amadey | 4d0cd9986b51ab2d0d0b6e972dfa7ccafb7a27ede7da5f1c4152b18ce3471758

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20240709-en
resource tags

arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
submitted
15/07/2024, 23:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4d0cd9986b51ab2d0d0b6e972dfa7ccafb7a27ede7da5f1c4152b18ce3471758.exe
Size 1.8MB
Sample240715-2zwclawejb
SHA256 4d0cd9986b51ab2d0d0b6e972dfa7ccafb7a27ede7da5f1c4152b18ce3471758
MD5 fd05c5c1e3bb5a6a99c161330938ecc4
SHA1 77461ed8923f52b470606174f700e691efb4a524
SHA512 d766d17fc954461971766ac9794ce8a0ff15485ffe3fc0fa0afa2baa01d3411f682bf73c16185bca9d0c31fa19aad577f20b43f8a8b6bc3689cc034ddc69d7c5
SSDEEP 49152:dhKj2d4paLqh8hUFKmJZYM3jLnvY+npDxSlmJelk8R:dsj2ipnKcZFj7NB8R
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey stealc 4dd39d funny discovery evasion spyware stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.30

Botnet

4dd39d

http://77.91.77.82

Attributes

install_dir
ad40971b6b
install_file
explorti.exe
strings_key
a434973ad22def7137dbb5e059b7081e
url_paths
/Hun4Ko/index.php

rc4.plain

Extracted

Family

stealc

Botnet

funny

http://85.28.47.30

Attributes

url_path
/920475a59bac849d.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Stealc
Stealc is an infostealer written in C++.
stealer stealc

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	4d0cd9986b51ab2d0d0b6e972dfa7ccafb7a27ede7da5f1c4152b18ce3471758.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	FBKECFIIEH.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 12 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	4d0cd9986b51ab2d0d0b6e972dfa7ccafb7a27ede7da5f1c4152b18ce3471758.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	FBKECFIIEH.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	4d0cd9986b51ab2d0d0b6e972dfa7ccafb7a27ede7da5f1c4152b18ce3471758.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	FBKECFIIEH.exe

Executes dropped EXE 7 IoCs

pid	Process
2924	explorti.exe
3680	8ad6a37b8e.exe
1400	3dc406301e.exe
3468	explorti.exe
3100	FBKECFIIEH.exe
3256	explorti.exe
3644	explorti.exe

Identifies Wine through registry keys 2 TTPs 6 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-95457810-830748662-4054918673-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-95457810-830748662-4054918673-1000\Software\Wine	FBKECFIIEH.exe
Key opened	\REGISTRY\USER\S-1-5-21-95457810-830748662-4054918673-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-95457810-830748662-4054918673-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-95457810-830748662-4054918673-1000\Software\Wine	4d0cd9986b51ab2d0d0b6e972dfa7ccafb7a27ede7da5f1c4152b18ce3471758.exe
Key opened	\REGISTRY\USER\S-1-5-21-95457810-830748662-4054918673-1000\Software\Wine	explorti.exe

Loads dropped DLL 2 IoCs

pid	Process
3680	8ad6a37b8e.exe
3680	8ad6a37b8e.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x000100000002aa59-42.dat	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs

pid	Process
1120	4d0cd9986b51ab2d0d0b6e972dfa7ccafb7a27ede7da5f1c4152b18ce3471758.exe
2924	explorti.exe
3680	8ad6a37b8e.exe
3468	explorti.exe
3680	8ad6a37b8e.exe
3680	8ad6a37b8e.exe
3100	FBKECFIIEH.exe
3256	explorti.exe
3644	explorti.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\explorti.job	4d0cd9986b51ab2d0d0b6e972dfa7ccafb7a27ede7da5f1c4152b18ce3471758.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	8ad6a37b8e.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	8ad6a37b8e.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-95457810-830748662-4054918673-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
1120	4d0cd9986b51ab2d0d0b6e972dfa7ccafb7a27ede7da5f1c4152b18ce3471758.exe
1120	4d0cd9986b51ab2d0d0b6e972dfa7ccafb7a27ede7da5f1c4152b18ce3471758.exe
2924	explorti.exe
2924	explorti.exe
3680	8ad6a37b8e.exe
3680	8ad6a37b8e.exe
3468	explorti.exe
3468	explorti.exe
3680	8ad6a37b8e.exe
3680	8ad6a37b8e.exe
3100	FBKECFIIEH.exe
3100	FBKECFIIEH.exe
3256	explorti.exe
3256	explorti.exe
3644	explorti.exe
3644	explorti.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	492	firefox.exe
Token: SeDebugPrivilege	492	firefox.exe
Token: SeDebugPrivilege	492	firefox.exe
Token: SeDebugPrivilege	492	firefox.exe
Token: SeDebugPrivilege	492	firefox.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1120	4d0cd9986b51ab2d0d0b6e972dfa7ccafb7a27ede7da5f1c4152b18ce3471758.exe
1400	3dc406301e.exe
1400	3dc406301e.exe
1400	3dc406301e.exe
1400	3dc406301e.exe
1400	3dc406301e.exe
1400	3dc406301e.exe
1400	3dc406301e.exe
492	firefox.exe
492	firefox.exe
492	firefox.exe
492	firefox.exe
492	firefox.exe
492	firefox.exe
492	firefox.exe
492	firefox.exe
492	firefox.exe
492	firefox.exe
492	firefox.exe
492	firefox.exe
492	firefox.exe
492	firefox.exe
492	firefox.exe
492	firefox.exe
492	firefox.exe
492	firefox.exe
492	firefox.exe
492	firefox.exe
492	firefox.exe
1400	3dc406301e.exe
1400	3dc406301e.exe
1400	3dc406301e.exe
1400	3dc406301e.exe
1400	3dc406301e.exe
1400	3dc406301e.exe
1400	3dc406301e.exe
1400	3dc406301e.exe
1400	3dc406301e.exe
1400	3dc406301e.exe
1400	3dc406301e.exe
1400	3dc406301e.exe
1400	3dc406301e.exe
1400	3dc406301e.exe
1400	3dc406301e.exe
1400	3dc406301e.exe
1400	3dc406301e.exe
1400	3dc406301e.exe
1400	3dc406301e.exe
1400	3dc406301e.exe
1400	3dc406301e.exe
1400	3dc406301e.exe
1400	3dc406301e.exe
1400	3dc406301e.exe
1400	3dc406301e.exe
1400	3dc406301e.exe
1400	3dc406301e.exe
1400	3dc406301e.exe
1400	3dc406301e.exe
1400	3dc406301e.exe
1400	3dc406301e.exe
1400	3dc406301e.exe
1400	3dc406301e.exe
1400	3dc406301e.exe
1400	3dc406301e.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1400	3dc406301e.exe
1400	3dc406301e.exe
1400	3dc406301e.exe
1400	3dc406301e.exe
1400	3dc406301e.exe
1400	3dc406301e.exe
1400	3dc406301e.exe
1400	3dc406301e.exe
1400	3dc406301e.exe
1400	3dc406301e.exe
1400	3dc406301e.exe
1400	3dc406301e.exe
1400	3dc406301e.exe
1400	3dc406301e.exe
1400	3dc406301e.exe
1400	3dc406301e.exe
1400	3dc406301e.exe
1400	3dc406301e.exe
1400	3dc406301e.exe
1400	3dc406301e.exe
1400	3dc406301e.exe
1400	3dc406301e.exe
1400	3dc406301e.exe
1400	3dc406301e.exe
1400	3dc406301e.exe
1400	3dc406301e.exe
1400	3dc406301e.exe
1400	3dc406301e.exe
1400	3dc406301e.exe
1400	3dc406301e.exe
1400	3dc406301e.exe
1400	3dc406301e.exe
1400	3dc406301e.exe
1400	3dc406301e.exe
1400	3dc406301e.exe
1400	3dc406301e.exe
1400	3dc406301e.exe
1400	3dc406301e.exe
1400	3dc406301e.exe
1400	3dc406301e.exe
1400	3dc406301e.exe
1400	3dc406301e.exe
1400	3dc406301e.exe
1400	3dc406301e.exe
1400	3dc406301e.exe
1400	3dc406301e.exe
1400	3dc406301e.exe
1400	3dc406301e.exe
1400	3dc406301e.exe
1400	3dc406301e.exe
1400	3dc406301e.exe
1400	3dc406301e.exe
1400	3dc406301e.exe
1400	3dc406301e.exe
1400	3dc406301e.exe
1400	3dc406301e.exe
1400	3dc406301e.exe
1400	3dc406301e.exe
1400	3dc406301e.exe
1400	3dc406301e.exe
1400	3dc406301e.exe
1400	3dc406301e.exe
1400	3dc406301e.exe
1400	3dc406301e.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3680	8ad6a37b8e.exe
492	firefox.exe
3904	cmd.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1120 wrote to memory of 2924	1120	4d0cd9986b51ab2d0d0b6e972dfa7ccafb7a27ede7da5f1c4152b18ce3471758.exe	82
PID 1120 wrote to memory of 2924	1120	4d0cd9986b51ab2d0d0b6e972dfa7ccafb7a27ede7da5f1c4152b18ce3471758.exe	82
PID 1120 wrote to memory of 2924	1120	4d0cd9986b51ab2d0d0b6e972dfa7ccafb7a27ede7da5f1c4152b18ce3471758.exe	82
PID 2924 wrote to memory of 3680	2924	explorti.exe	83
PID 2924 wrote to memory of 3680	2924	explorti.exe	83
PID 2924 wrote to memory of 3680	2924	explorti.exe	83
PID 2924 wrote to memory of 1400	2924	explorti.exe	84
PID 2924 wrote to memory of 1400	2924	explorti.exe	84
PID 2924 wrote to memory of 1400	2924	explorti.exe	84
PID 1400 wrote to memory of 2232	1400	3dc406301e.exe	86
PID 1400 wrote to memory of 2232	1400	3dc406301e.exe	86
PID 2232 wrote to memory of 492	2232	firefox.exe	89
PID 2232 wrote to memory of 492	2232	firefox.exe	89
PID 2232 wrote to memory of 492	2232	firefox.exe	89
PID 2232 wrote to memory of 492	2232	firefox.exe	89
PID 2232 wrote to memory of 492	2232	firefox.exe	89
PID 2232 wrote to memory of 492	2232	firefox.exe	89
PID 2232 wrote to memory of 492	2232	firefox.exe	89
PID 2232 wrote to memory of 492	2232	firefox.exe	89
PID 2232 wrote to memory of 492	2232	firefox.exe	89
PID 2232 wrote to memory of 492	2232	firefox.exe	89
PID 2232 wrote to memory of 492	2232	firefox.exe	89
PID 492 wrote to memory of 4088	492	firefox.exe	90
PID 492 wrote to memory of 4088	492	firefox.exe	90
PID 492 wrote to memory of 4088	492	firefox.exe	90
PID 492 wrote to memory of 4088	492	firefox.exe	90
PID 492 wrote to memory of 4088	492	firefox.exe	90
PID 492 wrote to memory of 4088	492	firefox.exe	90
PID 492 wrote to memory of 4088	492	firefox.exe	90
PID 492 wrote to memory of 4088	492	firefox.exe	90
PID 492 wrote to memory of 4088	492	firefox.exe	90
PID 492 wrote to memory of 4088	492	firefox.exe	90
PID 492 wrote to memory of 4088	492	firefox.exe	90
PID 492 wrote to memory of 4088	492	firefox.exe	90
PID 492 wrote to memory of 4088	492	firefox.exe	90
PID 492 wrote to memory of 4088	492	firefox.exe	90
PID 492 wrote to memory of 4088	492	firefox.exe	90
PID 492 wrote to memory of 4088	492	firefox.exe	90
PID 492 wrote to memory of 4088	492	firefox.exe	90
PID 492 wrote to memory of 4088	492	firefox.exe	90
PID 492 wrote to memory of 4088	492	firefox.exe	90
PID 492 wrote to memory of 4088	492	firefox.exe	90
PID 492 wrote to memory of 4088	492	firefox.exe	90
PID 492 wrote to memory of 4088	492	firefox.exe	90
PID 492 wrote to memory of 4088	492	firefox.exe	90
PID 492 wrote to memory of 4088	492	firefox.exe	90
PID 492 wrote to memory of 4088	492	firefox.exe	90
PID 492 wrote to memory of 4088	492	firefox.exe	90
PID 492 wrote to memory of 4088	492	firefox.exe	90
PID 492 wrote to memory of 4088	492	firefox.exe	90
PID 492 wrote to memory of 4088	492	firefox.exe	90
PID 492 wrote to memory of 4088	492	firefox.exe	90
PID 492 wrote to memory of 4088	492	firefox.exe	90
PID 492 wrote to memory of 4088	492	firefox.exe	90
PID 492 wrote to memory of 4088	492	firefox.exe	90
PID 492 wrote to memory of 4088	492	firefox.exe	90
PID 492 wrote to memory of 4088	492	firefox.exe	90
PID 492 wrote to memory of 4088	492	firefox.exe	90
PID 492 wrote to memory of 4088	492	firefox.exe	90
PID 492 wrote to memory of 4088	492	firefox.exe	90
PID 492 wrote to memory of 4088	492	firefox.exe	90
PID 492 wrote to memory of 4088	492	firefox.exe	90
PID 492 wrote to memory of 4088	492	firefox.exe	90
PID 492 wrote to memory of 4088	492	firefox.exe	90

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\4d0cd9986b51ab2d0d0b6e972dfa7ccafb7a27ede7da5f1c4152b18ce3471758.exe
"C:\Users\Admin\AppData\Local\Temp\4d0cd9986b51ab2d0d0b6e972dfa7ccafb7a27ede7da5f1c4152b18ce3471758.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1120
- C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
  "C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2924
- - C:\Users\Admin\AppData\Local\Temp\1000006001\8ad6a37b8e.exe
    "C:\Users\Admin\AppData\Local\Temp\1000006001\8ad6a37b8e.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:3680
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\FBKECFIIEH.exe"
      4⤵
      PID:2268
    - - C:\Users\Admin\AppData\Local\Temp\FBKECFIIEH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\FBKECFIIEH.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        
        PID:3100
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\KFCBAEHCAE.exe"
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:3904
- - C:\Users\Admin\AppData\Local\Temp\1000011001\3dc406301e.exe
    "C:\Users\Admin\AppData\Local\Temp\1000011001\3dc406301e.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:1400
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2232
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
        5⤵
        Checks processor information in registry
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:492
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1944 -parentBuildID 20240401114208 -prefsHandle 1860 -prefMapHandle 1852 -prefsLen 25749 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {df24259e-4125-4329-8fba-db4739e51539} 492 "\\.\pipe\gecko-crash-server-pipe.492" gpu
        6⤵
        
        PID:4088
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2364 -parentBuildID 20240401114208 -prefsHandle 2356 -prefMapHandle 2348 -prefsLen 26669 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e3ac3197-b273-4eb1-89d4-5c4c6a44a0d8} 492 "\\.\pipe\gecko-crash-server-pipe.492" socket
        6⤵
        
        PID:1396
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3236 -childID 1 -isForBrowser -prefsHandle 3068 -prefMapHandle 2528 -prefsLen 22698 -prefMapSize 244658 -jsInitHandle 1072 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ebd2f02a-884d-448a-970d-25959f701ffc} 492 "\\.\pipe\gecko-crash-server-pipe.492" tab
        6⤵
        
        PID:2316
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3624 -childID 2 -isForBrowser -prefsHandle 2896 -prefMapHandle 3620 -prefsLen 31159 -prefMapSize 244658 -jsInitHandle 1072 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fbcdffac-7570-4db3-8aec-cacb03ba4bf2} 492 "\\.\pipe\gecko-crash-server-pipe.492" tab
        6⤵
        
        PID:2112
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2516 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4508 -prefMapHandle 4504 -prefsLen 31159 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d03bf33d-8c3e-470e-b437-dd697451eef9} 492 "\\.\pipe\gecko-crash-server-pipe.492" utility
        6⤵
        Checks processor information in registry
        
        PID:4528
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5468 -childID 3 -isForBrowser -prefsHandle 5080 -prefMapHandle 5448 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1072 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {59ae0345-f45e-42ca-85a1-95387afe5ea7} 492 "\\.\pipe\gecko-crash-server-pipe.492" tab
        6⤵
        
        PID:4076
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5616 -childID 4 -isForBrowser -prefsHandle 5700 -prefMapHandle 5696 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1072 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {37d45ea9-c662-4aa0-b34a-055fb0d9c95b} 492 "\\.\pipe\gecko-crash-server-pipe.492" tab
        6⤵
        
        PID:3588
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5808 -childID 5 -isForBrowser -prefsHandle 5816 -prefMapHandle 5824 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1072 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4df92761-613f-4989-8056-d9b9c0c44243} 492 "\\.\pipe\gecko-crash-server-pipe.492" tab
        6⤵
        
        PID:700

C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3468

C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3256

C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mozglue.dll

Path C:\ProgramData\mozglue.dll
Size 593KB
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
SSDEEP 12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5 SHA1 SHA512 SSDEEP

Submit Download

nss3.dll

Path C:\ProgramData\nss3.dll
Size 2.0MB
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
SSDEEP 49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5 SHA1 SHA512 SSDEEP

Submit Download

activity-stream.discovery_stream.json.tmp

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\q0xshw2k.default-release\activity-stream.discovery_stream.json.tmp
Size 18KB
SHA256 23a0b1e83de46d4675274b37a31d7e13a1f6b580586d0a9298be271c113ef922
MD5 de2db5a4fa74b1a500bfb9ffb3f81528
SHA1 713a350cc4ed31c355c8100808ee064a695723ff
SHA512 87d01203cacee424f44f081c7446f512776f19604e8bf12f15f7c0f46b36a858973d4565e98fe3ae99495429d61ae046f56eb88511cadd526ba34914cccfe281
SSDEEP 384:F+lmece71CbWI/IbzzofiWiD412AbK5gloZ6Vct89yLUyaE:FCP1CbHnqW11rY7UyUyp
MD5 SHA1 SHA512 SSDEEP

Submit Download

8A2034D325DC0B5C9E11EDDA3FC70A54C8DC1C0D

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\q0xshw2k.default-release\cache2\entries\8A2034D325DC0B5C9E11EDDA3FC70A54C8DC1C0D
Size 13KB
SHA256 62592ab41a514f3d71e5de45dbceeac36ef4f07b9ce679aed17cf43b75bcd344
MD5 df7d4f68214e90eb74e9ca6fa13706b3
SHA1 7f82470db9bade957ee9cc0e7e0fe59c644704d6
SHA512 561be726fadc97039b2729818f4fae8c8408e73ab7774d49fbf979660d0ff5e1975191c50db5ca99b03c57173945f099bef01e52f6aed5051494ab9a9eda8763
SSDEEP 384:H485u9fiGLm4pU0ft2WlOX8lPLZZB7t0lpDIIpf2fP:nUBi8mCU0ft2WAX8tzB7eD8EOn
MD5 SHA1 SHA512 SSDEEP

Submit Download

8ad6a37b8e.exe

Path C:\Users\Admin\AppData\Local\Temp\1000006001\8ad6a37b8e.exe
Size 2.4MB
SHA256 aff20c28bd7188b03932a3ca44c307de9df1ec97c69d41ff3c6153e31d077b47
MD5 57a80d7e7f4ed41e5bb11364220136d5
SHA1 d5e6f7bffb60fa6f231bee4763a331ee24b6ff7c
SHA512 507ff461e0b681f897fda7e689d1c8f8d2b2f8f2d1f0808216768e8be72999eed05142011f5ddfb66dbaec5606d08050531e18672b5b9402c5171b20b934086d
SSDEEP 49152:CaPzQMiYR361Fvh0LH+D9xQjgCEMVEMDyOeAZOaONpQ+Z/Pj+EXFqhxYSp3ENE:CaPsrYRKrhAHS9YgCEMVEk9ONyVEXkzZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

3dc406301e.exe

Path C:\Users\Admin\AppData\Local\Temp\1000011001\3dc406301e.exe
Size 1.2MB
SHA256 28ecf3bb63c2e20ee4f4142672afdc3e7302924c36691634d9d86d3d059bdee3
MD5 22c9e47f612af8424c2e8f4c142f36e1
SHA1 6b61dbc7f05cbe753d8a803fda567c10441d5d06
SHA512 60c89d22ddbf72dd28a43d88d85da932b0ac73a61de0239b308a87a991bc8983d8566122a1a690c61247febdfe609a54a1568fed05d583d9e60c8c1df27c16ca
SSDEEP 24576:+qDEvCTbMWu7rQYlBQcBiT6rprG8aLX2Sbly7TWEPje:+TvC/MTQYxsWR7aLX2dW
MD5 SHA1 SHA512 SSDEEP

Submit Download

explorti.exe

Path C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
Size 1.8MB
SHA256 4d0cd9986b51ab2d0d0b6e972dfa7ccafb7a27ede7da5f1c4152b18ce3471758
MD5 fd05c5c1e3bb5a6a99c161330938ecc4
SHA1 77461ed8923f52b470606174f700e691efb4a524
SHA512 d766d17fc954461971766ac9794ce8a0ff15485ffe3fc0fa0afa2baa01d3411f682bf73c16185bca9d0c31fa19aad577f20b43f8a8b6bc3689cc034ddc69d7c5
SSDEEP 49152:dhKj2d4paLqh8hUFKmJZYM3jLnvY+npDxSlmJelk8R:dsj2ipnKcZFj7NB8R
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 479KB
SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
MD5 09372174e83dbbf696ee732fd2e875bb
SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 13.8MB
SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
MD5 0a8747a2ac9ac08ae9508f36c6d75692
SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q0xshw2k.default-release\AlternateServices.bin
Size 8KB
SHA256 87fb93b110a13d1c36648c30348e38ed5b485979180ba58db4ae2a63c7661650
MD5 864736aa1c310a42a39fd056dbf76553
SHA1 4dc35db24f6183006e8c53944236202564c5fa07
SHA512 f58646bb33274296847235a65b0034dc0c85ee7a2a75db9ee3ac9e3d04a955b92426f0cc146308eb753bb2fe17e6362d3e92a0917fc4ebfb7efb16dc52e0d41b
SSDEEP 24:RuB1oKBnFsh2F3LFNiygu1xgRbyXpR5cOFBuhMZbvsJbF0J1bT0WKsJblxWKf+Yb:uBNiy5oWX9cOFfvebOJ1bIpebvpf+Yb
MD5 SHA1 SHA512 SSDEEP

Submit Download

cookies.sqlite-wal

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q0xshw2k.default-release\cookies.sqlite-wal
Size 256KB
SHA256 e7cbef304bc0884cf09f92a60f977eda077a1ebf6036490a5bf4d1c94733f378
MD5 702400b3682e5490c6c3199e8e369bb2
SHA1 d1f484227d5b239252baca13b9970750ade3999b
SHA512 4344d4cc379c52be867614e8014aef96562c0fe0942bf74c3b7831c2249124ea76633c8b7c704c89c7f442b06bfbb61d66b08f43cd2761157b2d298c03824daf
SSDEEP 96:h3Z2SZr+Uki2SZQoKGUh+CC6ki2SZmauGUh+G:mOuK
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q0xshw2k.default-release\datareporting\glean\db\data.safe.tmp
Size 32KB
SHA256 d5f08e6565d3ea2ef388861cb8e96b6e85e4ae58ac4af807609c7fecfa94f922
MD5 b3b86759a33e242fc6110f0e0c158d64
SHA1 41e671d729df1a3079583fb1c648eac9fc2531f8
SHA512 b1b9296cf46b0bc77961014c5a7859f81b0dbc6de8f868426724685adcfe2f3e2bf0cf5329137c35215a3193fd386b1692df1bd30f9a5be69c1fd406465e9ed8
SSDEEP 768:4DtM710hkZIP/CirB8E0KfbubFb//bwb3bzbobFXRtVzA3ttQhmUm/noAo/X:4DtM710mZtrXRtVzA3ttQILnDCX
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q0xshw2k.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 a661af9580a8c93573103f85d97d6aa6e7fdc2789308b9d8a8ddab75ca356d62
MD5 785fa2b585d58dcd3bc8150cc19625aa
SHA1 cfed6fe28411edda3de7bfb47c535117c344c687
SHA512 8326624468fdd838767547e8a1fbd7a0984f3fe762e99e0faeb3aa9efd2cb78c035695b268e7221d458211ba3200d85b646c1c5b4d3f678add1220a5b976787e
SSDEEP 96:UPUPsQ1VVBFl66Joz0dzgClKtmSSkB/SMF9ZbkW6QX0BBUhmIn5PP/PrWZ:UPAR/66Joz0dzgCl6mSSUrvZboHUhJnI
MD5 SHA1 SHA512 SSDEEP

Submit Download

1695d775-37a4-4a77-ad76-c691277077cd

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q0xshw2k.default-release\datareporting\glean\pending_pings\1695d775-37a4-4a77-ad76-c691277077cd
Size 982B
SHA256 2d1a41ea349929852d4492187577ab814fea4be5b5e9ce25db2f0b206c9b71fa
MD5 662e24c101a697e26f561e5afa00c287
SHA1 22d464ae5cab7a61e7317ce66eda9605b10af53c
SHA512 6489289dab54d454379016a0fc389b5e3b414fc39d4e15f2d391cfd052121aadcd13ce1d1e32c0f93897e510b041ce369933db837321ddb522f98e9c98dd0aa4
MD5 SHA1 SHA512

Submit Download

dd562882-7b52-4e17-b830-f58991a435e3

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q0xshw2k.default-release\datareporting\glean\pending_pings\dd562882-7b52-4e17-b830-f58991a435e3
Size 671B
SHA256 ce4f7809ec4b08b35e55948b267b6337adb36e2eaf349f09cb0d9b33db93c706
MD5 1b6e05a33301bc39f464029e6d0b515f
SHA1 5e436cfd88bdbae058da754b389ff9b9968d9bdd
SHA512 a66408072b307fd5542f67feca99fb1ad55b15131d4e734446211e3181e4b680409f25e0584afc1b52ed33585d1ef5459da681436eac914f0f1edd5725b8c439
MD5 SHA1 SHA512

Submit Download

f740693a-c469-4640-acad-314d63a980b8

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q0xshw2k.default-release\datareporting\glean\pending_pings\f740693a-c469-4640-acad-314d63a980b8
Size 25KB
SHA256 da405f4430203c894b39e2e0c245f2358cdbfd6188d8cb6da100f8f216e24a65
MD5 8f25acfbe3854d943dc0c837f0c1940d
SHA1 37ca512c25be29949f3c9937f07909e5388f775a
SHA512 1809428d6e735815fe7a29b816afa777426914c5b22a9c582e1c00022684cd0ad83fca01646ede5c6786af0219412c65cfaf610dab0f6ed0480218cf6f68a1b1
SSDEEP 192:PF2QURIJUFyREesZn2tJXUSV01RWpzybzPbY5xafr9wIoOo19RuZIJ9A7s9AnhUJ:PoQUwkZneXaHrTMItaS8aR1KORnRK
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q0xshw2k.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Size 1.1MB
SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
MD5 842039753bf41fa5e11b3a1383061a87
SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q0xshw2k.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Size 116B
SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
MD5 2a461e9eb87fd1955cea740a3444ee7a
SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q0xshw2k.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Size 372B
SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
MD5 bf957ad58b55f64219ab3f793e374316
SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q0xshw2k.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Size 17.8MB
SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
MD5 daf7ef3acccab478aaa7d6dc1c60f865
SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
MD5 SHA1 SHA512 SSDEEP

Submit Download

places.sqlite-wal

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q0xshw2k.default-release\places.sqlite-wal
Size 992KB
SHA256 278e09af96106a39fba34f5bf601d9f3c006c70324f5d83a36a049c7804dc546
MD5 198a1158fff0795fb80465c7f21f2888
SHA1 778565844255e2c763d45cfaf9ad8261a024e65b
SHA512 9b97aeddc8a3b1364a72cf87565ad0dd4599ac35d830c1f95564e3fec902bbf8777c8a5bd45fdafc4d3e3fc8ed9441774b02e64dee7cb6601d4b368ab0f47b3d
SSDEEP 192:dRpG2OJq6egx/JRpBhKGYibHhtLXx/xARpv:dvGugnv2G9rovv
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q0xshw2k.default-release\prefs-1.js
Size 13KB
SHA256 d3cdaf6868cda4fb784e8ff1a42ed6a78eec40c3ea2a3ffb74e1fec9a0281974
MD5 f30ae1c5f5a97263ea8e256d1d3f3053
SHA1 a4621078206f401a874eb947e769fd605102ae8b
SHA512 45a066a0664d0a3f8d85e5d37b432e10ec61c77b6167d52da9dafee4020b90f0516703f1cbc0ea989a5eff7e0182bf416d7f0eef1db8e1fe5f5c9addcfe738cd
SSDEEP 192:J5npRvfhE0k930IWSxJJzcdwIWxQHrC60BaXA/Ja2neBw8HA:fmEFSx8CFxQLhU/98wD
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q0xshw2k.default-release\prefs-1.js
Size 11KB
SHA256 a0e358f467bc57729bef8ea8c32d8f682ba50b661ce288d36192451cfe3f0f6d
MD5 5590eb8589bcbd3ee1a77a35490f2867
SHA1 856757d0e2db1b9a2f01aba397cab70ac6be7424
SHA512 761edba0f79c1ccefaf82456bc43cfbd1cbfe3f346f9faba58a7db323e984eea7a2c0c6aa45b41b837547062cc202784bd55035192bf619c903058e2c26123de
SSDEEP 192:e5npRvfhE0k930IWSxJJzcdwIWxQHrC60BaXA/Ja2nOBw8Hq:0mEFSx8CFxQLhU/9swH
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q0xshw2k.default-release\prefs.js
Size 8KB
SHA256 1ec16570aeab25e77be010aaf946c6f4bf936341d3c123aa319a079e5af5dbb9
MD5 ea8c1a337880374c6b40e09fb4f30c4a
SHA1 4b6bc8d7d797941f2ddb85b1c48e700a2e350edd
SHA512 b3023e7cf99f82cad53c9055db66a9df7d84180bac9f5195c7543996d2600d9bf1326d0ac90980b8dbc783aa5bc5443b6a95a66433bf59a7d6711489830c0157
SSDEEP 192:e5npRvfhEhY4sDcdlr60raXj/Ja2nOBw8Vq:02sovO5/9sw5
MD5 SHA1 SHA512 SSDEEP

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q0xshw2k.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 976KB
SHA256 1e8f65200d5b43ee0cc49a79f32081f33b26f23a7a37aabd9c2e9c7fdba0740b
MD5 71d30334cc0381f25a995161166aae37
SHA1 1bb354cc10d4f3585a79ea105aa7ed9d8d606013
SHA512 7649f83d938204c6ad89572ada747c9b914aa7e244ba74afcb9a2194e1f0b6a0bedf0b12f8acb5e06b967f8b48c1a9a6778bf9de3e2fddc89b02782f26beacf0
SSDEEP 6144:bkKUUjn393z3m3P35THKDeX+rSUNWTUJGyoz0Pu/elS9iqtGZeeHN1HmcH11HOS5:JDeX+rnNdJLultVxdYvjbf
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1120-0-0x0000000000810000-0x0000000000CD1000-memory.dmp

Download

memory/1120-16-0x0000000000810000-0x0000000000CD1000-memory.dmp

Download

memory/1120-4-0x0000000000810000-0x0000000000CD1000-memory.dmp

Download

memory/1120-3-0x0000000000810000-0x0000000000CD1000-memory.dmp

Download

memory/1120-2-0x0000000000811000-0x000000000083F000-memory.dmp

Download

memory/1120-1-0x00000000776C6000-0x00000000776C8000-memory.dmp

Download

memory/2924-493-0x0000000000DD0000-0x0000000001291000-memory.dmp

Download

memory/2924-18-0x0000000000DD0000-0x0000000001291000-memory.dmp

Download

memory/2924-484-0x0000000000DD0000-0x0000000001291000-memory.dmp

Download

memory/2924-2624-0x0000000000DD0000-0x0000000001291000-memory.dmp

Download

memory/2924-2618-0x0000000000DD0000-0x0000000001291000-memory.dmp

Download

memory/2924-505-0x0000000000DD0000-0x0000000001291000-memory.dmp

Download

memory/2924-506-0x0000000000DD0000-0x0000000001291000-memory.dmp

Download

memory/2924-511-0x0000000000DD0000-0x0000000001291000-memory.dmp

Download

memory/2924-2613-0x0000000000DD0000-0x0000000001291000-memory.dmp

Download

memory/2924-94-0x0000000000DD0000-0x0000000001291000-memory.dmp

Download

memory/2924-2612-0x0000000000DD0000-0x0000000001291000-memory.dmp

Download

memory/2924-2611-0x0000000000DD0000-0x0000000001291000-memory.dmp

Download

memory/2924-2610-0x0000000000DD0000-0x0000000001291000-memory.dmp

Download

memory/2924-2609-0x0000000000DD0000-0x0000000001291000-memory.dmp

Download

memory/2924-21-0x0000000000DD0000-0x0000000001291000-memory.dmp

Download

memory/2924-20-0x0000000000DD0000-0x0000000001291000-memory.dmp

Download

memory/2924-19-0x0000000000DD1000-0x0000000000DFF000-memory.dmp

Download

memory/2924-2607-0x0000000000DD0000-0x0000000001291000-memory.dmp

Download

memory/2924-903-0x0000000000DD0000-0x0000000001291000-memory.dmp

Download

memory/2924-1962-0x0000000000DD0000-0x0000000001291000-memory.dmp

Download

memory/2924-2598-0x0000000000DD0000-0x0000000001291000-memory.dmp

Download

memory/3100-504-0x0000000000FD0000-0x0000000001491000-memory.dmp

Download

memory/3100-494-0x0000000000FD0000-0x0000000001491000-memory.dmp

Download

memory/3256-2603-0x0000000000DD0000-0x0000000001291000-memory.dmp

Download

memory/3256-2604-0x0000000000DD0000-0x0000000001291000-memory.dmp

Download

memory/3468-57-0x0000000000DD0000-0x0000000001291000-memory.dmp

Download

memory/3468-59-0x0000000000DD0000-0x0000000001291000-memory.dmp

Download

memory/3644-2615-0x0000000000DD0000-0x0000000001291000-memory.dmp

Download

memory/3644-2617-0x0000000000DD0000-0x0000000001291000-memory.dmp

Download

memory/3680-489-0x00000000004E0000-0x00000000010BF000-memory.dmp

Download

memory/3680-37-0x00000000004E0000-0x00000000010BF000-memory.dmp

Download

memory/3680-60-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Download

memory/3680-472-0x00000000004E0000-0x00000000010BF000-memory.dmp

Download