0ecc5cec9ab536e7ca5c5e0670cd0.exe	82
PID 2760 wrote to memory of 2664	2760	JaffaCakes118_6df0ecc5cec9ab536e7ca5c5e0670cd0.exe	82
PID 2664 wrote to memory of 4820	2664	ocs_v7d.exe	87
PID 2664 wrote to memory of 4820	2664	ocs_v7d.exe	87
PID 4820 wrote to memory of 1200	4820	firefox.exe	88
PID 4820 wrote to memory of 1200	4820	firefox.exe	88
PID 4820 wrote to memory of 1200	4820	firefox.exe	88
PID 4820 wrote to memory of 1200	4820	firefox.exe	88
PID 4820 wrote to memory of 1200	4820	firefox.exe	88
PID 4820 wrote to memory of 1200	4820	firefox.exe	88
PID 4820 wrote to memory of 1200	4820	firefox.exe	88
PID 4820 wrote to memory of 1200	4820	firefox.exe	88
PID 4820 wrote to memory of 1200	4820	firefox.exe	88
PID 4820 wrote to memory of 1200	4820	firefox.exe	88
PID 4820 wrote to memory of 1200	4820	firefox.exe	88
PID 1200 wrote to memory of 4048	1200	firefox.exe	89
PID 1200 wrote to memory of 4048	1200	firefox.exe	89
PID 1200 wrote to memory of 4048	1200	firefox.exe	89
PID 1200 wrote to memory of 4048	1200	firefox.exe	89
PID 1200 wrote to memory of 4048	1200	firefox.exe	89
PID 1200 wrote to memory of 4048	1200	firefox.exe	89
PID 1200 wrote to memory of 4048	1200	firefox.exe	89
PID 1200 wrote to memory of 4048	1200	firefox.exe	89
PID 1200 wrote to memory of 4048	1200	firefox.exe	89
PID 1200 wrote to memory of 4048	1200	firefox.exe	89
PID 1200 wrote to memory of 4048	1200	firefox.exe	89
PID 1200 wrote to memory of 4048	1200	firefox.exe	89
PID 1200 wrote to memory of 4048	1200	firefox.exe	89
PID 1200 wrote to memory of 4048	1200	firefox.exe	89
PID 1200 wrote to memory of 4048	1200	firefox.exe	89
PID 1200 wrote to memory of 4048	1200	firefox.exe	89
PID 1200 wrote to memory of 4048	1200	firefox.exe	89
PID 1200 wrote to memory of 4048	1200	firefox.exe	89
PID 1200 wrote to memory of 4048	1200	firefox.exe	89
PID 1200 wrote to memory of 4048	1200	firefox.exe	89
PID 1200 wrote to memory of 4048	1200	firefox.exe	89
PID 1200 wrote to memory of 4048	1200	firefox.exe	89
PID 1200 wrote to memory of 4048	1200	firefox.exe	89
PID 1200 wrote to memory of 4048	1200	firefox.exe	89
PID 1200 wrote to memory of 4048	1200	firefox.exe	89
PID 1200 wrote to memory of 4048	1200	firefox.exe	89
PID 1200 wrote to memory of 4048	1200	firefox.exe	89
PID 1200 wrote to memory of 4048	1200	firefox.exe	89
PID 1200 wrote to memory of 4048	1200	firefox.exe	89
PID 1200 wrote to memory of 4048	1200	firefox.exe	89
PID 1200 wrote to memory of 4048	1200	firefox.exe	89
PID 1200 wrote to memory of 4048	1200	firefox.exe	89
PID 1200 wrote to memory of 4048	1200	firefox.exe	89
PID 1200 wrote to memory of 4048	1200	firefox.exe	89
PID 1200 wrote to memory of 4048	1200	firefox.exe	89
PID 1200 wrote to memory of 4048	1200	firefox.exe	89
PID 1200 wrote to memory of 4048	1200	firefox.exe	89
PID 1200 wrote to memory of 4048	1200	firefox.exe	89
PID 1200 wrote to memory of 4048	1200	firefox.exe	89
PID 1200 wrote to memory of 4048	1200	firefox.exe	89
PID 1200 wrote to memory of 4048	1200	firefox.exe	89
PID 1200 wrote to memory of 4048	1200	firefox.exe	89
PID 1200 wrote to memory of 4048	1200	firefox.exe	89
PID 1200 wrote to memory of 4048	1200	firefox.exe	89
PID 1200 wrote to memory of 4048	1200	firefox.exe	89
PID 1200 wrote to memory of 2276	1200	firefox.exe	90
PID 1200 wrote to memory of 2276	1200	firefox.exe	90
PID 1200 wrote to memory of 2276	1200	firefox.exe	90
PID 1200 wrote to memory of 2276	1200	firefox.exe	90

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6df0ecc5cec9ab536e7ca5c5e0670cd0.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6df0ecc5cec9ab536e7ca5c5e0670cd0.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2760
- C:\Users\Admin\AppData\Local\Temp\OCS\ocs_v7d.exe
  C:\Users\Admin\AppData\Local\Temp\OCS\ocs_v7d.exe -install -3062240 -dcu -8db60d2eefd841818f5a2955d369a5bd - -hu -vfnocrmsugwpkyrz -262250
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2664
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" http://www.download-sponsor.de/exitdownload/thankyou.php?pid=dcu&cid=3062240&appname=[APPNAME]&cbstate=&uid=94fd9dcc-171a-489c-b32e-632ad6a3f995&sid=8db60d2eefd841818f5a2955d369a5bd&scid=&source=hu&language=en-cl&cdata=utyp-31.userid-333732323333393431306239383531393866393238333735.ua-66697265666f782e657865
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4820
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" http://www.download-sponsor.de/exitdownload/thankyou.php?pid=dcu&cid=3062240&appname=[APPNAME]&cbstate=&uid=94fd9dcc-171a-489c-b32e-632ad6a3f995&sid=8db60d2eefd841818f5a2955d369a5bd&scid=&source=hu&language=en-cl&cdata=utyp-31.userid-333732323333393431306239383531393866393238333735.ua-66697265666f782e657865
      4⤵
      Checks processor information in registry
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1200
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1988 -parentBuildID 20240401114208 -prefsHandle 1900 -prefMapHandle 1892 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c79d5398-1a1f-4849-87df-db532f43999b} 1200 "\\.\pipe\gecko-crash-server-pipe.1200" gpu
        5⤵
        
        PID:4048
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2468 -parentBuildID 20240401114208 -prefsHandle 2460 -prefMapHandle 2456 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0ae32227-8cb9-4d48-b100-5e51abeab3d5} 1200 "\\.\pipe\gecko-crash-server-pipe.1200" socket
        5⤵
        
        PID:2276
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1580 -childID 1 -isForBrowser -prefsHandle 3060 -prefMapHandle 1576 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1244 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c6c4b3af-838d-458f-b618-43ef1b2b8227} 1200 "\\.\pipe\gecko-crash-server-pipe.1200" tab
        5⤵
        
        PID:3656
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3684 -childID 2 -isForBrowser -prefsHandle 3676 -prefMapHandle 2748 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1244 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {69d267c5-18ff-483f-b534-d200429f8f1e} 1200 "\\.\pipe\gecko-crash-server-pipe.1200" tab
        5⤵
        
        PID:1400
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4648 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4664 -prefMapHandle 4660 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {32f2a873-b115-481b-800a-b4b827d59864} 1200 "\\.\pipe\gecko-crash-server-pipe.1200" utility
        5⤵
        Checks processor information in registry
        
        PID:4448
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5300 -childID 3 -isForBrowser -prefsHandle 5292 -prefMapHandle 5248 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1244 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ec4c7aba-03cd-4cbe-9aab-a3f1affd0cbc} 1200 "\\.\pipe\gecko-crash-server-pipe.1200" tab
        5⤵
        
        PID:2356
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5456 -childID 4 -isForBrowser -prefsHandle 5540 -prefMapHandle 5288 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1244 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {018afeec-c2c8-4e38-adfb-6d6752e31e32} 1200 "\\.\pipe\gecko-crash-server-pipe.1200" tab
        5⤵
        
        PID:4456
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5688 -childID 5 -isForBrowser -prefsHandle 5424 -prefMapHandle 5428 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1244 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0925c8e7-e88f-44cd-8672-690c7c64b9c0} 1200 "\\.\pipe\gecko-crash-server-pipe.1200" tab
        5⤵
        
        PID:3460
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4460 -childID 6 -isForBrowser -prefsHandle 3568 -prefMapHandle 5948 -prefsLen 30948 -prefMapSize 244658 -jsInitHandle 1244 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a479b211-a11c-49a6-9331-899057d237ce} 1200 "\\.\pipe\gecko-crash-server-pipe.1200" tab
        5⤵
        
        PID:4620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y0bypz8z.default-release\activity-stream.discovery_stream.json

Filesize
22KB

MD5
d3ed8817cbe96ec605955b5226ff989e

SHA1
1034193e72bc5bab15a7138f7fb7eb2e9df4dd09

SHA256
619a98ed331fc3aafb1c96f5f6aa328a770425c6c3b0d6c0c59bd4d5b053d7b7

SHA512
225a6c173cde6e978ad551cdb2a9771175e34ef1c3833da521fd9aabdf422c239e48f3e5745528aa9d7ed91258afcd74e91f9f2e6557f84022ba238587c86a16

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y0bypz8z.default-release\cache2\entries\6653BC7BE242C21AA1988A4A42D1DEDA18231C31

Filesize
13KB

MD5
815ddd3f9b3ed9fc6e900ab958386a89

SHA1
c02d87918e3b3eddacb8043cf71ad17f6a1102ce

SHA256
c2b924847a0427bf61852fed286b38d579794474b58490875381c3b6f800a181

SHA512
2b9ffeebd0215904af038df8446194d94f2f8f88a37922965636017e2d63550d39e5fcb2f4c3f2333ce471fe742bf85ee5c3b7e576e50e149c7b1c332c380235

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y0bypz8z.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

Filesize
15KB

MD5
96c542dec016d9ec1ecc4dddfcbaac66

SHA1
6199f7648bb744efa58acf7b96fee85d938389e4

SHA256
7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

SHA512
cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

Download Submit
C:\Users\Admin\AppData\Local\Temp\OCS\ocs_v7d.exe

Filesize
292KB

MD5
0f152d15cd6845999b6fe329e87ca52b

SHA1
34bcde11a22683ec42f88cf11a55df978a1ca53b

SHA256
6b0c155bd3f1129d78dc8e076841211963d05f0ec41db5fbbe28199531f611b2

SHA512
966f9388dfc106b1e2aed752ec3b2003ed9dc3371098a349232e9aaa47e7e1a58cbba3a85d95334511ebfebe3a14a4429bb354106de72a592c1b8462ca005a5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\OCS\vfnocrmsugwpkyrz.dat

Filesize
91B

MD5
d5168a5e3a4d744e02302879bbe2cb20

SHA1
127e74df41b164e98d026899577d4add5f03a6f6

SHA256
b427aa39d43395081527785cf8501ed58037e5fd48961ef4c2deec71026705e4

SHA512
0f9e306b13b152b72596eeac5b793309e43279a87249bc25c83458fd69dfe128014827cee541d78382d00c42d39ccde68d6e40ebd5e4a06ce3d6a2f7aaf3ef6f

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\AlternateServices.bin

Filesize
6KB

MD5
9391bdfcbc78003392d2d1fb50664aa7

SHA1
210d5906d4c907b063a54f56768210cab28a9877

SHA256
e83e659589d93a0018f5b92f532fec3e8187d95a888e341cc78310b565b00f82

SHA512
f1d581826e6fce2a8970889cf617ba63e4630f34088c91d1e0b8074e3211e28741363817af718390e307979e568392e5ea2ebe951b59c972f2eb3b2b6496e839

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\AlternateServices.bin

Filesize
8KB

MD5
03d78d5c538579ef8967edab364f1b14

SHA1
41b5c2c0470435c1b9b546ecd53383310a59106c

SHA256
74c6f30058e0d2e6d64882aad95c45fe1bc817b0921a805750ba66ae02abf689

SHA512
45560e82e73afd15202871858fafd73e70005beceaf29e18d731292019859bc3068471002a8be8917096ccbab73cb9d2f1616854de5af1f10dd182faf37df8f8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
e04b9fd3b98bed5c01755293c7e2aa64

SHA1
e23012576d42210b12a0df512477e5d04d1d48d5

SHA256
916105393a1c4d03e0a810b622c7081a5e53cda035cbe31429c7d6bc12bcc29a

SHA512
30d21fb494c3ffda86ad33c6d1acbfb7813b36c1192f39292b6995e3879a14252512d23551a115713236adcf39cfd45418934b41fc9e4c73fa6b8011a9ce3aa7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
7c1181b0110d61f8068f891d693e79a3

SHA1
f68f9fab1efc182871ce5a113f6386f707cb30f8

SHA256
982454dcd0d7730ef2d18916041e7f01ebb4b8cf89d9802b7a7b19575f8e7261

SHA512
38f6e7617b46266f8348cf847a48af9f068576bc7e9f163e7030f0548b8b4c0ab26063297e5ee25f0b71ee3aa54d43d94259ef43420fe012d3338a28ef1ce99d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\pending_pings\10032302-d83f-4f8f-9259-225a28916dbb

Filesize
671B

MD5
91f4c445e0ff4ee9ffdabd8315c68016

SHA1
47958ebcc408c1c02d9c3e56e0aa6c3201d4570f

SHA256
ba36e0c5787d6a5109187aaf00c7e1c020650e6f0741e68d8f3ddbcaab8f3a5f

SHA512
34f1ae19c2eabd9e810a4854accb1fe1f4170c49c9f73cedff64dbefad8da27e54596270ea4fd95cd798f7ec27b1e19257f3e70235d291b26ad95857eeed1275

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\pending_pings\108b7324-411a-47e0-85e7-fb3fb2fd2732

Filesize
27KB

MD5
5166e989341c5a7061c115e38d94ff68

SHA1
f2b5f9461a1e7b72310538a1e7227ff566394fa1

SHA256
5f191b0b3b382890e472b09931d9e5c4c4a348adc012e88d7ea859bc230f66f1

SHA512
8335978acb70e8ad739c3f35bcb2f35a8ceefcc3106bb4d1c12c1df149627d22a99189aa6f23bff790adaef3706649eeb46797099665cbde420331e107b6c5bf

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\pending_pings\e23dc8a2-a80b-4f2f-bad3-6accde6c7fda

Filesize
982B

MD5
71f94895c41ee68ffa62d5cc43230ab1

SHA1
f6eaaedf982ef521bc7e07a74603d644671d587a

SHA256
242cd06fe9f23f95461aa318d8298a88ca40fa76e3f468437f50c80e3f940a1e

SHA512
455d6f0affbe8aa2fb986ed9e69217e7485305ef588aa78b6b1b7ad28956b74a1862bb1ffdd89cb01e09e53705781112e9742e35db547573047eaf922b54bb36

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\prefs-1.js

Filesize
10KB

MD5
46173b83038234c8b93404bda6064679

SHA1
e821fac6acb0e98c8ddee4ebda84658595204261

SHA256
92c0536a6e3b4af2db0d640991c498b9d404a406bfcda7cb8aa7bddc4842afd6

SHA512
c24eb83b176354e6818c01f1bc9ba9f6cb57bf0459068392d9c90e412f91bc88ff0b589b9ea16a94e22700799c3c8bed9d60124994253343fa1271c974384f80

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\prefs-1.js

Filesize
11KB

MD5
51b2ebf85870b0045b8e885fc7d2ffb0

SHA1
29dc3d6bd1e2b80490d21c0fe575f828a4829010

SHA256
c29f9782816c4ad7ee10d0cd992da1825e5319182b547aabc0efb71ed0435169

SHA512
282e598d86068de8d330871d2cb146a109cc6af7f70465c7f16bc66a657a8fc4938e4fb015cfb3a5c91ee17694b065451e4cb5619a439654d13c640a5250fb1f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\prefs.js

Filesize
10KB

MD5
f67bf8b2964c67e560368ecd53418ea6

SHA1
884c3385376af30fe3062e6b38ea0ee985b2d7e2

SHA256
ca8f65d5340eabdb7372add9639c7fa79515ac5ef2ff0ad00f9b0ab30cfe5d2b

SHA512
d283a43a489065802df6b5bae0283f50a697299526c46214bb38d77cf47bebf78636f780bbf070da93ec7d2bcd957073276bb48efa40dbc02ec263a23c9d8033

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\prefs.js

Filesize
10KB

MD5
24e0d61d828bc0f2debf3a78f3a3b378

SHA1
032b9bfc4407f4b3fccc467f9a88d17224bbbc7e

SHA256
1b2e2778b8b38971b09c8e69b5fa1071071a843438e67b557c278027e0d0f39a

SHA512
ef90084a06f7431e64e7a4e34b415f9af17316980b0c88d43324c3beca1c451f778a68180e5aae2cce5c865fee4f4d5a3414c433774c068bde261a37dc1e40a2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\sessionstore-backups\recovery.baklz4

Filesize
1KB

MD5
ae9a94c5f51194828199f94a1589c64d

SHA1
679fc0f8d3014a8467a40974d163061753546ab7

SHA256
f100038693c6d7562082d33a3c885f6983de70a76298349d0bb17aaefad3d1e8

SHA512
1bb9fe4cf282d6ef08dc60ec34399c9d7bf84d98930c9d012e8fdddc36c06d4d20be24c74f23a5b571a68859c3f3427dace1883b65d5578fc70ed4c2f1e71d05

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\sessionstore-backups\recovery.baklz4

Filesize
1KB

MD5
bf6af702eb20383843d4a20e53ef3bed

SHA1
8ca02a2dbe981da7dedab3af1896efb0d9cf1681

SHA256
fee1f62dab059854eb8f06c99d5f467e9acd5d2edd7d1248d032b8ff7078378b

SHA512
854d1d913b18fe6caea47d0b30a1758a7f570cf33c8cd9e84b3f21606b03c45965cb9ff00cde8a4626dec77af26d6491ed1be3c5e2b2870b6c75f52117cfb6c4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
1.2MB

MD5
75492de1665e6824e3f3fe3c33475da8

SHA1
ff9b0083844e471fafbd1bc776a3dbb71b34ac6c

SHA256
45bcdc5a37425762d941ee33ece965188685b3f93a5961727c5c4e3d91120165

SHA512
0aac8eaf7a380eb3db5f412686b99b18291038f6c97f5b59d4d80f78301b130904f98e6972d4441afbef66e6f03bb4191f74596ecb886e2a344a7258efb5440f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
1.9MB

MD5
bcb6e198046ddf9df658d5a52f96529f

SHA1
7cd571e40f2379337f2df00561ce2771edb3dc9d

SHA256
b8411044b12acf9aa23ddf67822057074fc4115be5fc649906ca8785b74b6a36

SHA512
3faaaf5bb283cb2d17ede736d22246ff58ffb59cee14ceafe6efde097ffb846100a38ed9acff1dd1bad1f46235db979a906976ce402297bbc9ac48c79a65b90d

Download Submit
memory/2664-19-0x00007FFC04430000-0x00007FFC04DD1000-memory.dmp

Filesize
9.6MB

Download
memory/2664-23-0x00007FFC04430000-0x00007FFC04DD1000-memory.dmp

Filesize
9.6MB

Download
memory/2664-21-0x00007FFC04430000-0x00007FFC04DD1000-memory.dmp

Filesize
9.6MB

Download
memory/2664-20-0x00007FFC04430000-0x00007FFC04DD1000-memory.dmp

Filesize
9.6MB

Download
memory/2664-9-0x000000001B910000-0x000000001BDDE000-memory.dmp

Filesize
4.8MB

Download
memory/2664-12-0x000000001BDE0000-0x000000001BE7C000-memory.dmp

Filesize
624KB

Download
memory/2664-13-0x0000000000C60000-0x0000000000C68000-memory.dmp

Filesize
32KB

Download
memory/2664-10-0x00007FFC04430000-0x00007FFC04DD1000-memory.dmp

Filesize
9.6MB

Download
memory/2664-14-0x00007FFC04430000-0x00007FFC04DD1000-memory.dmp

Filesize
9.6MB

Download
memory/2664-18-0x00007FFC04430000-0x00007FFC04DD1000-memory.dmp

Filesize
9.6MB

Download
memory/2664-8-0x00007FFC046E5000-0x00007FFC046E6000-memory.dmp

Filesize
4KB

Download
memory/2664-17-0x00007FFC04430000-0x00007FFC04DD1000-memory.dmp

Filesize
9.6MB

Download
memory/2664-16-0x00007FFC04430000-0x00007FFC04DD1000-memory.dmp

Filesize
9.6MB

Download
memory/2664-11-0x000000001B260000-0x000000001B306000-memory.dmp

Filesize
664KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads