amadey | a08b952dc5725a233a849b720dfef7015c4ed76a562cf0ac2d7d0974b4504739

Analysis

max time kernel
150s
max time network
124s
platform
windows11-21h2_x64
resource
win11-20240709-en
resource tags

arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
submitted
13/07/2024, 04:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a08b952dc5725a233a849b720dfef7015c4ed76a562cf0ac2d7d0974b4504739.exe
Size 1.8MB
Sample240713-e6cgqsyblh
SHA256 a08b952dc5725a233a849b720dfef7015c4ed76a562cf0ac2d7d0974b4504739
MD5 7f3fc47c6337de3217802fa7d575a343
SHA1 d6bb3e49e229acd35d1415983d2c5e600a4932d6
SHA512 c50bfa3851b404ca979ec32d8c8b4411e6bb1026996bb8b21c0873d9af7b3b218aebccb65bd029947e1f4a1305ecc9ca81b668dd564689b0ae568179f2b24e8e
SSDEEP 49152:DBdXvL6U0TWWklTtcC9hYPZo6xsP/EckCJIu+Pyd:DBIU0D+TtzbY+6xsSCJZ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey stealc 4dd39d hate discovery evasion spyware stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.30

Botnet

4dd39d

http://77.91.77.82

Attributes

install_dir
ad40971b6b
install_file
explorti.exe
strings_key
a434973ad22def7137dbb5e059b7081e
url_paths
/Hun4Ko/index.php

rc4.plain

Extracted

Family

stealc

Botnet

hate

http://85.28.47.30

Attributes

url_path
/920475a59bac849d.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Stealc
Stealc is an infostealer written in C++.
stealer stealc

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	CGDGHCBGDH.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	a08b952dc5725a233a849b720dfef7015c4ed76a562cf0ac2d7d0974b4504739.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 12 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	a08b952dc5725a233a849b720dfef7015c4ed76a562cf0ac2d7d0974b4504739.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	CGDGHCBGDH.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	a08b952dc5725a233a849b720dfef7015c4ed76a562cf0ac2d7d0974b4504739.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	CGDGHCBGDH.exe

Executes dropped EXE 7 IoCs

pid	Process
1072	explorti.exe
3836	9aae257910.exe
4796	aa07d03193.exe
5016	explorti.exe
1656	CGDGHCBGDH.exe
5892	explorti.exe
5144	explorti.exe

Identifies Wine through registry keys 2 TTPs 6 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1376880307-1734125928-2892936080-1000\Software\Wine	CGDGHCBGDH.exe
Key opened	\REGISTRY\USER\S-1-5-21-1376880307-1734125928-2892936080-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-1376880307-1734125928-2892936080-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-1376880307-1734125928-2892936080-1000\Software\Wine	a08b952dc5725a233a849b720dfef7015c4ed76a562cf0ac2d7d0974b4504739.exe
Key opened	\REGISTRY\USER\S-1-5-21-1376880307-1734125928-2892936080-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-1376880307-1734125928-2892936080-1000\Software\Wine	explorti.exe

Loads dropped DLL 2 IoCs

pid	Process
3836	9aae257910.exe
3836	9aae257910.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x000100000002aa9d-42.dat	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs

pid	Process
3504	a08b952dc5725a233a849b720dfef7015c4ed76a562cf0ac2d7d0974b4504739.exe
1072	explorti.exe
3836	9aae257910.exe
3836	9aae257910.exe
5016	explorti.exe
3836	9aae257910.exe
1656	CGDGHCBGDH.exe
5892	explorti.exe
5144	explorti.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\explorti.job	a08b952dc5725a233a849b720dfef7015c4ed76a562cf0ac2d7d0974b4504739.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	9aae257910.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	9aae257910.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1376880307-1734125928-2892936080-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
3504	a08b952dc5725a233a849b720dfef7015c4ed76a562cf0ac2d7d0974b4504739.exe
3504	a08b952dc5725a233a849b720dfef7015c4ed76a562cf0ac2d7d0974b4504739.exe
1072	explorti.exe
1072	explorti.exe
3836	9aae257910.exe
3836	9aae257910.exe
5016	explorti.exe
5016	explorti.exe
3836	9aae257910.exe
3836	9aae257910.exe
1656	CGDGHCBGDH.exe
1656	CGDGHCBGDH.exe
5892	explorti.exe
5892	explorti.exe
5144	explorti.exe
5144	explorti.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3748	firefox.exe
Token: SeDebugPrivilege	3748	firefox.exe
Token: SeDebugPrivilege	3748	firefox.exe
Token: SeDebugPrivilege	3748	firefox.exe
Token: SeDebugPrivilege	3748	firefox.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4796	aa07d03193.exe
4796	aa07d03193.exe
4796	aa07d03193.exe
4796	aa07d03193.exe
4796	aa07d03193.exe
4796	aa07d03193.exe
4796	aa07d03193.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
4796	aa07d03193.exe
4796	aa07d03193.exe
4796	aa07d03193.exe
4796	aa07d03193.exe
4796	aa07d03193.exe
4796	aa07d03193.exe
4796	aa07d03193.exe
4796	aa07d03193.exe
4796	aa07d03193.exe
4796	aa07d03193.exe
4796	aa07d03193.exe
4796	aa07d03193.exe
4796	aa07d03193.exe
4796	aa07d03193.exe
4796	aa07d03193.exe
4796	aa07d03193.exe
4796	aa07d03193.exe
4796	aa07d03193.exe
4796	aa07d03193.exe
4796	aa07d03193.exe
4796	aa07d03193.exe
4796	aa07d03193.exe
4796	aa07d03193.exe
4796	aa07d03193.exe
4796	aa07d03193.exe
4796	aa07d03193.exe
4796	aa07d03193.exe
4796	aa07d03193.exe
4796	aa07d03193.exe
4796	aa07d03193.exe
4796	aa07d03193.exe
4796	aa07d03193.exe
4796	aa07d03193.exe
4796	aa07d03193.exe
4796	aa07d03193.exe
4796	aa07d03193.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4796	aa07d03193.exe
4796	aa07d03193.exe
4796	aa07d03193.exe
4796	aa07d03193.exe
4796	aa07d03193.exe
4796	aa07d03193.exe
4796	aa07d03193.exe
4796	aa07d03193.exe
4796	aa07d03193.exe
4796	aa07d03193.exe
4796	aa07d03193.exe
4796	aa07d03193.exe
4796	aa07d03193.exe
4796	aa07d03193.exe
4796	aa07d03193.exe
4796	aa07d03193.exe
4796	aa07d03193.exe
4796	aa07d03193.exe
4796	aa07d03193.exe
4796	aa07d03193.exe
4796	aa07d03193.exe
4796	aa07d03193.exe
4796	aa07d03193.exe
4796	aa07d03193.exe
4796	aa07d03193.exe
4796	aa07d03193.exe
4796	aa07d03193.exe
4796	aa07d03193.exe
4796	aa07d03193.exe
4796	aa07d03193.exe
4796	aa07d03193.exe
4796	aa07d03193.exe
4796	aa07d03193.exe
4796	aa07d03193.exe
4796	aa07d03193.exe
4796	aa07d03193.exe
4796	aa07d03193.exe
4796	aa07d03193.exe
4796	aa07d03193.exe
4796	aa07d03193.exe
4796	aa07d03193.exe
4796	aa07d03193.exe
4796	aa07d03193.exe
4796	aa07d03193.exe
4796	aa07d03193.exe
4796	aa07d03193.exe
4796	aa07d03193.exe
4796	aa07d03193.exe
4796	aa07d03193.exe
4796	aa07d03193.exe
4796	aa07d03193.exe
4796	aa07d03193.exe
4796	aa07d03193.exe
4796	aa07d03193.exe
4796	aa07d03193.exe
4796	aa07d03193.exe
4796	aa07d03193.exe
4796	aa07d03193.exe
4796	aa07d03193.exe
4796	aa07d03193.exe
4796	aa07d03193.exe
4796	aa07d03193.exe
4796	aa07d03193.exe
4796	aa07d03193.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3836	9aae257910.exe
3748	firefox.exe
4896	cmd.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3504 wrote to memory of 1072	3504	a08b952dc5725a233a849b720dfef7015c4ed76a562cf0ac2d7d0974b4504739.exe	82
PID 3504 wrote to memory of 1072	3504	a08b952dc5725a233a849b720dfef7015c4ed76a562cf0ac2d7d0974b4504739.exe	82
PID 3504 wrote to memory of 1072	3504	a08b952dc5725a233a849b720dfef7015c4ed76a562cf0ac2d7d0974b4504739.exe	82
PID 1072 wrote to memory of 3836	1072	explorti.exe	83
PID 1072 wrote to memory of 3836	1072	explorti.exe	83
PID 1072 wrote to memory of 3836	1072	explorti.exe	83
PID 1072 wrote to memory of 4796	1072	explorti.exe	84
PID 1072 wrote to memory of 4796	1072	explorti.exe	84
PID 1072 wrote to memory of 4796	1072	explorti.exe	84
PID 4796 wrote to memory of 4728	4796	aa07d03193.exe	85
PID 4796 wrote to memory of 4728	4796	aa07d03193.exe	85
PID 4728 wrote to memory of 3748	4728	firefox.exe	88
PID 4728 wrote to memory of 3748	4728	firefox.exe	88
PID 4728 wrote to memory of 3748	4728	firefox.exe	88
PID 4728 wrote to memory of 3748	4728	firefox.exe	88
PID 4728 wrote to memory of 3748	4728	firefox.exe	88
PID 4728 wrote to memory of 3748	4728	firefox.exe	88
PID 4728 wrote to memory of 3748	4728	firefox.exe	88
PID 4728 wrote to memory of 3748	4728	firefox.exe	88
PID 4728 wrote to memory of 3748	4728	firefox.exe	88
PID 4728 wrote to memory of 3748	4728	firefox.exe	88
PID 4728 wrote to memory of 3748	4728	firefox.exe	88
PID 3748 wrote to memory of 2388	3748	firefox.exe	89
PID 3748 wrote to memory of 2388	3748	firefox.exe	89
PID 3748 wrote to memory of 2388	3748	firefox.exe	89
PID 3748 wrote to memory of 2388	3748	firefox.exe	89
PID 3748 wrote to memory of 2388	3748	firefox.exe	89
PID 3748 wrote to memory of 2388	3748	firefox.exe	89
PID 3748 wrote to memory of 2388	3748	firefox.exe	89
PID 3748 wrote to memory of 2388	3748	firefox.exe	89
PID 3748 wrote to memory of 2388	3748	firefox.exe	89
PID 3748 wrote to memory of 2388	3748	firefox.exe	89
PID 3748 wrote to memory of 2388	3748	firefox.exe	89
PID 3748 wrote to memory of 2388	3748	firefox.exe	89
PID 3748 wrote to memory of 2388	3748	firefox.exe	89
PID 3748 wrote to memory of 2388	3748	firefox.exe	89
PID 3748 wrote to memory of 2388	3748	firefox.exe	89
PID 3748 wrote to memory of 2388	3748	firefox.exe	89
PID 3748 wrote to memory of 2388	3748	firefox.exe	89
PID 3748 wrote to memory of 2388	3748	firefox.exe	89
PID 3748 wrote to memory of 2388	3748	firefox.exe	89
PID 3748 wrote to memory of 2388	3748	firefox.exe	89
PID 3748 wrote to memory of 2388	3748	firefox.exe	89
PID 3748 wrote to memory of 2388	3748	firefox.exe	89
PID 3748 wrote to memory of 2388	3748	firefox.exe	89
PID 3748 wrote to memory of 2388	3748	firefox.exe	89
PID 3748 wrote to memory of 2388	3748	firefox.exe	89
PID 3748 wrote to memory of 2388	3748	firefox.exe	89
PID 3748 wrote to memory of 2388	3748	firefox.exe	89
PID 3748 wrote to memory of 2388	3748	firefox.exe	89
PID 3748 wrote to memory of 2388	3748	firefox.exe	89
PID 3748 wrote to memory of 2388	3748	firefox.exe	89
PID 3748 wrote to memory of 2388	3748	firefox.exe	89
PID 3748 wrote to memory of 2388	3748	firefox.exe	89
PID 3748 wrote to memory of 2388	3748	firefox.exe	89
PID 3748 wrote to memory of 2388	3748	firefox.exe	89
PID 3748 wrote to memory of 2388	3748	firefox.exe	89
PID 3748 wrote to memory of 2388	3748	firefox.exe	89
PID 3748 wrote to memory of 2388	3748	firefox.exe	89
PID 3748 wrote to memory of 2388	3748	firefox.exe	89
PID 3748 wrote to memory of 2388	3748	firefox.exe	89
PID 3748 wrote to memory of 2388	3748	firefox.exe	89
PID 3748 wrote to memory of 2388	3748	firefox.exe	89
PID 3748 wrote to memory of 2388	3748	firefox.exe	89

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\a08b952dc5725a233a849b720dfef7015c4ed76a562cf0ac2d7d0974b4504739.exe
"C:\Users\Admin\AppData\Local\Temp\a08b952dc5725a233a849b720dfef7015c4ed76a562cf0ac2d7d0974b4504739.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3504
- C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
  "C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1072
- - C:\Users\Admin\AppData\Local\Temp\1000006001\9aae257910.exe
    "C:\Users\Admin\AppData\Local\Temp\1000006001\9aae257910.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:3836
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\CGDGHCBGDH.exe"
      4⤵
      PID:4416
    - - C:\Users\Admin\AppData\Local\Temp\CGDGHCBGDH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CGDGHCBGDH.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        
        PID:1656
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\IIDAAFBGDB.exe"
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:4896
- - C:\Users\Admin\AppData\Local\Temp\1000011001\aa07d03193.exe
    "C:\Users\Admin\AppData\Local\Temp\1000011001\aa07d03193.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:4796
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4728
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
        5⤵
        Checks processor information in registry
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3748
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1956 -parentBuildID 20240401114208 -prefsHandle 1872 -prefMapHandle 1864 -prefsLen 25751 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5062439a-b330-4d46-b09a-b13358e4aae9} 3748 "\\.\pipe\gecko-crash-server-pipe.3748" gpu
        6⤵
        
        PID:2388
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2348 -parentBuildID 20240401114208 -prefsHandle 2332 -prefMapHandle 2328 -prefsLen 26671 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {02652c8a-bba7-443d-9584-db742aab685a} 3748 "\\.\pipe\gecko-crash-server-pipe.3748" socket
        6⤵
        
        PID:4752
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3136 -childID 1 -isForBrowser -prefsHandle 3128 -prefMapHandle 3124 -prefsLen 22698 -prefMapSize 244658 -jsInitHandle 1116 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1d405316-5b99-4480-a963-92cdcb42fb2e} 3748 "\\.\pipe\gecko-crash-server-pipe.3748" tab
        6⤵
        
        PID:4352
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3692 -childID 2 -isForBrowser -prefsHandle 3044 -prefMapHandle 3116 -prefsLen 31161 -prefMapSize 244658 -jsInitHandle 1116 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {805f0697-c83f-465c-9215-69da48dcf787} 3748 "\\.\pipe\gecko-crash-server-pipe.3748" tab
        6⤵
        
        PID:2924
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4868 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4924 -prefMapHandle 4920 -prefsLen 31161 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {675145b2-527f-407f-8d04-0f777e00ec30} 3748 "\\.\pipe\gecko-crash-server-pipe.3748" utility
        6⤵
        Checks processor information in registry
        
        PID:5176
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5476 -childID 3 -isForBrowser -prefsHandle 5544 -prefMapHandle 5568 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1116 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {272d55ae-4c13-41d7-a9fb-aca98cfc05d9} 3748 "\\.\pipe\gecko-crash-server-pipe.3748" tab
        6⤵
        
        PID:3024
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5340 -childID 4 -isForBrowser -prefsHandle 5704 -prefMapHandle 5708 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1116 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1b665731-05b6-4082-991a-300e67bf7ae6} 3748 "\\.\pipe\gecko-crash-server-pipe.3748" tab
        6⤵
        
        PID:532
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5880 -childID 5 -isForBrowser -prefsHandle 5888 -prefMapHandle 5892 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1116 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3d9a41d3-96eb-460f-9ad6-7020357709e0} 3748 "\\.\pipe\gecko-crash-server-pipe.3748" tab
        6⤵
        
        PID:4328

C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5016

C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5892

C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mozglue.dll

Path C:\ProgramData\mozglue.dll
Size 593KB
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
SSDEEP 12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5 SHA1 SHA512 SSDEEP

Submit Download

nss3.dll

Path C:\ProgramData\nss3.dll
Size 2.0MB
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
SSDEEP 49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5 SHA1 SHA512 SSDEEP

Submit Download

activity-stream.discovery_stream.json.tmp

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n9orreff.default-release\activity-stream.discovery_stream.json.tmp
Size 21KB
SHA256 56119746f2ff4bb86b0de42dc18e5b3f3dfb87664eca56352a3d14086c41120d
MD5 af632dc054431b9c6b33fdc727350b1e
SHA1 6840f1b39f1b40ee43c7b08c011d241219344310
SHA512 4e1d295ecf0f5415b2e5dd067336ebd37b7989f533a54367dc4abfa3314135716bf0d4e288d63d1af87a01768e0c35a3815c220c1d0018e3b0f7e45eb881ba72
SSDEEP 384:IdOmecwIa1cL2IWIAdC12cnbt5MBlizofiCiQZ6GfLzyaukhWgWV7:ISHR14HEC1J+qCN//ydkYRV7
MD5 SHA1 SHA512 SSDEEP

Submit Download

9aae257910.exe

Path C:\Users\Admin\AppData\Local\Temp\1000006001\9aae257910.exe
Size 2.4MB
SHA256 b9ce9a4cbde31bbcd141e3e0136c0474f23b3008c043e365cec3926758283423
MD5 19e12e86b83be77897a032abf5f32fa0
SHA1 ed606581628aea09508d24540866828e73b020c9
SHA512 b912227ee8e6d67ae3a2106626e70390f22bcb8e83a343662545efb7070ade906c87fab6f947a499c858a26979968459569b7fae5cfb4f38cdda4d5535e58453
SSDEEP 49152:dzB2YroEDJbbi9SWeLlt0FpvF6m4gFAVVj2E3BuQZqGL5:dRro4JbxQvF6m1FAVVj2E3Brj1
MD5 SHA1 SHA512 SSDEEP

Submit Download

aa07d03193.exe

Path C:\Users\Admin\AppData\Local\Temp\1000011001\aa07d03193.exe
Size 1.2MB
SHA256 1a367ea41eebe508b18e6932c5a2c4c4bf49d538f693fedf5ed9ac1a700256c9
MD5 09152a5de42f88b88ae9c7742ea0f93f
SHA1 d5dd93d7867c77c07a4e9a2f87ba888333c5df24
SHA512 eb1ea8fbe2b259833fc4898c71bd5f597da1c6b78719e3eeb5f46c6f6840db29f52ceb7a5e219d17344541b653c30bf7e318d435f0dcfc3777dc16f3dd0d97b7
SSDEEP 24576:IqDEvCTbMWu7rQYlBQcBiT6rprG8aLo2Sbly7TWEPje:ITvC/MTQYxsWR7aLo2dW
MD5 SHA1 SHA512 SSDEEP

Submit Download

explorti.exe

Path C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
Size 1.8MB
SHA256 a08b952dc5725a233a849b720dfef7015c4ed76a562cf0ac2d7d0974b4504739
MD5 7f3fc47c6337de3217802fa7d575a343
SHA1 d6bb3e49e229acd35d1415983d2c5e600a4932d6
SHA512 c50bfa3851b404ca979ec32d8c8b4411e6bb1026996bb8b21c0873d9af7b3b218aebccb65bd029947e1f4a1305ecc9ca81b668dd564689b0ae568179f2b24e8e
SSDEEP 49152:DBdXvL6U0TWWklTtcC9hYPZo6xsP/EckCJIu+Pyd:DBIU0D+TtzbY+6xsSCJZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 479KB
SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
MD5 09372174e83dbbf696ee732fd2e875bb
SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 13.8MB
SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
MD5 0a8747a2ac9ac08ae9508f36c6d75692
SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9orreff.default-release\AlternateServices.bin
Size 8KB
SHA256 4e55fe360c91629fb84b36cdb2ee2d8ffcdd4170c6269f7cad69cf348ca6d77c
MD5 ac843f110a0f36814835183cf93dbbf5
SHA1 3b90b7062ac867f90392b6e843c314df8b1d63fb
SHA512 1dda785a501313d54055c3f2e509fc1037f7919f9281a75a57e113043f1376c0a82ae6219c35c23217619bb0bb458cfc7a95ecccdd8d804dd08b54c9742b07e8
SSDEEP 24:RuB1oVpR5cOTsogu1xgRbe48uhMZmFsh2F3LFZmsJbF0Jc5bL0WKsJblxWKf+c5b:R9cOTF5oy4mebOJc5bL0pebvpf+c5b
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9orreff.default-release\AlternateServices.bin
Size 12KB
SHA256 22f2d84100b632ee1dac6df4d9a423962d29257ab22c72a7d3148cec8769b156
MD5 66c33bbd7480ffd8e515fd80eba298af
SHA1 e2c75b335cb7002c308a7d593ee78bd39d36a49a
SHA512 877019e3ce6564b9465bde2b462d9036097d41461560cced6df645b67848055c8fbd1c0d90a61f53b5f2a8a12faaf0acbd087fdd7c2eee1e7403dc74db12a35e
SSDEEP 96:d5o2ebOJMbQpebvpf+MbYbwbtgbgzTbsbMb:d5Ru
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9orreff.default-release\AlternateServices.bin
Size 16KB
SHA256 d0bd160cfd9823f133a6240d044bdcf7467d3fc78b84d0b87d503e5b96e6f736
MD5 dbd8998f89d299f9f84938d0a4742703
SHA1 5e69dbb61ede902211cff0ef70d55afdcc7733f1
SHA512 fe8a932a3e80fd354c9991b5f11283fe88e512fe99c60029df26d0c7cc7489765d11ddd445b9087c243d0195a97adcf8d778ad1e74fa2d7a66cb7737d1d94d51
SSDEEP 96:95o2ebOJMbnpebvpf+NbYbwbtgbgzTbsbMbqbkbbbPb:95eu
MD5 SHA1 SHA512 SSDEEP

Submit Download

cookies.sqlite-wal

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9orreff.default-release\cookies.sqlite-wal
Size 256KB
SHA256 1900b12dc7ba5f6be9d8fb61d2a0061efe0761248236ab2df1174d2e73e44382
MD5 7bef0287e2beea3ee98da16764d430c7
SHA1 49505c08d6e13dc5607f6d5e219c73e2e9328f64
SHA512 6c866517913d28017a98c6405c58db85415062574384a080ef7819e581e8d0b42b0407184332d3f2683e5ee9ccd265f121961e48600bb769daee9f672dcf0121
SSDEEP 96:H0z52RD0Z+YPm2RD08oKGUh+y8SLPm2RD05auGUh+G:UjU8OBAK
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9orreff.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 5d147a17437ef0893f16e31943e1c4a961a24b04c9ede1e3e50dd6c99a462b0a
MD5 2772aa60e649d1ff20e0777aa8570407
SHA1 e9f4d6e5f72eecd1a7e73599ce17ef998a74371a
SHA512 41a676e3f572f0f6fb1bd250f6e696eab5d962c2f518332dbb5f19e6fcf25a3ff9f69b3d336fddff956963f51a85ffe446f3c27c81a2dbef24c0c3b9c9d0658f
SSDEEP 96:J1BTSMF9ZbkW6QX0BBchmSrPP/PhxkW44nQ2hLhFl66Joz0dzgClKtmSSM:prvZboHchzDPDf5/66Joz0dzgCl6mSSM
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9orreff.default-release\datareporting\glean\db\data.safe.tmp
Size 31KB
SHA256 8e92add87f03e1c819c43bf81d5c62d1882fbc5d8bfaff791ad74f3798aa9328
MD5 a7afe8cf2b4c86826e1c6763e8af0564
SHA1 7d6766c606e7b4e9a9829ae963018e195a22c64b
SHA512 e664fe1f40b0b21293d9df1fa52eabdd54204eeb031f290d826d901ad003cad8c0473cfb223f67e421a8de97bf91ccd43e564d39aed1a1188d7580d52acf7306
SSDEEP 768:Bml748ks7hzYIFPcEhLnMEp9XbQb4bqbWbnbCb5bmH3X1dVPoqRDk:W748kOhzYIRH3X1dVPo9
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9orreff.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 aab76536a14d66b6181e8e9a01d9fcacdfcfefe0ca6269981a21d7805c14e43f
MD5 9599c9569734620ff584d4e7f492e7dd
SHA1 3a19a4cf8689d280e620b0c0daf23b3fd4e8fa48
SHA512 bb675e2bd22a738b71e92ef0ff23da16e33d6a8e089255fe4152dcb5de93ffeba40404c6ee4ce4b2be433b563a090152cbe0e99f7b959c3db0ee320177be1260
SSDEEP 96:b4nQ2hLhFl66Joz0dzgClKtmSSkBTSMF9ZbkW6QX0BBchmSrPP/PrWZ0WI:E/66Joz0dzgCl6mSSsrvZboHchzDPCpI
MD5 SHA1 SHA512 SSDEEP

Submit Download

27f3757d-5731-4b86-aa7c-53721612fbb5

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9orreff.default-release\datareporting\glean\pending_pings\27f3757d-5731-4b86-aa7c-53721612fbb5
Size 982B
SHA256 df96d0ddf70d4b183b9b5c3986e623e69040dd48d89c664c984f043a43f0efe0
MD5 b9210c54bdc5e6c213104140bcc6d717
SHA1 89c020fbc83509ae7ef204031680f646de686232
SHA512 a880a13d0aa52b6332e258344d5852331e0445fefb6ba5b5db19e4e0839cd5452877a9f68cc99134b17212551d99cecc4a69ab7c3a6830571f3a68f67d565b91
MD5 SHA1 SHA512

Submit Download

98c15650-0cb2-446b-9b7a-c4933bd29f87

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9orreff.default-release\datareporting\glean\pending_pings\98c15650-0cb2-446b-9b7a-c4933bd29f87
Size 25KB
SHA256 7c42abb955a84fcf88da4ce290ec370f3ce666905a545429ec0ba4181681ba97
MD5 6cfc98b4e15afc0d76edae7b37cc93be
SHA1 3dcd722096ba8d28ce4c17c46a549bd31311ed99
SHA512 1e5e2d975e414cceb06ec92eb4cf2fac2a8c573637ea61bf0af01e5ace442479b70715d74a7c80616ddafa6dbaf0d4abd6661dfc10a839669fba6333cb64d634
SSDEEP 192:j1fLujqgRJPhbNfHm3BTgxdm6tLPJle8xL9D0p0ORb7G79ezlLz90IHdEi60+Q5D:j1fqznlm3WhyOa06bS79e1cd8njFsq24
MD5 SHA1 SHA512 SSDEEP

Submit Download

cd508ca6-ab0c-4344-a9cb-13771e24d087

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9orreff.default-release\datareporting\glean\pending_pings\cd508ca6-ab0c-4344-a9cb-13771e24d087
Size 671B
SHA256 939a91f148f366f5add294c2db283eae1e34b81a27f465eca5365fa3f4155a02
MD5 1c6b7292078407c8fe1cbe6eae9b0b48
SHA1 c41bea83edfb8f636eb546fb3245d82078263efd
SHA512 55ca0a446134040ec5b100103043eec5f6aafc29d3a859c7885602fb06d4785374e085a29663c9e680495d3db1644e7c5a62ffbff867610f723af259ef8795fa
MD5 SHA1 SHA512

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9orreff.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Size 1.1MB
SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
MD5 842039753bf41fa5e11b3a1383061a87
SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9orreff.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Size 116B
SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
MD5 2a461e9eb87fd1955cea740a3444ee7a
SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9orreff.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Size 372B
SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
MD5 bf957ad58b55f64219ab3f793e374316
SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9orreff.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Size 17.8MB
SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
MD5 daf7ef3acccab478aaa7d6dc1c60f865
SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
MD5 SHA1 SHA512 SSDEEP

Submit Download

places.sqlite-wal

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9orreff.default-release\places.sqlite-wal
Size 992KB
SHA256 4e2c4629e08583a97ed895f971d803556ba24215936396027ac0db37f7f1ca31
MD5 2404238c6366667d22492faf9bfdcc1f
SHA1 5dda527975cf0dde79e6f77163560e3bb3a64cda
SHA512 c524b409ce9ed54bba2de5b43fcf0002ba11581f0ef4808bf82da4399abf8eb536d0967bd19ee1d8f898f64ea7c45494056fd9c3bc40b176efdac2cb9ef614e1
SSDEEP 192:QNBD6MMZCqgx/INBQhKFYZPO66x/xhNBE:QjD6Ng6jTFm4JjE
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9orreff.default-release\prefs-1.js
Size 11KB
SHA256 2f30132b3123ec8ad7cb9afb1db7a96622f477a807828b8faeba78a82bc1d759
MD5 7660043034ee705db8dffd4e8772f626
SHA1 f417d79ecd7eac16c79bcc87869754740435a2c4
SHA512 3bb82a5abe617addc24bb9f92a70a470221734edece2d447ebc9640f472c60aa482a9231a1bff692578d3a98afe56cc7b2227806f5dc8d6cbacc96b3efa9eb1a
SSDEEP 192:RSnKRJfa2OUFgIWE0lJEcd48HIW0Jy1Z/jZ0laXPhs7DBw8Hc:RNgFtBDHFsy1Z/jp2Bwt
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9orreff.default-release\prefs.js
Size 10KB
SHA256 2dd3710a9623f41624b230c3fc305644ba90301fd41ad910622bb0a476c6f8a8
MD5 b8102ac4dd346cde5e4daf9511fe49bf
SHA1 121009620f6c00caf5500ddf261975cc04cd29e6
SHA512 d00885c892880eb225f704bfe339b3f412b40fa2d0012f1f698b16d610f85cb8779f033c762a05ad0c1a62807ce4b3c614aba280067528d50a8680ba23120e34
SSDEEP 192:R5nKRJfK2OUFgIWE0lJEcd48HIW0Jy1Z/jZ0laXPhs7aBw8HY:EdgFtBDHFsy1Z/jp2Uw9
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9orreff.default-release\prefs.js
Size 8KB
SHA256 9b823b415b0048aa8e0dc6f18bb96c6a4c6daa0ce39e5543b6225beb895988a0
MD5 a79a482dbecf6b42d9472b6639b25c0f
SHA1 fa783c9f4970d6a14e953cb6def837b8a6ee0a89
SHA512 a7cefee54c449687a5da41ef324fb80a230898b0972b5fd27f9d601eb5001f038cb3b24b8aeb3e13d5457ff90635c1c1b8b60af65c714f8f5abc67ccb7196616
SSDEEP 192:R5nKRJfKTye2xUcdzky60zLaXmhs7aBw8VY:E7x5yxs2Uw3
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1072-92-0x0000000000AE0000-0x0000000000F92000-memory.dmp

Download

memory/1072-618-0x0000000000AE0000-0x0000000000F92000-memory.dmp

Download

memory/1072-632-0x0000000000AE0000-0x0000000000F92000-memory.dmp

Download

memory/1072-623-0x0000000000AE0000-0x0000000000F92000-memory.dmp

Download

memory/1072-622-0x0000000000AE0000-0x0000000000F92000-memory.dmp

Download

memory/1072-621-0x0000000000AE0000-0x0000000000F92000-memory.dmp

Download

memory/1072-620-0x0000000000AE0000-0x0000000000F92000-memory.dmp

Download

memory/1072-476-0x0000000000AE0000-0x0000000000F92000-memory.dmp

Download

memory/1072-619-0x0000000000AE0000-0x0000000000F92000-memory.dmp

Download

memory/1072-596-0x0000000000AE0000-0x0000000000F92000-memory.dmp

Download

memory/1072-613-0x0000000000AE0000-0x0000000000F92000-memory.dmp

Download

memory/1072-490-0x0000000000AE0000-0x0000000000F92000-memory.dmp

Download

memory/1072-491-0x0000000000AE0000-0x0000000000F92000-memory.dmp

Download

memory/1072-504-0x0000000000AE0000-0x0000000000F92000-memory.dmp

Download

memory/1072-507-0x0000000000AE0000-0x0000000000F92000-memory.dmp

Download

memory/1072-21-0x0000000000AE0000-0x0000000000F92000-memory.dmp

Download

memory/1072-20-0x0000000000AE0000-0x0000000000F92000-memory.dmp

Download

memory/1072-19-0x0000000000AE1000-0x0000000000B0F000-memory.dmp

Download

memory/1072-607-0x0000000000AE0000-0x0000000000F92000-memory.dmp

Download

memory/1072-18-0x0000000000AE0000-0x0000000000F92000-memory.dmp

Download

memory/1656-489-0x00000000004B0000-0x0000000000962000-memory.dmp

Download

memory/1656-488-0x00000000004B0000-0x0000000000962000-memory.dmp

Download

memory/3504-17-0x0000000000430000-0x00000000008E2000-memory.dmp

Download

memory/3504-1-0x0000000077846000-0x0000000077848000-memory.dmp

Download

memory/3504-4-0x0000000000430000-0x00000000008E2000-memory.dmp

Download

memory/3504-3-0x0000000000430000-0x00000000008E2000-memory.dmp

Download

memory/3504-0-0x0000000000430000-0x00000000008E2000-memory.dmp

Download

memory/3504-2-0x0000000000431000-0x000000000045F000-memory.dmp

Download

memory/3836-37-0x0000000000D00000-0x00000000018E2000-memory.dmp

Download

memory/3836-475-0x0000000000D00000-0x00000000018E2000-memory.dmp

Download

memory/3836-484-0x0000000000D00000-0x00000000018E2000-memory.dmp

Download

memory/3836-56-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Download

memory/5016-411-0x0000000000AE0000-0x0000000000F92000-memory.dmp

Download

memory/5016-99-0x0000000000AE0000-0x0000000000F92000-memory.dmp

Download

memory/5144-625-0x0000000000AE0000-0x0000000000F92000-memory.dmp

Download

memory/5144-626-0x0000000000AE0000-0x0000000000F92000-memory.dmp

Download

memory/5892-615-0x0000000000AE0000-0x0000000000F92000-memory.dmp

Download

memory/5892-616-0x0000000000AE0000-0x0000000000F92000-memory.dmp

Download