amadey | fdbe8717b84549e19bc86283f8735c793478e42a10b8e40eede91f966b1c9e5b

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20240709-en
resource tags

arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
submitted
12/07/2024, 17:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fdbe8717b84549e19bc86283f8735c793478e42a10b8e40eede91f966b1c9e5b.exe
Size 1.8MB
Sample240712-vy912ashlr
SHA256 fdbe8717b84549e19bc86283f8735c793478e42a10b8e40eede91f966b1c9e5b
MD5 9d047f353dd1398873849b493ed30629
SHA1 b43a81631d88f2a283e96bcb2550525d4108e25c
SHA512 1174a3bc725fd998bb99e7759a1010cc6e1b8eb7b2680a744a821eef387a1bfaf33f0e2f925adcd84f19030210d7ab7af43c4ee77fbc99b6e68cafedc804a874
SSDEEP 49152:eJ1j/JWZ4DbrLyHNtwhM9gesP4qcEW/4+W5AJ:m/JW2Pr+3wi+cnNJ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey stealc 4dd39d hate discovery evasion spyware stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.30

Botnet

4dd39d

http://77.91.77.82

Attributes

install_dir
ad40971b6b
install_file
explorti.exe
strings_key
a434973ad22def7137dbb5e059b7081e
url_paths
/Hun4Ko/index.php

rc4.plain

Extracted

Family

stealc

Botnet

hate

http://85.28.47.30

Attributes

url_path
/920475a59bac849d.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Stealc
Stealc is an infostealer written in C++.
stealer stealc

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	fdbe8717b84549e19bc86283f8735c793478e42a10b8e40eede91f966b1c9e5b.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	EHJDHJKFIE.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	JEBGCBAFCG.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 12 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	fdbe8717b84549e19bc86283f8735c793478e42a10b8e40eede91f966b1c9e5b.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	JEBGCBAFCG.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	fdbe8717b84549e19bc86283f8735c793478e42a10b8e40eede91f966b1c9e5b.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	EHJDHJKFIE.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	EHJDHJKFIE.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	JEBGCBAFCG.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe

Executes dropped EXE 7 IoCs

pid	Process
2008	explorti.exe
4100	8f26649a7a.exe
2608	cfea58e4d2.exe
3920	EHJDHJKFIE.exe
3924	JEBGCBAFCG.exe
5640	explorti.exe
1492	explorti.exe

Identifies Wine through registry keys 2 TTPs 6 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2087971895-212656400-463594913-1000\Software\Wine	fdbe8717b84549e19bc86283f8735c793478e42a10b8e40eede91f966b1c9e5b.exe
Key opened	\REGISTRY\USER\S-1-5-21-2087971895-212656400-463594913-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-2087971895-212656400-463594913-1000\Software\Wine	EHJDHJKFIE.exe
Key opened	\REGISTRY\USER\S-1-5-21-2087971895-212656400-463594913-1000\Software\Wine	JEBGCBAFCG.exe
Key opened	\REGISTRY\USER\S-1-5-21-2087971895-212656400-463594913-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-2087971895-212656400-463594913-1000\Software\Wine	explorti.exe

Loads dropped DLL 2 IoCs

pid	Process
4100	8f26649a7a.exe
4100	8f26649a7a.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x000100000002aa91-42.dat	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs

pid	Process
788	fdbe8717b84549e19bc86283f8735c793478e42a10b8e40eede91f966b1c9e5b.exe
2008	explorti.exe
4100	8f26649a7a.exe
4100	8f26649a7a.exe
3920	EHJDHJKFIE.exe
3924	JEBGCBAFCG.exe
5640	explorti.exe
1492	explorti.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\explorti.job	fdbe8717b84549e19bc86283f8735c793478e42a10b8e40eede91f966b1c9e5b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	8f26649a7a.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	8f26649a7a.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2087971895-212656400-463594913-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
788	fdbe8717b84549e19bc86283f8735c793478e42a10b8e40eede91f966b1c9e5b.exe
788	fdbe8717b84549e19bc86283f8735c793478e42a10b8e40eede91f966b1c9e5b.exe
2008	explorti.exe
2008	explorti.exe
4100	8f26649a7a.exe
4100	8f26649a7a.exe
4100	8f26649a7a.exe
4100	8f26649a7a.exe
3920	EHJDHJKFIE.exe
3920	EHJDHJKFIE.exe
3924	JEBGCBAFCG.exe
3924	JEBGCBAFCG.exe
5640	explorti.exe
5640	explorti.exe
1492	explorti.exe
1492	explorti.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	464	firefox.exe
Token: SeDebugPrivilege	464	firefox.exe
Token: SeDebugPrivilege	464	firefox.exe
Token: SeDebugPrivilege	464	firefox.exe
Token: SeDebugPrivilege	464	firefox.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
788	fdbe8717b84549e19bc86283f8735c793478e42a10b8e40eede91f966b1c9e5b.exe
2608	cfea58e4d2.exe
2608	cfea58e4d2.exe
2608	cfea58e4d2.exe
2608	cfea58e4d2.exe
2608	cfea58e4d2.exe
2608	cfea58e4d2.exe
2608	cfea58e4d2.exe
464	firefox.exe
464	firefox.exe
464	firefox.exe
464	firefox.exe
464	firefox.exe
464	firefox.exe
464	firefox.exe
464	firefox.exe
464	firefox.exe
464	firefox.exe
464	firefox.exe
464	firefox.exe
464	firefox.exe
464	firefox.exe
464	firefox.exe
464	firefox.exe
464	firefox.exe
464	firefox.exe
464	firefox.exe
464	firefox.exe
464	firefox.exe
2608	cfea58e4d2.exe
2608	cfea58e4d2.exe
2608	cfea58e4d2.exe
2608	cfea58e4d2.exe
2608	cfea58e4d2.exe
2608	cfea58e4d2.exe
2608	cfea58e4d2.exe
2608	cfea58e4d2.exe
2608	cfea58e4d2.exe
2608	cfea58e4d2.exe
2608	cfea58e4d2.exe
2608	cfea58e4d2.exe
2608	cfea58e4d2.exe
2608	cfea58e4d2.exe
2608	cfea58e4d2.exe
2608	cfea58e4d2.exe
2608	cfea58e4d2.exe
2608	cfea58e4d2.exe
2608	cfea58e4d2.exe
2608	cfea58e4d2.exe
2608	cfea58e4d2.exe
2608	cfea58e4d2.exe
2608	cfea58e4d2.exe
2608	cfea58e4d2.exe
2608	cfea58e4d2.exe
2608	cfea58e4d2.exe
2608	cfea58e4d2.exe
2608	cfea58e4d2.exe
2608	cfea58e4d2.exe
2608	cfea58e4d2.exe
2608	cfea58e4d2.exe
2608	cfea58e4d2.exe
2608	cfea58e4d2.exe
2608	cfea58e4d2.exe
2608	cfea58e4d2.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2608	cfea58e4d2.exe
2608	cfea58e4d2.exe
2608	cfea58e4d2.exe
2608	cfea58e4d2.exe
2608	cfea58e4d2.exe
2608	cfea58e4d2.exe
2608	cfea58e4d2.exe
2608	cfea58e4d2.exe
2608	cfea58e4d2.exe
2608	cfea58e4d2.exe
2608	cfea58e4d2.exe
2608	cfea58e4d2.exe
2608	cfea58e4d2.exe
2608	cfea58e4d2.exe
2608	cfea58e4d2.exe
2608	cfea58e4d2.exe
2608	cfea58e4d2.exe
2608	cfea58e4d2.exe
2608	cfea58e4d2.exe
2608	cfea58e4d2.exe
2608	cfea58e4d2.exe
2608	cfea58e4d2.exe
2608	cfea58e4d2.exe
2608	cfea58e4d2.exe
2608	cfea58e4d2.exe
2608	cfea58e4d2.exe
2608	cfea58e4d2.exe
2608	cfea58e4d2.exe
2608	cfea58e4d2.exe
2608	cfea58e4d2.exe
2608	cfea58e4d2.exe
2608	cfea58e4d2.exe
2608	cfea58e4d2.exe
2608	cfea58e4d2.exe
2608	cfea58e4d2.exe
2608	cfea58e4d2.exe
2608	cfea58e4d2.exe
2608	cfea58e4d2.exe
2608	cfea58e4d2.exe
2608	cfea58e4d2.exe
2608	cfea58e4d2.exe
2608	cfea58e4d2.exe
2608	cfea58e4d2.exe
2608	cfea58e4d2.exe
2608	cfea58e4d2.exe
2608	cfea58e4d2.exe
2608	cfea58e4d2.exe
2608	cfea58e4d2.exe
2608	cfea58e4d2.exe
2608	cfea58e4d2.exe
2608	cfea58e4d2.exe
2608	cfea58e4d2.exe
2608	cfea58e4d2.exe
2608	cfea58e4d2.exe
2608	cfea58e4d2.exe
2608	cfea58e4d2.exe
2608	cfea58e4d2.exe
2608	cfea58e4d2.exe
2608	cfea58e4d2.exe
2608	cfea58e4d2.exe
2608	cfea58e4d2.exe
2608	cfea58e4d2.exe
2608	cfea58e4d2.exe
2608	cfea58e4d2.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4100	8f26649a7a.exe
464	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 788 wrote to memory of 2008	788	fdbe8717b84549e19bc86283f8735c793478e42a10b8e40eede91f966b1c9e5b.exe	82
PID 788 wrote to memory of 2008	788	fdbe8717b84549e19bc86283f8735c793478e42a10b8e40eede91f966b1c9e5b.exe	82
PID 788 wrote to memory of 2008	788	fdbe8717b84549e19bc86283f8735c793478e42a10b8e40eede91f966b1c9e5b.exe	82
PID 2008 wrote to memory of 4100	2008	explorti.exe	83
PID 2008 wrote to memory of 4100	2008	explorti.exe	83
PID 2008 wrote to memory of 4100	2008	explorti.exe	83
PID 2008 wrote to memory of 2608	2008	explorti.exe	84
PID 2008 wrote to memory of 2608	2008	explorti.exe	84
PID 2008 wrote to memory of 2608	2008	explorti.exe	84
PID 2608 wrote to memory of 3128	2608	cfea58e4d2.exe	85
PID 2608 wrote to memory of 3128	2608	cfea58e4d2.exe	85
PID 3128 wrote to memory of 464	3128	firefox.exe	88
PID 3128 wrote to memory of 464	3128	firefox.exe	88
PID 3128 wrote to memory of 464	3128	firefox.exe	88
PID 3128 wrote to memory of 464	3128	firefox.exe	88
PID 3128 wrote to memory of 464	3128	firefox.exe	88
PID 3128 wrote to memory of 464	3128	firefox.exe	88
PID 3128 wrote to memory of 464	3128	firefox.exe	88
PID 3128 wrote to memory of 464	3128	firefox.exe	88
PID 3128 wrote to memory of 464	3128	firefox.exe	88
PID 3128 wrote to memory of 464	3128	firefox.exe	88
PID 3128 wrote to memory of 464	3128	firefox.exe	88
PID 464 wrote to memory of 1716	464	firefox.exe	89
PID 464 wrote to memory of 1716	464	firefox.exe	89
PID 464 wrote to memory of 1716	464	firefox.exe	89
PID 464 wrote to memory of 1716	464	firefox.exe	89
PID 464 wrote to memory of 1716	464	firefox.exe	89
PID 464 wrote to memory of 1716	464	firefox.exe	89
PID 464 wrote to memory of 1716	464	firefox.exe	89
PID 464 wrote to memory of 1716	464	firefox.exe	89
PID 464 wrote to memory of 1716	464	firefox.exe	89
PID 464 wrote to memory of 1716	464	firefox.exe	89
PID 464 wrote to memory of 1716	464	firefox.exe	89
PID 464 wrote to memory of 1716	464	firefox.exe	89
PID 464 wrote to memory of 1716	464	firefox.exe	89
PID 464 wrote to memory of 1716	464	firefox.exe	89
PID 464 wrote to memory of 1716	464	firefox.exe	89
PID 464 wrote to memory of 1716	464	firefox.exe	89
PID 464 wrote to memory of 1716	464	firefox.exe	89
PID 464 wrote to memory of 1716	464	firefox.exe	89
PID 464 wrote to memory of 1716	464	firefox.exe	89
PID 464 wrote to memory of 1716	464	firefox.exe	89
PID 464 wrote to memory of 1716	464	firefox.exe	89
PID 464 wrote to memory of 1716	464	firefox.exe	89
PID 464 wrote to memory of 1716	464	firefox.exe	89
PID 464 wrote to memory of 1716	464	firefox.exe	89
PID 464 wrote to memory of 1716	464	firefox.exe	89
PID 464 wrote to memory of 1716	464	firefox.exe	89
PID 464 wrote to memory of 1716	464	firefox.exe	89
PID 464 wrote to memory of 1716	464	firefox.exe	89
PID 464 wrote to memory of 1716	464	firefox.exe	89
PID 464 wrote to memory of 1716	464	firefox.exe	89
PID 464 wrote to memory of 1716	464	firefox.exe	89
PID 464 wrote to memory of 1716	464	firefox.exe	89
PID 464 wrote to memory of 1716	464	firefox.exe	89
PID 464 wrote to memory of 1716	464	firefox.exe	89
PID 464 wrote to memory of 1716	464	firefox.exe	89
PID 464 wrote to memory of 1716	464	firefox.exe	89
PID 464 wrote to memory of 1716	464	firefox.exe	89
PID 464 wrote to memory of 1716	464	firefox.exe	89
PID 464 wrote to memory of 1716	464	firefox.exe	89
PID 464 wrote to memory of 1716	464	firefox.exe	89
PID 464 wrote to memory of 1716	464	firefox.exe	89
PID 464 wrote to memory of 1716	464	firefox.exe	89

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\fdbe8717b84549e19bc86283f8735c793478e42a10b8e40eede91f966b1c9e5b.exe
"C:\Users\Admin\AppData\Local\Temp\fdbe8717b84549e19bc86283f8735c793478e42a10b8e40eede91f966b1c9e5b.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:788
- C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
  "C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2008
- - C:\Users\Admin\AppData\Local\Temp\1000006001\8f26649a7a.exe
    "C:\Users\Admin\AppData\Local\Temp\1000006001\8f26649a7a.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:4100
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\EHJDHJKFIE.exe"
      4⤵
      PID:3500
    - - C:\Users\Admin\AppData\Local\Temp\EHJDHJKFIE.exe
        
        "C:\Users\Admin\AppData\Local\Temp\EHJDHJKFIE.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        
        PID:3920
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\JEBGCBAFCG.exe"
      4⤵
      PID:2880
    - - C:\Users\Admin\AppData\Local\Temp\JEBGCBAFCG.exe
        
        "C:\Users\Admin\AppData\Local\Temp\JEBGCBAFCG.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        
        PID:3924
- - C:\Users\Admin\AppData\Local\Temp\1000011001\cfea58e4d2.exe
    "C:\Users\Admin\AppData\Local\Temp\1000011001\cfea58e4d2.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2608
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3128
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
        5⤵
        Checks processor information in registry
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:464
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1996 -parentBuildID 20240401114208 -prefsHandle 1924 -prefMapHandle 1916 -prefsLen 25751 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {618f1019-e456-4d79-9a5f-ef8a9bd0dc07} 464 "\\.\pipe\gecko-crash-server-pipe.464" gpu
        6⤵
        
        PID:1716
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2416 -parentBuildID 20240401114208 -prefsHandle 2408 -prefMapHandle 2404 -prefsLen 26671 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {29494e8c-b227-407f-b061-f59e7375a4c2} 464 "\\.\pipe\gecko-crash-server-pipe.464" socket
        6⤵
        
        PID:4348
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3356 -childID 1 -isForBrowser -prefsHandle 3348 -prefMapHandle 3344 -prefsLen 22698 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5575e598-b08a-4c68-b72e-89ae7c0c05aa} 464 "\\.\pipe\gecko-crash-server-pipe.464" tab
        6⤵
        
        PID:3944
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2560 -childID 2 -isForBrowser -prefsHandle 3904 -prefMapHandle 3928 -prefsLen 31161 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {edb7713a-be4f-42d1-a00e-75d9dcf41c14} 464 "\\.\pipe\gecko-crash-server-pipe.464" tab
        6⤵
        
        PID:4764
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4936 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4892 -prefMapHandle 4900 -prefsLen 31161 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ff6eea57-db3e-4e21-b3ea-6387b0bf066c} 464 "\\.\pipe\gecko-crash-server-pipe.464" utility
        6⤵
        Checks processor information in registry
        
        PID:3020
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5532 -childID 3 -isForBrowser -prefsHandle 5528 -prefMapHandle 5432 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0c6a7e4a-492e-4afa-bfbd-1564f8f12dad} 464 "\\.\pipe\gecko-crash-server-pipe.464" tab
        6⤵
        
        PID:5812
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5724 -childID 4 -isForBrowser -prefsHandle 5800 -prefMapHandle 5796 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ce087f4e-0285-468f-9a87-5dd94699f561} 464 "\\.\pipe\gecko-crash-server-pipe.464" tab
        6⤵
        
        PID:5824
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5908 -childID 5 -isForBrowser -prefsHandle 4756 -prefMapHandle 4752 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5adebb9d-920e-4977-bd80-2605a6cc004a} 464 "\\.\pipe\gecko-crash-server-pipe.464" tab
        6⤵
        
        PID:5852

C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5640

C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

EGCGHCBKFCFBFHIDHDBF

Path C:\ProgramData\EGCGHCBKFCFBFHIDHDBF
Size 11KB
SHA256 0e8320a1571894a78525b89b001123c9f7f665564e316abb67c3e4361c69534f
MD5 81eb172a5420466ef461cd4a636bf84a
SHA1 b6289c2eb362f6c6fcefba03257c28330c718eb0
SHA512 6d00ef934c2ee5226f0ec796d3aa6c7afd90f1674c76ea5544506554ec1ed096415eebd64c015329c67b0068f432d5ab3531b1aba78e6048f6c0a21def95eec3
SSDEEP 192:5J5nlRMftbJrDIWZK12cdQIWRQHrI60XaX49a4XBw8HK:5oLDFZquFRQLDG9twT
MD5 SHA1 SHA512 SSDEEP

Submit Download

mozglue.dll

Path C:\ProgramData\mozglue.dll
Size 593KB
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
SSDEEP 12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5 SHA1 SHA512 SSDEEP

Submit Download

nss3.dll

Path C:\ProgramData\nss3.dll
Size 2.0MB
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
SSDEEP 49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5 SHA1 SHA512 SSDEEP

Submit Download

activity-stream.discovery_stream.json.tmp

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\7qnbgwy0.default-release\activity-stream.discovery_stream.json.tmp
Size 18KB
SHA256 7a3bd28a7a636a5d9b4eed443010bb95563ba2328af6e6616927451214490107
MD5 f236de7a67efc10dc3d9e59a85d7c7ea
SHA1 4c171aa9e584d8f196819137f75101d33495d6bc
SHA512 bee1f770f5537d27fefb3adf32b32f2677dccb4b2d3346f803a765a6e1451ea0ce9e39668237091730f0cff6aecec3ad35e2e7b19ab7b8ee8c69c585e1fb8329
SSDEEP 384:2dOmecwIa1cL2IWIAdC12cnbt5MBlizofiCiQZ6GfLsya3:2SHR14HEC1J+qCN/YyE
MD5 SHA1 SHA512 SSDEEP

Submit Download

5CD1EBDF6B57F13C7E783CE5E6D8E9C44014FE1A

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\7qnbgwy0.default-release\cache2\entries\5CD1EBDF6B57F13C7E783CE5E6D8E9C44014FE1A
Size 13KB
SHA256 61679cbdb11ebd3c4c40ea106d26abf24350549cdfc9c434f4eca677fe7f6598
MD5 dfe6fc5db0847bfa4685781ab5342867
SHA1 7b152e1cc35a54f7592fe635a5474d4b76c0152b
SHA512 e207046496275062dd5421b6d09fd19b3c71661d102fe3389d89ab30809c006bd53663cf800853afb32f34cfac9fe754022f771a7f8afdaf0bbb916911890335
SSDEEP 384:HunTu9fiGLm4pUzft2WlOX8lPLZZB7t0lpDIIFg+:dBi8mCUzft2WAX8tzB7eD8K
MD5 SHA1 SHA512 SSDEEP

Submit Download

8A2034D325DC0B5C9E11EDDA3FC70A54C8DC1C0D

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\7qnbgwy0.default-release\cache2\entries\8A2034D325DC0B5C9E11EDDA3FC70A54C8DC1C0D
Size 13KB
SHA256 b918b826f3c326a04a85ed802684c3f88646f908356b0f3f1d894606c4dba0d3
MD5 340a2440d716ae2e490a19302435f0b4
SHA1 14b64a920fe2f8b006af3177bcfaaf15edf7ac1f
SHA512 cafacfd7d7f8e2aa70ffb7fda8bde1eee2be41ba5289ab0402a986148e851d5aac014a0d62a87a1c9f669d020fa193b398447746a81249c8a6467dcf0e332442
SSDEEP 384:H485u9fiGLm4pUQft2WlOX8lPLZZB7t0lpDIIiH1:nUBi8mCUQft2WAX8tzB7eD8h
MD5 SHA1 SHA512 SSDEEP

Submit Download

8f26649a7a.exe

Path C:\Users\Admin\AppData\Local\Temp\1000006001\8f26649a7a.exe
Size 2.4MB
SHA256 c19e844a529bb52d59a243340243e2208ad23ca059aa6b095f555f415d22f687
MD5 be934ec22037ff0e960f7aac46914ba5
SHA1 c83d95fbdb2610bfdae718c485e5ee339c940905
SHA512 ece945b348bf224784f814772cb17fabff23e1301fd5131a4ba26bf4cced5ec4e05fcf27fa5b96e5d942b71f04f3e30e8f119ee40165a1d256322459076a7243
SSDEEP 49152:YlFyP1lG+KRGsl1z5dkQ7N0MqdODEZ22buRhIwh4h:YlQcGsbk60M2ODEs2buSh
MD5 SHA1 SHA512 SSDEEP

Submit Download

cfea58e4d2.exe

Path C:\Users\Admin\AppData\Local\Temp\1000011001\cfea58e4d2.exe
Size 1.2MB
SHA256 d5b5c2bfbf9d01c3ac037aa994000a61e08766474af00186b3b3676c8327dcdf
MD5 51afaa81fa0fe86fd952e03f64da86d4
SHA1 8a5cd176b024d0ed84c3a50eeda3c242ce60d7ef
SHA512 7736bb17055f8cfeb74911cbbc792483d12727e1ea63fd0e4c17f8df6326e0c2e3e0b639621a04cdabc7ea909e027fc622be83e5b7380901a5716ab7e5ff69dc
SSDEEP 24576:6qDEvCTbMWu7rQYlBQcBiT6rprG8aLn2Sbly7TWEPje:6TvC/MTQYxsWR7aLn2dW
MD5 SHA1 SHA512 SSDEEP

Submit Download

explorti.exe

Path C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
Size 1.8MB
SHA256 fdbe8717b84549e19bc86283f8735c793478e42a10b8e40eede91f966b1c9e5b
MD5 9d047f353dd1398873849b493ed30629
SHA1 b43a81631d88f2a283e96bcb2550525d4108e25c
SHA512 1174a3bc725fd998bb99e7759a1010cc6e1b8eb7b2680a744a821eef387a1bfaf33f0e2f925adcd84f19030210d7ab7af43c4ee77fbc99b6e68cafedc804a874
SSDEEP 49152:eJ1j/JWZ4DbrLyHNtwhM9gesP4qcEW/4+W5AJ:m/JW2Pr+3wi+cnNJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 479KB
SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
MD5 09372174e83dbbf696ee732fd2e875bb
SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 13.8MB
SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
MD5 0a8747a2ac9ac08ae9508f36c6d75692
SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7qnbgwy0.default-release\AlternateServices.bin
Size 17KB
SHA256 e6ff12f461f351a1ff0e24ca537c9acf89ce8a7de8792fd5821c3a4be8526248
MD5 7671d11d36e4e54f34d6c43526dac2d5
SHA1 2cc3b8708ef102740fbc52b5a96d99ebc3f9005b
SHA512 36ba73868dbdd6bf4b6922c585275e98aa64fe16365a648822672b7704c07a8ae0d2ee1e1505ef5b09c437424fee693e3d564b896b35c9c8c0b038d59642c3b3
SSDEEP 96:pCn5oeebOJVblpebvpf+jbrbLbOgbgzwbzbXbTbfb1HVsbAb:i53u
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7qnbgwy0.default-release\AlternateServices.bin
Size 8KB
SHA256 870e85479f0b0a874557e713b97f4699b05e4c3f26033d22e071120c916a7328
MD5 965a2b4da01e148379838e9424d779a8
SHA1 aa97e868a993a6d4866b5672769c4316141c2bf1
SHA512 bec9d0248ca62b317885abf339a26aadab5cd460d975acb8aa548ac1cdf41171012dc580ce7f5d335c428e7e16f05c9e4e47b1920bf5f8f2b908ee737f418329
SSDEEP 24:EuB1owEngu1xgRbqpR5cOeuhMZ8Fsh2F3LFhsJbF0J3lbHWKsJblxWKf+3lb:Mn5om9cO3ebOJ3lbHpebvpf+3lb
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7qnbgwy0.default-release\AlternateServices.bin
Size 12KB
SHA256 1485af08eb8a05f8e18eaea6540db23f3328de3813bf4765270c4dc33192a43c
MD5 7b163abaf2a66ccddad0f2e21f97a53c
SHA1 23c95f46049acee589960b16777d8589b4ec3762
SHA512 968e203672f818eb74f5ce4660fb9db52dcf48d6df3d59c99d3722f352c1ab93b61eadc7a5be75b3c6815bc4268c77208ef45697c2f028927ea64331ccbad7db
SSDEEP 96:Mn5oeebOJVbHpebvpf+Vbj8bsbVgbgzXbcbwb:u5Fu
MD5 SHA1 SHA512 SSDEEP

Submit Download

cookies.sqlite-wal

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7qnbgwy0.default-release\cookies.sqlite-wal
Size 256KB
SHA256 bc3246423bd470c9ca861baa758b2c6d2a4d5002a4183345e2631598515e8fe7
MD5 f22070196f4496ea6ad502abce9e2631
SHA1 5acd8f17f74517f1fed0497b2fa55594e202c1e8
SHA512 ff9cd1345cdac010e8b93b4d8c75c5ba21a363230e920b31f183c915bd98ef397585a46e63973d3f99fdf2af3fb6845b22f95dc70c61876f29d3d1663305b899
SSDEEP 96:1fnR2GO7+B1V2GO9oKGUh+dJy1V2GOfauGUh+G:taOiK
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7qnbgwy0.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 f19b5efafdac9f6f5c5584606161c0646143a57e4fb489b5039b66eb03524581
MD5 75c6a7dbeda5d527a9554968e1e9c07f
SHA1 273df5b3c844fb1e048b363a19b196a913c5c248
SHA512 1416c7d3802f7266ee1893b0c8a28e9580c36bf3d52c7f3a32fb489f12fe89707b8d0293fcc27e9accab838486bb24361349e016e69cd5c5d50d340fd4a0ac6d
SSDEEP 96:yXQiqziMifi9Fl66Joz0dzgClKtmSSbBFMSMF9ZbkW6QX0BBGAhm0UPPP/PrWI:z7/66Joz0dzgCl6mSSgrvZboHzhYHPCI
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7qnbgwy0.default-release\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 bec452f4bb1a0439c0cabb8760d7194fa950a9a70c86d16988761de0375b2c70
MD5 798c3e2f281a7b5b737cbe33eace6add
SHA1 0d1a1f5413844f9b498b06ef53c4e1a4c8928186
SHA512 41c6b4091fcdb9fe89adf7cce2259a972d8d1172bd7b7273aefdda435eea366dd48771ead7b1cbe15d970e058cffb8b54df2e5b455ae836314ac8244f5d643ca
MD5 SHA1 SHA512

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7qnbgwy0.default-release\datareporting\glean\db\data.safe.tmp
Size 15KB
SHA256 7e728d84987ddb1fcb1304450bbd8e7d4628486bcd29554e18706b16273d15c1
MD5 6a7e905db75711f709ff722195429e16
SHA1 1ca217bb0086363e245a1c62f4596ea4df3aa28d
SHA512 b5d6fe0956b737fd891a3da641e3bd1c2a6f825ccb95bade80415f7c331e9847631fc1797b37cbd328cf5af9f7ce056952e5ba181b66158ef5886d6cc06cf0d2
SSDEEP 384:FjLmoJBw7DyJkEbubL9dYboTdUgPFf/66JozQzgC1bM:FL17ADyJkEbubL9dw1gNamm
MD5 SHA1 SHA512 SSDEEP

Submit Download

289220e0-36d9-4cdb-9a72-09b8a5ed31e5

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7qnbgwy0.default-release\datareporting\glean\pending_pings\289220e0-36d9-4cdb-9a72-09b8a5ed31e5
Size 671B
SHA256 3a302449ee452f895605fd6afbd24a80711d72c92f2652c7ccc69435c8598c65
MD5 da1ca6e74799fa16d165e2489f49a95b
SHA1 ddc75920d0e85df46fb4fd4d879d413a09e6a2c3
SHA512 04b29922eebb2fcc41b91124556baa2e433a5dda6e8d24d040be8450d3ef946561931a4b201356aa3afc769f6f34cb86b1ff92aba235ce0058cbf84d7630e389
MD5 SHA1 SHA512

Submit Download

2e47184e-ef88-435f-aac5-0545a173f728

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7qnbgwy0.default-release\datareporting\glean\pending_pings\2e47184e-ef88-435f-aac5-0545a173f728
Size 982B
SHA256 221b57ec24420c9c6d934de98a7d9080d280960d2c832913b30644fe781940ca
MD5 1879f2a633b6d2265ad131f1323d6b84
SHA1 395646cb2e1258a2f3316ea827c60d29c2950e49
SHA512 78081e5e9c080f328dc062772905ee3bfbcde3aaed2f308f9082673ad1c682a380c73712c50691d15cfba2bf9cc5641b04f3fb58f20de8b06bff9c9ca3a2dac1
MD5 SHA1 SHA512

Submit Download

e7f5ded5-37e5-4ab2-abf4-dc071fe33c8d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7qnbgwy0.default-release\datareporting\glean\pending_pings\e7f5ded5-37e5-4ab2-abf4-dc071fe33c8d
Size 23KB
SHA256 fc8f40dede5e387da0fa8d5b73f525fe012bfac2a5a640c5740c2472b161ec2e
MD5 2e17fa120baafc1e0fd9afd6c014e035
SHA1 e97d776b8c5ddee8db859d21805786d334b03d2e
SHA512 abce1b59ef88fc8ede7060315d00716985db4cc329e1602c0b0585a3f20bab8581dcf3c2f444bbd4c3c56b96d99755a82112c0edd88e033eab4240d8caa8dbb1
SSDEEP 192:/P8PyNaWaM2YDFjNXGWdB1WEjempjMychYFwZhJR7zo9RyIYIfnHSDxdCd76M+hP:/Tr3FJ0mNqjmgBD7PUfdxMYmfVZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7qnbgwy0.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Size 1.1MB
SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
MD5 842039753bf41fa5e11b3a1383061a87
SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7qnbgwy0.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Size 116B
SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
MD5 2a461e9eb87fd1955cea740a3444ee7a
SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7qnbgwy0.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Size 372B
SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
MD5 bf957ad58b55f64219ab3f793e374316
SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7qnbgwy0.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Size 17.8MB
SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
MD5 daf7ef3acccab478aaa7d6dc1c60f865
SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
MD5 SHA1 SHA512 SSDEEP

Submit Download

places.sqlite-wal

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7qnbgwy0.default-release\places.sqlite-wal
Size 992KB
SHA256 3a2efc7d9838f97df422884fd522f08595946030b966ad8953ab8df4d6633d98
MD5 c50d8a6c3d2c3bd208aff7ea3b927eef
SHA1 7209e5c53f0949cbc70e8b8b1db8871efc5df79d
SHA512 8dfc5c4c1205992ae7e3ebecddb05b7d36c6282d647a91022deaf2992e4b52100cf2d3d9ea22117a26bf40db76e964f7d08d156db839946deea8e61272a03671
SSDEEP 192:jjIyW4jNL9gx/jjIphKGYPqahrdK2B4x/xCjIf:jMyJgNMOGQXRUaMf
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7qnbgwy0.default-release\prefs-1.js
Size 12KB
SHA256 c0e529f203258b869e6d4750c734b291d56f860223034d5303a106e1de913964
MD5 1b67338b1fdade5d6b067e3fa081549a
SHA1 3104cc3c2ce7b79adaaa03a18cb0aebd6f035c39
SHA512 f8531c244a6af07772e622097829d5d6638ad0f3463247b1d53edb22a5eb1a8b86cb9b5b6d766a670acf453705fc1eb9308ddf28ca40204371d4b94de2acd63f
SSDEEP 192:CPJ5nlRMftbJrDIWZK12cdQIWRQHrI60XaX49a4wBw8HkhZ:6oLDFZquFRQLDG96wLn
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7qnbgwy0.default-release\prefs-1.js
Size 16KB
SHA256 1b633cc38bedaf79fce811764e3e27da892161d487bf54b7ae2b39cf40546e4e
MD5 d5abd21c8513ab4fca313747a6aae21f
SHA1 9ec8e3b8b21be5b0d1c0285d6ea5ab9ea020fc6f
SHA512 a6bf19ff576c6d2fbd460afb841347d8c1b8e1b464e60f8921f4c4c77591737dca2de33fe25c5c2939407b4d323cced06c4ae1b0feb4036c0947c2e23891fb02
SSDEEP 192:CPJCnlRMfSbJrDIWZK12cdQIWRQHrI60XaX4X+a4aiBw8HkQ1JaFZ:65mDFZquFRQLDGOVwLoU
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7qnbgwy0.default-release\prefs.js
Size 8KB
SHA256 63a7c965d918d37b3aae65d6f17d67c2233749cb7ff1169387459d801805fcb3
MD5 401321f0a18c55064ac2586a4cf759f1
SHA1 9b3c5ebf6593bbc80449c37e3dba0626030a14ff
SHA512 784a0c8c4ead3b3c6989a2114bf5ac98f257c9974773c19506f13e4a8a29593fbf9743e7883ee41e7417f4a3676e7020ad24ad28d68e269a74d1522e91327d78
SSDEEP 192:5J5nlRMft3atxUcdzky60zqaXVa4XBw8VK:5oSx5yxytwN
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/788-2-0x00000000000B1000-0x00000000000DF000-memory.dmp

Download

memory/788-1-0x00000000774A6000-0x00000000774A8000-memory.dmp

Download

memory/788-0-0x00000000000B0000-0x000000000055B000-memory.dmp

Download

memory/788-18-0x00000000000B0000-0x000000000055B000-memory.dmp

Download

memory/788-3-0x00000000000B0000-0x000000000055B000-memory.dmp

Download

memory/788-5-0x00000000000B0000-0x000000000055B000-memory.dmp

Download

memory/1492-2645-0x0000000000360000-0x000000000080B000-memory.dmp

Download

memory/1492-2646-0x0000000000360000-0x000000000080B000-memory.dmp

Download

memory/2008-490-0x0000000000360000-0x000000000080B000-memory.dmp

Download

memory/2008-436-0x0000000000360000-0x000000000080B000-memory.dmp

Download

memory/2008-507-0x0000000000360000-0x000000000080B000-memory.dmp

Download

memory/2008-20-0x0000000000360000-0x000000000080B000-memory.dmp

Download

memory/2008-19-0x0000000000361000-0x000000000038F000-memory.dmp

Download

memory/2008-2654-0x0000000000360000-0x000000000080B000-memory.dmp

Download

memory/2008-16-0x0000000000360000-0x000000000080B000-memory.dmp

Download

memory/2008-2648-0x0000000000360000-0x000000000080B000-memory.dmp

Download

memory/2008-502-0x0000000000360000-0x000000000080B000-memory.dmp

Download

memory/2008-21-0x0000000000360000-0x000000000080B000-memory.dmp

Download

memory/2008-2647-0x0000000000360000-0x000000000080B000-memory.dmp

Download

memory/2008-2644-0x0000000000360000-0x000000000080B000-memory.dmp

Download

memory/2008-473-0x0000000000360000-0x000000000080B000-memory.dmp

Download

memory/2008-2642-0x0000000000360000-0x000000000080B000-memory.dmp

Download

memory/2008-1105-0x0000000000360000-0x000000000080B000-memory.dmp

Download

memory/2008-2641-0x0000000000360000-0x000000000080B000-memory.dmp

Download

memory/2008-2123-0x0000000000360000-0x000000000080B000-memory.dmp

Download

memory/2008-2640-0x0000000000360000-0x000000000080B000-memory.dmp

Download

memory/2008-2630-0x0000000000360000-0x000000000080B000-memory.dmp

Download

memory/2008-2637-0x0000000000360000-0x000000000080B000-memory.dmp

Download

memory/3920-486-0x0000000000150000-0x00000000005FB000-memory.dmp

Download

memory/3920-480-0x0000000000150000-0x00000000005FB000-memory.dmp

Download

memory/3924-491-0x0000000000130000-0x00000000005DB000-memory.dmp

Download

memory/3924-493-0x0000000000130000-0x00000000005DB000-memory.dmp

Download

memory/4100-464-0x0000000000DD0000-0x00000000019A9000-memory.dmp

Download

memory/4100-37-0x0000000000DD0000-0x00000000019A9000-memory.dmp

Download

memory/4100-56-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Download

memory/4100-484-0x0000000000DD0000-0x00000000019A9000-memory.dmp

Download

memory/5640-2278-0x0000000000360000-0x000000000080B000-memory.dmp

Download

memory/5640-2124-0x0000000000360000-0x000000000080B000-memory.dmp

Download