amadey | e5c8edd471134d167e8c71279e1e920b2428bdfa704a5e286e0b4edbcbe620f5

Analysis

max time kernel
150s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20240709-en
resource tags

arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
submitted
13/07/2024, 23:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e5c8edd471134d167e8c71279e1e920b2428bdfa704a5e286e0b4edbcbe620f5.exe
Size 1.8MB
Sample240713-3dyfhashlb
SHA256 e5c8edd471134d167e8c71279e1e920b2428bdfa704a5e286e0b4edbcbe620f5
MD5 2e998ab684db3c1e906cf4b040f8ffb0
SHA1 42fc009d45d469bd24daf70bc7aa74c3b1d47821
SHA512 b1162c49fc6ef47aa84e90381ff7a7584e89f4107f1dabe08b5791d0930c3da62d4ff3858425d0e15bb13011da3c49f75507cb08caab12e32640ff68a666d35e
SSDEEP 49152:OwVHOHIsg6OPgZMOtMwtWPokPZ7i64O5HFunlXL6LZB9o:Owjt6OPgZiw0P55i64O/unlbUF
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey stealc 4dd39d hate discovery evasion spyware stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.30

Botnet

4dd39d

http://77.91.77.82

Attributes

install_dir
ad40971b6b
install_file
explorti.exe
strings_key
a434973ad22def7137dbb5e059b7081e
url_paths
/Hun4Ko/index.php

rc4.plain

Extracted

Family

stealc

Botnet

hate

http://85.28.47.30

Attributes

url_path
/920475a59bac849d.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Stealc
Stealc is an infostealer written in C++.
stealer stealc

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	e5c8edd471134d167e8c71279e1e920b2428bdfa704a5e286e0b4edbcbe620f5.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	IEHDBGDHDA.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 12 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	e5c8edd471134d167e8c71279e1e920b2428bdfa704a5e286e0b4edbcbe620f5.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	e5c8edd471134d167e8c71279e1e920b2428bdfa704a5e286e0b4edbcbe620f5.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	IEHDBGDHDA.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	IEHDBGDHDA.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe

Executes dropped EXE 7 IoCs

pid	Process
4784	explorti.exe
1820	f80db458da.exe
4776	647c1d1a6e.exe
2340	IEHDBGDHDA.exe
5684	explorti.exe
5440	explorti.exe
5668	explorti.exe

Identifies Wine through registry keys 2 TTPs 6 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000\Software\Wine	e5c8edd471134d167e8c71279e1e920b2428bdfa704a5e286e0b4edbcbe620f5.exe
Key opened	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000\Software\Wine	IEHDBGDHDA.exe
Key opened	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000\Software\Wine	explorti.exe

Loads dropped DLL 2 IoCs

pid	Process
1820	f80db458da.exe
1820	f80db458da.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x000100000002aad8-75.dat	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs

pid	Process
420	e5c8edd471134d167e8c71279e1e920b2428bdfa704a5e286e0b4edbcbe620f5.exe
4784	explorti.exe
1820	f80db458da.exe
2340	IEHDBGDHDA.exe
5684	explorti.exe
5440	explorti.exe
5668	explorti.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\explorti.job	e5c8edd471134d167e8c71279e1e920b2428bdfa704a5e286e0b4edbcbe620f5.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	f80db458da.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	f80db458da.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
420	e5c8edd471134d167e8c71279e1e920b2428bdfa704a5e286e0b4edbcbe620f5.exe
420	e5c8edd471134d167e8c71279e1e920b2428bdfa704a5e286e0b4edbcbe620f5.exe
4784	explorti.exe
4784	explorti.exe
1820	f80db458da.exe
1820	f80db458da.exe
1820	f80db458da.exe
1820	f80db458da.exe
2340	IEHDBGDHDA.exe
2340	IEHDBGDHDA.exe
5684	explorti.exe
5684	explorti.exe
5440	explorti.exe
5440	explorti.exe
5668	explorti.exe
5668	explorti.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4800	firefox.exe
Token: SeDebugPrivilege	4800	firefox.exe
Token: SeDebugPrivilege	4800	firefox.exe
Token: SeDebugPrivilege	4800	firefox.exe
Token: SeDebugPrivilege	4800	firefox.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
420	e5c8edd471134d167e8c71279e1e920b2428bdfa704a5e286e0b4edbcbe620f5.exe
4776	647c1d1a6e.exe
4776	647c1d1a6e.exe
4776	647c1d1a6e.exe
4776	647c1d1a6e.exe
4776	647c1d1a6e.exe
4776	647c1d1a6e.exe
4776	647c1d1a6e.exe
4800	firefox.exe
4800	firefox.exe
4800	firefox.exe
4800	firefox.exe
4800	firefox.exe
4800	firefox.exe
4800	firefox.exe
4800	firefox.exe
4800	firefox.exe
4800	firefox.exe
4800	firefox.exe
4800	firefox.exe
4800	firefox.exe
4800	firefox.exe
4800	firefox.exe
4800	firefox.exe
4800	firefox.exe
4800	firefox.exe
4800	firefox.exe
4800	firefox.exe
4800	firefox.exe
4776	647c1d1a6e.exe
4776	647c1d1a6e.exe
4776	647c1d1a6e.exe
4776	647c1d1a6e.exe
4776	647c1d1a6e.exe
4776	647c1d1a6e.exe
4776	647c1d1a6e.exe
4776	647c1d1a6e.exe
4776	647c1d1a6e.exe
4776	647c1d1a6e.exe
4776	647c1d1a6e.exe
4776	647c1d1a6e.exe
4776	647c1d1a6e.exe
4776	647c1d1a6e.exe
4776	647c1d1a6e.exe
4776	647c1d1a6e.exe
4776	647c1d1a6e.exe
4776	647c1d1a6e.exe
4776	647c1d1a6e.exe
4776	647c1d1a6e.exe
4776	647c1d1a6e.exe
4776	647c1d1a6e.exe
4776	647c1d1a6e.exe
4776	647c1d1a6e.exe
4776	647c1d1a6e.exe
4776	647c1d1a6e.exe
4776	647c1d1a6e.exe
4776	647c1d1a6e.exe
4776	647c1d1a6e.exe
4776	647c1d1a6e.exe
4776	647c1d1a6e.exe
4776	647c1d1a6e.exe
4776	647c1d1a6e.exe
4776	647c1d1a6e.exe
4776	647c1d1a6e.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4776	647c1d1a6e.exe
4776	647c1d1a6e.exe
4776	647c1d1a6e.exe
4776	647c1d1a6e.exe
4776	647c1d1a6e.exe
4776	647c1d1a6e.exe
4776	647c1d1a6e.exe
4776	647c1d1a6e.exe
4776	647c1d1a6e.exe
4776	647c1d1a6e.exe
4776	647c1d1a6e.exe
4776	647c1d1a6e.exe
4776	647c1d1a6e.exe
4776	647c1d1a6e.exe
4776	647c1d1a6e.exe
4776	647c1d1a6e.exe
4776	647c1d1a6e.exe
4776	647c1d1a6e.exe
4776	647c1d1a6e.exe
4776	647c1d1a6e.exe
4776	647c1d1a6e.exe
4776	647c1d1a6e.exe
4776	647c1d1a6e.exe
4776	647c1d1a6e.exe
4776	647c1d1a6e.exe
4776	647c1d1a6e.exe
4776	647c1d1a6e.exe
4776	647c1d1a6e.exe
4776	647c1d1a6e.exe
4776	647c1d1a6e.exe
4776	647c1d1a6e.exe
4776	647c1d1a6e.exe
4776	647c1d1a6e.exe
4776	647c1d1a6e.exe
4776	647c1d1a6e.exe
4776	647c1d1a6e.exe
4776	647c1d1a6e.exe
4776	647c1d1a6e.exe
4776	647c1d1a6e.exe
4776	647c1d1a6e.exe
4776	647c1d1a6e.exe
4776	647c1d1a6e.exe
4776	647c1d1a6e.exe
4776	647c1d1a6e.exe
4776	647c1d1a6e.exe
4776	647c1d1a6e.exe
4776	647c1d1a6e.exe
4776	647c1d1a6e.exe
4776	647c1d1a6e.exe
4776	647c1d1a6e.exe
4776	647c1d1a6e.exe
4776	647c1d1a6e.exe
4776	647c1d1a6e.exe
4776	647c1d1a6e.exe
4776	647c1d1a6e.exe
4776	647c1d1a6e.exe
4776	647c1d1a6e.exe
4776	647c1d1a6e.exe
4776	647c1d1a6e.exe
4776	647c1d1a6e.exe
4776	647c1d1a6e.exe
4776	647c1d1a6e.exe
4776	647c1d1a6e.exe
4776	647c1d1a6e.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1820	f80db458da.exe
4800	firefox.exe
2956	cmd.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 420 wrote to memory of 4784	420	e5c8edd471134d167e8c71279e1e920b2428bdfa704a5e286e0b4edbcbe620f5.exe	82
PID 420 wrote to memory of 4784	420	e5c8edd471134d167e8c71279e1e920b2428bdfa704a5e286e0b4edbcbe620f5.exe	82
PID 420 wrote to memory of 4784	420	e5c8edd471134d167e8c71279e1e920b2428bdfa704a5e286e0b4edbcbe620f5.exe	82
PID 4784 wrote to memory of 1820	4784	explorti.exe	83
PID 4784 wrote to memory of 1820	4784	explorti.exe	83
PID 4784 wrote to memory of 1820	4784	explorti.exe	83
PID 4784 wrote to memory of 4776	4784	explorti.exe	84
PID 4784 wrote to memory of 4776	4784	explorti.exe	84
PID 4784 wrote to memory of 4776	4784	explorti.exe	84
PID 4776 wrote to memory of 2388	4776	647c1d1a6e.exe	85
PID 4776 wrote to memory of 2388	4776	647c1d1a6e.exe	85
PID 2388 wrote to memory of 4800	2388	firefox.exe	88
PID 2388 wrote to memory of 4800	2388	firefox.exe	88
PID 2388 wrote to memory of 4800	2388	firefox.exe	88
PID 2388 wrote to memory of 4800	2388	firefox.exe	88
PID 2388 wrote to memory of 4800	2388	firefox.exe	88
PID 2388 wrote to memory of 4800	2388	firefox.exe	88
PID 2388 wrote to memory of 4800	2388	firefox.exe	88
PID 2388 wrote to memory of 4800	2388	firefox.exe	88
PID 2388 wrote to memory of 4800	2388	firefox.exe	88
PID 2388 wrote to memory of 4800	2388	firefox.exe	88
PID 2388 wrote to memory of 4800	2388	firefox.exe	88
PID 4800 wrote to memory of 2808	4800	firefox.exe	89
PID 4800 wrote to memory of 2808	4800	firefox.exe	89
PID 4800 wrote to memory of 2808	4800	firefox.exe	89
PID 4800 wrote to memory of 2808	4800	firefox.exe	89
PID 4800 wrote to memory of 2808	4800	firefox.exe	89
PID 4800 wrote to memory of 2808	4800	firefox.exe	89
PID 4800 wrote to memory of 2808	4800	firefox.exe	89
PID 4800 wrote to memory of 2808	4800	firefox.exe	89
PID 4800 wrote to memory of 2808	4800	firefox.exe	89
PID 4800 wrote to memory of 2808	4800	firefox.exe	89
PID 4800 wrote to memory of 2808	4800	firefox.exe	89
PID 4800 wrote to memory of 2808	4800	firefox.exe	89
PID 4800 wrote to memory of 2808	4800	firefox.exe	89
PID 4800 wrote to memory of 2808	4800	firefox.exe	89
PID 4800 wrote to memory of 2808	4800	firefox.exe	89
PID 4800 wrote to memory of 2808	4800	firefox.exe	89
PID 4800 wrote to memory of 2808	4800	firefox.exe	89
PID 4800 wrote to memory of 2808	4800	firefox.exe	89
PID 4800 wrote to memory of 2808	4800	firefox.exe	89
PID 4800 wrote to memory of 2808	4800	firefox.exe	89
PID 4800 wrote to memory of 2808	4800	firefox.exe	89
PID 4800 wrote to memory of 2808	4800	firefox.exe	89
PID 4800 wrote to memory of 2808	4800	firefox.exe	89
PID 4800 wrote to memory of 2808	4800	firefox.exe	89
PID 4800 wrote to memory of 2808	4800	firefox.exe	89
PID 4800 wrote to memory of 2808	4800	firefox.exe	89
PID 4800 wrote to memory of 2808	4800	firefox.exe	89
PID 4800 wrote to memory of 2808	4800	firefox.exe	89
PID 4800 wrote to memory of 2808	4800	firefox.exe	89
PID 4800 wrote to memory of 2808	4800	firefox.exe	89
PID 4800 wrote to memory of 2808	4800	firefox.exe	89
PID 4800 wrote to memory of 2808	4800	firefox.exe	89
PID 4800 wrote to memory of 2808	4800	firefox.exe	89
PID 4800 wrote to memory of 2808	4800	firefox.exe	89
PID 4800 wrote to memory of 2808	4800	firefox.exe	89
PID 4800 wrote to memory of 2808	4800	firefox.exe	89
PID 4800 wrote to memory of 2808	4800	firefox.exe	89
PID 4800 wrote to memory of 2808	4800	firefox.exe	89
PID 4800 wrote to memory of 2808	4800	firefox.exe	89
PID 4800 wrote to memory of 2808	4800	firefox.exe	89
PID 4800 wrote to memory of 2808	4800	firefox.exe	89
PID 4800 wrote to memory of 2808	4800	firefox.exe	89

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\e5c8edd471134d167e8c71279e1e920b2428bdfa704a5e286e0b4edbcbe620f5.exe
"C:\Users\Admin\AppData\Local\Temp\e5c8edd471134d167e8c71279e1e920b2428bdfa704a5e286e0b4edbcbe620f5.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:420
- C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
  "C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4784
- - C:\Users\Admin\AppData\Local\Temp\1000006001\f80db458da.exe
    "C:\Users\Admin\AppData\Local\Temp\1000006001\f80db458da.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:1820
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\IEHDBGDHDA.exe"
      4⤵
      PID:5460
    - - C:\Users\Admin\AppData\Local\Temp\IEHDBGDHDA.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IEHDBGDHDA.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        
        PID:2340
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\BAFIEGIECG.exe"
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:2956
- - C:\Users\Admin\AppData\Local\Temp\1000011001\647c1d1a6e.exe
    "C:\Users\Admin\AppData\Local\Temp\1000011001\647c1d1a6e.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:4776
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2388
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
        5⤵
        Checks processor information in registry
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4800
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1972 -parentBuildID 20240401114208 -prefsHandle 1900 -prefMapHandle 1892 -prefsLen 25751 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2506654c-7133-4ed1-bd67-0031c5a3881f} 4800 "\\.\pipe\gecko-crash-server-pipe.4800" gpu
        6⤵
        
        PID:2808
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2384 -parentBuildID 20240401114208 -prefsHandle 2376 -prefMapHandle 2372 -prefsLen 26671 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b5126f74-f9b2-4d23-afc0-24ba39b0aea5} 4800 "\\.\pipe\gecko-crash-server-pipe.4800" socket
        6⤵
        
        PID:3404
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3340 -childID 1 -isForBrowser -prefsHandle 3332 -prefMapHandle 3328 -prefsLen 22698 -prefMapSize 244658 -jsInitHandle 1348 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bf67d865-92c0-4035-af68-efbb23185aea} 4800 "\\.\pipe\gecko-crash-server-pipe.4800" tab
        6⤵
        
        PID:1676
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3892 -childID 2 -isForBrowser -prefsHandle 3884 -prefMapHandle 3880 -prefsLen 31161 -prefMapSize 244658 -jsInitHandle 1348 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {656912a6-690b-4f86-ad1f-22db6b465f4f} 4800 "\\.\pipe\gecko-crash-server-pipe.4800" tab
        6⤵
        
        PID:6100
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4708 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4604 -prefMapHandle 4716 -prefsLen 31161 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {65ad0374-05ea-4da7-a3f5-9a9a7cf42f2e} 4800 "\\.\pipe\gecko-crash-server-pipe.4800" utility
        6⤵
        Checks processor information in registry
        
        PID:3948
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5432 -childID 3 -isForBrowser -prefsHandle 5568 -prefMapHandle 5564 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1348 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2ffa7dba-8935-4d1a-83da-953b06e1c3f1} 4800 "\\.\pipe\gecko-crash-server-pipe.4800" tab
        6⤵
        
        PID:5996
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5740 -childID 4 -isForBrowser -prefsHandle 5660 -prefMapHandle 5664 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1348 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {36602368-c793-48e1-9b6f-bc7f7c74d360} 4800 "\\.\pipe\gecko-crash-server-pipe.4800" tab
        6⤵
        
        PID:5948
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5580 -childID 5 -isForBrowser -prefsHandle 5640 -prefMapHandle 5648 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1348 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f1874770-b2f4-4981-9e0c-82d51c649660} 4800 "\\.\pipe\gecko-crash-server-pipe.4800" tab
        6⤵
        
        PID:1884

C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5684

C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5440

C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mozglue.dll

Path C:\ProgramData\mozglue.dll
Size 593KB
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
SSDEEP 12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5 SHA1 SHA512 SSDEEP

Submit Download

nss3.dll

Path C:\ProgramData\nss3.dll
Size 2.0MB
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
SSDEEP 49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5 SHA1 SHA512 SSDEEP

Submit Download

activity-stream.discovery_stream.json.tmp

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\tu0k8f5w.default-release\activity-stream.discovery_stream.json.tmp
Size 18KB
SHA256 2fe0b7a85c08200abc3d7b0ee8b502d5c46868ddf517a5d0aee09554dc22850d
MD5 e2f10c15c8c932c06f2d8d4bdd995135
SHA1 e1bf0f607ede730ee9421ad7b87c12352e1d0cd1
SHA512 894e420c6ba12cf105ed93fa99402952ca567f98d9519049c0bc7faf483dde04ff5d2022a080ff9513b2e200a10474b086dbc5567cb54b2d17b5c057fa6b9fef
SSDEEP 384:/mYmecdNG1jpPWICe412A4IbxdzofiA5LlViiZ6wM2IWyaE:/tr1jtHO1RLEq+7Y2hyp
MD5 SHA1 SHA512 SSDEEP

Submit Download

5CD1EBDF6B57F13C7E783CE5E6D8E9C44014FE1A

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\tu0k8f5w.default-release\cache2\entries\5CD1EBDF6B57F13C7E783CE5E6D8E9C44014FE1A
Size 13KB
SHA256 9c75a8b35b6f84fc10deaede08cc1659551c8501306f8c1d64c95d27266b3243
MD5 3347ddef9cf8a3c16ce05ece1d57575b
SHA1 ea2880720b715a215d9f01ba9558a08a7577de19
SHA512 a23bc20de08a897bb0436e51e136e788d806fcb9e903ee7e17ac1b6c33b550b25d1e389efee89999915eedaebc8f2e42d60fb53e12e2de055ab8fd5e025fa81a
SSDEEP 384:HunTu9fiGLm4pUdft2WlOX8lPLZZB7t0lpDIIF1H:dBi8mCUdft2WAX8tzB7eD8u
MD5 SHA1 SHA512 SSDEEP

Submit Download

8A2034D325DC0B5C9E11EDDA3FC70A54C8DC1C0D

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\tu0k8f5w.default-release\cache2\entries\8A2034D325DC0B5C9E11EDDA3FC70A54C8DC1C0D
Size 13KB
SHA256 b60071272e19da23f0b760868b039ae5a8e37194e47e8114a561a39afa710227
MD5 54e426fda45fb6a635ac494e2f78039a
SHA1 e65613bd3f28f103182ebcc0cdff8779e3fd411e
SHA512 6cacc5fb8d7fb332e33b6b965aadb9fde70a513253ba958b4f032dfd1cf8f6b902461ae221071d435b78cc4b5a8e003bc41111adea5e7c3a190e0bece87f35bc
SSDEEP 384:H485u9fiGLm4pUVft2WlOX8lPLZZB7t0lpDIIDwFwK:nUBi8mCUVft2WAX8tzB7eD8j
MD5 SHA1 SHA512 SSDEEP

Submit Download

f80db458da.exe

Path C:\Users\Admin\AppData\Local\Temp\1000006001\f80db458da.exe
Size 2.3MB
SHA256 cffcefda3f31a6dbfa4687e4ce143a1efe5a7188d9770ace09409884ce731ca4
MD5 5e279b51525d6813a8b2e5cd29e7fc7a
SHA1 04adbc1c2fe7633e70d9fc979fadf547248bca1d
SHA512 64a3bb5d5f7181a691d66854be36282c303131f5507d1544827bec0b121c2825328819bc34b6eb96dfa4d02935cdd9cde304b62cd79a4d1c57320cbf61eb2555
SSDEEP 49152:oWz5JciZQVK+P7PaWhsTQegLaZqzi3oykzH2aCJ4Xyrb:H5JpKXOaLLabe72a9Xe
MD5 SHA1 SHA512 SSDEEP

Submit Download

647c1d1a6e.exe

Path C:\Users\Admin\AppData\Local\Temp\1000011001\647c1d1a6e.exe
Size 1.2MB
SHA256 7edc0619b1e279561188b4546bfabb91bd65b0ebd84c8301866456e2434a75af
MD5 afbd974d91ad61d62bcd30a939872398
SHA1 007be8cd13f30db62869e99698612d7fd1efdc6b
SHA512 0925f94f018e767a050c88f2274e7fb52bb2a002389246297c62dcc9ce9bc708a1c144df1c74b70963ec3d65cfaa7b770396856f52a006eb9ea5f90fb9ce6347
SSDEEP 24576:NqDEvCTbMWu7rQYlBQcBiT6rprG8aLF2Sbly7TWEPje:NTvC/MTQYxsWR7aLF2dW
MD5 SHA1 SHA512 SSDEEP

Submit Download

explorti.exe

Path C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
Size 1.8MB
SHA256 e5c8edd471134d167e8c71279e1e920b2428bdfa704a5e286e0b4edbcbe620f5
MD5 2e998ab684db3c1e906cf4b040f8ffb0
SHA1 42fc009d45d469bd24daf70bc7aa74c3b1d47821
SHA512 b1162c49fc6ef47aa84e90381ff7a7584e89f4107f1dabe08b5791d0930c3da62d4ff3858425d0e15bb13011da3c49f75507cb08caab12e32640ff68a666d35e
SSDEEP 49152:OwVHOHIsg6OPgZMOtMwtWPokPZ7i64O5HFunlXL6LZB9o:Owjt6OPgZiw0P55i64O/unlbUF
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 479KB
SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
MD5 09372174e83dbbf696ee732fd2e875bb
SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 13.8MB
SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
MD5 0a8747a2ac9ac08ae9508f36c6d75692
SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tu0k8f5w.default-release\AlternateServices.bin
Size 12KB
SHA256 fa6c20dd25139b23174511b7afcce1c0010659f8e21a661cba76e6487fe9f1ba
MD5 4f7a6108423f39f15102a44847fcdc7b
SHA1 a083e79195a78f3686c24da7ba933aa8edf1ba57
SHA512 5e467534007546f02e61e79e62d25ba5da73a49f5d46ee5482989a3b30865adfba0331437a979107529bea41e0c32fcfa44d470cf629a33e3e0300367d9d3e5a
SSDEEP 96:55oIebOJSbCpebvpf+SbxbJbwgbgzybdb1b:55Pu
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tu0k8f5w.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 57c08523aae501607159b54821e3236896edb1e3cdbe1dfdcdfb9709ad865f80
MD5 48ae9fa55f240e93bda775d4fb348d44
SHA1 5d349ae18d2994a6c53db18025e38fc138dc9749
SHA512 cd84358992819f1a925d152c8797251f81dbd505b41277b2d014c0588158de5401de568303ac1b3fecd9c9de9de1ff6a0261459b18a1676a227f05849526e5a4
SSDEEP 96:VByvSMF9ZbkW6QX0BBnBhmEjPP/PrWZTHQcsZyFl66Joz0dzgClKtmSSM:grvZboHBhxrPCz/66Joz0dzgCl6mSSM
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tu0k8f5w.default-release\datareporting\glean\db\data.safe.tmp
Size 15KB
SHA256 083cc05c83fda6c57f0d44ee63e5ffd1b0af5b05401d63b26b51e64126bd4630
MD5 6486ef85abd902fca3405474b3c869a5
SHA1 9d2336ab1b313264234cb520045da4a4600cc685
SHA512 bef52f65c3bb667502d15b7307f4390787788ffe1f5c09b05afef6886daeeef17ab416da8660fbf951b454139cdd9126bac6b8a8a504926db3891fa03e34f6aa
SSDEEP 384:yhHFw4cUdxDIlWKbYbGj/66JozQzgC1bRbohT1P3:4FwJoxDIlWKbYbG+mfsP
MD5 SHA1 SHA512 SSDEEP

Submit Download

0e87ce39-1d12-4f16-be95-f0c482009eac

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tu0k8f5w.default-release\datareporting\glean\pending_pings\0e87ce39-1d12-4f16-be95-f0c482009eac
Size 982B
SHA256 69ee81f46d99980c27f712744698106673187f186f8ac33e29db59e105c6ff87
MD5 f7b40a3c69b117e8f3cb331412f7a866
SHA1 22c2e13656c0e3def7e429999e538acd2171175c
SHA512 4772538918bab038804bfe914ce731e2a33dd8e33b5b8aa821686f8492f3dde423ee8b376dabefe54f45bffe95c18b2f9d94532289dcc162c8f91e7d9dae2da8
MD5 SHA1 SHA512

Submit Download

4ece2b30-1394-4f70-ad71-18202a7af953

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tu0k8f5w.default-release\datareporting\glean\pending_pings\4ece2b30-1394-4f70-ad71-18202a7af953
Size 27KB
SHA256 e08e255579756e8b7b5148497bb18b5b54ec3c863d1a7f459f0c10721525489b
MD5 5b1461a71a9240a75407e34edde8ae4c
SHA1 560eaf1b7e9e421a407938ada9c04a5564f83229
SHA512 3387b4bda4960fefcfb3f1ee2468c178718a28e2ac5fcef901df3ca5ff0d6d0f20a54ce2b4d65bc5d449460c17efab60ae1166282d1404bad2d9f1538f6469fb
SSDEEP 192:ydndJea4m6WyKC+iptHZcPJl6/djDk3DcYyG0U3iaXcZdJxL0l1XEkFDn0LInMtS:yddkWCbAw9LBKkjc7dBly47QmMJO+e9
MD5 SHA1 SHA512 SSDEEP

Submit Download

fd728678-70f5-41c3-b1b3-65a0d5d37b1f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tu0k8f5w.default-release\datareporting\glean\pending_pings\fd728678-70f5-41c3-b1b3-65a0d5d37b1f
Size 671B
SHA256 67dbbbf6bca570588826f413d019a82d6d46edc90d1d74fefb92b3023d24e39c
MD5 40139d25718dd964ea2b59c157361280
SHA1 0740c4c56da89f391c9570a77363a7eabecdb073
SHA512 3a1ffc8391a409c66a8dc010d08d647b35286fa1857ee345c4679deafa62efdd6b6dd2ededcbce96643b5b1a8b8a79c933eb280148a674a265302f05248bf18e
MD5 SHA1 SHA512

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tu0k8f5w.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Size 1.1MB
SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
MD5 842039753bf41fa5e11b3a1383061a87
SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tu0k8f5w.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Size 116B
SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
MD5 2a461e9eb87fd1955cea740a3444ee7a
SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tu0k8f5w.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Size 372B
SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
MD5 bf957ad58b55f64219ab3f793e374316
SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tu0k8f5w.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Size 17.8MB
SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
MD5 daf7ef3acccab478aaa7d6dc1c60f865
SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tu0k8f5w.default-release\prefs-1.js
Size 13KB
SHA256 6b216e4e4c44ab9b802dcf743a45ddb728aa0a8c960a4440a1392d3890adad29
MD5 61362417b7a6bfadf44b597eb1fa8856
SHA1 f93789db159de7798178f2e9be8583240b74e528
SHA512 47bd774a9a486710366da1ce1e10fac82be00e82c3393dd7c3d78b6ff1a80caceac3577f1493874ac71de58fb135dc61e079363db90898e53c238f3e5e56be48
SSDEEP 384:VNiEFkm9cfFBQLymdVd2OM/ww42rMdtDucck1L:uKkm9c9BQLxdz2OM/U2rMdpucck1L
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tu0k8f5w.default-release\prefs-1.js
Size 16KB
SHA256 fb8dde12d5a29fc2ded6c149ac43a4db832b70231705ce82c61ebc8dc473b71d
MD5 67b2a66b82cc9aca3f10b0b6f3bf3db0
SHA1 2c9eccbef39a1eb93666dd804277ef46dede1c3f
SHA512 4673a138d5128c4c420863fbf543d0aa972227060adb029c27ca94b356810743c25af4b7648edc0459a7ed8eb5fc4ac9ce641e7895da2d562c7a9d8bbf2c76f0
SSDEEP 384:iNiEFkm9cfFBQLy7dVd2OMJ7wnkgd2lBDLbcorMsEoD5Od1YtDUuccp/kG1OEcrC:LKkm9c9BQL6dz2OMJKkgd2lBDLbcorM8
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tu0k8f5w.default-release\prefs.js
Size 11KB
SHA256 655da074eb8cb38259afea8c5ca87a58f2ac0d3c47f769e8a09127c20a47d020
MD5 577cba5e439611a00e8564a7cf3a516b
SHA1 351c6b7ba8efd37538c3a3e20e8049ee93c42654
SHA512 bac3126ebfbddd0a6d89e07ff2f7e3c7b721b4467d461cdabc57f9b83bd91a0da4001f6fc34dc53ca862e63628ab9432ef30a9225fb4ff21c937971436d4ddf7
SSDEEP 192:A5nu2RUfp5HwIiEIWkm4eJUcd2fIWVzQHrf604aXTd4uIxEBw8Hw:7NiEFkm9cfFBQLymdVXwd
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tu0k8f5w.default-release\prefs.js
Size 8KB
SHA256 e8a5875acebe3740b98544d34312e7f1855c4923951237345ec6d984f7d62ed7
MD5 308edbd778776726e545c2e34b1ef4ac
SHA1 4deb416bee6a59dc64f63e050c316f5f86e0aebb
SHA512 cdecbca2c92b91c4336d8e50954db48aafe4926cc8b7cc53b1fc25420273c1060c7596b4ad5ebcc3533fd2fa374e467dd55307dd854c2981f7367d9b30e4281a
SSDEEP 192:A5nu2RUfpEnGxUcdzky60zEGaXId4uIxEBw8Vw:7Lx5yxOdVXwz
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/420-3-0x0000000000080000-0x000000000053F000-memory.dmp

Download

memory/420-18-0x0000000000080000-0x000000000053F000-memory.dmp

Download

memory/420-1-0x0000000077036000-0x0000000077038000-memory.dmp

Download

memory/420-5-0x0000000000080000-0x000000000053F000-memory.dmp

Download

memory/420-0-0x0000000000080000-0x000000000053F000-memory.dmp

Download

memory/420-2-0x0000000000081000-0x00000000000AF000-memory.dmp

Download

memory/1820-37-0x0000000000F70000-0x0000000001B48000-memory.dmp

Download

memory/1820-133-0x0000000000F70000-0x0000000001B48000-memory.dmp

Download

memory/1820-38-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Download

memory/2340-468-0x0000000000500000-0x00000000009BF000-memory.dmp

Download

memory/2340-416-0x0000000000500000-0x00000000009BF000-memory.dmp

Download

memory/4784-491-0x0000000000890000-0x0000000000D4F000-memory.dmp

Download

memory/4784-2683-0x0000000000890000-0x0000000000D4F000-memory.dmp

Download

memory/4784-19-0x0000000000891000-0x00000000008BF000-memory.dmp

Download

memory/4784-499-0x0000000000890000-0x0000000000D4F000-memory.dmp

Download

memory/4784-16-0x0000000000890000-0x0000000000D4F000-memory.dmp

Download

memory/4784-494-0x0000000000890000-0x0000000000D4F000-memory.dmp

Download

memory/4784-2693-0x0000000000890000-0x0000000000D4F000-memory.dmp

Download

memory/4784-2687-0x0000000000890000-0x0000000000D4F000-memory.dmp

Download

memory/4784-481-0x0000000000890000-0x0000000000D4F000-memory.dmp

Download

memory/4784-480-0x0000000000890000-0x0000000000D4F000-memory.dmp

Download

memory/4784-21-0x0000000000890000-0x0000000000D4F000-memory.dmp

Download

memory/4784-767-0x0000000000890000-0x0000000000D4F000-memory.dmp

Download

memory/4784-376-0x0000000000890000-0x0000000000D4F000-memory.dmp

Download

memory/4784-1477-0x0000000000890000-0x0000000000D4F000-memory.dmp

Download

memory/4784-2668-0x0000000000890000-0x0000000000D4F000-memory.dmp

Download

memory/4784-2675-0x0000000000890000-0x0000000000D4F000-memory.dmp

Download

memory/4784-2679-0x0000000000890000-0x0000000000D4F000-memory.dmp

Download

memory/4784-2686-0x0000000000890000-0x0000000000D4F000-memory.dmp

Download

memory/4784-2685-0x0000000000890000-0x0000000000D4F000-memory.dmp

Download

memory/4784-20-0x0000000000890000-0x0000000000D4F000-memory.dmp

Download

memory/4784-2684-0x0000000000890000-0x0000000000D4F000-memory.dmp

Download

memory/5440-2682-0x0000000000890000-0x0000000000D4F000-memory.dmp

Download

memory/5440-2681-0x0000000000890000-0x0000000000D4F000-memory.dmp

Download

memory/5668-2695-0x0000000000890000-0x0000000000D4F000-memory.dmp

Download

memory/5668-2696-0x0000000000890000-0x0000000000D4F000-memory.dmp

Download

memory/5684-492-0x0000000000890000-0x0000000000D4F000-memory.dmp

Download

memory/5684-493-0x0000000000890000-0x0000000000D4F000-memory.dmp

Download