amadey | 32a3831bb6eba3ae5eedf0e60fdb17a2740441aa254dde64ff00589c7edf9b44

Analysis

max time kernel
149s
max time network
155s
platform
windows11-21h2_x64
resource
win11-20240709-en
resource tags

arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
submitted
13/07/2024, 13:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
32a3831bb6eba3ae5eedf0e60fdb17a2740441aa254dde64ff00589c7edf9b44.exe
Size 1.8MB
Sample240713-qlc4bavard
SHA256 32a3831bb6eba3ae5eedf0e60fdb17a2740441aa254dde64ff00589c7edf9b44
MD5 a0ee2884945f74a62c68f4c80572c402
SHA1 d8607d8a8a6d20fcf90819b97f5412e9e77f950b
SHA512 17b5e1616a815b0e4c9149a30c1020d792970641fb842d654e44883ba10cc17ba77b8f0e0165c4746b92a86de293dc8d59d3d43b66719fa791f1de63b20096b0
SSDEEP 49152:nXKaneyW+ugHzt+69PzaXwu5fAq31sQx6fsxJG:nFeyNXTtT9PzWXhGARJG
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey stealc 4dd39d hate discovery evasion spyware stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.30

Botnet

4dd39d

http://77.91.77.82

Attributes

install_dir
ad40971b6b
install_file
explorti.exe
strings_key
a434973ad22def7137dbb5e059b7081e
url_paths
/Hun4Ko/index.php

rc4.plain

Extracted

Family

stealc

Botnet

hate

http://85.28.47.30

Attributes

url_path
/920475a59bac849d.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Stealc
Stealc is an infostealer written in C++.
stealer stealc

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	32a3831bb6eba3ae5eedf0e60fdb17a2740441aa254dde64ff00589c7edf9b44.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	AFHDBGHJKF.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	KJEHDHIEGI.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 14 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	32a3831bb6eba3ae5eedf0e60fdb17a2740441aa254dde64ff00589c7edf9b44.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	AFHDBGHJKF.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	KJEHDHIEGI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	KJEHDHIEGI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	32a3831bb6eba3ae5eedf0e60fdb17a2740441aa254dde64ff00589c7edf9b44.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	AFHDBGHJKF.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe

Executes dropped EXE 8 IoCs

pid	Process
1552	explorti.exe
5000	1275574705.exe
4696	bd5dc14e26.exe
5148	explorti.exe
4956	AFHDBGHJKF.exe
3040	KJEHDHIEGI.exe
1268	explorti.exe
1432	explorti.exe

Identifies Wine through registry keys 2 TTPs 7 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1376880307-1734125928-2892936080-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-1376880307-1734125928-2892936080-1000\Software\Wine	32a3831bb6eba3ae5eedf0e60fdb17a2740441aa254dde64ff00589c7edf9b44.exe
Key opened	\REGISTRY\USER\S-1-5-21-1376880307-1734125928-2892936080-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-1376880307-1734125928-2892936080-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-1376880307-1734125928-2892936080-1000\Software\Wine	AFHDBGHJKF.exe
Key opened	\REGISTRY\USER\S-1-5-21-1376880307-1734125928-2892936080-1000\Software\Wine	KJEHDHIEGI.exe
Key opened	\REGISTRY\USER\S-1-5-21-1376880307-1734125928-2892936080-1000\Software\Wine	explorti.exe

Loads dropped DLL 2 IoCs

pid	Process
5000	1275574705.exe
5000	1275574705.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x000100000002ab1f-42.dat	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs

pid	Process
1224	32a3831bb6eba3ae5eedf0e60fdb17a2740441aa254dde64ff00589c7edf9b44.exe
1552	explorti.exe
5000	1275574705.exe
5000	1275574705.exe
5148	explorti.exe
4956	AFHDBGHJKF.exe
3040	KJEHDHIEGI.exe
1268	explorti.exe
1432	explorti.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\explorti.job	32a3831bb6eba3ae5eedf0e60fdb17a2740441aa254dde64ff00589c7edf9b44.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	1275574705.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	1275574705.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1376880307-1734125928-2892936080-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
1224	32a3831bb6eba3ae5eedf0e60fdb17a2740441aa254dde64ff00589c7edf9b44.exe
1224	32a3831bb6eba3ae5eedf0e60fdb17a2740441aa254dde64ff00589c7edf9b44.exe
1552	explorti.exe
1552	explorti.exe
5000	1275574705.exe
5000	1275574705.exe
5000	1275574705.exe
5000	1275574705.exe
5148	explorti.exe
5148	explorti.exe
4956	AFHDBGHJKF.exe
4956	AFHDBGHJKF.exe
3040	KJEHDHIEGI.exe
3040	KJEHDHIEGI.exe
1268	explorti.exe
1268	explorti.exe
1432	explorti.exe
1432	explorti.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1116	firefox.exe
Token: SeDebugPrivilege	1116	firefox.exe
Token: SeDebugPrivilege	1116	firefox.exe
Token: SeDebugPrivilege	1116	firefox.exe
Token: SeDebugPrivilege	1116	firefox.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4696	bd5dc14e26.exe
4696	bd5dc14e26.exe
4696	bd5dc14e26.exe
4696	bd5dc14e26.exe
4696	bd5dc14e26.exe
4696	bd5dc14e26.exe
4696	bd5dc14e26.exe
1116	firefox.exe
1116	firefox.exe
1116	firefox.exe
1116	firefox.exe
1116	firefox.exe
1116	firefox.exe
1116	firefox.exe
1116	firefox.exe
1116	firefox.exe
1116	firefox.exe
1116	firefox.exe
1116	firefox.exe
1116	firefox.exe
1116	firefox.exe
1116	firefox.exe
1116	firefox.exe
1116	firefox.exe
1116	firefox.exe
1116	firefox.exe
1116	firefox.exe
1116	firefox.exe
4696	bd5dc14e26.exe
4696	bd5dc14e26.exe
4696	bd5dc14e26.exe
4696	bd5dc14e26.exe
4696	bd5dc14e26.exe
4696	bd5dc14e26.exe
4696	bd5dc14e26.exe
4696	bd5dc14e26.exe
4696	bd5dc14e26.exe
4696	bd5dc14e26.exe
4696	bd5dc14e26.exe
4696	bd5dc14e26.exe
4696	bd5dc14e26.exe
4696	bd5dc14e26.exe
4696	bd5dc14e26.exe
4696	bd5dc14e26.exe
4696	bd5dc14e26.exe
4696	bd5dc14e26.exe
4696	bd5dc14e26.exe
4696	bd5dc14e26.exe
4696	bd5dc14e26.exe
4696	bd5dc14e26.exe
4696	bd5dc14e26.exe
4696	bd5dc14e26.exe
4696	bd5dc14e26.exe
4696	bd5dc14e26.exe
4696	bd5dc14e26.exe
4696	bd5dc14e26.exe
4696	bd5dc14e26.exe
4696	bd5dc14e26.exe
4696	bd5dc14e26.exe
4696	bd5dc14e26.exe
4696	bd5dc14e26.exe
4696	bd5dc14e26.exe
4696	bd5dc14e26.exe
4696	bd5dc14e26.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4696	bd5dc14e26.exe
4696	bd5dc14e26.exe
4696	bd5dc14e26.exe
4696	bd5dc14e26.exe
4696	bd5dc14e26.exe
4696	bd5dc14e26.exe
4696	bd5dc14e26.exe
4696	bd5dc14e26.exe
4696	bd5dc14e26.exe
4696	bd5dc14e26.exe
4696	bd5dc14e26.exe
4696	bd5dc14e26.exe
4696	bd5dc14e26.exe
4696	bd5dc14e26.exe
4696	bd5dc14e26.exe
4696	bd5dc14e26.exe
4696	bd5dc14e26.exe
4696	bd5dc14e26.exe
4696	bd5dc14e26.exe
4696	bd5dc14e26.exe
4696	bd5dc14e26.exe
4696	bd5dc14e26.exe
4696	bd5dc14e26.exe
4696	bd5dc14e26.exe
4696	bd5dc14e26.exe
4696	bd5dc14e26.exe
4696	bd5dc14e26.exe
4696	bd5dc14e26.exe
4696	bd5dc14e26.exe
4696	bd5dc14e26.exe
4696	bd5dc14e26.exe
4696	bd5dc14e26.exe
4696	bd5dc14e26.exe
4696	bd5dc14e26.exe
4696	bd5dc14e26.exe
4696	bd5dc14e26.exe
4696	bd5dc14e26.exe
4696	bd5dc14e26.exe
4696	bd5dc14e26.exe
4696	bd5dc14e26.exe
4696	bd5dc14e26.exe
4696	bd5dc14e26.exe
4696	bd5dc14e26.exe
4696	bd5dc14e26.exe
4696	bd5dc14e26.exe
4696	bd5dc14e26.exe
4696	bd5dc14e26.exe
4696	bd5dc14e26.exe
4696	bd5dc14e26.exe
4696	bd5dc14e26.exe
4696	bd5dc14e26.exe
4696	bd5dc14e26.exe
4696	bd5dc14e26.exe
4696	bd5dc14e26.exe
4696	bd5dc14e26.exe
4696	bd5dc14e26.exe
4696	bd5dc14e26.exe
4696	bd5dc14e26.exe
4696	bd5dc14e26.exe
4696	bd5dc14e26.exe
4696	bd5dc14e26.exe
4696	bd5dc14e26.exe
4696	bd5dc14e26.exe
4696	bd5dc14e26.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5000	1275574705.exe
1116	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1224 wrote to memory of 1552	1224	32a3831bb6eba3ae5eedf0e60fdb17a2740441aa254dde64ff00589c7edf9b44.exe	83
PID 1224 wrote to memory of 1552	1224	32a3831bb6eba3ae5eedf0e60fdb17a2740441aa254dde64ff00589c7edf9b44.exe	83
PID 1224 wrote to memory of 1552	1224	32a3831bb6eba3ae5eedf0e60fdb17a2740441aa254dde64ff00589c7edf9b44.exe	83
PID 1552 wrote to memory of 5000	1552	explorti.exe	84
PID 1552 wrote to memory of 5000	1552	explorti.exe	84
PID 1552 wrote to memory of 5000	1552	explorti.exe	84
PID 1552 wrote to memory of 4696	1552	explorti.exe	85
PID 1552 wrote to memory of 4696	1552	explorti.exe	85
PID 1552 wrote to memory of 4696	1552	explorti.exe	85
PID 4696 wrote to memory of 720	4696	bd5dc14e26.exe	86
PID 4696 wrote to memory of 720	4696	bd5dc14e26.exe	86
PID 720 wrote to memory of 1116	720	firefox.exe	89
PID 720 wrote to memory of 1116	720	firefox.exe	89
PID 720 wrote to memory of 1116	720	firefox.exe	89
PID 720 wrote to memory of 1116	720	firefox.exe	89
PID 720 wrote to memory of 1116	720	firefox.exe	89
PID 720 wrote to memory of 1116	720	firefox.exe	89
PID 720 wrote to memory of 1116	720	firefox.exe	89
PID 720 wrote to memory of 1116	720	firefox.exe	89
PID 720 wrote to memory of 1116	720	firefox.exe	89
PID 720 wrote to memory of 1116	720	firefox.exe	89
PID 720 wrote to memory of 1116	720	firefox.exe	89
PID 1116 wrote to memory of 1800	1116	firefox.exe	90
PID 1116 wrote to memory of 1800	1116	firefox.exe	90
PID 1116 wrote to memory of 1800	1116	firefox.exe	90
PID 1116 wrote to memory of 1800	1116	firefox.exe	90
PID 1116 wrote to memory of 1800	1116	firefox.exe	90
PID 1116 wrote to memory of 1800	1116	firefox.exe	90
PID 1116 wrote to memory of 1800	1116	firefox.exe	90
PID 1116 wrote to memory of 1800	1116	firefox.exe	90
PID 1116 wrote to memory of 1800	1116	firefox.exe	90
PID 1116 wrote to memory of 1800	1116	firefox.exe	90
PID 1116 wrote to memory of 1800	1116	firefox.exe	90
PID 1116 wrote to memory of 1800	1116	firefox.exe	90
PID 1116 wrote to memory of 1800	1116	firefox.exe	90
PID 1116 wrote to memory of 1800	1116	firefox.exe	90
PID 1116 wrote to memory of 1800	1116	firefox.exe	90
PID 1116 wrote to memory of 1800	1116	firefox.exe	90
PID 1116 wrote to memory of 1800	1116	firefox.exe	90
PID 1116 wrote to memory of 1800	1116	firefox.exe	90
PID 1116 wrote to memory of 1800	1116	firefox.exe	90
PID 1116 wrote to memory of 1800	1116	firefox.exe	90
PID 1116 wrote to memory of 1800	1116	firefox.exe	90
PID 1116 wrote to memory of 1800	1116	firefox.exe	90
PID 1116 wrote to memory of 1800	1116	firefox.exe	90
PID 1116 wrote to memory of 1800	1116	firefox.exe	90
PID 1116 wrote to memory of 1800	1116	firefox.exe	90
PID 1116 wrote to memory of 1800	1116	firefox.exe	90
PID 1116 wrote to memory of 1800	1116	firefox.exe	90
PID 1116 wrote to memory of 1800	1116	firefox.exe	90
PID 1116 wrote to memory of 1800	1116	firefox.exe	90
PID 1116 wrote to memory of 1800	1116	firefox.exe	90
PID 1116 wrote to memory of 1800	1116	firefox.exe	90
PID 1116 wrote to memory of 1800	1116	firefox.exe	90
PID 1116 wrote to memory of 1800	1116	firefox.exe	90
PID 1116 wrote to memory of 1800	1116	firefox.exe	90
PID 1116 wrote to memory of 1800	1116	firefox.exe	90
PID 1116 wrote to memory of 1800	1116	firefox.exe	90
PID 1116 wrote to memory of 1800	1116	firefox.exe	90
PID 1116 wrote to memory of 1800	1116	firefox.exe	90
PID 1116 wrote to memory of 1800	1116	firefox.exe	90
PID 1116 wrote to memory of 1800	1116	firefox.exe	90
PID 1116 wrote to memory of 1800	1116	firefox.exe	90
PID 1116 wrote to memory of 1800	1116	firefox.exe	90

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\32a3831bb6eba3ae5eedf0e60fdb17a2740441aa254dde64ff00589c7edf9b44.exe
"C:\Users\Admin\AppData\Local\Temp\32a3831bb6eba3ae5eedf0e60fdb17a2740441aa254dde64ff00589c7edf9b44.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1224
- C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
  "C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1552
- - C:\Users\Admin\AppData\Local\Temp\1000006001\1275574705.exe
    "C:\Users\Admin\AppData\Local\Temp\1000006001\1275574705.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:5000
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\AFHDBGHJKF.exe"
      4⤵
      PID:2664
    - - C:\Users\Admin\AppData\Local\Temp\AFHDBGHJKF.exe
        
        "C:\Users\Admin\AppData\Local\Temp\AFHDBGHJKF.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        
        PID:4956
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\KJEHDHIEGI.exe"
      4⤵
      PID:5244
    - - C:\Users\Admin\AppData\Local\Temp\KJEHDHIEGI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\KJEHDHIEGI.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        
        PID:3040
- - C:\Users\Admin\AppData\Local\Temp\1000011001\bd5dc14e26.exe
    "C:\Users\Admin\AppData\Local\Temp\1000011001\bd5dc14e26.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:4696
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
      4⤵
      Suspicious use of WriteProcessMemory
      PID:720
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
        5⤵
        Checks processor information in registry
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1116
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1928 -parentBuildID 20240401114208 -prefsHandle 1772 -prefMapHandle 1852 -prefsLen 25751 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {13c12e90-8456-46a3-a921-bc790cb34658} 1116 "\\.\pipe\gecko-crash-server-pipe.1116" gpu
        6⤵
        
        PID:1800
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2348 -parentBuildID 20240401114208 -prefsHandle 2340 -prefMapHandle 2336 -prefsLen 26671 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {426b586e-a9b7-43ec-8eee-e35f632e4791} 1116 "\\.\pipe\gecko-crash-server-pipe.1116" socket
        6⤵
        
        PID:2300
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2856 -childID 1 -isForBrowser -prefsHandle 3172 -prefMapHandle 2868 -prefsLen 22698 -prefMapSize 244658 -jsInitHandle 948 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {afaff7ab-f1d2-4d82-9229-f540c691fe7f} 1116 "\\.\pipe\gecko-crash-server-pipe.1116" tab
        6⤵
        
        PID:3300
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3948 -childID 2 -isForBrowser -prefsHandle 3940 -prefMapHandle 3936 -prefsLen 31161 -prefMapSize 244658 -jsInitHandle 948 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {10a267b0-8e0c-4b5b-8a96-e5ab9ac4d74d} 1116 "\\.\pipe\gecko-crash-server-pipe.1116" tab
        6⤵
        
        PID:412
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4908 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4872 -prefMapHandle 4896 -prefsLen 31161 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cbcc90b7-cba2-48ea-bfc5-f76e0c106bc9} 1116 "\\.\pipe\gecko-crash-server-pipe.1116" utility
        6⤵
        Checks processor information in registry
        
        PID:5168
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5672 -childID 3 -isForBrowser -prefsHandle 5664 -prefMapHandle 5660 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 948 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {48c28013-fead-400e-b203-445931e41974} 1116 "\\.\pipe\gecko-crash-server-pipe.1116" tab
        6⤵
        
        PID:572
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5680 -childID 4 -isForBrowser -prefsHandle 5788 -prefMapHandle 5784 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 948 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f67f9799-62ba-4ba9-8bdd-ee7ea197d29e} 1116 "\\.\pipe\gecko-crash-server-pipe.1116" tab
        6⤵
        
        PID:3420
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5340 -childID 5 -isForBrowser -prefsHandle 5932 -prefMapHandle 5936 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 948 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b7761cc9-4bf1-4bc5-96a4-657477311ab3} 1116 "\\.\pipe\gecko-crash-server-pipe.1116" tab
        6⤵
        
        PID:4148

C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5148

C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1268

C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mozglue.dll

Path C:\ProgramData\mozglue.dll
Size 593KB
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
SSDEEP 12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5 SHA1 SHA512 SSDEEP

Submit Download

nss3.dll

Path C:\ProgramData\nss3.dll
Size 2.0MB
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
SSDEEP 49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5 SHA1 SHA512 SSDEEP

Submit Download

activity-stream.discovery_stream.json.tmp

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n9orreff.default-release\activity-stream.discovery_stream.json.tmp
Size 18KB
SHA256 76d722936a5cb157c74c2da6062820e74f752d65fa1be19e8ce3bf50b2d5b468
MD5 1c9dea1cdf63bf0b919451b80662de7c
SHA1 831700a3bee5aa34a199951273ba92ed5d56ad8a
SHA512 6bf8fe2d9388fce70753d79e83515a68970986eb414d4ca30e26ef1ccaa8f73d71936ff8276e7dd1558dc745f197de7d88fbf544fd671c430c5155bdd744b81d
SSDEEP 384:ZdOmecwIa1cL2IWIAdC12cnbt5MBlizofiCiQZ6GfLgya3:ZSHR14HEC1J+qCN/MyE
MD5 SHA1 SHA512 SSDEEP

Submit Download

5CD1EBDF6B57F13C7E783CE5E6D8E9C44014FE1A

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n9orreff.default-release\cache2\entries\5CD1EBDF6B57F13C7E783CE5E6D8E9C44014FE1A
Size 13KB
SHA256 834a856aca55e46f422cf34415ff8cfb77cde14ccf7479c2380f57d3ac7ece36
MD5 1d5982b0e4fcecb512e320e14c853ead
SHA1 9ccfeff39d7c7a674cb1346efb33b051193d5c1b
SHA512 cb47e34d3d770485abd9722ea4ec964681d2f4a9aa3c32149ff66fa5fe6e55571ca29732417d304dbfc75f3e4e5cbe32ac0394ddb7769c0a60f8a96ea3dd0828
SSDEEP 384:HunTu9fiGLm4pUhft2WlOX8lPLZZB7t0lpDIIFts:dBi8mCUhft2WAX8tzB7eD8r
MD5 SHA1 SHA512 SSDEEP

Submit Download

8A2034D325DC0B5C9E11EDDA3FC70A54C8DC1C0D

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n9orreff.default-release\cache2\entries\8A2034D325DC0B5C9E11EDDA3FC70A54C8DC1C0D
Size 13KB
SHA256 b590de9896c4cc0080c89c97f0de80cbb51cb69d6f7a0c32effae8f70825b9a1
MD5 ae1289fd5e9808fa324c87ea31112196
SHA1 2447352aeb508631b646014f2a70c7c70d21cdce
SHA512 77b37d806752ef8c24026f8e30c7bd28a83980b7cb81dbabb5023a62c1002680142b53feddc1eb6272bd57fbf97fe86d099c2d31b99e2d433763bccbaa24dc5e
SSDEEP 384:H485u9fiGLm4pUyft2WlOX8lPLZZB7t0lpDIIvmh:nUBi8mCUyft2WAX8tzB7eD8n
MD5 SHA1 SHA512 SSDEEP

Submit Download

1275574705.exe

Path C:\Users\Admin\AppData\Local\Temp\1000006001\1275574705.exe
Size 2.4MB
SHA256 110a3616523579af31689b0adb305d0dde68d103d2d836b1e1649df802dac599
MD5 6df237049e2950a0da53ae449ade3db4
SHA1 5872182fc56499f265c841a068865245d692e971
SHA512 dac17c622baf098208552e9a8dffb5fcbc5fce6404f7c76c8a555fd3bdd977ae732bd2225b9ac2ec35b694b7fc96750a7363b389f506fd891fa1a4014247e033
SSDEEP 49152:btP9pNqkWeQXAUBvVv1KaEdJUzxs6x8sBvCdZs7Agt0USL:Z9Pq5e4AU/YzDUzxDBBv+Zs7xuUS
MD5 SHA1 SHA512 SSDEEP

Submit Download

bd5dc14e26.exe

Path C:\Users\Admin\AppData\Local\Temp\1000011001\bd5dc14e26.exe
Size 1.2MB
SHA256 76ce95326fa876b975b3ba93ca14941baf1d637ba755f6a1a92969f56fae92fb
MD5 5f0ee4b8dbe1df9542180afb4aec8945
SHA1 9d0e623735191280355c6693b22319c29c7fb770
SHA512 363206273bbce1ad9b549b59674ca65770517460ce9b7f910f1ed4df3048fe6645d614e2a640da34d600d285e9fe758a6288602d8d75bfe33d13db730c5acb64
SSDEEP 24576:WqDEvCTbMWu7rQYlBQcBiT6rprG8aLP2Sbly7TWEPje:WTvC/MTQYxsWR7aLP2dW
MD5 SHA1 SHA512 SSDEEP

Submit Download

explorti.exe

Path C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
Size 1.8MB
SHA256 32a3831bb6eba3ae5eedf0e60fdb17a2740441aa254dde64ff00589c7edf9b44
MD5 a0ee2884945f74a62c68f4c80572c402
SHA1 d8607d8a8a6d20fcf90819b97f5412e9e77f950b
SHA512 17b5e1616a815b0e4c9149a30c1020d792970641fb842d654e44883ba10cc17ba77b8f0e0165c4746b92a86de293dc8d59d3d43b66719fa791f1de63b20096b0
SSDEEP 49152:nXKaneyW+ugHzt+69PzaXwu5fAq31sQx6fsxJG:nFeyNXTtT9PzWXhGARJG
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 479KB
SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
MD5 09372174e83dbbf696ee732fd2e875bb
SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 13.8MB
SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
MD5 0a8747a2ac9ac08ae9508f36c6d75692
SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9orreff.default-release\AlternateServices.bin
Size 8KB
SHA256 bd4a7097f8b76eb276ae735314e75d2bea2448084e989352664940caddccfffe
MD5 2aee4cdc142f75e9f99fede761646e81
SHA1 87be9da2f54a6274e668bf6b96c9b99c03078678
SHA512 aeaa7ff33440c362a1590f5679266d4315fd500a04ae8c458761943f41359760cb548358841f893e2a102c54c2dc023613db46ad235a79f83003d03ab3d1e6a2
SSDEEP 24:RuB1orqpR5cO0ygu1xgRb88uhMZ/7Fsh2F3LFMpsJbF0JbbxWKsJblxWKf+bb:3q9cO0y5oNwpebOJbbxpebvpf+bb
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9orreff.default-release\AlternateServices.bin
Size 13KB
SHA256 d0b60ef38032f6b5d8b4f4f240bd5fecf9d943908e08a9b343274c426bcdda5b
MD5 8797042f231919e15a8a9e9f1ed61181
SHA1 55d9a008bcaed15a4a294875f2535c1b02113777
SHA512 3f06c1d793b1d4585e0c6cbb013873d33cf1134768f861bb943fe1312dc57baa749ba106b34bdbf8d9cf2e62ca7ff1f54df0ac1ef884155c9293e3356666d6eb
SSDEEP 96:5y5oyebOJbbxpebvpf+bb5bxbVtgbgzBbmbqbhbVb:Q5ZuM
MD5 SHA1 SHA512 SSDEEP

Submit Download

cookies.sqlite-wal

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9orreff.default-release\cookies.sqlite-wal
Size 256KB
SHA256 8f2f87ea296a01febee6267e15e3cd64c9ef1838c2f2b14fcb652e6ce8c62b53
MD5 2b89990532277496d0aa5abff656c1bd
SHA1 baa7a75b8e5595d040493b3b0153930348411e49
SHA512 9ed4e02f82a1b7f03c52b9d3b156b1cb25b311b95954cba86d715220070a906e4e9aaf7927253d9cc1ba2ba7f3373c916f929148110d008f79186de0b8eb3316
SSDEEP 96:WhH+2s3hU+OUE2s3hjoKGUh+MaUUE2s3h03auGUh+G:WODyK
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9orreff.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 bf12d70f10e56d50e64b241f6118b35f946b9cb5dd9a9994d4b74e9bcaa109e9
MD5 371c8abebe071bd5260670a131e87421
SHA1 b6a20fb0cd933017d56a486f4da5e5a8f23a8d42
SHA512 5cbd6778642c0126dbc24ac982ccb19284c0233fe21c3fbdf01ec35da84adb8eb4a5a22544141fe55805a0a7d40cdbc995137521ecaae3daaaa328dd8a1be329
SSDEEP 96:Q4nQ1xU0Fl66Joz0dzgClKtmSStB8SMF9ZbkW6QX0BB9hmpGPP/PhxkW3:I/66Joz0dzgCl6mSScrvZboH9hKoPDf3
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9orreff.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 5f2932161400072f7fcf4c674dca59347d1c36c6cd9e8ce510d86f83563867b5
MD5 fbff00a77baccc1106a322c220889505
SHA1 c089fc8afab652f4bc9fbf4f74bf058ed9ff150b
SHA512 972e4decb66569489c6541be9c52f88b5354086d432d042c60af019e016b20dbc7402088f16e5bf3da90cf1fdf6504df6dfca5290b68277d92d4c53e119819cc
SSDEEP 96:b4nQ1xU0Fl66Joz0dzgClKtmSSMB8SMF9ZbkW6QX0BB9hm5GPP/PaxvWI:1/66Joz0dzgCl6mSSPrvZboH9hkoP0OI
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9orreff.default-release\datareporting\glean\db\data.safe.tmp
Size 16KB
SHA256 61d09b251ae56f737616875e54d61d4a08aed8ff31f12947846d53d28f6d2877
MD5 ea2d1c9e5c7f37a6326c07b986c27789
SHA1 05436a2116ff65b275c868b0495a34a926048887
SHA512 8e55db5b674161d29aa4679bfa2b3b97d895d1fdd729f6870fce9de992d170cd3833a71e9bfad11da417337d5a6cfb63f1fb67c3a1d772ebd9523349022067d2
SSDEEP 384:rbodPSP5/66JozQzgC1b9GTv179qDucfIb2bcY:vbEmiTdQDucfIb2bcY
MD5 SHA1 SHA512 SSDEEP

Submit Download

09493cf5-1e0e-4493-9c42-2f05934c1cfe

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9orreff.default-release\datareporting\glean\pending_pings\09493cf5-1e0e-4493-9c42-2f05934c1cfe
Size 671B
SHA256 8f141a0364c5cc608c9bcddd29c4de893edd40e91da726c40511c1b5ddd924fa
MD5 f87122f7f448be6c1bc4e33356ffc257
SHA1 c311985c7d1d8d057d11026b8f4940748d14d8bc
SHA512 4ffc5de59d147ac498019912a17ee1cc7cb471fb86bbbc7c007cc15315887225f2670a6c527ae8c3a1eb22de6a27aac227d5a7d7a6a99a6dc5f4dd91efb83511
MD5 SHA1 SHA512

Submit Download

a735edc3-f6ee-43d4-a1de-6ce8e2c72ed3

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9orreff.default-release\datareporting\glean\pending_pings\a735edc3-f6ee-43d4-a1de-6ce8e2c72ed3
Size 27KB
SHA256 1d266a3673c00fc2940876e3f5e29eabac1d6a364a7c3ddb79617797ec6fb622
MD5 e3b34e3048795e02dc4b21fd10801175
SHA1 f60b615a18cd08dcd6b81eace05c067f90d36a11
SHA512 83742672a4b9e21040216590b3944896bb4d9cef29c72cb982ef14ccf7fa2dd27331067fea6bcb726270d891796676cbfdb8a8905dfc694fdfed4a4d1e66beac
SSDEEP 192:2mHz0l9xoLV0zAVS5tBGGdQNoy7FqWnzT1QQQSPHqfXED6l9fStaMYx72bKsdtKN:268PsV0MVS5tB65Znzb/bZBuTzl
MD5 SHA1 SHA512 SSDEEP

Submit Download

c5125f94-651d-42b4-9ae2-7deb961facc3

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9orreff.default-release\datareporting\glean\pending_pings\c5125f94-651d-42b4-9ae2-7deb961facc3
Size 982B
SHA256 583edff6dda2f25b5207034c013cde839824dffb63384f2d4ea8ac1ac49d0667
MD5 d3b93f5ea1d0a775600f0983ca37d886
SHA1 08912b0a4ff078385c8ffcc6e830c91099722ad2
SHA512 543b21f16a488844e3fd82720193b2a28eaf28c006f3c38bac2a5c934224ba942655cdc1b80058208075a74f7aaeca401492787afe23e92feae2754512a44a01
MD5 SHA1 SHA512

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9orreff.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Size 1.1MB
SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
MD5 842039753bf41fa5e11b3a1383061a87
SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9orreff.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Size 116B
SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
MD5 2a461e9eb87fd1955cea740a3444ee7a
SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9orreff.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Size 372B
SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
MD5 bf957ad58b55f64219ab3f793e374316
SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9orreff.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Size 17.8MB
SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
MD5 daf7ef3acccab478aaa7d6dc1c60f865
SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
MD5 SHA1 SHA512 SSDEEP

Submit Download

places.sqlite-wal

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9orreff.default-release\places.sqlite-wal
Size 992KB
SHA256 4bcfa09ce12c898295d187f60e912b4bd3b21c9aa8250cf93ea4e47352565986
MD5 034a68c777fe63e365098b7ff7a6dc6b
SHA1 8a5b4bff8aa9e37f37c5b91fe90f32427dc90520
SHA512 bae7abd583f64fb45c1cd69540cbd770b6516a5cbd30d5d7775363272b5cd39c9966f85181f1ef34b460e49d94134de00c38b173f5e75750bb0040761e291afc
SSDEEP 192:mxBb3zekOdlT7gx/exB4hK1YMRRXQ80x/xbxBE:mnbw3gUnr174TnE
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9orreff.default-release\prefs-1.js
Size 13KB
SHA256 84ea674945dd5d691eb43acc8f90504e8c9d8dca8744429bd08d40340ab85fb5
MD5 cda4a10c528692a26da2a670550441f8
SHA1 739df6793fd4889d9afb5fa7a85c5409e454743e
SHA512 aefa418f0475e56e0871a258f09a18d90f4f38ab89c9bd84f4de756f0972221159fe369364f4ee53122af3a7865f7f2eab73ee31b7f7220fb961eacf6b233067
SSDEEP 192:U5nKRJfKn2K9BN2YSd3syJwcdswYUdrS1I0660haXEhs7RbTxAuBw8HLjsBWZ4rt:RQmJsOXn6o2ZwoO
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9orreff.default-release\prefs-1.js
Size 11KB
SHA256 ec4b2e6dfec7698ff9ec2a9ae6ad0b87a262ba3df6a773e6f2508fb7004fffc8
MD5 e4e374ebb74adb33388fe348c99b6e3b
SHA1 c3f5a7b25ed9d4a41a3292e09e3cfeb0290a1444
SHA512 ee6aa82c36539eeb7486231dc7eeaf25cf91ddb4a07280edff5bb9a5948c20290b479e36be046a85180b5c11642564ad33ec00acb2557a2896bd633727941a90
SSDEEP 192:R5nKRJfKn2K9BN2YSd3syJwcdswYUdrS1I0660haXEhs7aBw8Hh:EQmJsOXn6o2UwI
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9orreff.default-release\prefs.js
Size 8KB
SHA256 4e4694432d3ba8f40b8ae4c3b13f6cfcfd0c0a148bbfdb0b3902f8ce0be898e7
MD5 eaabc37b0cc757ae203ba439f5f6428d
SHA1 70624dd344281f2c122b9ae0197cc72222ea206c
SHA512 12dcc573a9f26e46ddcdb8bb56858d1caedfca07d4defb457b1d3c84dced9c97ad0b9195d98dc6baca0e8aa4373dcb80b78cba456ff240dea9725c6c9ed6d19c
SSDEEP 192:R5nKRJfKTyiVxUcdzky60zwaXeghs7aBw8Vh:Ecx5yxPg2UwS
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1224-17-0x0000000000460000-0x0000000000911000-memory.dmp

Download

memory/1224-1-0x00000000776C6000-0x00000000776C8000-memory.dmp

Download

memory/1224-2-0x0000000000461000-0x000000000048F000-memory.dmp

Download

memory/1224-3-0x0000000000460000-0x0000000000911000-memory.dmp

Download

memory/1224-0-0x0000000000460000-0x0000000000911000-memory.dmp

Download

memory/1224-5-0x0000000000460000-0x0000000000911000-memory.dmp

Download

memory/1268-2822-0x00000000001D0000-0x0000000000681000-memory.dmp

Download

memory/1268-2823-0x00000000001D0000-0x0000000000681000-memory.dmp

Download

memory/1432-2836-0x00000000001D0000-0x0000000000681000-memory.dmp

Download

memory/1432-2837-0x00000000001D0000-0x0000000000681000-memory.dmp

Download

memory/1552-523-0x00000000001D0000-0x0000000000681000-memory.dmp

Download

memory/1552-2825-0x00000000001D0000-0x0000000000681000-memory.dmp

Download

memory/1552-509-0x00000000001D0000-0x0000000000681000-memory.dmp

Download

memory/1552-510-0x00000000001D0000-0x0000000000681000-memory.dmp

Download

memory/1552-2838-0x00000000001D0000-0x0000000000681000-memory.dmp

Download

memory/1552-18-0x00000000001D0000-0x0000000000681000-memory.dmp

Download

memory/1552-2829-0x00000000001D0000-0x0000000000681000-memory.dmp

Download

memory/1552-2828-0x00000000001D0000-0x0000000000681000-memory.dmp

Download

memory/1552-2827-0x00000000001D0000-0x0000000000681000-memory.dmp

Download

memory/1552-491-0x00000000001D0000-0x0000000000681000-memory.dmp

Download

memory/1552-2826-0x00000000001D0000-0x0000000000681000-memory.dmp

Download

memory/1552-2824-0x00000000001D0000-0x0000000000681000-memory.dmp

Download

memory/1552-21-0x00000000001D0000-0x0000000000681000-memory.dmp

Download

memory/1552-477-0x00000000001D0000-0x0000000000681000-memory.dmp

Download

memory/1552-19-0x00000000001D0000-0x0000000000681000-memory.dmp

Download

memory/1552-1361-0x00000000001D0000-0x0000000000681000-memory.dmp

Download

memory/1552-2804-0x00000000001D0000-0x0000000000681000-memory.dmp

Download

memory/1552-2813-0x00000000001D0000-0x0000000000681000-memory.dmp

Download

memory/1552-2819-0x00000000001D0000-0x0000000000681000-memory.dmp

Download

memory/1552-20-0x00000000001D0000-0x0000000000681000-memory.dmp

Download

memory/3040-503-0x0000000000700000-0x0000000000BB1000-memory.dmp

Download

memory/3040-499-0x0000000000700000-0x0000000000BB1000-memory.dmp

Download

memory/4956-494-0x00000000009A0000-0x0000000000E51000-memory.dmp

Download

memory/4956-502-0x00000000009A0000-0x0000000000E51000-memory.dmp

Download

memory/5000-481-0x0000000000E10000-0x00000000019F0000-memory.dmp

Download

memory/5000-487-0x0000000000E10000-0x00000000019F0000-memory.dmp

Download

memory/5000-37-0x0000000000E10000-0x00000000019F0000-memory.dmp

Download

memory/5000-56-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Download

memory/5148-482-0x00000000001D0000-0x0000000000681000-memory.dmp

Download

memory/5148-501-0x00000000001D0000-0x0000000000681000-memory.dmp

Download