amadey | e3e446910bfa679023440ffc3b43ea6d6b8ca29846e9f87994ad914875c74bbc

Analysis

max time kernel
150s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20240709-en
resource tags

arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
submitted
13/07/2024, 14:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e3e446910bfa679023440ffc3b43ea6d6b8ca29846e9f87994ad914875c74bbc.exe
Size 1.8MB
Sample240713-r42easvdrp
SHA256 e3e446910bfa679023440ffc3b43ea6d6b8ca29846e9f87994ad914875c74bbc
MD5 3f20104f04361d3160093f6438fb30ff
SHA1 775a56adc6ae431d74a5efef395448199759fb9c
SHA512 bfab7bfc4871a44887ed97fbe6530dc4b38ee12daa71d808d997486c5da9dcde9d2728dfc8545d057ab9b3348fad191518c5fd580415c64409d137fb835d3145
SSDEEP 24576:4Ox9aSn7EmqRPfv7OZJuqdYiFWKcpAt175B9nFvQiVUFsSAY6L3YcdD:4Y8Sn1qRvCxYUGpGdLFvcsgc
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey stealc 4dd39d hate discovery evasion spyware stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.30

Botnet

4dd39d

http://77.91.77.82

Attributes

install_dir
ad40971b6b
install_file
explorti.exe
strings_key
a434973ad22def7137dbb5e059b7081e
url_paths
/Hun4Ko/index.php

rc4.plain

Extracted

Family

stealc

Botnet

hate

http://85.28.47.30

Attributes

url_path
/920475a59bac849d.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Stealc
Stealc is an infostealer written in C++.
stealer stealc

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	e3e446910bfa679023440ffc3b43ea6d6b8ca29846e9f87994ad914875c74bbc.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	CFIECBFIDG.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 12 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	e3e446910bfa679023440ffc3b43ea6d6b8ca29846e9f87994ad914875c74bbc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	e3e446910bfa679023440ffc3b43ea6d6b8ca29846e9f87994ad914875c74bbc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	CFIECBFIDG.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	CFIECBFIDG.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe

Executes dropped EXE 7 IoCs

pid	Process
540	explorti.exe
2364	9b7420f9d8.exe
3876	0607f0595c.exe
1788	CFIECBFIDG.exe
2384	explorti.exe
1548	explorti.exe
5160	explorti.exe

Identifies Wine through registry keys 2 TTPs 6 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-95457810-830748662-4054918673-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-95457810-830748662-4054918673-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-95457810-830748662-4054918673-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-95457810-830748662-4054918673-1000\Software\Wine	e3e446910bfa679023440ffc3b43ea6d6b8ca29846e9f87994ad914875c74bbc.exe
Key opened	\REGISTRY\USER\S-1-5-21-95457810-830748662-4054918673-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-95457810-830748662-4054918673-1000\Software\Wine	CFIECBFIDG.exe

Loads dropped DLL 2 IoCs

pid	Process
2364	9b7420f9d8.exe
2364	9b7420f9d8.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x000100000002aa53-42.dat	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs

pid	Process
1744	e3e446910bfa679023440ffc3b43ea6d6b8ca29846e9f87994ad914875c74bbc.exe
540	explorti.exe
2364	9b7420f9d8.exe
2364	9b7420f9d8.exe
1788	CFIECBFIDG.exe
2384	explorti.exe
1548	explorti.exe
5160	explorti.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\explorti.job	e3e446910bfa679023440ffc3b43ea6d6b8ca29846e9f87994ad914875c74bbc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	9b7420f9d8.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	9b7420f9d8.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-95457810-830748662-4054918673-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
1744	e3e446910bfa679023440ffc3b43ea6d6b8ca29846e9f87994ad914875c74bbc.exe
1744	e3e446910bfa679023440ffc3b43ea6d6b8ca29846e9f87994ad914875c74bbc.exe
540	explorti.exe
540	explorti.exe
2364	9b7420f9d8.exe
2364	9b7420f9d8.exe
2364	9b7420f9d8.exe
2364	9b7420f9d8.exe
1788	CFIECBFIDG.exe
1788	CFIECBFIDG.exe
2384	explorti.exe
2384	explorti.exe
1548	explorti.exe
1548	explorti.exe
5160	explorti.exe
5160	explorti.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3856	firefox.exe
Token: SeDebugPrivilege	3856	firefox.exe
Token: SeDebugPrivilege	3856	firefox.exe
Token: SeDebugPrivilege	3856	firefox.exe
Token: SeDebugPrivilege	3856	firefox.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3876	0607f0595c.exe
3876	0607f0595c.exe
3876	0607f0595c.exe
3876	0607f0595c.exe
3876	0607f0595c.exe
3876	0607f0595c.exe
3876	0607f0595c.exe
3856	firefox.exe
3856	firefox.exe
3856	firefox.exe
3856	firefox.exe
3856	firefox.exe
3856	firefox.exe
3856	firefox.exe
3856	firefox.exe
3856	firefox.exe
3856	firefox.exe
3856	firefox.exe
3856	firefox.exe
3856	firefox.exe
3856	firefox.exe
3856	firefox.exe
3856	firefox.exe
3856	firefox.exe
3856	firefox.exe
3856	firefox.exe
3856	firefox.exe
3856	firefox.exe
3876	0607f0595c.exe
3876	0607f0595c.exe
3876	0607f0595c.exe
3876	0607f0595c.exe
3876	0607f0595c.exe
3876	0607f0595c.exe
3876	0607f0595c.exe
3876	0607f0595c.exe
3876	0607f0595c.exe
3876	0607f0595c.exe
3876	0607f0595c.exe
3876	0607f0595c.exe
3876	0607f0595c.exe
3876	0607f0595c.exe
3876	0607f0595c.exe
3876	0607f0595c.exe
3876	0607f0595c.exe
3876	0607f0595c.exe
3876	0607f0595c.exe
3876	0607f0595c.exe
3876	0607f0595c.exe
3876	0607f0595c.exe
3876	0607f0595c.exe
3876	0607f0595c.exe
3876	0607f0595c.exe
3876	0607f0595c.exe
3876	0607f0595c.exe
3876	0607f0595c.exe
3876	0607f0595c.exe
3876	0607f0595c.exe
3876	0607f0595c.exe
3876	0607f0595c.exe
3876	0607f0595c.exe
3876	0607f0595c.exe
3876	0607f0595c.exe
3876	0607f0595c.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3876	0607f0595c.exe
3876	0607f0595c.exe
3876	0607f0595c.exe
3876	0607f0595c.exe
3876	0607f0595c.exe
3876	0607f0595c.exe
3876	0607f0595c.exe
3876	0607f0595c.exe
3876	0607f0595c.exe
3876	0607f0595c.exe
3876	0607f0595c.exe
3876	0607f0595c.exe
3876	0607f0595c.exe
3876	0607f0595c.exe
3876	0607f0595c.exe
3876	0607f0595c.exe
3876	0607f0595c.exe
3876	0607f0595c.exe
3876	0607f0595c.exe
3876	0607f0595c.exe
3876	0607f0595c.exe
3876	0607f0595c.exe
3876	0607f0595c.exe
3876	0607f0595c.exe
3876	0607f0595c.exe
3876	0607f0595c.exe
3876	0607f0595c.exe
3876	0607f0595c.exe
3876	0607f0595c.exe
3876	0607f0595c.exe
3876	0607f0595c.exe
3876	0607f0595c.exe
3876	0607f0595c.exe
3876	0607f0595c.exe
3876	0607f0595c.exe
3876	0607f0595c.exe
3876	0607f0595c.exe
3876	0607f0595c.exe
3876	0607f0595c.exe
3876	0607f0595c.exe
3876	0607f0595c.exe
3876	0607f0595c.exe
3876	0607f0595c.exe
3876	0607f0595c.exe
3876	0607f0595c.exe
3876	0607f0595c.exe
3876	0607f0595c.exe
3876	0607f0595c.exe
3876	0607f0595c.exe
3876	0607f0595c.exe
3876	0607f0595c.exe
3876	0607f0595c.exe
3876	0607f0595c.exe
3876	0607f0595c.exe
3876	0607f0595c.exe
3876	0607f0595c.exe
3876	0607f0595c.exe
3876	0607f0595c.exe
3876	0607f0595c.exe
3876	0607f0595c.exe
3876	0607f0595c.exe
3876	0607f0595c.exe
3876	0607f0595c.exe
3876	0607f0595c.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2364	9b7420f9d8.exe
3856	firefox.exe
5068	cmd.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1744 wrote to memory of 540	1744	e3e446910bfa679023440ffc3b43ea6d6b8ca29846e9f87994ad914875c74bbc.exe	79
PID 1744 wrote to memory of 540	1744	e3e446910bfa679023440ffc3b43ea6d6b8ca29846e9f87994ad914875c74bbc.exe	79
PID 1744 wrote to memory of 540	1744	e3e446910bfa679023440ffc3b43ea6d6b8ca29846e9f87994ad914875c74bbc.exe	79
PID 540 wrote to memory of 2364	540	explorti.exe	80
PID 540 wrote to memory of 2364	540	explorti.exe	80
PID 540 wrote to memory of 2364	540	explorti.exe	80
PID 540 wrote to memory of 3876	540	explorti.exe	81
PID 540 wrote to memory of 3876	540	explorti.exe	81
PID 540 wrote to memory of 3876	540	explorti.exe	81
PID 3876 wrote to memory of 3436	3876	0607f0595c.exe	82
PID 3876 wrote to memory of 3436	3876	0607f0595c.exe	82
PID 3436 wrote to memory of 3856	3436	firefox.exe	85
PID 3436 wrote to memory of 3856	3436	firefox.exe	85
PID 3436 wrote to memory of 3856	3436	firefox.exe	85
PID 3436 wrote to memory of 3856	3436	firefox.exe	85
PID 3436 wrote to memory of 3856	3436	firefox.exe	85
PID 3436 wrote to memory of 3856	3436	firefox.exe	85
PID 3436 wrote to memory of 3856	3436	firefox.exe	85
PID 3436 wrote to memory of 3856	3436	firefox.exe	85
PID 3436 wrote to memory of 3856	3436	firefox.exe	85
PID 3436 wrote to memory of 3856	3436	firefox.exe	85
PID 3436 wrote to memory of 3856	3436	firefox.exe	85
PID 3856 wrote to memory of 2868	3856	firefox.exe	86
PID 3856 wrote to memory of 2868	3856	firefox.exe	86
PID 3856 wrote to memory of 2868	3856	firefox.exe	86
PID 3856 wrote to memory of 2868	3856	firefox.exe	86
PID 3856 wrote to memory of 2868	3856	firefox.exe	86
PID 3856 wrote to memory of 2868	3856	firefox.exe	86
PID 3856 wrote to memory of 2868	3856	firefox.exe	86
PID 3856 wrote to memory of 2868	3856	firefox.exe	86
PID 3856 wrote to memory of 2868	3856	firefox.exe	86
PID 3856 wrote to memory of 2868	3856	firefox.exe	86
PID 3856 wrote to memory of 2868	3856	firefox.exe	86
PID 3856 wrote to memory of 2868	3856	firefox.exe	86
PID 3856 wrote to memory of 2868	3856	firefox.exe	86
PID 3856 wrote to memory of 2868	3856	firefox.exe	86
PID 3856 wrote to memory of 2868	3856	firefox.exe	86
PID 3856 wrote to memory of 2868	3856	firefox.exe	86
PID 3856 wrote to memory of 2868	3856	firefox.exe	86
PID 3856 wrote to memory of 2868	3856	firefox.exe	86
PID 3856 wrote to memory of 2868	3856	firefox.exe	86
PID 3856 wrote to memory of 2868	3856	firefox.exe	86
PID 3856 wrote to memory of 2868	3856	firefox.exe	86
PID 3856 wrote to memory of 2868	3856	firefox.exe	86
PID 3856 wrote to memory of 2868	3856	firefox.exe	86
PID 3856 wrote to memory of 2868	3856	firefox.exe	86
PID 3856 wrote to memory of 2868	3856	firefox.exe	86
PID 3856 wrote to memory of 2868	3856	firefox.exe	86
PID 3856 wrote to memory of 2868	3856	firefox.exe	86
PID 3856 wrote to memory of 2868	3856	firefox.exe	86
PID 3856 wrote to memory of 2868	3856	firefox.exe	86
PID 3856 wrote to memory of 2868	3856	firefox.exe	86
PID 3856 wrote to memory of 2868	3856	firefox.exe	86
PID 3856 wrote to memory of 2868	3856	firefox.exe	86
PID 3856 wrote to memory of 2868	3856	firefox.exe	86
PID 3856 wrote to memory of 2868	3856	firefox.exe	86
PID 3856 wrote to memory of 2868	3856	firefox.exe	86
PID 3856 wrote to memory of 2868	3856	firefox.exe	86
PID 3856 wrote to memory of 2868	3856	firefox.exe	86
PID 3856 wrote to memory of 2868	3856	firefox.exe	86
PID 3856 wrote to memory of 2868	3856	firefox.exe	86
PID 3856 wrote to memory of 2868	3856	firefox.exe	86
PID 3856 wrote to memory of 2868	3856	firefox.exe	86
PID 3856 wrote to memory of 2868	3856	firefox.exe	86

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\e3e446910bfa679023440ffc3b43ea6d6b8ca29846e9f87994ad914875c74bbc.exe
"C:\Users\Admin\AppData\Local\Temp\e3e446910bfa679023440ffc3b43ea6d6b8ca29846e9f87994ad914875c74bbc.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1744
- C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
  "C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:540
- - C:\Users\Admin\AppData\Local\Temp\1000006001\9b7420f9d8.exe
    "C:\Users\Admin\AppData\Local\Temp\1000006001\9b7420f9d8.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:2364
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\CFIECBFIDG.exe"
      4⤵
      PID:424
    - - C:\Users\Admin\AppData\Local\Temp\CFIECBFIDG.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CFIECBFIDG.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        
        PID:1788
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\BKJEHCAKFB.exe"
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:5068
- - C:\Users\Admin\AppData\Local\Temp\1000011001\0607f0595c.exe
    "C:\Users\Admin\AppData\Local\Temp\1000011001\0607f0595c.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:3876
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3436
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
        5⤵
        Checks processor information in registry
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3856
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1956 -parentBuildID 20240401114208 -prefsHandle 1872 -prefMapHandle 1864 -prefsLen 25757 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {83c667f0-b759-42ef-b43a-0141f410f441} 3856 "\\.\pipe\gecko-crash-server-pipe.3856" gpu
        6⤵
        
        PID:2868
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2368 -parentBuildID 20240401114208 -prefsHandle 2360 -prefMapHandle 2356 -prefsLen 26677 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {471206aa-c4df-435e-9074-dccbacd2e0a3} 3856 "\\.\pipe\gecko-crash-server-pipe.3856" socket
        6⤵
        
        PID:1568
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3160 -childID 1 -isForBrowser -prefsHandle 3080 -prefMapHandle 3204 -prefsLen 22698 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c4b0c37e-dadf-41cc-9f13-52af4fa25559} 3856 "\\.\pipe\gecko-crash-server-pipe.3856" tab
        6⤵
        
        PID:2004
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3860 -childID 2 -isForBrowser -prefsHandle 3852 -prefMapHandle 3848 -prefsLen 31167 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {85078f26-29ab-49cf-b39b-08e6be1965b6} 3856 "\\.\pipe\gecko-crash-server-pipe.3856" tab
        6⤵
        
        PID:1068
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4516 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4644 -prefMapHandle 4524 -prefsLen 31167 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {25f46450-d890-4dfb-a028-d8258cf6a97e} 3856 "\\.\pipe\gecko-crash-server-pipe.3856" utility
        6⤵
        Checks processor information in registry
        
        PID:4216
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5636 -childID 3 -isForBrowser -prefsHandle 5596 -prefMapHandle 5608 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b95db26c-1b8e-4c7a-9d9e-910182bc1614} 3856 "\\.\pipe\gecko-crash-server-pipe.3856" tab
        6⤵
        
        PID:5968
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5780 -childID 4 -isForBrowser -prefsHandle 5860 -prefMapHandle 5856 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6fdba5d1-9a11-47a8-9377-c835b95a0fb7} 3856 "\\.\pipe\gecko-crash-server-pipe.3856" tab
        6⤵
        
        PID:5980
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6056 -childID 5 -isForBrowser -prefsHandle 6064 -prefMapHandle 6008 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4fa7cda2-4dd6-4b2d-be3b-826e33c4a025} 3856 "\\.\pipe\gecko-crash-server-pipe.3856" tab
        6⤵
        
        PID:6012

C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2384

C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1548

C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mozglue.dll

Path C:\ProgramData\mozglue.dll
Size 593KB
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
SSDEEP 12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5 SHA1 SHA512 SSDEEP

Submit Download

nss3.dll

Path C:\ProgramData\nss3.dll
Size 2.0MB
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
SSDEEP 49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5 SHA1 SHA512 SSDEEP

Submit Download

activity-stream.discovery_stream.json.tmp

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\q0xshw2k.default-release\activity-stream.discovery_stream.json.tmp
Size 18KB
SHA256 23a0b1e83de46d4675274b37a31d7e13a1f6b580586d0a9298be271c113ef922
MD5 de2db5a4fa74b1a500bfb9ffb3f81528
SHA1 713a350cc4ed31c355c8100808ee064a695723ff
SHA512 87d01203cacee424f44f081c7446f512776f19604e8bf12f15f7c0f46b36a858973d4565e98fe3ae99495429d61ae046f56eb88511cadd526ba34914cccfe281
SSDEEP 384:F+lmece71CbWI/IbzzofiWiD412AbK5gloZ6Vct89yLUyaE:FCP1CbHnqW11rY7UyUyp
MD5 SHA1 SHA512 SSDEEP

Submit Download

5CD1EBDF6B57F13C7E783CE5E6D8E9C44014FE1A

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\q0xshw2k.default-release\cache2\entries\5CD1EBDF6B57F13C7E783CE5E6D8E9C44014FE1A
Size 13KB
SHA256 070730cb6071a8677323c214e16c281fd369c950502bb62a3ba44b0dbdc39d95
MD5 15d48b1f70ba17564e637ea0a6617a55
SHA1 880b375e6aea3b966c1f4074befc2c59eba0d7b7
SHA512 7a4c468fd271b44e8d6272d2da419ba61615ecff260fe06b6e835f477feedf91e1ad0d6fd783f6bf1de83954179e05137058af35f2dfdb261026b3fe20ac02cd
SSDEEP 384:HunTu9fiGLm4pUlft2WlOX8lPLZZB7t0lpDIIQFfFk:dBi8mCUlft2WAX8tzB7eD8w
MD5 SHA1 SHA512 SSDEEP

Submit Download

8A2034D325DC0B5C9E11EDDA3FC70A54C8DC1C0D

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\q0xshw2k.default-release\cache2\entries\8A2034D325DC0B5C9E11EDDA3FC70A54C8DC1C0D
Size 13KB
SHA256 5789d2490c0804b929d65455254aca72c985decf4b8d72ee88271006f926ad88
MD5 e38940ba70dc5bb5c3ca9c34243949ae
SHA1 a4278a57ef74a319ffc9d821fd6448c166a6b870
SHA512 7538be69a236377cf63866c89dd84cb49b6c276e3178e396783fedba89ff978fa631dc254c3d9664498c722cfd13a0a5d7cea4528082589a1e00ae3d9f4af76d
SSDEEP 384:H485u9fiGLm4pUOft2WlOX8lPLZZB7t0lpDIItrcrP:nUBi8mCUOft2WAX8tzB7eD82Yb
MD5 SHA1 SHA512 SSDEEP

Submit Download

9b7420f9d8.exe

Path C:\Users\Admin\AppData\Local\Temp\1000006001\9b7420f9d8.exe
Size 2.4MB
SHA256 73aa846fc6566e449ad9c89f487f74c7c51dea5c003f8a9010cc1b9b49248789
MD5 98d75ac516c8422010860028f45fe6d7
SHA1 2e70fd8c3f8ed1cdeeb754c8bc005b66971208ce
SHA512 21f0bd0a73376d70147d4bf186fb8ca3ddc731aff01613c120bc17ac33266a4861e9e9344252f87a5c6376c66dd5e3f7b4a5906bdcb5f7d3150ad0d969badbea
SSDEEP 49152:lAz1nDsYWmekVo7fwXRq02Xv835G/8cxGGSgklYcZqXpPDM8:eqYtVycBq0yklykPZwDh
MD5 SHA1 SHA512 SSDEEP

Submit Download

0607f0595c.exe

Path C:\Users\Admin\AppData\Local\Temp\1000011001\0607f0595c.exe
Size 1.2MB
SHA256 0d304553b9c5839ab50e7861321678a51c3a04497fd7928681e59eac50afdb5a
MD5 62253718a2f24caa6dbe6cf07145a6e1
SHA1 e3f424d31a79a2a70d92b394b93557f104ef0ca6
SHA512 f13ac056cb944cd850b43db4e26fbda8e398a3bc9808041ab261ba2464b79e5f59bd88a4875cc1e41a550bfe1fcf61a845e722d92987f5fbf64310e7fef30613
SSDEEP 24576:hqDEvCTbMWu7rQYlBQcBiT6rprG8aLL2Sbly7TWEPje:hTvC/MTQYxsWR7aLL2dW
MD5 SHA1 SHA512 SSDEEP

Submit Download

explorti.exe

Path C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
Size 1.8MB
SHA256 e3e446910bfa679023440ffc3b43ea6d6b8ca29846e9f87994ad914875c74bbc
MD5 3f20104f04361d3160093f6438fb30ff
SHA1 775a56adc6ae431d74a5efef395448199759fb9c
SHA512 bfab7bfc4871a44887ed97fbe6530dc4b38ee12daa71d808d997486c5da9dcde9d2728dfc8545d057ab9b3348fad191518c5fd580415c64409d137fb835d3145
SSDEEP 24576:4Ox9aSn7EmqRPfv7OZJuqdYiFWKcpAt175B9nFvQiVUFsSAY6L3YcdD:4Y8Sn1qRvCxYUGpGdLFvcsgc
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 479KB
SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
MD5 09372174e83dbbf696ee732fd2e875bb
SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 13.8MB
SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
MD5 0a8747a2ac9ac08ae9508f36c6d75692
SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q0xshw2k.default-release\AlternateServices.bin
Size 11KB
SHA256 42681e43730725bb647686fd039249b1e24fb69869ecc87bf43f23f853752872
MD5 0adb2139a17369105224f00332e9d092
SHA1 43deb11a64e91699ec5244235dad6b8210a39790
SHA512 875cab0a8778d666b8ee5b2050b49ba4ccf52b4179634b0ac8f057a57359a398e45b1ca0c16b92faacd8c4c591f31644c86a18cd253c2d919b59baf23585ce40
SSDEEP 96:u0Kz5omzXdebOJDbRpebvpf+Db5bNb4gbgzab:n85du
MD5 SHA1 SHA512 SSDEEP

Submit Download

cookies.sqlite-wal

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q0xshw2k.default-release\cookies.sqlite-wal
Size 192KB
SHA256 406d68e630c2373460d8273d80b6103aa1a22985dcef88f044dfb8639cfb8eca
MD5 bdc544fb90149b5e22dd2737a4b4b6ba
SHA1 8b3010121eacdd071e1a1b6bccbad365c82991d2
SHA512 03af10698b428c54e33054e5d6b43e29d8de9617da9550615037a5cde90059b28875e8d660e30e3f0ae6890beea302a7f670de4879c2fb794134a4d817295c52
SSDEEP 48:4AG6cmp21ZlGP+AWo8321ZlGEVo5oGUh+G:4L6Jp21ZUP+Y8321ZUEVoKGUh+G
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q0xshw2k.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 3001712504562b4cdb2dea8f336f7056415c5e33852821cd61fc2acfbb512cd5
MD5 2bd5590a4a7578473ffe3d327ce88701
SHA1 47952b75aa889b046d1315a4374b17c2017c8d94
SHA512 8dd0085af17afe8338da690c99ed64002dcdd10cd980c9663ebf4395f9b04d4ad51010121c8d2970a951bc67bc8a8e1db3d405a358dd29c2771011596e7d363b
SSDEEP 192:drvZboHjhopPDfBPAo/66Joz0dzgCl6mSS:nboDgP1Ao/66JozQzgC1b
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q0xshw2k.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 b3505610ae7d108e2a2ff2bf905893fd8d945834e00d5c6d49ab2d02ef10ffbd
MD5 62a9f2cc5e0a62280de412f1023a35d5
SHA1 955cd13d4a4af877e6a71b36d3084adaf4fc9e2d
SHA512 8790efff817dd8b41433947e7853e89d3f931e045eec4bb2987a36923acf305725bd8c18c8e0ccf40e68f8c29fbb4470796e6ca960fbf2627faeffc0a9d717f0
SSDEEP 96:qBWSMF9ZbkW6QX0BBjhmd1PP/PrWZRPUPsvzEUFl66Joz0dzgClKtmSSM:HrvZboHjhopPCbPAo/66Joz0dzgCl6mI
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q0xshw2k.default-release\datareporting\glean\db\data.safe.tmp
Size 16KB
SHA256 159e03179047b65e7443b30fb8e727c0bd79cbc15106a2950dcb1f95eca44d9c
MD5 64f337d786b851402d23d4f3fdf69379
SHA1 a3830b35fface0fbe9457eb92945dc7d41dc21d3
SHA512 db44ded1bfdb23122208ddc9766e13ca14094c42e3cba29f7042bebbea7ac0fd3008baf03a97534ab9dd32feef40f734df599493c92be9fb9a2d067ae46ba76e
SSDEEP 384:PGMVa2LuKr+zDtlSwb5bnIAo/66JozQzgC1b/boD7eyP2:+MVaBmKDtlSwb5bnHVmBUO
MD5 SHA1 SHA512 SSDEEP

Submit Download

0c7f192e-bfef-46c8-9ea6-ed3579387300

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q0xshw2k.default-release\datareporting\glean\pending_pings\0c7f192e-bfef-46c8-9ea6-ed3579387300
Size 982B
SHA256 5f8a0a5b386806a57fe157cbe40971540cad66a2946a70ebf346ec1905de7cb9
MD5 0957ed4b38b5d6d4986eab399e3fa011
SHA1 3456b6d1d3735ef651c5200f090e573243470a9f
SHA512 8b052f629482e0227144936852fdcaf7001d475d9fe779282a3022f96de6242bb7db04295e0fee30123f2e5a62058988db3b56b1caaa5617f38cdc8c9db6568e
MD5 SHA1 SHA512

Submit Download

6b514c74-e2b7-4f0c-9f7a-a644d28d188f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q0xshw2k.default-release\datareporting\glean\pending_pings\6b514c74-e2b7-4f0c-9f7a-a644d28d188f
Size 671B
SHA256 21266808f93c9e37dc6bfbebd35439ca0ab9daac778f5777b6047819cdbe5fec
MD5 d4384314237fec1b9081e35bc55d80f9
SHA1 d0b27c69f0e09c5885c29c50ea58a3f5a145eb5e
SHA512 ad8d7b20c9427c7e89dda4a87a7e92396ffb361733f218e6ae39fd95491667a4ae4bf3d08da40e2a8b974c49ce315cbb0bd73bdbf75f88cd572f3376a56fb0ae
MD5 SHA1 SHA512

Submit Download

7cada7c2-7009-4619-a005-8bbec3b05e26

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q0xshw2k.default-release\datareporting\glean\pending_pings\7cada7c2-7009-4619-a005-8bbec3b05e26
Size 27KB
SHA256 a235e4c1e13e3051e4e37ebce4d329bc67f4ff7b184f20c19a706e01596ff33a
MD5 559f99c8f89ce94fe912528d1c3df0d2
SHA1 b6418642b970f092c6b6ad61a129450146980468
SHA512 e603370d8f57bec009eb2d9e214fb97e75719d40c5e2a2d29810d788c3c3de023a92f68efeb29375334f0bc5a73858cb7bcc354ef923a8edf60f05e5d1e8e238
SSDEEP 192:EhFORjPBSlbKsz3uvpBEM2HUZGJQZpmLbDPk6JBnVQh0CXEjy/+qsXeswuSCDNB3:Eh4RFSlbKsjfkwTfkMgn3AkQ/gBg
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q0xshw2k.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Size 1.1MB
SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
MD5 842039753bf41fa5e11b3a1383061a87
SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q0xshw2k.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Size 116B
SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
MD5 2a461e9eb87fd1955cea740a3444ee7a
SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q0xshw2k.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Size 372B
SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
MD5 bf957ad58b55f64219ab3f793e374316
SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q0xshw2k.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Size 17.8MB
SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
MD5 daf7ef3acccab478aaa7d6dc1c60f865
SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
MD5 SHA1 SHA512 SSDEEP

Submit Download

places.sqlite-wal

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q0xshw2k.default-release\places.sqlite-wal
Size 992KB
SHA256 c516cbb75c4ebed9d8d72c4d6fa8994386749802456ce8bd271a23e4f20cc9cd
MD5 222841a2120f99a806c025bea3ebbcfe
SHA1 75422dc5df0887eca247f7906d56c008825d75a7
SHA512 c1b7199f3d9f4fabcf5cdb68b535162ccab9574e0dcf5b92dc36e94272caa36cd59edd76cb4176ca95a6a8b7cd67974c66b5dddcf606268d919aa6fbea4df97f
SSDEEP 192:FrUpcbALqLQgx/PUpXhKuYZKYiex/xSUpv:FrUcW/gdUYuKNKUv
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q0xshw2k.default-release\prefs-1.js
Size 12KB
SHA256 af685ccebf3a526414600c48996dfbcf3d922ddbf70cd9278fae2934e37dc320
MD5 41f269f131f7b4421a3d95d277d93a55
SHA1 8f24ae513107752b93ec0f18f2631c7e91cc864e
SHA512 5ec93eb234ad6d4987696d651104077dfdce0bcb3fac2554f837496d8b5b36a50ee2844cfa57ee9e8eb42241b76f9a64efc263fa0c17b19c573e9a267d2c515f
SSDEEP 192:J5npRvfhEI8fO+8MYZd38NAJLcdGpY7dr+1I0y60OKaX0n/Ja2nUBw8HFZq:fBEE0F4cyE/9aw44
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q0xshw2k.default-release\prefs-1.js
Size 16KB
SHA256 b095e6079bc368a7e18dfe1b324c30f1cc9e602a779d61d91e70a77ae1a93628
MD5 5cb49d410d743a3e77a58d088d12dd9a
SHA1 a6565ee23d3bd72723e2020c86442fd735db23d2
SHA512 19e73426fe383672f90a6b07857bf10289546a3025fac7984ea301244518c46e302128d646f8e6a4e8526f78c5bd210102f1cc5ca554f034627752aae31d2362
SSDEEP 192:JqnpRvf10I8fO+8MYZd38NAJLcdGpY7dr+1I0y60OKaX0J+/Ja2nEiBw8HF74DPE:yREE0F4cyp/9Xw4G8
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q0xshw2k.default-release\prefs.js
Size 11KB
SHA256 e25ef5f78e718fbea98c81b636da9c4c9b8cd2666a7c09c79c5ffddb926c4c21
MD5 d135b1bb585da25e530972ce8110d1a5
SHA1 ef419e55a9cb2f962d9a5b206a1b538ba8e14903
SHA512 28ff17e49fa4a32ee07c66f112ca968e8ebb9babe59aabfe2ca7fa3e07d5c851206787265c37ef8b1626a531145123b1da0f517036b255c3748b7d089e3805e5
SSDEEP 192:e5npRvfhEI8fO+8MYZd38NAJLcdGpY7dr+1I0y60OKaX0n/Ja2nOBw8HK:0BEE0F4cyE/9sw3
MD5 SHA1 SHA512 SSDEEP

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q0xshw2k.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 1.5MB
SHA256 41ad0757c352d2e2e51255d97d605576489de6ed7126096b98b4b2f143c1ef08
MD5 a567c78f10c1ba439f45b2b1ddf37148
SHA1 4c79e45943abf34f77c1effbf3ede8a26f477b16
SHA512 c616366997e860df11d0362050dd088f5be7cee762e185b48395803dc61f75461383753919bcf9a6e234755170c744cd9b6ab1de29a1d17ba771c00ddbb20a69
SSDEEP 6144:J0A5M23ZNN1H+i5hG1+EM9UsUUFyGUcy0q6aURcg3r3K393z3m3ZLSmm0vT522oN:P8oG+EM21Y0z0f9KIToPJz/x0rbX2aeD
MD5 SHA1 SHA512 SSDEEP

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q0xshw2k.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 2.2MB
SHA256 77b91c391d572fc217b3b30685ad8b476382126d10c029617838c7abdab5cb07
MD5 d8a9e5d37612d7eda557b6994ffb8fe1
SHA1 ece6099ba158aeb0376c25e9e585a042408bdb71
SHA512 6b5ad1feb4b323c498b46dbfe708818e4cf14c1b0698068f553f08363f709bd63dd73044e7c8fa5cfbb0df8f5a586cbbaf8a6d0cb50a1268e9072256ba99eb7f
SSDEEP 12288:0RzFe22130LZjRSnYToPJz/t0rbX2Se+H/hM5lyO8vL3t:0RzzIwzaNLt0rCSempCIO8vR
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/540-498-0x00000000003C0000-0x0000000000881000-memory.dmp

Download

memory/540-2649-0x00000000003C0000-0x0000000000881000-memory.dmp

Download

memory/540-2652-0x00000000003C0000-0x0000000000881000-memory.dmp

Download

memory/540-2651-0x00000000003C0000-0x0000000000881000-memory.dmp

Download

memory/540-2650-0x00000000003C0000-0x0000000000881000-memory.dmp

Download

memory/540-488-0x00000000003C0000-0x0000000000881000-memory.dmp

Download

memory/540-497-0x00000000003C0000-0x0000000000881000-memory.dmp

Download

memory/540-2662-0x00000000003C0000-0x0000000000881000-memory.dmp

Download

memory/540-503-0x00000000003C0000-0x0000000000881000-memory.dmp

Download

memory/540-2653-0x00000000003C0000-0x0000000000881000-memory.dmp

Download

memory/540-21-0x00000000003C0000-0x0000000000881000-memory.dmp

Download

memory/540-20-0x00000000003C0000-0x0000000000881000-memory.dmp

Download

memory/540-19-0x00000000003C1000-0x00000000003EF000-memory.dmp

Download

memory/540-18-0x00000000003C0000-0x0000000000881000-memory.dmp

Download

memory/540-2648-0x00000000003C0000-0x0000000000881000-memory.dmp

Download

memory/540-2643-0x00000000003C0000-0x0000000000881000-memory.dmp

Download

memory/540-467-0x00000000003C0000-0x0000000000881000-memory.dmp

Download

memory/540-2637-0x00000000003C0000-0x0000000000881000-memory.dmp

Download

memory/540-2580-0x00000000003C0000-0x0000000000881000-memory.dmp

Download

memory/540-1022-0x00000000003C0000-0x0000000000881000-memory.dmp

Download

memory/1548-2647-0x00000000003C0000-0x0000000000881000-memory.dmp

Download

memory/1548-2646-0x00000000003C0000-0x0000000000881000-memory.dmp

Download

memory/1744-16-0x0000000000B00000-0x0000000000FC1000-memory.dmp

Download

memory/1744-1-0x0000000077206000-0x0000000077208000-memory.dmp

Download

memory/1744-2-0x0000000000B01000-0x0000000000B2F000-memory.dmp

Download

memory/1744-3-0x0000000000B00000-0x0000000000FC1000-memory.dmp

Download

memory/1744-5-0x0000000000B00000-0x0000000000FC1000-memory.dmp

Download

memory/1744-0-0x0000000000B00000-0x0000000000FC1000-memory.dmp

Download

memory/1788-478-0x0000000000820000-0x0000000000CE1000-memory.dmp

Download

memory/1788-484-0x0000000000820000-0x0000000000CE1000-memory.dmp

Download

memory/2364-37-0x0000000000980000-0x0000000001562000-memory.dmp

Download

memory/2364-56-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Download

memory/2364-474-0x0000000000980000-0x0000000001562000-memory.dmp

Download

memory/2384-487-0x00000000003C0000-0x0000000000881000-memory.dmp

Download

memory/2384-486-0x00000000003C0000-0x0000000000881000-memory.dmp

Download

memory/5160-2660-0x00000000003C0000-0x0000000000881000-memory.dmp

Download

memory/5160-2661-0x00000000003C0000-0x0000000000881000-memory.dmp

Download