revengerat | de857504d0af2fb85045bc4f68ed7df380e2490186af314ca2a27cd1b7d13a6a

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24/01/2025, 06:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

de857504d0af2fb85045bc4f68ed7df380e2490186af314ca2a27cd1b7d13a6a.exe
Size

578KB
MD5

2e1c27be8ad0c7cd5d617f4e65386eb4
SHA1

fb52e06e294053458025c3b4fb5c828c0d69eede
SHA256

de857504d0af2fb85045bc4f68ed7df380e2490186af314ca2a27cd1b7d13a6a
SHA512

35dac0d3a5db35798495c4ff64abe5b7e7b6486db82efe1cfb7898a86e11d2ae6d6f4c800cac2ec5289982f737357e932ab3f77f1ec7d28e2fc3bcd34f3e19f0
SSDEEP

6144:tKld3FcfCElJk125U8SpVUagDsvb6mgmw4sFfTysVufBn597NX2U:tkVcfXlJkE5YVUjuOjysgfBnnl2U

Score

10^/10

revengerat discovery stealer trojan

Malware Config

Signatures

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat
Revengerat family
revengerat

RevengeRat Executable 1 IoCs

stealer

resource	yara_rule
behavioral2/files/0x0007000000023ca9-6.dat	revengerat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	ocs_v6z.exe

Executes dropped EXE 1 IoCs

pid	Process
5068	ocs_v6z.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	de857504d0af2fb85045bc4f68ed7df380e2490186af314ca2a27cd1b7d13a6a.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	5068	ocs_v6z.exe
Token: SeDebugPrivilege	1312	firefox.exe
Token: SeDebugPrivilege	1312	firefox.exe
Token: SeDebugPrivilege	1312	firefox.exe
Token: SeDebugPrivilege	1312	firefox.exe
Token: SeDebugPrivilege	1312	firefox.exe

Suspicious use of FindShellTrayWindow 21 IoCs

pid	Process
1312	firefox.exe
1312	firefox.exe
1312	firefox.exe
1312	firefox.exe
1312	firefox.exe
1312	firefox.exe
1312	firefox.exe
1312	firefox.exe
1312	firefox.exe
1312	firefox.exe
1312	firefox.exe
1312	firefox.exe
1312	firefox.exe
1312	firefox.exe
1312	firefox.exe
1312	firefox.exe
1312	firefox.exe
1312	firefox.exe
1312	firefox.exe
1312	firefox.exe
1312	firefox.exe

Suspicious use of SendNotifyMessage 20 IoCs

pid	Process
1312	firefox.exe
1312	firefox.exe
1312	firefox.exe
1312	firefox.exe
1312	firefox.exe
1312	firefox.exe
1312	firefox.exe
1312	firefox.exe
1312	firefox.exe
1312	firefox.exe
1312	firefox.exe
1312	firefox.exe
1312	firefox.exe
1312	firefox.exe
1312	firefox.exe
1312	firefox.exe
1312	firefox.exe
1312	firefox.exe
1312	firefox.exe
1312	firefox.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4808	de857504d0af2fb85045bc4f68ed7df380e2490186af314ca2a27cd1b7d13a6a.exe
5068	ocs_v6z.exe
5068	ocs_v6z.exe
1312	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4808 wrote to memory of 5068	4808	de857504d0af2fb85045bc4f68ed7df380e2490186af314ca2a27cd1b7d13a6a.exe	83
PID 4808 wrote to memory of 5068	4808	de857504d0af2fb85045bc4f68ed7df380e2490186af314ca2a27cd1b7d13a6a.exe	83
PID 5068 wrote to memory of 3496	5068	ocs_v6z.exe	88
PID 5068 wrote to memory of 3496	5068	ocs_v6z.exe	88
PID 3496 wrote to memory of 1312	3496	firefox.exe	89
PID 3496 wrote to memory of 1312	3496	firefox.exe	89
PID 3496 wrote to memory of 1312	3496	firefox.exe	89
PID 3496 wrote to memory of 1312	3496	firefox.exe	89
PID 3496 wrote to memory of 1312	3496	firefox.exe	89
PID 3496 wrote to memory of 1312	3496	firefox.exe	89
PID 3496 wrote to memory of 1312	3496	firefox.exe	89
PID 3496 wrote to memory of 1312	3496	firefox.exe	89
PID 3496 wrote to memory of 1312	3496	firefox.exe	89
PID 3496 wrote to memory of 1312	3496	firefox.exe	89
PID 3496 wrote to memory of 1312	3496	firefox.exe	89
PID 1312 wrote to memory of 1740	1312	firefox.exe	90
PID 1312 wrote to memory of 1740	1312	firefox.exe	90
PID 1312 wrote to memory of 1740	1312	firefox.exe	90
PID 1312 wrote to memory of 1740	1312	firefox.exe	90
PID 1312 wrote to memory of 1740	1312	firefox.exe	90
PID 1312 wrote to memory of 1740	1312	firefox.exe	90
PID 1312 wrote to memory of 1740	1312	firefox.exe	90
PID 1312 wrote to memory of 1740	1312	firefox.exe	90
PID 1312 wrote to memory of 1740	1312	firefox.exe	90
PID 1312 wrote to memory of 1740	1312	firefox.exe	90
PID 1312 wrote to memory of 1740	1312	firefox.exe	90
PID 1312 wrote to memory of 1740	1312	firefox.exe	90
PID 1312 wrote to memory of 1740	1312	firefox.exe	90
PID 1312 wrote to memory of 1740	1312	firefox.exe	90
PID 1312 wrote to memory of 1740	1312	firefox.exe	90
PID 1312 wrote to memory of 1740	1312	firefox.exe	90
PID 1312 wrote to memory of 1740	1312	firefox.exe	90
PID 1312 wrote to memory of 1740	1312	firefox.exe	90
PID 1312 wrote to memory of 1740	1312	firefox.exe	90
PID 1312 wrote to memory of 1740	1312	firefox.exe	90
PID 1312 wrote to memory of 1740	1312	firefox.exe	90
PID 1312 wrote to memory of 1740	1312	firefox.exe	90
PID 1312 wrote to memory of 1740	1312	firefox.exe	90
PID 1312 wrote to memory of 1740	1312	firefox.exe	90
PID 1312 wrote to memory of 1740	1312	firefox.exe	90
PID 1312 wrote to memory of 1740	1312	firefox.exe	90
PID 1312 wrote to memory of 1740	1312	firefox.exe	90
PID 1312 wrote to memory of 1740	1312	firefox.exe	90
PID 1312 wrote to memory of 1740	1312	firefox.exe	90
PID 1312 wrote to memory of 1740	1312	firefox.exe	90
PID 1312 wrote to memory of 1740	1312	firefox.exe	90
PID 1312 wrote to memory of 1740	1312	firefox.exe	90
PID 1312 wrote to memory of 1740	1312	firefox.exe	90
PID 1312 wrote to memory of 1740	1312	firefox.exe	90
PID 1312 wrote to memory of 1740	1312	firefox.exe	90
PID 1312 wrote to memory of 1740	1312	firefox.exe	90
PID 1312 wrote to memory of 1740	1312	firefox.exe	90
PID 1312 wrote to memory of 1740	1312	firefox.exe	90
PID 1312 wrote to memory of 1740	1312	firefox.exe	90
PID 1312 wrote to memory of 1740	1312	firefox.exe	90
PID 1312 wrote to memory of 1740	1312	firefox.exe	90
PID 1312 wrote to memory of 1740	1312	firefox.exe	90
PID 1312 wrote to memory of 1740	1312	firefox.exe	90
PID 1312 wrote to memory of 1740	1312	firefox.exe	90
PID 1312 wrote to memory of 1740	1312	firefox.exe	90
PID 1312 wrote to memory of 2496	1312	firefox.exe	91
PID 1312 wrote to memory of 2496	1312	firefox.exe	91
PID 1312 wrote to memory of 2496	1312	firefox.exe	91
PID 1312 wrote to memory of 2496	1312	firefox.exe	91

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\de857504d0af2fb85045bc4f68ed7df380e2490186af314ca2a27cd1b7d13a6a.exe
"C:\Users\Admin\AppData\Local\Temp\de857504d0af2fb85045bc4f68ed7df380e2490186af314ca2a27cd1b7d13a6a.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4808
- C:\Users\Admin\AppData\Local\Temp\OCS\ocs_v6z.exe
  C:\Users\Admin\AppData\Local\Temp\OCS\ocs_v6z.exe -install -555175 -dcude -6aa2c8fc392d4f159dd9827d875dc51d - -en -tiphgbsylgflfkpb
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5068
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" http://www.download-sponsor.de/exitdownload/thankyou.php?pid=dcude&cid=555175&appname=[APPNAME]&cbstate=&uid=84f0eae2-3649-4c63-ba93-aca732049796&sid=6aa2c8fc392d4f159dd9827d875dc51d&scid=&source=en&language=en-US&cdata=utyp-31.userid-373538386166383338366565616338323336306438336639.ua-66697265666f782e657865
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3496
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" http://www.download-sponsor.de/exitdownload/thankyou.php?pid=dcude&cid=555175&appname=[APPNAME]&cbstate=&uid=84f0eae2-3649-4c63-ba93-aca732049796&sid=6aa2c8fc392d4f159dd9827d875dc51d&scid=&source=en&language=en-US&cdata=utyp-31.userid-373538386166383338366565616338323336306438336639.ua-66697265666f782e657865
      4⤵
      Checks processor information in registry
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1312
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1948 -parentBuildID 20240401114208 -prefsHandle 1880 -prefMapHandle 1872 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4649c17d-fd22-4d05-bcd9-b9a6238ebd5f} 1312 "\\.\pipe\gecko-crash-server-pipe.1312" gpu
        5⤵
        
        PID:1740
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2440 -parentBuildID 20240401114208 -prefsHandle 2432 -prefMapHandle 2420 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0e1756c2-c5cd-4721-a86c-c50900573171} 1312 "\\.\pipe\gecko-crash-server-pipe.1312" socket
        5⤵
        
        PID:2496
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3004 -childID 1 -isForBrowser -prefsHandle 1364 -prefMapHandle 3080 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 944 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {abd17f0e-252a-4c28-9f47-ee41bd7e28d8} 1312 "\\.\pipe\gecko-crash-server-pipe.1312" tab
        5⤵
        
        PID:4620
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1040 -childID 2 -isForBrowser -prefsHandle 3624 -prefMapHandle 2596 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 944 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a94deb30-6464-473a-996f-cba140a66aa3} 1312 "\\.\pipe\gecko-crash-server-pipe.1312" tab
        5⤵
        
        PID:548
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4760 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4768 -prefMapHandle 4780 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e77c5c41-3afd-4610-a7b5-19dedf765246} 1312 "\\.\pipe\gecko-crash-server-pipe.1312" utility
        5⤵
        Checks processor information in registry
        
        PID:4896
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5144 -childID 3 -isForBrowser -prefsHandle 5136 -prefMapHandle 4792 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 944 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {60fb3d34-7bee-4481-a4b9-5547324af005} 1312 "\\.\pipe\gecko-crash-server-pipe.1312" tab
        5⤵
        
        PID:3656
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5160 -childID 4 -isForBrowser -prefsHandle 5304 -prefMapHandle 5308 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 944 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {79552a2e-e4e9-4338-b9a3-350df7f82126} 1312 "\\.\pipe\gecko-crash-server-pipe.1312" tab
        5⤵
        
        PID:2944
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5500 -childID 5 -isForBrowser -prefsHandle 5576 -prefMapHandle 5572 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 944 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {729f8cde-7852-4f47-913e-9b4abd88220b} 1312 "\\.\pipe\gecko-crash-server-pipe.1312" tab
        5⤵
        
        PID:3132
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4476 -childID 6 -isForBrowser -prefsHandle 4504 -prefMapHandle 4732 -prefsLen 30948 -prefMapSize 244658 -jsInitHandle 944 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dabc1833-52e2-4917-b77c-befade6323dd} 1312 "\\.\pipe\gecko-crash-server-pipe.1312" tab
        5⤵
        
        PID:4572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\g9per00b.default-release\activity-stream.discovery_stream.json

Filesize
31KB

MD5
705247067b20441e61acbdc78b532bee

SHA1
13e840695aca5e1b6d412fc6789fd1cbe65c2e24

SHA256
b476d29bc845eea29727a0ae11361380f38d89b265a32201bc8ae29423c4a445

SHA512
3e6bb99ec90ec31cebd41fb8fe8416e5d97ea5ce33a115892804f9a46e5dc35cf51da694caf1daf500466a8fbe7df6cadb1d3c9bd3bd73d17d311c95f26f6df1

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\g9per00b.default-release\cache2\entries\D18FB7DA89F8DD4E7A2C97703A1647E8C981D05A

Filesize
13KB

MD5
ce950fd0062475f9ff3d0a4f70881550

SHA1
7b5f49c559e7c370c41f03b0b77ce7bd27162d19

SHA256
876ef062067cf825da9b20cf09d1cc5ebd32c6649a559bcdcfa52e630c1b040a

SHA512
acfd92bf940298e5eeccd1ae58ddc2f1980b13c11981954a8de30767835266b96747b21130ff3ece56f49897b3a0c1e29ffebbdd61820df4dc136075b3392f8f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\g9per00b.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

Filesize
15KB

MD5
96c542dec016d9ec1ecc4dddfcbaac66

SHA1
6199f7648bb744efa58acf7b96fee85d938389e4

SHA256
7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

SHA512
cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

Download Submit
C:\Users\Admin\AppData\Local\Temp\OCS\ocs_v6z.exe

Filesize
312KB

MD5
09f02c017e40a998537f26d0caee8d22

SHA1
7676d2f17068a9050bbbbe10908e75bc5d59b631

SHA256
fae6c9cfda16a9f4587b0041156a7284bf7cb1fc48e1e34f33b50ebc2d00e2d7

SHA512
0c7d4fad92bb7478e277f6c56e0e0dbd665171a7bea06a6668d9d0120c5f171cbcec37c60b6354a286192f2f0bbf104ccc5550159e863ee03cc2e23243eb93c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\OCS\tiphgbsylgflfkpb.dat

Filesize
91B

MD5
404a7679c5a70c38de354f87d537ca39

SHA1
5d33433a70b49f03a6fc448b778bbf7be41187b5

SHA256
96950de153a245f1aead7e2edcdc266236d7f0a6b5d0be4703565cef45f1f7df

SHA512
3502307cdc103755dab5dfc3f124e67323bde3b28bed6ca177eb8344030ace304329337a959eb4ada96d43a0482a7be7a99a0bb8aef322e0516c29e08d32aa0e

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\AlternateServices.bin

Filesize
6KB

MD5
c161233b5071020b2d5ae409b3c044d0

SHA1
95a374fb72b3c5908d8079276d1c7023e67e25d0

SHA256
09b7de45a2c4e12fb6ca769f58225d6dd373d2e6b8b75b29638a539cc7c74905

SHA512
4fc13c242b0b105a961ba0cde85065057e92c9609585843354c56717734b2342968b5c7067a31c9512de7402181cf2c7c10d6deebce4d8acd25200d367eb726d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\AlternateServices.bin

Filesize
6KB

MD5
694409d978e6a29d2a877b74818971fa

SHA1
8eca242fa2eb51ddf6c3c8066441764aee2c78e6

SHA256
a6f799d19f9f841dfbf9dfa13e030bd63b754b8a8ca567fb9d15449ec49fe8f5

SHA512
bc6e805e28ceefb0a0a3863ac3d7535f34f3b399cf987f25391cfc5067a592bfa235465cabb8e9c6b107adca61535d413486e5cafe8e100510af7722e8d0652b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
21d7bf502068360786cd5ca66a7085bd

SHA1
5cc2454bd9549b79a30f32f888418ad2b0eb051e

SHA256
199888de1e9362651de47d85fcc8d786146989cda732614ab500dc394af728ec

SHA512
37d759bb5045ef7a03add18cfce600172ce80a8f8c1a2bbaa3dabd3265b01cd12094e535632dc6e8b12670ff60c8716be5106e5c4819a4f48f2a405715366889

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\db\data.safe.tmp

Filesize
14KB

MD5
58aabf70b09e2b4e2966b6f6f9c1842b

SHA1
893fb4ccfde41f8332e859ee2883f27c20bd4a98

SHA256
5df92b933769aea51d10bd6077e11fbb7ee38ce1605825beefbb556c91e4c2db

SHA512
9fa07b3ddb981a5cf8a18f7da56fd17c39913db3bf5bebdc06c7171de046222ff91d94b51b9bd02be1db21a9b8e17f79b010bc3212730e9975dcd07ab5151162

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\db\data.safe.tmp

Filesize
14KB

MD5
4d3e7c071fe0da1c258af349ea2682ab

SHA1
41ef03c11acec0b85e29df5b8017745720e01353

SHA256
52327135a00b9e66344e18414196c791c9d7bf33e3ad7caa0bad8b817fb03b09

SHA512
8a808c23ee05bba67adf3a05774f3ce1c2dcf0aa20e37240c3b5f7a55cfb544c8e3817e79b7364c3195b1c14bc2d602c18b086dd29ff1232767a299c60fe1c96

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\pending_pings\6bf2f899-3042-44d6-96cf-6889d0779a8d

Filesize
671B

MD5
f520ccbf7b7c917430df47f7b048b20b

SHA1
84c4f181243984d53461c7dd14ff38103779d496

SHA256
82ed79535ba80246b5a66bad961c701ae416dd39060a041f5ee24a3251cc4d98

SHA512
613d6a3e22d68ecc870e5104a5b40cc3078c8a65363160aa0339d72288fecb3da567fceac3d54d071dc5442350076eacf0cc81ab170e38bcdc989c85782581fc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\pending_pings\7a1dccdc-3e1f-4571-86ee-efdc7249075a

Filesize
26KB

MD5
643550bfe0eb62f21cce109e0cdbb51c

SHA1
1e19813c8b2acf52b693f821743b17b59d846fab

SHA256
dc06418cb411bb757da94b19f521fd1b7adbf6764f26fe264a5387cab8272b98

SHA512
af7b636a25632815e2152a773b6014d07fdac0aa7a518923f1d0ee2fd22f4983db0c2b53daac36c5d05083f8ffdc5dbec0ad18d6cf67005c344dccca34fc8f32

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\pending_pings\910f8865-40ee-4a5f-87e0-f1fd1d238b25

Filesize
982B

MD5
7cbefb6563d0933a7bd6bb8935849844

SHA1
3456526f25e6dbc8010f457a692fb36313d19a46

SHA256
3523c8a836644528612ef244502ef742c8a97e58f545720656f71f4b6d06b672

SHA512
a3ab1ed796b3979da7db5ee626ee6f57eae07ef0169408d1bf7ff747859956bd9f92a3417462eea7b507a2eda5a8acd28fdce2bfe2164200b23b64098aaf81e7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\prefs-1.js

Filesize
10KB

MD5
83b8ed3d2377de377cc9d7740c4620d7

SHA1
c87466e69d8471f6de004ad7b5a606b22ad351d3

SHA256
f13097433112b7bb769a79abd56196b40c2ea04c80caf9a8d92efae330f1371b

SHA512
77d8ebe17fbeac9dee3d0f37d9bd4eda2a4b106077ffd859e6d3237dcc70d414ce5b122647bd803e6da8f04383327e04903f6e768943d88a18547f0029b758df

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\prefs-1.js

Filesize
14KB

MD5
d77509cd2f8b90b3c18b50a35d1ff2e0

SHA1
b2a0a57ee54766710731b8b8e3a1df6286e46d70

SHA256
bf5386530a066b78425c18c9c3dc1e457c4f45d876ef6654ef963bcdab6b7c58

SHA512
eac64b0a2f69f4f3f5b9fc509b10e52dcb7905afd1b0a86218d6438598dd2b3b6f9246b3d14d214b5258c3cfa963743c8c835055d7095a65f43406d59a9691b3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\prefs.js

Filesize
10KB

MD5
3fe101bababa0853c2766b9fd5b2a39a

SHA1
745b1f8e55b3ecf2c7af59be9259085c8fb92ce9

SHA256
580d75500d30058f9560067d91185f2cfab9746b877fe86a1a762b66b3e5b0e4

SHA512
d1dfcf16b891a7606faced8e57e5e7b3effcb7d70a28283ebe1d0520bf0c36685d154909304943c2c3c81bc192b2faac760466c33fb3de1f484c27e563a10210

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\sessionstore-backups\recovery.baklz4

Filesize
1KB

MD5
a5a96da9dcca063e270e447362159c9d

SHA1
f8954864852652e9da6c30aa97f255927b1e4524

SHA256
fbb9bcc03c64c73b401b673196caacb2247d0ac46287ff35d23da7df290934dd

SHA512
d997589da81aa9f7e4a88a23b7a4bfd21e445c71359c56b0ac1c98517c3d92891a3225df44987420babfb0cc6dc9c4bdc13e1fb791a88574fc517fb2e79108f3

Download Submit
memory/5068-24-0x00007FFBBD7A0000-0x00007FFBBE141000-memory.dmp

Filesize
9.6MB

Download
memory/5068-23-0x00007FFBBD7A0000-0x00007FFBBE141000-memory.dmp

Filesize
9.6MB

Download
memory/5068-13-0x00007FFBBD7A0000-0x00007FFBBE141000-memory.dmp

Filesize
9.6MB

Download
memory/5068-27-0x00007FFBBD7A0000-0x00007FFBBE141000-memory.dmp

Filesize
9.6MB

Download
memory/5068-12-0x000000001C6A0000-0x000000001C73C000-memory.dmp

Filesize
624KB

Download
memory/5068-11-0x000000001C550000-0x000000001C5F6000-memory.dmp

Filesize
664KB

Download
memory/5068-25-0x00007FFBBD7A0000-0x00007FFBBE141000-memory.dmp

Filesize
9.6MB

Download
memory/5068-10-0x000000001C080000-0x000000001C54E000-memory.dmp

Filesize
4.8MB

Download
memory/5068-16-0x00007FFBBD7A0000-0x00007FFBBE141000-memory.dmp

Filesize
9.6MB

Download
memory/5068-14-0x00000000016C0000-0x00000000016C8000-memory.dmp

Filesize
32KB

Download
memory/5068-22-0x00007FFBBDA55000-0x00007FFBBDA56000-memory.dmp

Filesize
4KB

Download
memory/5068-9-0x00007FFBBD7A0000-0x00007FFBBE141000-memory.dmp

Filesize
9.6MB

Download
memory/5068-8-0x00007FFBBDA55000-0x00007FFBBDA56000-memory.dmp

Filesize
4KB

Download
memory/5068-21-0x00007FFBBD7A0000-0x00007FFBBE141000-memory.dmp

Filesize
9.6MB

Download
memory/5068-20-0x00007FFBBD7A0000-0x00007FFBBE141000-memory.dmp

Filesize
9.6MB

Download
memory/5068-19-0x00007FFBBD7A0000-0x00007FFBBE141000-memory.dmp

Filesize
9.6MB

Download
memory/5068-18-0x00007FFBBD7A0000-0x00007FFBBE141000-memory.dmp

Filesize
9.6MB

Download
memory/5068-17-0x00007FFBBD7A0000-0x00007FFBBE141000-memory.dmp

Filesize
9.6MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads