amadey | 866d841bbc26abb0b0f05e20a05e74c10f347019cdc266f20bf0943c42acde73

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20240709-en
resource tags

arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
submitted
12/07/2024, 16:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
866d841bbc26abb0b0f05e20a05e74c10f347019cdc266f20bf0943c42acde73.exe
Size 1.9MB
Sample240712-tpps3a1cnj
SHA256 866d841bbc26abb0b0f05e20a05e74c10f347019cdc266f20bf0943c42acde73
MD5 35e836756a43519f67cca42e1e7fd853
SHA1 f4d53ee515b1e1bcd86d664796e8043b0b5f7551
SHA512 ef48fe5b3dd07783e40fe16cc4da8e1ee32d754296ca509e85cab11067dd34f9b20460b801fe1997a0e960b4ae832e23c349a5a2f979d6f31c2a851762802924
SSDEEP 49152:Ck0sptgi95tFu8+XnJk/vcmRi420igjUWWRRC:F0og8LH+EcOiYIW0
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey stealc 4dd39d hate discovery evasion spyware stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.30

Botnet

4dd39d

http://77.91.77.82

Attributes

install_dir
ad40971b6b
install_file
explorti.exe
strings_key
a434973ad22def7137dbb5e059b7081e
url_paths
/Hun4Ko/index.php

rc4.plain

Extracted

Family

stealc

Botnet

hate

http://85.28.47.30

Attributes

url_path
/920475a59bac849d.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Stealc
Stealc is an infostealer written in C++.
stealer stealc

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	866d841bbc26abb0b0f05e20a05e74c10f347019cdc266f20bf0943c42acde73.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	GCBGIIECGH.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 10 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	GCBGIIECGH.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	866d841bbc26abb0b0f05e20a05e74c10f347019cdc266f20bf0943c42acde73.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	866d841bbc26abb0b0f05e20a05e74c10f347019cdc266f20bf0943c42acde73.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	GCBGIIECGH.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe

Executes dropped EXE 6 IoCs

pid	Process
4364	explorti.exe
2060	6dc220a74b.exe
2840	2951eba6b8.exe
2004	GCBGIIECGH.exe
4264	explorti.exe
1128	explorti.exe

Identifies Wine through registry keys 2 TTPs 5 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3766757357-1293853516-507035944-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-3766757357-1293853516-507035944-1000\Software\Wine	GCBGIIECGH.exe
Key opened	\REGISTRY\USER\S-1-5-21-3766757357-1293853516-507035944-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-3766757357-1293853516-507035944-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-3766757357-1293853516-507035944-1000\Software\Wine	866d841bbc26abb0b0f05e20a05e74c10f347019cdc266f20bf0943c42acde73.exe

Loads dropped DLL 2 IoCs

pid	Process
2060	6dc220a74b.exe
2060	6dc220a74b.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x000100000002aae6-42.dat	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs

pid	Process
676	866d841bbc26abb0b0f05e20a05e74c10f347019cdc266f20bf0943c42acde73.exe
4364	explorti.exe
2060	6dc220a74b.exe
2060	6dc220a74b.exe
2004	GCBGIIECGH.exe
4264	explorti.exe
1128	explorti.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\explorti.job	866d841bbc26abb0b0f05e20a05e74c10f347019cdc266f20bf0943c42acde73.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	6dc220a74b.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	6dc220a74b.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3766757357-1293853516-507035944-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
676	866d841bbc26abb0b0f05e20a05e74c10f347019cdc266f20bf0943c42acde73.exe
676	866d841bbc26abb0b0f05e20a05e74c10f347019cdc266f20bf0943c42acde73.exe
4364	explorti.exe
4364	explorti.exe
2060	6dc220a74b.exe
2060	6dc220a74b.exe
2060	6dc220a74b.exe
2060	6dc220a74b.exe
2004	GCBGIIECGH.exe
2004	GCBGIIECGH.exe
4264	explorti.exe
4264	explorti.exe
1128	explorti.exe
1128	explorti.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3784	firefox.exe
Token: SeDebugPrivilege	3784	firefox.exe
Token: SeDebugPrivilege	3784	firefox.exe
Token: SeDebugPrivilege	3784	firefox.exe
Token: SeDebugPrivilege	3784	firefox.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2840	2951eba6b8.exe
2840	2951eba6b8.exe
2840	2951eba6b8.exe
2840	2951eba6b8.exe
2840	2951eba6b8.exe
2840	2951eba6b8.exe
2840	2951eba6b8.exe
3784	firefox.exe
3784	firefox.exe
3784	firefox.exe
3784	firefox.exe
3784	firefox.exe
3784	firefox.exe
3784	firefox.exe
3784	firefox.exe
3784	firefox.exe
3784	firefox.exe
3784	firefox.exe
3784	firefox.exe
3784	firefox.exe
3784	firefox.exe
3784	firefox.exe
3784	firefox.exe
3784	firefox.exe
3784	firefox.exe
3784	firefox.exe
3784	firefox.exe
3784	firefox.exe
2840	2951eba6b8.exe
2840	2951eba6b8.exe
2840	2951eba6b8.exe
2840	2951eba6b8.exe
2840	2951eba6b8.exe
2840	2951eba6b8.exe
2840	2951eba6b8.exe
2840	2951eba6b8.exe
2840	2951eba6b8.exe
2840	2951eba6b8.exe
2840	2951eba6b8.exe
2840	2951eba6b8.exe
2840	2951eba6b8.exe
2840	2951eba6b8.exe
2840	2951eba6b8.exe
2840	2951eba6b8.exe
2840	2951eba6b8.exe
2840	2951eba6b8.exe
2840	2951eba6b8.exe
2840	2951eba6b8.exe
2840	2951eba6b8.exe
2840	2951eba6b8.exe
2840	2951eba6b8.exe
2840	2951eba6b8.exe
2840	2951eba6b8.exe
2840	2951eba6b8.exe
2840	2951eba6b8.exe
2840	2951eba6b8.exe
2840	2951eba6b8.exe
2840	2951eba6b8.exe
2840	2951eba6b8.exe
2840	2951eba6b8.exe
2840	2951eba6b8.exe
2840	2951eba6b8.exe
2840	2951eba6b8.exe
2840	2951eba6b8.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2840	2951eba6b8.exe
2840	2951eba6b8.exe
2840	2951eba6b8.exe
2840	2951eba6b8.exe
2840	2951eba6b8.exe
2840	2951eba6b8.exe
2840	2951eba6b8.exe
2840	2951eba6b8.exe
2840	2951eba6b8.exe
2840	2951eba6b8.exe
2840	2951eba6b8.exe
2840	2951eba6b8.exe
2840	2951eba6b8.exe
2840	2951eba6b8.exe
2840	2951eba6b8.exe
2840	2951eba6b8.exe
2840	2951eba6b8.exe
2840	2951eba6b8.exe
2840	2951eba6b8.exe
2840	2951eba6b8.exe
2840	2951eba6b8.exe
2840	2951eba6b8.exe
2840	2951eba6b8.exe
2840	2951eba6b8.exe
2840	2951eba6b8.exe
2840	2951eba6b8.exe
2840	2951eba6b8.exe
2840	2951eba6b8.exe
2840	2951eba6b8.exe
2840	2951eba6b8.exe
2840	2951eba6b8.exe
2840	2951eba6b8.exe
2840	2951eba6b8.exe
2840	2951eba6b8.exe
2840	2951eba6b8.exe
2840	2951eba6b8.exe
2840	2951eba6b8.exe
2840	2951eba6b8.exe
2840	2951eba6b8.exe
2840	2951eba6b8.exe
2840	2951eba6b8.exe
2840	2951eba6b8.exe
2840	2951eba6b8.exe
2840	2951eba6b8.exe
2840	2951eba6b8.exe
2840	2951eba6b8.exe
2840	2951eba6b8.exe
2840	2951eba6b8.exe
2840	2951eba6b8.exe
2840	2951eba6b8.exe
2840	2951eba6b8.exe
2840	2951eba6b8.exe
2840	2951eba6b8.exe
2840	2951eba6b8.exe
2840	2951eba6b8.exe
2840	2951eba6b8.exe
2840	2951eba6b8.exe
2840	2951eba6b8.exe
2840	2951eba6b8.exe
2840	2951eba6b8.exe
2840	2951eba6b8.exe
2840	2951eba6b8.exe
2840	2951eba6b8.exe
2840	2951eba6b8.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2060	6dc220a74b.exe
3784	firefox.exe
5032	cmd.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 676 wrote to memory of 4364	676	866d841bbc26abb0b0f05e20a05e74c10f347019cdc266f20bf0943c42acde73.exe	78
PID 676 wrote to memory of 4364	676	866d841bbc26abb0b0f05e20a05e74c10f347019cdc266f20bf0943c42acde73.exe	78
PID 676 wrote to memory of 4364	676	866d841bbc26abb0b0f05e20a05e74c10f347019cdc266f20bf0943c42acde73.exe	78
PID 4364 wrote to memory of 2060	4364	explorti.exe	79
PID 4364 wrote to memory of 2060	4364	explorti.exe	79
PID 4364 wrote to memory of 2060	4364	explorti.exe	79
PID 4364 wrote to memory of 2840	4364	explorti.exe	80
PID 4364 wrote to memory of 2840	4364	explorti.exe	80
PID 4364 wrote to memory of 2840	4364	explorti.exe	80
PID 2840 wrote to memory of 1392	2840	2951eba6b8.exe	81
PID 2840 wrote to memory of 1392	2840	2951eba6b8.exe	81
PID 1392 wrote to memory of 3784	1392	firefox.exe	84
PID 1392 wrote to memory of 3784	1392	firefox.exe	84
PID 1392 wrote to memory of 3784	1392	firefox.exe	84
PID 1392 wrote to memory of 3784	1392	firefox.exe	84
PID 1392 wrote to memory of 3784	1392	firefox.exe	84
PID 1392 wrote to memory of 3784	1392	firefox.exe	84
PID 1392 wrote to memory of 3784	1392	firefox.exe	84
PID 1392 wrote to memory of 3784	1392	firefox.exe	84
PID 1392 wrote to memory of 3784	1392	firefox.exe	84
PID 1392 wrote to memory of 3784	1392	firefox.exe	84
PID 1392 wrote to memory of 3784	1392	firefox.exe	84
PID 3784 wrote to memory of 4660	3784	firefox.exe	85
PID 3784 wrote to memory of 4660	3784	firefox.exe	85
PID 3784 wrote to memory of 4660	3784	firefox.exe	85
PID 3784 wrote to memory of 4660	3784	firefox.exe	85
PID 3784 wrote to memory of 4660	3784	firefox.exe	85
PID 3784 wrote to memory of 4660	3784	firefox.exe	85
PID 3784 wrote to memory of 4660	3784	firefox.exe	85
PID 3784 wrote to memory of 4660	3784	firefox.exe	85
PID 3784 wrote to memory of 4660	3784	firefox.exe	85
PID 3784 wrote to memory of 4660	3784	firefox.exe	85
PID 3784 wrote to memory of 4660	3784	firefox.exe	85
PID 3784 wrote to memory of 4660	3784	firefox.exe	85
PID 3784 wrote to memory of 4660	3784	firefox.exe	85
PID 3784 wrote to memory of 4660	3784	firefox.exe	85
PID 3784 wrote to memory of 4660	3784	firefox.exe	85
PID 3784 wrote to memory of 4660	3784	firefox.exe	85
PID 3784 wrote to memory of 4660	3784	firefox.exe	85
PID 3784 wrote to memory of 4660	3784	firefox.exe	85
PID 3784 wrote to memory of 4660	3784	firefox.exe	85
PID 3784 wrote to memory of 4660	3784	firefox.exe	85
PID 3784 wrote to memory of 4660	3784	firefox.exe	85
PID 3784 wrote to memory of 4660	3784	firefox.exe	85
PID 3784 wrote to memory of 4660	3784	firefox.exe	85
PID 3784 wrote to memory of 4660	3784	firefox.exe	85
PID 3784 wrote to memory of 4660	3784	firefox.exe	85
PID 3784 wrote to memory of 4660	3784	firefox.exe	85
PID 3784 wrote to memory of 4660	3784	firefox.exe	85
PID 3784 wrote to memory of 4660	3784	firefox.exe	85
PID 3784 wrote to memory of 4660	3784	firefox.exe	85
PID 3784 wrote to memory of 4660	3784	firefox.exe	85
PID 3784 wrote to memory of 4660	3784	firefox.exe	85
PID 3784 wrote to memory of 4660	3784	firefox.exe	85
PID 3784 wrote to memory of 4660	3784	firefox.exe	85
PID 3784 wrote to memory of 4660	3784	firefox.exe	85
PID 3784 wrote to memory of 4660	3784	firefox.exe	85
PID 3784 wrote to memory of 4660	3784	firefox.exe	85
PID 3784 wrote to memory of 4660	3784	firefox.exe	85
PID 3784 wrote to memory of 4660	3784	firefox.exe	85
PID 3784 wrote to memory of 4660	3784	firefox.exe	85
PID 3784 wrote to memory of 4660	3784	firefox.exe	85
PID 3784 wrote to memory of 4660	3784	firefox.exe	85
PID 3784 wrote to memory of 4660	3784	firefox.exe	85

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\866d841bbc26abb0b0f05e20a05e74c10f347019cdc266f20bf0943c42acde73.exe
"C:\Users\Admin\AppData\Local\Temp\866d841bbc26abb0b0f05e20a05e74c10f347019cdc266f20bf0943c42acde73.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:676
- C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
  "C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4364
- - C:\Users\Admin\AppData\Local\Temp\1000006001\6dc220a74b.exe
    "C:\Users\Admin\AppData\Local\Temp\1000006001\6dc220a74b.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:2060
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\GCBGIIECGH.exe"
      4⤵
      PID:224
    - - C:\Users\Admin\AppData\Local\Temp\GCBGIIECGH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GCBGIIECGH.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        
        PID:2004
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\IIEBKJECFC.exe"
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:5032
- - C:\Users\Admin\AppData\Local\Temp\1000011001\2951eba6b8.exe
    "C:\Users\Admin\AppData\Local\Temp\1000011001\2951eba6b8.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2840
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1392
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
        5⤵
        Checks processor information in registry
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3784
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1960 -parentBuildID 20240401114208 -prefsHandle 1876 -prefMapHandle 1868 -prefsLen 25751 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {28b40ca2-67e8-4023-8782-cd13f5d0c5f8} 3784 "\\.\pipe\gecko-crash-server-pipe.3784" gpu
        6⤵
        
        PID:4660
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2368 -parentBuildID 20240401114208 -prefsHandle 2360 -prefMapHandle 2356 -prefsLen 26671 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b582f716-9743-4db6-99c0-a9606e1448b1} 3784 "\\.\pipe\gecko-crash-server-pipe.3784" socket
        6⤵
        
        PID:1432
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3084 -childID 1 -isForBrowser -prefsHandle 3216 -prefMapHandle 3212 -prefsLen 22698 -prefMapSize 244658 -jsInitHandle 1324 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {205ce4fd-6bfc-411d-8fb5-c869e2fe06a7} 3784 "\\.\pipe\gecko-crash-server-pipe.3784" tab
        6⤵
        
        PID:4304
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2496 -childID 2 -isForBrowser -prefsHandle 3968 -prefMapHandle 3964 -prefsLen 31161 -prefMapSize 244658 -jsInitHandle 1324 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5a56db05-dd77-473e-8946-d429e1beed63} 3784 "\\.\pipe\gecko-crash-server-pipe.3784" tab
        6⤵
        
        PID:4184
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4816 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4892 -prefMapHandle 4888 -prefsLen 31161 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {024f2dba-ed62-4ee1-a5e9-18e7ecf95ee8} 3784 "\\.\pipe\gecko-crash-server-pipe.3784" utility
        6⤵
        Checks processor information in registry
        
        PID:1944
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5548 -childID 3 -isForBrowser -prefsHandle 5540 -prefMapHandle 5468 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1324 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1329a672-1c27-4722-8fff-7bca707d56b2} 3784 "\\.\pipe\gecko-crash-server-pipe.3784" tab
        6⤵
        
        PID:2372
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5768 -childID 4 -isForBrowser -prefsHandle 5688 -prefMapHandle 5692 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1324 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a685aa7d-77ca-4480-973a-f3c27c108e2d} 3784 "\\.\pipe\gecko-crash-server-pipe.3784" tab
        6⤵
        
        PID:3928
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5964 -childID 5 -isForBrowser -prefsHandle 5884 -prefMapHandle 5888 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1324 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d2a1bc93-dbf9-4816-8fdf-75c1d709f04d} 3784 "\\.\pipe\gecko-crash-server-pipe.3784" tab
        6⤵
        
        PID:3060

C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4264

C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mozglue.dll

Path C:\ProgramData\mozglue.dll
Size 593KB
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
SSDEEP 12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5 SHA1 SHA512 SSDEEP

Submit Download

nss3.dll

Path C:\ProgramData\nss3.dll
Size 2.0MB
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
SSDEEP 49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5 SHA1 SHA512 SSDEEP

Submit Download

activity-stream.discovery_stream.json.tmp

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yz8w575m.default-release\activity-stream.discovery_stream.json.tmp
Size 20KB
SHA256 556c77167a63ef87c10f16e48e7b35340a705cb47e0aba53d265bdce2646053d
MD5 71302529beb8c23f40c54cc946c9b074
SHA1 3f2ec405946d472db25633cc7a37030e947448ef
SHA512 efb4bac9af8087c09b508013a9987c34648636a270db9dd57678116a9717ac5fed9de771a668e1c98feee5001783f14a6b8fd1005cef70e2d373205b672accdb
SSDEEP 384:uyaumvYw75nmecwWI3d17rOF412sbmIPqibzofiSlE7pZ6PFrOM:uyd7wZHHt17113y/q9MOM
MD5 SHA1 SHA512 SSDEEP

Submit Download

5CD1EBDF6B57F13C7E783CE5E6D8E9C44014FE1A

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yz8w575m.default-release\cache2\entries\5CD1EBDF6B57F13C7E783CE5E6D8E9C44014FE1A
Size 13KB
SHA256 051d0d214ddf7d58800fc663bb188599060c19c3e1394913bddc2c6dc9ddbddc
MD5 a582678318346015d05529133ec5dc41
SHA1 d9ed85edf95fd572a730ca989419577781211f4e
SHA512 e44fe81c6409b3e652dcd577773b15365eba69331d6483bd29c62e630c550e20f0bc25478b2a788d0c64a5cf33cb15ccbb7c984f95aefef13de74908ca3f50af
SSDEEP 384:HunTu9fiGLm4pU0ft2WlOX8lPLZZB7t0lpDIIFLE:dBi8mCU0ft2WAX8tzB7eD8F
MD5 SHA1 SHA512 SSDEEP

Submit Download

6dc220a74b.exe

Path C:\Users\Admin\AppData\Local\Temp\1000006001\6dc220a74b.exe
Size 2.4MB
SHA256 c19e844a529bb52d59a243340243e2208ad23ca059aa6b095f555f415d22f687
MD5 be934ec22037ff0e960f7aac46914ba5
SHA1 c83d95fbdb2610bfdae718c485e5ee339c940905
SHA512 ece945b348bf224784f814772cb17fabff23e1301fd5131a4ba26bf4cced5ec4e05fcf27fa5b96e5d942b71f04f3e30e8f119ee40165a1d256322459076a7243
SSDEEP 49152:YlFyP1lG+KRGsl1z5dkQ7N0MqdODEZ22buRhIwh4h:YlQcGsbk60M2ODEs2buSh
MD5 SHA1 SHA512 SSDEEP

Submit Download

2951eba6b8.exe

Path C:\Users\Admin\AppData\Local\Temp\1000011001\2951eba6b8.exe
Size 1.2MB
SHA256 85be60fea741f3dad3b31c5edd3617bf09e319b635368df229465021786417c6
MD5 5c9b78b27b633f3222e61fb15b0ffbfe
SHA1 247231bf8fefa04cb9ffb54b81a0c77b1c324349
SHA512 45c1b38bd397bfec615937e32b218a53d1134e43249df48a5329759f7e5c0d6c3bfa342f2c6d76775506c421ff7e276da509129925319dce270cfad95e37f70d
SSDEEP 24576:hqDEvCTbMWu7rQYlBQcBiT6rprG8aLu2Sbly7TWEPje:hTvC/MTQYxsWR7aLu2dW
MD5 SHA1 SHA512 SSDEEP

Submit Download

explorti.exe

Path C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
Size 1.9MB
SHA256 866d841bbc26abb0b0f05e20a05e74c10f347019cdc266f20bf0943c42acde73
MD5 35e836756a43519f67cca42e1e7fd853
SHA1 f4d53ee515b1e1bcd86d664796e8043b0b5f7551
SHA512 ef48fe5b3dd07783e40fe16cc4da8e1ee32d754296ca509e85cab11067dd34f9b20460b801fe1997a0e960b4ae832e23c349a5a2f979d6f31c2a851762802924
SSDEEP 49152:Ck0sptgi95tFu8+XnJk/vcmRi420igjUWWRRC:F0og8LH+EcOiYIW0
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 479KB
SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
MD5 09372174e83dbbf696ee732fd2e875bb
SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 13.8MB
SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
MD5 0a8747a2ac9ac08ae9508f36c6d75692
SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yz8w575m.default-release\AlternateServices.bin
Size 8KB
SHA256 f204762afd38358fbfe73921b2e5effcafa5253aaca9cf25503e1bd0327d4b6d
MD5 1203ea67c30add178efc8108b267f856
SHA1 864c6063b9007503b1ae445a387ce613b4b075fc
SHA512 38a23e1f92228f7ad74e783f29ae7e4f994b226b28893380fb1cdb4e3bb00fcaafeeb3cc33158f6723219cf5d866aa168cca7369c74b5e9681aa556dfc153d61
SSDEEP 24:vygu1xgRbwTpR5cOxtuhMZX0uB1osSFsh2F3LF+ssJbF0JU9b2WKsJblxWKf+U9b:K5oe9cOeebOJU9b2pebvpf+U9b
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yz8w575m.default-release\AlternateServices.bin
Size 12KB
SHA256 5d5bc12b9b5cc904ca7428d6f19ab62abc1d7386df45458c7dff80661589da02
MD5 898300629f4b2ab73ba4db4cc573775a
SHA1 c194deb24db72e67e0f05a6f4a73ee48c72bcdbf
SHA512 ba618d02a454d2ffaad7d6e179a59a4c0d8262f8ab02248f560e772b10bd3c024d1eae47204aee6abd460a2db4254c4e6b9dc224ab02a43b1dcfd80ec8c675d7
SSDEEP 96:K5onebOJ+b2pebvpf++brbfbzb7bOgbgzUb:K5Iu
MD5 SHA1 SHA512 SSDEEP

Submit Download

cookies.sqlite-wal

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yz8w575m.default-release\cookies.sqlite-wal
Size 192KB
SHA256 a2781f15850e5161880567dc7bba5963e14ef2e8aeef239caf72ddb8576b8eb3
MD5 3047629c5ee398b7cd9449016ae6dde4
SHA1 10d426a7d9bf1ffbad9a496c593a05f95a4ff86f
SHA512 04028436e187cb600f43cf13375b8156fa9a3b24dac260be365569abfdf00a77b8671693fd4394c2521572154cb73e006a493d5d60f39eb27c4acb7ac9c9734f
SSDEEP 96:iAj0j2Htj6Aja+mmAjY2Htj6Aj5oKGUh+G:IOK
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yz8w575m.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 c41d84135d1735bacb5c6059232ac22fc345608611aa0b568b74d607eb0659de
MD5 fe598dd5316daf207a814c9a5bdbac4d
SHA1 b0d67e21bac650ee11a2c9d5b46e07ccea8f881f
SHA512 825c95f25fc90edba9299cb0e3b02cd182fe336f0388cbb6fb201aef96a444c3923d827e0932ab3de9f4c9ac616ff62a6b61cdbc7b237bbfd9e931656f201d11
SSDEEP 192:XR/66Joz0dzgCl6mSSjrvZboHfhQwPDf3:B/66JozQzgC1b5bo/9Pr
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yz8w575m.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 5df3585c874986bfef498db5967c8f7826b5c544c3e89ceaafad8554dee440af
MD5 5a631126c42df43f77cdffeeaffc1126
SHA1 0401de57c4d0b2320c42e14d6fffb0132d54eebc
SHA512 ec0a0888597cc9f0523bd30ad2dbd8f5dbe536bfee91882bd1a13dfde26d1d64dcf983eee30deba3691314786f70b4f3ffef2876829c9f26f547157800e011a3
SSDEEP 96:qBOSMF9ZbkW6QX0BBfhmKePP/PrWZOCQcIhKCRFl66Joz0dzgClKtmSSM:7rvZboHfhbwPCKR/66Joz0dzgCl6mSSM
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yz8w575m.default-release\datareporting\glean\db\data.safe.tmp
Size 16KB
SHA256 044cd66887bd4af00f0bfd7d628caaa2351275dc954aac092bcf2ac89ff3621e
MD5 8721b5904f9f02e67ab9cb97f7ff5317
SHA1 a704e6123ec225fdb4dac019e1a492275107cb18
SHA512 eac05775053d6177c1decc7a0a2a588037f889234bf6e7f0d80e92911df15a1aac305eb02df5192c11f9bc75e518f5ae0a74fea0b0d063fddeab1a2396569fef
SSDEEP 384:B/66JozQzgC1b9dxScQbome1D7MFEtbTbmibo/4RPj:kmRY3omwDoFEtbTbmGx7
MD5 SHA1 SHA512 SSDEEP

Submit Download

b7798a8b-8d05-4352-b6af-79eccf8b24d4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yz8w575m.default-release\datareporting\glean\pending_pings\b7798a8b-8d05-4352-b6af-79eccf8b24d4
Size 982B
SHA256 8b47b593839771c33c9a1e1e74c38c70bfbf0ca512519e1f06e941961d487f1d
MD5 ad221f54e5937e98147c7cdd3fede8fc
SHA1 fc76aed24208ab2e1a84292a0f36537ba26b7a49
SHA512 3c05028227adddefe23a7cb0e96f14ae83813785f8cd68df53512a77fedc0c1fa3de071b0078ba17d65e015871a14d7cd8d73f164f35d9137c5f4a9a82a6751f
MD5 SHA1 SHA512

Submit Download

d238bf8c-06a4-44dd-ad65-e93ca0b036d7

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yz8w575m.default-release\datareporting\glean\pending_pings\d238bf8c-06a4-44dd-ad65-e93ca0b036d7
Size 671B
SHA256 2fe24240e5a4785e24d613b92ad59ff1551aab067ffa250976b84164e721a365
MD5 0883b963258f0ab931ade80827a88d18
SHA1 5b92470fbd116ab1c2bc4e24876fa2fc8f7a2da2
SHA512 65c792b8d1e3c8256908b8fd5ea9b560bc30eb12fcfbc25ca80a809d7d09be2c9b34a1c473cee22d1f3db72a3b4c92b8fdb8852178fd99ab1455e00f16a5016c
MD5 SHA1 SHA512

Submit Download

d4ecc5a8-e084-4db9-8429-c856f4c320d4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yz8w575m.default-release\datareporting\glean\pending_pings\d4ecc5a8-e084-4db9-8429-c856f4c320d4
Size 27KB
SHA256 5d817e4322c326db5ab9e2641f39a1bf1795341ee6b8d800700747eeea0caa8f
MD5 4047a83d774af5b84d1ae8ff75f5cc9f
SHA1 4f17bc62aa4296cb2a4b363fdd60019096c0dc19
SHA512 18af20bea19da87e3390acb765012816748c024652a69fd79690e9a516f99fcb08c8796cafa864f8177e601c5e0e385eea5350976c2bf5f6c9fd84d6034d3e86
SSDEEP 384:COzrMZE3sSR88DlR+wOeoCR0KjeblDZIxL:53MZGPJODKh
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yz8w575m.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Size 1.1MB
SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
MD5 842039753bf41fa5e11b3a1383061a87
SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yz8w575m.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Size 116B
SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
MD5 2a461e9eb87fd1955cea740a3444ee7a
SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yz8w575m.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Size 372B
SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
MD5 bf957ad58b55f64219ab3f793e374316
SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yz8w575m.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Size 17.8MB
SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
MD5 daf7ef3acccab478aaa7d6dc1c60f865
SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
MD5 SHA1 SHA512 SSDEEP

Submit Download

places.sqlite-wal

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yz8w575m.default-release\places.sqlite-wal
Size 992KB
SHA256 272a5b2b54434799194f19916c65e5dcd57e140e6c2acf236dfecc59176005e2
MD5 eb0e33df6950517225eac7cd5aa98943
SHA1 93847705ce392530c45365ffda53de1b3fe6b8fb
SHA512 7b877be980f19ccdf31dfea4403d8cd101a139c47e414ee35fad283769d36232b6b7ade313d6d5f78b48403f4046098710eca6dd8b4fc4b2262dda521585c49d
SSDEEP 192:vmgO7D2+n4Ky8gx/3mgO7ehKmYOnqbCC/8x/x6mgO79:v7O7Dc6gt7O7Nmtq+DS7O79
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yz8w575m.default-release\prefs-1.js
Size 13KB
SHA256 6a8397e1cfc8fc60c515d6d979f91c249ec226012085d7c552a499ee1e1fc950
MD5 d58292cded6bf83da6ac72d5f0542de3
SHA1 304fffe6d2995049309853addb2697274791ac93
SHA512 3f70bf2ce756e890cebaedc3d716bf07b3a8b5c50932e47f5314be84d7e97d2c1e3c12a37e278ad8a6b3c0dda8fb77701e63774973651f1d5022665ae7d678ac
SSDEEP 192:6y5nhQRbfHvWP/VYjd3yPlYUJAcdk9Ytdre1I0z60laXqstGOWOBw8HFY:Fkq/VCyPldMOtps6w0Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yz8w575m.default-release\prefs-1.js
Size 16KB
SHA256 2b988333839621fd97bb283e990f3f584413ae319c13cf1673e7c385b368b5ce
MD5 bab2193635b7f2a3df84b67d98cc263c
SHA1 469d0922f9b6b78a6171ea73d903c70f0f07173e
SHA512 7fe36adf80285290ca3b9eba5a798b5ce6e4688efdcd648866f585063312a1e8f21143bac09cda91e20901f9089c4f2e0c5a7c7296cfab91ac26663a9e785e55
SSDEEP 192:6yKnhQRbflvWP/VYjd3yPlYUJAcdk9Ytdre1I0z60laXqw+tGOWGiBw8Hn7XBuX:Gk4/VCyPldMOtisjwIC
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yz8w575m.default-release\prefs.js
Size 8KB
SHA256 1dcf1a3b2b38464b40694abcfa6f35ed46c3a6601454f1232ef64f355644878b
MD5 ef8d4bdf10ec196020583ce1be96c227
SHA1 6f85a4203d346d181de3b27b226aa10821978bf3
SHA512 b0150142627d9f171cf8ff500fbe806ef37b47afc30f7ef54c9d8e8c604853e103976013f5ba05b5b7d72bc7921307ed0177eebd6811bbfcaf193e668469a04f
SSDEEP 192:Cy5nhQRbfHUbkwhilcdVBA60KaXbtGOWsBw8VY:dkv+FnR4s8wf
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yz8w575m.default-release\prefs.js
Size 11KB
SHA256 9ab64983ba89a077881d7461b0b501fcd74e5a6e53f0ee211d9ebae11ea80471
MD5 262279113a44843f515b48e26c624961
SHA1 ebd0165201447847a58a6233a8406b6637f0cdf9
SHA512 40c94ff2c0406ed8f6e1368977713306ccee654cd0429ec581618a53a4efaa25e9c8c3dfd32233fbc6cb2b7b4fbeb5ac783759627bfe39e53a180ca0632ce19d
SSDEEP 192:Cy5nhQRbfHvWP/VYjd3yPlYUJAcdk9Ytdre1I0z60laXqstGOWsBw8HY:dkq/VCyPldMOtps8wF
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/676-2-0x0000000000301000-0x000000000032F000-memory.dmp

Download

memory/676-0-0x0000000000300000-0x00000000007D2000-memory.dmp

Download

memory/676-1-0x0000000076F66000-0x0000000076F68000-memory.dmp

Download

memory/676-17-0x0000000000300000-0x00000000007D2000-memory.dmp

Download

memory/676-3-0x0000000000300000-0x00000000007D2000-memory.dmp

Download

memory/676-5-0x0000000000300000-0x00000000007D2000-memory.dmp

Download

memory/1128-2720-0x0000000000D80000-0x0000000001252000-memory.dmp

Download

memory/1128-2721-0x0000000000D80000-0x0000000001252000-memory.dmp

Download

memory/2004-486-0x00000000004E0000-0x00000000009B2000-memory.dmp

Download

memory/2004-477-0x00000000004E0000-0x00000000009B2000-memory.dmp

Download

memory/2060-56-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Download

memory/2060-37-0x0000000000410000-0x0000000000FE9000-memory.dmp

Download

memory/2060-473-0x0000000000410000-0x0000000000FE9000-memory.dmp

Download

memory/4264-2106-0x0000000000D80000-0x0000000001252000-memory.dmp

Download

memory/4264-2336-0x0000000000D80000-0x0000000001252000-memory.dmp

Download

memory/4364-2708-0x0000000000D80000-0x0000000001252000-memory.dmp

Download

memory/4364-18-0x0000000000D80000-0x0000000001252000-memory.dmp

Download

memory/4364-497-0x0000000000D80000-0x0000000001252000-memory.dmp

Download

memory/4364-470-0x0000000000D80000-0x0000000001252000-memory.dmp

Download

memory/4364-19-0x0000000000D81000-0x0000000000DAF000-memory.dmp

Download

memory/4364-1153-0x0000000000D80000-0x0000000001252000-memory.dmp

Download

memory/4364-502-0x0000000000D80000-0x0000000001252000-memory.dmp

Download

memory/4364-496-0x0000000000D80000-0x0000000001252000-memory.dmp

Download

memory/4364-489-0x0000000000D80000-0x0000000001252000-memory.dmp

Download

memory/4364-2700-0x0000000000D80000-0x0000000001252000-memory.dmp

Download

memory/4364-2717-0x0000000000D80000-0x0000000001252000-memory.dmp

Download

memory/4364-2716-0x0000000000D80000-0x0000000001252000-memory.dmp

Download

memory/4364-2714-0x0000000000D80000-0x0000000001252000-memory.dmp

Download

memory/4364-2718-0x0000000000D80000-0x0000000001252000-memory.dmp

Download

memory/4364-21-0x0000000000D80000-0x0000000001252000-memory.dmp

Download

memory/4364-20-0x0000000000D80000-0x0000000001252000-memory.dmp

Download

memory/4364-2722-0x0000000000D80000-0x0000000001252000-memory.dmp

Download

memory/4364-2723-0x0000000000D80000-0x0000000001252000-memory.dmp

Download

memory/4364-2724-0x0000000000D80000-0x0000000001252000-memory.dmp

Download

memory/4364-2730-0x0000000000D80000-0x0000000001252000-memory.dmp

Download