amadey | 413b036946af75dba74c98d52cf2a8ac969b6fded5da8a754c56776d5edc0553

Analysis

max time kernel
150s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20240709-en
resource tags

arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
submitted
10/07/2024, 08:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
413b036946af75dba74c98d52cf2a8ac969b6fded5da8a754c56776d5edc0553.exe
Size 1.9MB
Sample240710-j35fkaydmd
SHA256 413b036946af75dba74c98d52cf2a8ac969b6fded5da8a754c56776d5edc0553
MD5 2624875da55238f620fa50a01d4bce57
SHA1 f955733b1feeb7d7b1a7eefe414c2e33c242df1c
SHA512 0ebee57fc926ed57309b2aa8eae951ca44e71992999086e92a3b58a7448e2d610f57364b2fdbc5fefe76eb8ea557966be34b072e0f545b6514992008f6cc9159
SSDEEP 49152:uIbM0yp5IuJOqo6IS54+2JzQA2muJ2gB8LUWzxSB0:uI1XS5IaJ21zxSB0
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey stealc 4dd39d hate discovery evasion spyware stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.30

Botnet

4dd39d

http://77.91.77.82

Attributes

install_dir
ad40971b6b
install_file
explorti.exe
strings_key
a434973ad22def7137dbb5e059b7081e
url_paths
/Hun4Ko/index.php

rc4.plain

Extracted

Family

stealc

Botnet

hate

http://85.28.47.30

Attributes

url_path
/920475a59bac849d.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Stealc
Stealc is an infostealer written in C++.
stealer stealc

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	KJKEHIIJJE.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	413b036946af75dba74c98d52cf2a8ac969b6fded5da8a754c56776d5edc0553.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 12 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	413b036946af75dba74c98d52cf2a8ac969b6fded5da8a754c56776d5edc0553.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	KJKEHIIJJE.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	413b036946af75dba74c98d52cf2a8ac969b6fded5da8a754c56776d5edc0553.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	KJKEHIIJJE.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe

Executes dropped EXE 7 IoCs

pid	Process
5808	explorti.exe
3008	0dd8438c21.exe
1688	7fbca2d0f6.exe
6060	KJKEHIIJJE.exe
2812	explorti.exe
796	explorti.exe
2512	explorti.exe

Identifies Wine through registry keys 2 TTPs 6 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000\Software\Wine	413b036946af75dba74c98d52cf2a8ac969b6fded5da8a754c56776d5edc0553.exe
Key opened	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000\Software\Wine	KJKEHIIJJE.exe
Key opened	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000\Software\Wine	explorti.exe

Loads dropped DLL 2 IoCs

pid	Process
3008	0dd8438c21.exe
3008	0dd8438c21.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x000100000002aa62-42.dat	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs

pid	Process
1088	413b036946af75dba74c98d52cf2a8ac969b6fded5da8a754c56776d5edc0553.exe
5808	explorti.exe
3008	0dd8438c21.exe
3008	0dd8438c21.exe
6060	KJKEHIIJJE.exe
2812	explorti.exe
796	explorti.exe
2512	explorti.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\explorti.job	413b036946af75dba74c98d52cf2a8ac969b6fded5da8a754c56776d5edc0553.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	0dd8438c21.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	0dd8438c21.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
1088	413b036946af75dba74c98d52cf2a8ac969b6fded5da8a754c56776d5edc0553.exe
1088	413b036946af75dba74c98d52cf2a8ac969b6fded5da8a754c56776d5edc0553.exe
5808	explorti.exe
5808	explorti.exe
3008	0dd8438c21.exe
3008	0dd8438c21.exe
3008	0dd8438c21.exe
3008	0dd8438c21.exe
6060	KJKEHIIJJE.exe
6060	KJKEHIIJJE.exe
2812	explorti.exe
2812	explorti.exe
796	explorti.exe
796	explorti.exe
2512	explorti.exe
2512	explorti.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1532	firefox.exe
Token: SeDebugPrivilege	1532	firefox.exe
Token: SeDebugPrivilege	1532	firefox.exe
Token: SeDebugPrivilege	1532	firefox.exe
Token: SeDebugPrivilege	1532	firefox.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1088	413b036946af75dba74c98d52cf2a8ac969b6fded5da8a754c56776d5edc0553.exe
1688	7fbca2d0f6.exe
1688	7fbca2d0f6.exe
1688	7fbca2d0f6.exe
1688	7fbca2d0f6.exe
1688	7fbca2d0f6.exe
1688	7fbca2d0f6.exe
1688	7fbca2d0f6.exe
1532	firefox.exe
1532	firefox.exe
1532	firefox.exe
1532	firefox.exe
1532	firefox.exe
1532	firefox.exe
1532	firefox.exe
1532	firefox.exe
1532	firefox.exe
1532	firefox.exe
1532	firefox.exe
1532	firefox.exe
1532	firefox.exe
1532	firefox.exe
1532	firefox.exe
1532	firefox.exe
1532	firefox.exe
1532	firefox.exe
1532	firefox.exe
1532	firefox.exe
1532	firefox.exe
1688	7fbca2d0f6.exe
1688	7fbca2d0f6.exe
1688	7fbca2d0f6.exe
1688	7fbca2d0f6.exe
1688	7fbca2d0f6.exe
1688	7fbca2d0f6.exe
1688	7fbca2d0f6.exe
1688	7fbca2d0f6.exe
1688	7fbca2d0f6.exe
1688	7fbca2d0f6.exe
1688	7fbca2d0f6.exe
1688	7fbca2d0f6.exe
1688	7fbca2d0f6.exe
1688	7fbca2d0f6.exe
1688	7fbca2d0f6.exe
1688	7fbca2d0f6.exe
1688	7fbca2d0f6.exe
1688	7fbca2d0f6.exe
1688	7fbca2d0f6.exe
1688	7fbca2d0f6.exe
1688	7fbca2d0f6.exe
1688	7fbca2d0f6.exe
1688	7fbca2d0f6.exe
1688	7fbca2d0f6.exe
1688	7fbca2d0f6.exe
1688	7fbca2d0f6.exe
1688	7fbca2d0f6.exe
1688	7fbca2d0f6.exe
1688	7fbca2d0f6.exe
1688	7fbca2d0f6.exe
1688	7fbca2d0f6.exe
1688	7fbca2d0f6.exe
1688	7fbca2d0f6.exe
1688	7fbca2d0f6.exe
1688	7fbca2d0f6.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1688	7fbca2d0f6.exe
1688	7fbca2d0f6.exe
1688	7fbca2d0f6.exe
1688	7fbca2d0f6.exe
1688	7fbca2d0f6.exe
1688	7fbca2d0f6.exe
1688	7fbca2d0f6.exe
1688	7fbca2d0f6.exe
1688	7fbca2d0f6.exe
1688	7fbca2d0f6.exe
1688	7fbca2d0f6.exe
1688	7fbca2d0f6.exe
1688	7fbca2d0f6.exe
1688	7fbca2d0f6.exe
1688	7fbca2d0f6.exe
1688	7fbca2d0f6.exe
1688	7fbca2d0f6.exe
1688	7fbca2d0f6.exe
1688	7fbca2d0f6.exe
1688	7fbca2d0f6.exe
1688	7fbca2d0f6.exe
1688	7fbca2d0f6.exe
1688	7fbca2d0f6.exe
1688	7fbca2d0f6.exe
1688	7fbca2d0f6.exe
1688	7fbca2d0f6.exe
1688	7fbca2d0f6.exe
1688	7fbca2d0f6.exe
1688	7fbca2d0f6.exe
1688	7fbca2d0f6.exe
1688	7fbca2d0f6.exe
1688	7fbca2d0f6.exe
1688	7fbca2d0f6.exe
1688	7fbca2d0f6.exe
1688	7fbca2d0f6.exe
1688	7fbca2d0f6.exe
1688	7fbca2d0f6.exe
1688	7fbca2d0f6.exe
1688	7fbca2d0f6.exe
1688	7fbca2d0f6.exe
1688	7fbca2d0f6.exe
1688	7fbca2d0f6.exe
1688	7fbca2d0f6.exe
1688	7fbca2d0f6.exe
1688	7fbca2d0f6.exe
1688	7fbca2d0f6.exe
1688	7fbca2d0f6.exe
1688	7fbca2d0f6.exe
1688	7fbca2d0f6.exe
1688	7fbca2d0f6.exe
1688	7fbca2d0f6.exe
1688	7fbca2d0f6.exe
1688	7fbca2d0f6.exe
1688	7fbca2d0f6.exe
1688	7fbca2d0f6.exe
1688	7fbca2d0f6.exe
1688	7fbca2d0f6.exe
1688	7fbca2d0f6.exe
1688	7fbca2d0f6.exe
1688	7fbca2d0f6.exe
1688	7fbca2d0f6.exe
1688	7fbca2d0f6.exe
1688	7fbca2d0f6.exe
1688	7fbca2d0f6.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3008	0dd8438c21.exe
1532	firefox.exe
5216	cmd.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1088 wrote to memory of 5808	1088	413b036946af75dba74c98d52cf2a8ac969b6fded5da8a754c56776d5edc0553.exe	81
PID 1088 wrote to memory of 5808	1088	413b036946af75dba74c98d52cf2a8ac969b6fded5da8a754c56776d5edc0553.exe	81
PID 1088 wrote to memory of 5808	1088	413b036946af75dba74c98d52cf2a8ac969b6fded5da8a754c56776d5edc0553.exe	81
PID 5808 wrote to memory of 3008	5808	explorti.exe	82
PID 5808 wrote to memory of 3008	5808	explorti.exe	82
PID 5808 wrote to memory of 3008	5808	explorti.exe	82
PID 5808 wrote to memory of 1688	5808	explorti.exe	83
PID 5808 wrote to memory of 1688	5808	explorti.exe	83
PID 5808 wrote to memory of 1688	5808	explorti.exe	83
PID 1688 wrote to memory of 1744	1688	7fbca2d0f6.exe	84
PID 1688 wrote to memory of 1744	1688	7fbca2d0f6.exe	84
PID 1744 wrote to memory of 1532	1744	firefox.exe	87
PID 1744 wrote to memory of 1532	1744	firefox.exe	87
PID 1744 wrote to memory of 1532	1744	firefox.exe	87
PID 1744 wrote to memory of 1532	1744	firefox.exe	87
PID 1744 wrote to memory of 1532	1744	firefox.exe	87
PID 1744 wrote to memory of 1532	1744	firefox.exe	87
PID 1744 wrote to memory of 1532	1744	firefox.exe	87
PID 1744 wrote to memory of 1532	1744	firefox.exe	87
PID 1744 wrote to memory of 1532	1744	firefox.exe	87
PID 1744 wrote to memory of 1532	1744	firefox.exe	87
PID 1744 wrote to memory of 1532	1744	firefox.exe	87
PID 1532 wrote to memory of 5332	1532	firefox.exe	88
PID 1532 wrote to memory of 5332	1532	firefox.exe	88
PID 1532 wrote to memory of 5332	1532	firefox.exe	88
PID 1532 wrote to memory of 5332	1532	firefox.exe	88
PID 1532 wrote to memory of 5332	1532	firefox.exe	88
PID 1532 wrote to memory of 5332	1532	firefox.exe	88
PID 1532 wrote to memory of 5332	1532	firefox.exe	88
PID 1532 wrote to memory of 5332	1532	firefox.exe	88
PID 1532 wrote to memory of 5332	1532	firefox.exe	88
PID 1532 wrote to memory of 5332	1532	firefox.exe	88
PID 1532 wrote to memory of 5332	1532	firefox.exe	88
PID 1532 wrote to memory of 5332	1532	firefox.exe	88
PID 1532 wrote to memory of 5332	1532	firefox.exe	88
PID 1532 wrote to memory of 5332	1532	firefox.exe	88
PID 1532 wrote to memory of 5332	1532	firefox.exe	88
PID 1532 wrote to memory of 5332	1532	firefox.exe	88
PID 1532 wrote to memory of 5332	1532	firefox.exe	88
PID 1532 wrote to memory of 5332	1532	firefox.exe	88
PID 1532 wrote to memory of 5332	1532	firefox.exe	88
PID 1532 wrote to memory of 5332	1532	firefox.exe	88
PID 1532 wrote to memory of 5332	1532	firefox.exe	88
PID 1532 wrote to memory of 5332	1532	firefox.exe	88
PID 1532 wrote to memory of 5332	1532	firefox.exe	88
PID 1532 wrote to memory of 5332	1532	firefox.exe	88
PID 1532 wrote to memory of 5332	1532	firefox.exe	88
PID 1532 wrote to memory of 5332	1532	firefox.exe	88
PID 1532 wrote to memory of 5332	1532	firefox.exe	88
PID 1532 wrote to memory of 5332	1532	firefox.exe	88
PID 1532 wrote to memory of 5332	1532	firefox.exe	88
PID 1532 wrote to memory of 5332	1532	firefox.exe	88
PID 1532 wrote to memory of 5332	1532	firefox.exe	88
PID 1532 wrote to memory of 5332	1532	firefox.exe	88
PID 1532 wrote to memory of 5332	1532	firefox.exe	88
PID 1532 wrote to memory of 5332	1532	firefox.exe	88
PID 1532 wrote to memory of 5332	1532	firefox.exe	88
PID 1532 wrote to memory of 5332	1532	firefox.exe	88
PID 1532 wrote to memory of 5332	1532	firefox.exe	88
PID 1532 wrote to memory of 5332	1532	firefox.exe	88
PID 1532 wrote to memory of 5332	1532	firefox.exe	88
PID 1532 wrote to memory of 5332	1532	firefox.exe	88
PID 1532 wrote to memory of 5332	1532	firefox.exe	88
PID 1532 wrote to memory of 5332	1532	firefox.exe	88

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\413b036946af75dba74c98d52cf2a8ac969b6fded5da8a754c56776d5edc0553.exe
"C:\Users\Admin\AppData\Local\Temp\413b036946af75dba74c98d52cf2a8ac969b6fded5da8a754c56776d5edc0553.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1088
- C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
  "C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5808
- - C:\Users\Admin\AppData\Local\Temp\1000006001\0dd8438c21.exe
    "C:\Users\Admin\AppData\Local\Temp\1000006001\0dd8438c21.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:3008
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\KJKEHIIJJE.exe"
      4⤵
      PID:4580
    - - C:\Users\Admin\AppData\Local\Temp\KJKEHIIJJE.exe
        
        "C:\Users\Admin\AppData\Local\Temp\KJKEHIIJJE.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        
        PID:6060
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\FCFBFBFBKF.exe"
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:5216
- - C:\Users\Admin\AppData\Local\Temp\1000010001\7fbca2d0f6.exe
    "C:\Users\Admin\AppData\Local\Temp\1000010001\7fbca2d0f6.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:1688
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1744
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
        5⤵
        Checks processor information in registry
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1532
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1964 -parentBuildID 20240401114208 -prefsHandle 1892 -prefMapHandle 1884 -prefsLen 25751 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {06f04292-0d31-481e-8c66-11ef2aa8e862} 1532 "\\.\pipe\gecko-crash-server-pipe.1532" gpu
        6⤵
        
        PID:5332
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2380 -parentBuildID 20240401114208 -prefsHandle 2372 -prefMapHandle 2368 -prefsLen 26671 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1ab8e786-6084-4a15-8d41-537b8ccdbb89} 1532 "\\.\pipe\gecko-crash-server-pipe.1532" socket
        6⤵
        
        PID:2644
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2896 -childID 1 -isForBrowser -prefsHandle 3408 -prefMapHandle 3372 -prefsLen 22698 -prefMapSize 244658 -jsInitHandle 1352 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {71110b20-378e-4ecd-9d94-9be94960cd0b} 1532 "\\.\pipe\gecko-crash-server-pipe.1532" tab
        6⤵
        
        PID:2060
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3460 -childID 2 -isForBrowser -prefsHandle 3664 -prefMapHandle 1376 -prefsLen 31161 -prefMapSize 244658 -jsInitHandle 1352 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a008544a-812b-47b9-b424-dfa2da7e0458} 1532 "\\.\pipe\gecko-crash-server-pipe.1532" tab
        6⤵
        
        PID:5136
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4568 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4556 -prefMapHandle 4552 -prefsLen 31161 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {17db30e5-040b-4810-9cb3-701b99cdf8fb} 1532 "\\.\pipe\gecko-crash-server-pipe.1532" utility
        6⤵
        Checks processor information in registry
        
        PID:6020
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5664 -childID 3 -isForBrowser -prefsHandle 5652 -prefMapHandle 5648 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 1352 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {df79f0e6-0fcf-40c1-8129-5074d59b7c41} 1532 "\\.\pipe\gecko-crash-server-pipe.1532" tab
        6⤵
        
        PID:3948
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5780 -childID 4 -isForBrowser -prefsHandle 5700 -prefMapHandle 5704 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 1352 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {70f05d50-c6e0-455c-8e34-f75145f285f0} 1532 "\\.\pipe\gecko-crash-server-pipe.1532" tab
        6⤵
        
        PID:5656
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5932 -childID 5 -isForBrowser -prefsHandle 5636 -prefMapHandle 5676 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 1352 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {859b115a-d40c-4d28-af7e-ebcfa033a0ec} 1532 "\\.\pipe\gecko-crash-server-pipe.1532" tab
        6⤵
        
        PID:4904

C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2812

C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:796

C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

GHCGDAFCFHIDBGDHCFCB

Path C:\ProgramData\GHCGDAFCFHIDBGDHCFCB
Size 8KB
SHA256 8b5f6ffaa00b0dadfdf59f5510160acdfe43ef1008f7a9241d2c532001deb16b
MD5 20757fd4991fc8d72295b2b2b6396952
SHA1 93492c5bc28b8c610133f31bd54c04e0443469bb
SHA512 db2c2fbf026b8fcb2ebd0c1fac9263271bdf7b4785cf0ea0e005001b6278f988239155f9890b5e0dbe8cfe7827d20d8d78c4be6205d73be7a8e1ed3b1373b6c7
SSDEEP 192:A5nu2RUfpeD14xUcdzky60z4aXGPd4uIxEBw8Vl:7kWx5yxXdVXwO
MD5 SHA1 SHA512 SSDEEP

Submit Download

mozglue.dll

Path C:\ProgramData\mozglue.dll
Size 593KB
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
SSDEEP 12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5 SHA1 SHA512 SSDEEP

Submit Download

nss3.dll

Path C:\ProgramData\nss3.dll
Size 2.0MB
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
SSDEEP 49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5 SHA1 SHA512 SSDEEP

Submit Download

activity-stream.discovery_stream.json.tmp

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\tu0k8f5w.default-release\activity-stream.discovery_stream.json.tmp
Size 18KB
SHA256 2fe0b7a85c08200abc3d7b0ee8b502d5c46868ddf517a5d0aee09554dc22850d
MD5 e2f10c15c8c932c06f2d8d4bdd995135
SHA1 e1bf0f607ede730ee9421ad7b87c12352e1d0cd1
SHA512 894e420c6ba12cf105ed93fa99402952ca567f98d9519049c0bc7faf483dde04ff5d2022a080ff9513b2e200a10474b086dbc5567cb54b2d17b5c057fa6b9fef
SSDEEP 384:/mYmecdNG1jpPWICe412A4IbxdzofiA5LlViiZ6wM2IWyaE:/tr1jtHO1RLEq+7Y2hyp
MD5 SHA1 SHA512 SSDEEP

Submit Download

5CD1EBDF6B57F13C7E783CE5E6D8E9C44014FE1A

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\tu0k8f5w.default-release\cache2\entries\5CD1EBDF6B57F13C7E783CE5E6D8E9C44014FE1A
Size 13KB
SHA256 01b9c67c707d30625b0e45186834b2eb6eaf5c7b98ee49cecedadeb83da48c4b
MD5 be5f1adadfa7bbd6a79e261545b2dc94
SHA1 7f3d3d4bcef3320298282ce25b40adb6ae3b0482
SHA512 e8e7f4dce3f1c89e423e0747883ae2a94ec90e76233730b28be093c63ed72631578d27dd8da48842d76e862904ffa2468a61e19c6277c79185e15df1806bca2b
SSDEEP 384:HunTu9fiGLm4pUHft2WlOX8lPLZZB7t0lpDIIFZH:dBi8mCUHft2WAX8tzB7eD8W
MD5 SHA1 SHA512 SSDEEP

Submit Download

0dd8438c21.exe

Path C:\Users\Admin\AppData\Local\Temp\1000006001\0dd8438c21.exe
Size 2.4MB
SHA256 4f8c4c304d73e6e2d3d11708c57b158e648bd79132f0a973520dc14f9e3e2e01
MD5 7eac5517949c3ba823c0d05f296bd953
SHA1 89d79b84addb51db2bdfeb90c7780dda23fabd2d
SHA512 d7b189e5b24e7c68d57eb9c42b71233463d80b046a8d6b85e40391f477db5fb09348a1a1c0a78ce93320601a238972220dd04ed41b8fa84de69feec575c9ab89
SSDEEP 49152:81s8BuadFFjSnGgQWYec225D4JnoSIOXEUMF9+wKm1fMkK:2BP9SnGrfeGh+onOXEdf6m1Ek
MD5 SHA1 SHA512 SSDEEP

Submit Download

7fbca2d0f6.exe

Path C:\Users\Admin\AppData\Local\Temp\1000010001\7fbca2d0f6.exe
Size 1.2MB
SHA256 d18bbfa83202881061743177527c4f1ea0681c658028dd7dd0468f9a8a39e7cf
MD5 bea6ed281b600eae06be252f581721c1
SHA1 25fae547b4ad0a74bcc0bdf7e819f2c56d8be05d
SHA512 746a1bcae568caaf399ec8ca393250d6846235296088e22a2c8d80ce290e13d5845d79d7848b4f46adce2dad147b91c3731059b44ce7370f26072c999758bb42
SSDEEP 24576:YqDEvCTbMWu7rQYlBQcBiT6rprG8aLZ2Sbly7TWEPje:YTvC/MTQYxsWR7aLZ2dW
MD5 SHA1 SHA512 SSDEEP

Submit Download

explorti.exe

Path C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
Size 1.9MB
SHA256 413b036946af75dba74c98d52cf2a8ac969b6fded5da8a754c56776d5edc0553
MD5 2624875da55238f620fa50a01d4bce57
SHA1 f955733b1feeb7d7b1a7eefe414c2e33c242df1c
SHA512 0ebee57fc926ed57309b2aa8eae951ca44e71992999086e92a3b58a7448e2d610f57364b2fdbc5fefe76eb8ea557966be34b072e0f545b6514992008f6cc9159
SSDEEP 49152:uIbM0yp5IuJOqo6IS54+2JzQA2muJ2gB8LUWzxSB0:uI1XS5IaJ21zxSB0
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 479KB
SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
MD5 09372174e83dbbf696ee732fd2e875bb
SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 13.8MB
SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
MD5 0a8747a2ac9ac08ae9508f36c6d75692
SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tu0k8f5w.default-release\AlternateServices.bin
Size 11KB
SHA256 16a123dfe6209e77ee7bf2efb65230ab3c8bf0b876f5be999edd8235d59a0939
MD5 f23486a799e6ce91639f403fa6c7d57a
SHA1 06781da3be5f4fc8888fa95893acde7cf6178c60
SHA512 f3fd16a197a982c666053a5b2631bf8b078f9f7b8cf16475d4a52953c8b2901801ff9f7da1c8fd5e24252b336af918c435f6d5b1b7b7dea9de2d9a9b117d7729
SSDEEP 96:P5oWebOJmbupebvpf+mbisbHblgbgzXb:P5Ju2
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tu0k8f5w.default-release\AlternateServices.bin
Size 12KB
SHA256 b1a6d4d3ca643d30d94533151a23a719acf84aa25ad876d593b26877de01baf9
MD5 f5ad77923e9675fca806c78861294a2e
SHA1 cbe8065b313514f4665f57805de9ab4b3f214aba
SHA512 55816ac1e6580a41a91c37f824301f68fba6b6297066e8ea8f9ad69cc410effd1b9b22808895b4a7d9f8d86f50f4ae6289314ad75f4bd239b59f04a1c0ee9280
SSDEEP 96:P5oWebOJmbupebvpf+mbisbHbWgbgzQbjbrb:P5Ju2
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tu0k8f5w.default-release\datareporting\glean\db\data.safe.tmp
Size 35KB
SHA256 e2c341f3dd1d5747b49d15b67755cc158779be22df54883ce702dd2a949471cb
MD5 d6c4e038167d1b92e56f5a28d716526f
SHA1 97d2827b49783aefa4d63f40c88d7283843a9a88
SHA512 08315b0214f1a768208247e52eef2e2b497cedaa01bf25abd7c6d33a5564e293aa6295fc20312634d1ea3b5b866cb8aedb725403e304cf10fb74b2c6d8d34369
SSDEEP 768:+jNm3mVOQWOFbjpZxP9Y1xwJNPmATpH3fvPMbTbUbbb2b3b1b9bS7uvh+gZoSpb:NmVOQWOtgxwJf7uvh+gZoSF
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tu0k8f5w.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 88ea9d1fddc8770befbf0bac78b57d55116b71500ed2b357effae603d12a6dad
MD5 a5f9eeb5919105f26c47a57409b6e9cd
SHA1 80601edb5dc19c08bd4a2d9a74f36edcd17a0b00
SHA512 648c1cf79a39d964fa59c41b8da30085fad2157fcbedbc0649cfd07b8a0317610524f886367965b0c333fdef82e79156777b14533c9c895892c01900cf468c01
SSDEEP 96:qBQSMF9ZbkW6QX0BBdhmiSHPP/PrWZ8HQfD7HzAFl66Joz0dzgClKtmSSM:xrvZboHdhzSvPClnA/66Joz0dzgCl6mI
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tu0k8f5w.default-release\datareporting\glean\db\data.safe.tmp
Size 16KB
SHA256 f8bc38d6048d0a33d0dbdd252d370f13bbd14daece16ed0c58af5d1531d0ab07
MD5 b7b454ace5db6b0bc511ebc5b8cb0b13
SHA1 9b415992e2fced71434809ea124e299ea97148ad
SHA512 19edcb603d139c0f6f840f051222af0f7a8500f053c0aec5dd9d2f0c16441af433838aa65e4fbfbe60032a29bbb87deff2b0e8bdbf06fa5e3d82501bcd9026f2
SSDEEP 384:zbo9pAPGWQYgINLnarDTg1qbbbdctA/66JozQzgC1bM:HjVRgAnIDTg1qbbbinmm
MD5 SHA1 SHA512 SSDEEP

Submit Download

1f7c94f2-a2fa-483c-a2a3-09a468ad8733

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tu0k8f5w.default-release\datareporting\glean\pending_pings\1f7c94f2-a2fa-483c-a2a3-09a468ad8733
Size 671B
SHA256 7aa574385c692b3b0d3335e2861b7927e8b543af5f52c10ce733838de41fb101
MD5 84535ab50ed11403c70facd0915086c9
SHA1 cd95e44422297c0321e39854976d2197eb3b7db2
SHA512 2ef523dfdc24853c2ff0c4ad0b4cd037589f0510429435eaf1977058a24cb6b302c873f790c2a52ceeafe201311d3959aed056bb6218718708e06bc5941d906f
MD5 SHA1 SHA512

Submit Download

2d3ee712-676a-49eb-b2fd-d69e66373568

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tu0k8f5w.default-release\datareporting\glean\pending_pings\2d3ee712-676a-49eb-b2fd-d69e66373568
Size 982B
SHA256 01b6155609c6a6fd5479902b698c254553aec945bd22105cab45e8a8137897e0
MD5 52286341c1e87e964c4151d48f6eec27
SHA1 4b1cc698f8794f185b8a2df8f7c35f26416cf0e4
SHA512 b59c7cc1f162b21cec63a27691d9387391a256087836c297a2160a442b2c66de2f2a38506941c638f0dc016ba41004f4678324a2cbbda1ac09fd80745fbd504c
MD5 SHA1 SHA512

Submit Download

51850907-3c01-42b7-b4cd-792caf6ae9e2

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tu0k8f5w.default-release\datareporting\glean\pending_pings\51850907-3c01-42b7-b4cd-792caf6ae9e2
Size 26KB
SHA256 c141d536e141b4c2acc5838eaa078bdcefc79cd163b91ea3929930aea1f8ef08
MD5 bc6af62d5856b6e744bf30da731642e2
SHA1 77b6a8b7a48f4940e10fdab7f7fcdc9329831935
SHA512 62d63c9ca41d76cb6a7c8f0ea4d09e3666665b67dc089368e6a7c5748ff85014e366d840db0d81940a92ee27192ac680395ecd20f91baf9040bd1f3709d92da3
SSDEEP 192:/GqWsuzqxQEas6GA8/GzxMGEkb0KAgBj6GM/Wv6vYwUU+IzLkNJUvcTTkwmpL5Wg:/qnqiDG3OlMNkb0KRWOvaCE+3+uJ8
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tu0k8f5w.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Size 1.1MB
SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
MD5 842039753bf41fa5e11b3a1383061a87
SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tu0k8f5w.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Size 116B
SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
MD5 2a461e9eb87fd1955cea740a3444ee7a
SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tu0k8f5w.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Size 372B
SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
MD5 bf957ad58b55f64219ab3f793e374316
SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tu0k8f5w.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Size 17.8MB
SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
MD5 daf7ef3acccab478aaa7d6dc1c60f865
SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tu0k8f5w.default-release\prefs-1.js
Size 13KB
SHA256 d7138fea4c0a791884c40fc545c02af708ec823c71b89e551067ca9f0a7807d5
MD5 51262253b2b4e78873b7c52927957602
SHA1 9c1f3bdb9e10a8ca1cb0d788d70ff668e448f6af
SHA512 d79718238d5cc80e3bb1892531555aeecd23d8cf2ac6409bae437189a8a0dd53a196253bb3fcba8437f95d57f2a3f8432ea36659d2933286de3d03e8791afccb
SSDEEP 192:GCnu2RUfpth/z4cdu08EaX4+d4uIxmiBw8HifTHIB:iFz9MrdVQwzY
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tu0k8f5w.default-release\prefs.js
Size 8KB
SHA256 f8f921dbc798bb3d03136a74735e2bdc06d3cda0faaf309c801001ca96d0ece7
MD5 ab8398686734677adb9fe70e90ec275e
SHA1 0efa3d4a12d91866b02399a92883a78de5bb971b
SHA512 1a6e26bcf688f67dae265dc35277d566033626dc361d80af83d1b20fba13eb15205a5f05deb720b890131c84eef86a654ab44b46214a947e2985329884c4f512
SSDEEP 192:A5nu2RUfpeD1/z4cdu08EaXGPd4uIxEBw8Hl:7kpz9McdVXwo
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tu0k8f5w.default-release\prefs.js
Size 8KB
SHA256 833c061af71f8607b459d07a71a412c5af2ea75efb80c6c811e9e15283401844
MD5 b9adea242ef53c7f2195e753aa3da772
SHA1 ae5a4b55a4c139a9c0c1f1e3a17748a71793fc4a
SHA512 b796f5f50380e4cb50abebaea9c5ebb8af30cd115d64e7fcf6d8975d09db35225f0429381746a2b97f6ed91f303fda520d3dcd84cb836d67253b072c16c1cea1
SSDEEP 192:A5nu2RUfpth/z4cdu08EaX0d4uIxEBw8Hl:7Fz9M2dVXwo
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tu0k8f5w.default-release\prefs.js
Size 10KB
SHA256 23bfb8748955d2cbf90c113815156d1889da0ed5caef5791488612067757df91
MD5 0f99b6a5e42a47d3a216beca0ffc822a
SHA1 9d7ec6a52b6bd6adaf539329962f70bcef5a6791
SHA512 5f24c37c1971c5fdad7fe9c06107554193818f6ce364764944757d980f9f63e5b4f755b48bb761ecf5eaca8cea1ec85908d69ce82e33f8f150e6a7857d688c73
SSDEEP 192:G5nu2RUfpth/z4cdu08EaX0d4uIxaBw8Hg:VFz9M2dVbwv
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/796-2691-0x0000000000BB0000-0x0000000001088000-memory.dmp

Download

memory/796-2693-0x0000000000BB0000-0x0000000001088000-memory.dmp

Download

memory/1088-18-0x00000000003E0000-0x00000000008B8000-memory.dmp

Download

memory/1088-1-0x00000000775A6000-0x00000000775A8000-memory.dmp

Download

memory/1088-2-0x00000000003E1000-0x000000000040F000-memory.dmp

Download

memory/1088-3-0x00000000003E0000-0x00000000008B8000-memory.dmp

Download

memory/1088-4-0x00000000003E0000-0x00000000008B8000-memory.dmp

Download

memory/1088-0-0x00000000003E0000-0x00000000008B8000-memory.dmp

Download

memory/2512-2708-0x0000000000BB0000-0x0000000001088000-memory.dmp

Download

memory/2512-2706-0x0000000000BB0000-0x0000000001088000-memory.dmp

Download

memory/2812-481-0x0000000000BB0000-0x0000000001088000-memory.dmp

Download

memory/2812-476-0x0000000000BB0000-0x0000000001088000-memory.dmp

Download

memory/3008-467-0x0000000000180000-0x0000000000D6F000-memory.dmp

Download

memory/3008-37-0x0000000000180000-0x0000000000D6F000-memory.dmp

Download

memory/3008-56-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Download

memory/5808-489-0x0000000000BB0000-0x0000000001088000-memory.dmp

Download

memory/5808-2687-0x0000000000BB0000-0x0000000001088000-memory.dmp

Download

memory/5808-497-0x0000000000BB0000-0x0000000001088000-memory.dmp

Download

memory/5808-496-0x0000000000BB0000-0x0000000001088000-memory.dmp

Download

memory/5808-2709-0x0000000000BB0000-0x0000000001088000-memory.dmp

Download

memory/5808-475-0x0000000000BB0000-0x0000000001088000-memory.dmp

Download

memory/5808-803-0x0000000000BB0000-0x0000000001088000-memory.dmp

Download

memory/5808-16-0x0000000000BB0000-0x0000000001088000-memory.dmp

Download

memory/5808-2258-0x0000000000BB0000-0x0000000001088000-memory.dmp

Download

memory/5808-459-0x0000000000BB0000-0x0000000001088000-memory.dmp

Download

memory/5808-2681-0x0000000000BB0000-0x0000000001088000-memory.dmp

Download

memory/5808-502-0x0000000000BB0000-0x0000000001088000-memory.dmp

Download

memory/5808-21-0x0000000000BB0000-0x0000000001088000-memory.dmp

Download

memory/5808-20-0x0000000000BB0000-0x0000000001088000-memory.dmp

Download

memory/5808-2694-0x0000000000BB0000-0x0000000001088000-memory.dmp

Download

memory/5808-2695-0x0000000000BB0000-0x0000000001088000-memory.dmp

Download

memory/5808-2696-0x0000000000BB0000-0x0000000001088000-memory.dmp

Download

memory/5808-2697-0x0000000000BB0000-0x0000000001088000-memory.dmp

Download

memory/5808-2698-0x0000000000BB0000-0x0000000001088000-memory.dmp

Download

memory/5808-2699-0x0000000000BB0000-0x0000000001088000-memory.dmp

Download

memory/5808-19-0x0000000000BB1000-0x0000000000BDF000-memory.dmp

Download

memory/6060-471-0x0000000000C80000-0x0000000001158000-memory.dmp

Download

memory/6060-478-0x0000000000C80000-0x0000000001158000-memory.dmp

Download