amadey | b0fe3596f9cc2cc542a7bb3f501cb2c8974e50f5c93fbcef9d52ed5b8d48ad37

Analysis

max time kernel
149s
max time network
142s
platform
windows11-21h2_x64
resource
win11-20240709-en
resource tags

arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
submitted
15/07/2024, 10:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b0fe3596f9cc2cc542a7bb3f501cb2c8974e50f5c93fbcef9d52ed5b8d48ad37.exe
Size 1.8MB
Sample240715-l5tsystepa
SHA256 b0fe3596f9cc2cc542a7bb3f501cb2c8974e50f5c93fbcef9d52ed5b8d48ad37
MD5 60be661051bc2fc08d6902bb872f41f8
SHA1 664adbf94beadf1ff0a1de1ebacc286ee01f85b1
SHA512 1d288d3c31d7da04b1622e0af4b32cde34b803eed8964eab3e74ad4fecee72ff1fad3afae9b28662a4430e0f722f6a284dd71bc87cf732603c9b62a990e7b4c4
SSDEEP 49152:So2OyIyp5tpQpU+gEog4gZ17ISPo7nIo84+C:xMN5LQpU+gEogpZN/ozR84+C
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey stealc 4dd39d funny discovery evasion spyware stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.30

Botnet

4dd39d

http://77.91.77.82

Attributes

install_dir
ad40971b6b
install_file
explorti.exe
strings_key
a434973ad22def7137dbb5e059b7081e
url_paths
/Hun4Ko/index.php

rc4.plain

Extracted

Family

stealc

Botnet

funny

http://85.28.47.30

Attributes

url_path
/920475a59bac849d.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Stealc
Stealc is an infostealer written in C++.
stealer stealc

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	IDBKKKKKFB.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	b0fe3596f9cc2cc542a7bb3f501cb2c8974e50f5c93fbcef9d52ed5b8d48ad37.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 10 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	b0fe3596f9cc2cc542a7bb3f501cb2c8974e50f5c93fbcef9d52ed5b8d48ad37.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	IDBKKKKKFB.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	b0fe3596f9cc2cc542a7bb3f501cb2c8974e50f5c93fbcef9d52ed5b8d48ad37.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	IDBKKKKKFB.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe

Executes dropped EXE 6 IoCs

pid	Process
2328	explorti.exe
4548	836664c2b4.exe
324	8cfb1746db.exe
756	IDBKKKKKFB.exe
1916	explorti.exe
2868	explorti.exe

Identifies Wine through registry keys 2 TTPs 5 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2087971895-212656400-463594913-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-2087971895-212656400-463594913-1000\Software\Wine	IDBKKKKKFB.exe
Key opened	\REGISTRY\USER\S-1-5-21-2087971895-212656400-463594913-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-2087971895-212656400-463594913-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-2087971895-212656400-463594913-1000\Software\Wine	b0fe3596f9cc2cc542a7bb3f501cb2c8974e50f5c93fbcef9d52ed5b8d48ad37.exe

Loads dropped DLL 2 IoCs

pid	Process
4548	836664c2b4.exe
4548	836664c2b4.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x000100000002aa97-42.dat	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs

pid	Process
3336	b0fe3596f9cc2cc542a7bb3f501cb2c8974e50f5c93fbcef9d52ed5b8d48ad37.exe
2328	explorti.exe
4548	836664c2b4.exe
4548	836664c2b4.exe
756	IDBKKKKKFB.exe
1916	explorti.exe
2868	explorti.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\explorti.job	b0fe3596f9cc2cc542a7bb3f501cb2c8974e50f5c93fbcef9d52ed5b8d48ad37.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	836664c2b4.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	836664c2b4.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2087971895-212656400-463594913-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3336	b0fe3596f9cc2cc542a7bb3f501cb2c8974e50f5c93fbcef9d52ed5b8d48ad37.exe
3336	b0fe3596f9cc2cc542a7bb3f501cb2c8974e50f5c93fbcef9d52ed5b8d48ad37.exe
2328	explorti.exe
2328	explorti.exe
4548	836664c2b4.exe
4548	836664c2b4.exe
4548	836664c2b4.exe
4548	836664c2b4.exe
756	IDBKKKKKFB.exe
756	IDBKKKKKFB.exe
1916	explorti.exe
1916	explorti.exe
2868	explorti.exe
2868	explorti.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1312	firefox.exe
Token: SeDebugPrivilege	1312	firefox.exe
Token: SeDebugPrivilege	1312	firefox.exe
Token: SeDebugPrivilege	1312	firefox.exe
Token: SeDebugPrivilege	1312	firefox.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3336	b0fe3596f9cc2cc542a7bb3f501cb2c8974e50f5c93fbcef9d52ed5b8d48ad37.exe
324	8cfb1746db.exe
324	8cfb1746db.exe
324	8cfb1746db.exe
324	8cfb1746db.exe
324	8cfb1746db.exe
324	8cfb1746db.exe
324	8cfb1746db.exe
1312	firefox.exe
1312	firefox.exe
1312	firefox.exe
1312	firefox.exe
1312	firefox.exe
1312	firefox.exe
1312	firefox.exe
1312	firefox.exe
1312	firefox.exe
1312	firefox.exe
1312	firefox.exe
1312	firefox.exe
1312	firefox.exe
1312	firefox.exe
1312	firefox.exe
1312	firefox.exe
1312	firefox.exe
1312	firefox.exe
1312	firefox.exe
1312	firefox.exe
1312	firefox.exe
324	8cfb1746db.exe
324	8cfb1746db.exe
324	8cfb1746db.exe
324	8cfb1746db.exe
324	8cfb1746db.exe
324	8cfb1746db.exe
324	8cfb1746db.exe
324	8cfb1746db.exe
324	8cfb1746db.exe
324	8cfb1746db.exe
324	8cfb1746db.exe
324	8cfb1746db.exe
324	8cfb1746db.exe
324	8cfb1746db.exe
324	8cfb1746db.exe
324	8cfb1746db.exe
324	8cfb1746db.exe
324	8cfb1746db.exe
324	8cfb1746db.exe
324	8cfb1746db.exe
324	8cfb1746db.exe
324	8cfb1746db.exe
324	8cfb1746db.exe
324	8cfb1746db.exe
324	8cfb1746db.exe
324	8cfb1746db.exe
324	8cfb1746db.exe
324	8cfb1746db.exe
324	8cfb1746db.exe
324	8cfb1746db.exe
324	8cfb1746db.exe
324	8cfb1746db.exe
324	8cfb1746db.exe
324	8cfb1746db.exe
324	8cfb1746db.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
324	8cfb1746db.exe
324	8cfb1746db.exe
324	8cfb1746db.exe
324	8cfb1746db.exe
324	8cfb1746db.exe
324	8cfb1746db.exe
324	8cfb1746db.exe
324	8cfb1746db.exe
324	8cfb1746db.exe
324	8cfb1746db.exe
324	8cfb1746db.exe
324	8cfb1746db.exe
324	8cfb1746db.exe
324	8cfb1746db.exe
324	8cfb1746db.exe
324	8cfb1746db.exe
324	8cfb1746db.exe
324	8cfb1746db.exe
324	8cfb1746db.exe
324	8cfb1746db.exe
324	8cfb1746db.exe
324	8cfb1746db.exe
324	8cfb1746db.exe
324	8cfb1746db.exe
324	8cfb1746db.exe
324	8cfb1746db.exe
324	8cfb1746db.exe
324	8cfb1746db.exe
324	8cfb1746db.exe
324	8cfb1746db.exe
324	8cfb1746db.exe
324	8cfb1746db.exe
324	8cfb1746db.exe
324	8cfb1746db.exe
324	8cfb1746db.exe
324	8cfb1746db.exe
324	8cfb1746db.exe
324	8cfb1746db.exe
324	8cfb1746db.exe
324	8cfb1746db.exe
324	8cfb1746db.exe
324	8cfb1746db.exe
324	8cfb1746db.exe
324	8cfb1746db.exe
324	8cfb1746db.exe
324	8cfb1746db.exe
324	8cfb1746db.exe
324	8cfb1746db.exe
324	8cfb1746db.exe
324	8cfb1746db.exe
324	8cfb1746db.exe
324	8cfb1746db.exe
324	8cfb1746db.exe
324	8cfb1746db.exe
324	8cfb1746db.exe
324	8cfb1746db.exe
324	8cfb1746db.exe
324	8cfb1746db.exe
324	8cfb1746db.exe
324	8cfb1746db.exe
324	8cfb1746db.exe
324	8cfb1746db.exe
324	8cfb1746db.exe
324	8cfb1746db.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4548	836664c2b4.exe
1312	firefox.exe
3440	cmd.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3336 wrote to memory of 2328	3336	b0fe3596f9cc2cc542a7bb3f501cb2c8974e50f5c93fbcef9d52ed5b8d48ad37.exe	78
PID 3336 wrote to memory of 2328	3336	b0fe3596f9cc2cc542a7bb3f501cb2c8974e50f5c93fbcef9d52ed5b8d48ad37.exe	78
PID 3336 wrote to memory of 2328	3336	b0fe3596f9cc2cc542a7bb3f501cb2c8974e50f5c93fbcef9d52ed5b8d48ad37.exe	78
PID 2328 wrote to memory of 4548	2328	explorti.exe	79
PID 2328 wrote to memory of 4548	2328	explorti.exe	79
PID 2328 wrote to memory of 4548	2328	explorti.exe	79
PID 2328 wrote to memory of 324	2328	explorti.exe	80
PID 2328 wrote to memory of 324	2328	explorti.exe	80
PID 2328 wrote to memory of 324	2328	explorti.exe	80
PID 324 wrote to memory of 3820	324	8cfb1746db.exe	81
PID 324 wrote to memory of 3820	324	8cfb1746db.exe	81
PID 3820 wrote to memory of 1312	3820	firefox.exe	84
PID 3820 wrote to memory of 1312	3820	firefox.exe	84
PID 3820 wrote to memory of 1312	3820	firefox.exe	84
PID 3820 wrote to memory of 1312	3820	firefox.exe	84
PID 3820 wrote to memory of 1312	3820	firefox.exe	84
PID 3820 wrote to memory of 1312	3820	firefox.exe	84
PID 3820 wrote to memory of 1312	3820	firefox.exe	84
PID 3820 wrote to memory of 1312	3820	firefox.exe	84
PID 3820 wrote to memory of 1312	3820	firefox.exe	84
PID 3820 wrote to memory of 1312	3820	firefox.exe	84
PID 3820 wrote to memory of 1312	3820	firefox.exe	84
PID 1312 wrote to memory of 1260	1312	firefox.exe	85
PID 1312 wrote to memory of 1260	1312	firefox.exe	85
PID 1312 wrote to memory of 1260	1312	firefox.exe	85
PID 1312 wrote to memory of 1260	1312	firefox.exe	85
PID 1312 wrote to memory of 1260	1312	firefox.exe	85
PID 1312 wrote to memory of 1260	1312	firefox.exe	85
PID 1312 wrote to memory of 1260	1312	firefox.exe	85
PID 1312 wrote to memory of 1260	1312	firefox.exe	85
PID 1312 wrote to memory of 1260	1312	firefox.exe	85
PID 1312 wrote to memory of 1260	1312	firefox.exe	85
PID 1312 wrote to memory of 1260	1312	firefox.exe	85
PID 1312 wrote to memory of 1260	1312	firefox.exe	85
PID 1312 wrote to memory of 1260	1312	firefox.exe	85
PID 1312 wrote to memory of 1260	1312	firefox.exe	85
PID 1312 wrote to memory of 1260	1312	firefox.exe	85
PID 1312 wrote to memory of 1260	1312	firefox.exe	85
PID 1312 wrote to memory of 1260	1312	firefox.exe	85
PID 1312 wrote to memory of 1260	1312	firefox.exe	85
PID 1312 wrote to memory of 1260	1312	firefox.exe	85
PID 1312 wrote to memory of 1260	1312	firefox.exe	85
PID 1312 wrote to memory of 1260	1312	firefox.exe	85
PID 1312 wrote to memory of 1260	1312	firefox.exe	85
PID 1312 wrote to memory of 1260	1312	firefox.exe	85
PID 1312 wrote to memory of 1260	1312	firefox.exe	85
PID 1312 wrote to memory of 1260	1312	firefox.exe	85
PID 1312 wrote to memory of 1260	1312	firefox.exe	85
PID 1312 wrote to memory of 1260	1312	firefox.exe	85
PID 1312 wrote to memory of 1260	1312	firefox.exe	85
PID 1312 wrote to memory of 1260	1312	firefox.exe	85
PID 1312 wrote to memory of 1260	1312	firefox.exe	85
PID 1312 wrote to memory of 1260	1312	firefox.exe	85
PID 1312 wrote to memory of 1260	1312	firefox.exe	85
PID 1312 wrote to memory of 1260	1312	firefox.exe	85
PID 1312 wrote to memory of 1260	1312	firefox.exe	85
PID 1312 wrote to memory of 1260	1312	firefox.exe	85
PID 1312 wrote to memory of 1260	1312	firefox.exe	85
PID 1312 wrote to memory of 1260	1312	firefox.exe	85
PID 1312 wrote to memory of 1260	1312	firefox.exe	85
PID 1312 wrote to memory of 1260	1312	firefox.exe	85
PID 1312 wrote to memory of 1260	1312	firefox.exe	85
PID 1312 wrote to memory of 1260	1312	firefox.exe	85
PID 1312 wrote to memory of 1260	1312	firefox.exe	85

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\b0fe3596f9cc2cc542a7bb3f501cb2c8974e50f5c93fbcef9d52ed5b8d48ad37.exe
"C:\Users\Admin\AppData\Local\Temp\b0fe3596f9cc2cc542a7bb3f501cb2c8974e50f5c93fbcef9d52ed5b8d48ad37.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3336
- C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
  "C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2328
- - C:\Users\Admin\AppData\Local\Temp\1000006001\836664c2b4.exe
    "C:\Users\Admin\AppData\Local\Temp\1000006001\836664c2b4.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:4548
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\IDBKKKKKFB.exe"
      4⤵
      PID:944
    - - C:\Users\Admin\AppData\Local\Temp\IDBKKKKKFB.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IDBKKKKKFB.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        
        PID:756
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\FCAAEHJDBK.exe"
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:3440
- - C:\Users\Admin\AppData\Local\Temp\1000011001\8cfb1746db.exe
    "C:\Users\Admin\AppData\Local\Temp\1000011001\8cfb1746db.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:324
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3820
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
        5⤵
        Checks processor information in registry
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1312
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1980 -parentBuildID 20240401114208 -prefsHandle 1896 -prefMapHandle 1888 -prefsLen 25751 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {dad9c717-e2b0-47e0-adc5-ec27c6b06dea} 1312 "\\.\pipe\gecko-crash-server-pipe.1312" gpu
        6⤵
        
        PID:1260
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2400 -parentBuildID 20240401114208 -prefsHandle 2376 -prefMapHandle 2364 -prefsLen 26671 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3fc89b91-e1af-4a78-88f2-ba54b7e12566} 1312 "\\.\pipe\gecko-crash-server-pipe.1312" socket
        6⤵
        
        PID:3544
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3264 -childID 1 -isForBrowser -prefsHandle 3256 -prefMapHandle 3252 -prefsLen 22698 -prefMapSize 244658 -jsInitHandle 1288 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {25a1c0e7-5df5-446b-84b0-d551c5f5070f} 1312 "\\.\pipe\gecko-crash-server-pipe.1312" tab
        6⤵
        
        PID:3596
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3908 -childID 2 -isForBrowser -prefsHandle 3900 -prefMapHandle 3896 -prefsLen 31161 -prefMapSize 244658 -jsInitHandle 1288 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {aab3c639-393c-4eca-998d-56c0edf8caf9} 1312 "\\.\pipe\gecko-crash-server-pipe.1312" tab
        6⤵
        
        PID:4428
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4544 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4520 -prefMapHandle 4484 -prefsLen 31161 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {67f3d440-2233-4282-be52-fa56d362f9d0} 1312 "\\.\pipe\gecko-crash-server-pipe.1312" utility
        6⤵
        Checks processor information in registry
        
        PID:1224
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5684 -childID 3 -isForBrowser -prefsHandle 5668 -prefMapHandle 5652 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1288 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2fac70d8-1206-473f-bfb4-37b7acad5e33} 1312 "\\.\pipe\gecko-crash-server-pipe.1312" tab
        6⤵
        
        PID:2944
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5836 -childID 4 -isForBrowser -prefsHandle 5620 -prefMapHandle 5624 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1288 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {10126194-2598-42be-bf46-547af6104895} 1312 "\\.\pipe\gecko-crash-server-pipe.1312" tab
        6⤵
        
        PID:2728
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5948 -childID 5 -isForBrowser -prefsHandle 5956 -prefMapHandle 5964 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1288 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6c1192f7-75e6-4ed8-bd62-d34369aadbfd} 1312 "\\.\pipe\gecko-crash-server-pipe.1312" tab
        6⤵
        
        PID:2392

C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1916

C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DBKKFHIEGDHJKECAAKKE

Path C:\ProgramData\DBKKFHIEGDHJKECAAKKE
Size 11KB
SHA256 846827226d4682e8c8156f495db21a9f1f5fe8f1e693263cfa2e77254149c0f6
MD5 a89586b0c291b2cbb8be946f4836126c
SHA1 44f5dc6b2c8c4ea53d6c040c2c7d23f8660d72bb
SHA512 c01b77088a2a6a2aa68a49bb1239f861bed9a349e111e41c1dd6ab694a985279b836bb8df40cb02c21d4368ca2384182f2b7273790a2ab48e54977629b4e9734
SSDEEP 192:5J5nlRMft3aqT+YzOdTgJlcd7zLQHr160maXza4XBw8HM:5o3+YzO9fpzLQL88twd
MD5 SHA1 SHA512 SSDEEP

Submit Download

mozglue.dll

Path C:\ProgramData\mozglue.dll
Size 593KB
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
SSDEEP 12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5 SHA1 SHA512 SSDEEP

Submit Download

nss3.dll

Path C:\ProgramData\nss3.dll
Size 2.0MB
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
SSDEEP 49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5 SHA1 SHA512 SSDEEP

Submit Download

activity-stream.discovery_stream.json.tmp

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\7qnbgwy0.default-release\activity-stream.discovery_stream.json.tmp
Size 18KB
SHA256 16977839ee713ec9528ab8a3326b99f0c0c65b59c0be156fb3e3fcfc9f5eca25
MD5 e923e7fdacbf535cc2e617fea862fda2
SHA1 a60fd3c54df0b7604f22417b8d39d8efda1abc72
SHA512 7eeb4e5a156085b15a5171f99e9aeba3061c51212376905fec2c1d0f0dc3640c683f798a0af4a1d80e1579bcb76dbf0f401979f87639c7aad0c381183c441bcd
SSDEEP 384:a75nmecwWI3d17rOF412sbmIPqibzofiSlE7pZ6PFrO/yaE:aZHHt17113y/q9MO/yp
MD5 SHA1 SHA512 SSDEEP

Submit Download

8A2034D325DC0B5C9E11EDDA3FC70A54C8DC1C0D

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\7qnbgwy0.default-release\cache2\entries\8A2034D325DC0B5C9E11EDDA3FC70A54C8DC1C0D
Size 13KB
SHA256 07298848ecdbf325c94b2eadedc21d2de3f6ddd75a87a72032bb6780eb22fe02
MD5 d3867a26df08b7d435bdbedb88bb8d04
SHA1 b3e202f039dfded7cfc1e23b854b910605cba03a
SHA512 e87e38fef4c4e1ac1c0e09740eac876518204175fa9e2db637891d81541d4fe1ba02d8bee57aa397297506cb7c327a6828f58d265917c935b86140cb713f6ece
SSDEEP 384:H485u9fiGLm4pUWft2WlOX8lPLZZB7t0lpDIIF7+:nUBi8mCUWft2WAX8tzB7eD8h
MD5 SHA1 SHA512 SSDEEP

Submit Download

836664c2b4.exe

Path C:\Users\Admin\AppData\Local\Temp\1000006001\836664c2b4.exe
Size 2.4MB
SHA256 a1eff1aaed6950dd710f372001f4cb1cf4092b0af4c9d9527db0b267624b3f4f
MD5 b26dcc8942a0a048f694c735358ddf33
SHA1 1fa45273a085340e7797e9e2a039f9fc9391744c
SHA512 f03c88c854cd4ddb1bfda877e49a86705dbf55095235b632b9f42772f7b6f1bad049d01558a96652b9873f510428d90d8188a43ca14e3381c0fd5f766f49580f
SSDEEP 49152:bgZBZajIJYae4a3JWHlBEhCh/bsc2eCIpsAG2ECHUe1R1qpNmIE7gd:U1oie3cFLFyUCAhHUe1R1qpNZr
MD5 SHA1 SHA512 SSDEEP

Submit Download

8cfb1746db.exe

Path C:\Users\Admin\AppData\Local\Temp\1000011001\8cfb1746db.exe
Size 1.2MB
SHA256 4a772ec8619b3d1ff899763f642cadb059108391fef145b4138817d0cc9fb084
MD5 12d6b2e36bce3898330c0b77410fd9ed
SHA1 fb57352b538eb9b6fa981a8a08e3a5b2765c5ee8
SHA512 fa916e3d27c4639b3bd0f1e74d8ba6c6c311a7113d8aaca71667555d8a0b1d25ff5b7636cfaac441f408a2b55c39fdef4adb17510436565b3e83617a5ce008c2
SSDEEP 24576:3qDEvCTbMWu7rQYlBQcBiT6rprG8aLP2Sbly7TWEPje:3TvC/MTQYxsWR7aLP2dW
MD5 SHA1 SHA512 SSDEEP

Submit Download

explorti.exe

Path C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
Size 1.8MB
SHA256 b0fe3596f9cc2cc542a7bb3f501cb2c8974e50f5c93fbcef9d52ed5b8d48ad37
MD5 60be661051bc2fc08d6902bb872f41f8
SHA1 664adbf94beadf1ff0a1de1ebacc286ee01f85b1
SHA512 1d288d3c31d7da04b1622e0af4b32cde34b803eed8964eab3e74ad4fecee72ff1fad3afae9b28662a4430e0f722f6a284dd71bc87cf732603c9b62a990e7b4c4
SSDEEP 49152:So2OyIyp5tpQpU+gEog4gZ17ISPo7nIo84+C:xMN5LQpU+gEogpZN/ozR84+C
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 479KB
SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
MD5 09372174e83dbbf696ee732fd2e875bb
SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 13.8MB
SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
MD5 0a8747a2ac9ac08ae9508f36c6d75692
SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7qnbgwy0.default-release\AlternateServices.bin
Size 8KB
SHA256 8f87ed52e38e67f63b8697a767823d6e7d42fc15d67b8b77a58ebf0e7af79ae7
MD5 09dd45cfb7e40d6f096e493e24c7910a
SHA1 ef7193a33bd9c402d75a59ce61b522dc7907ae26
SHA512 f63a392018a56b85d5aa99d182503818e12345ee414710bb0a80c0b0d284eab4fd3c7e0cc24638bdab44dcd26af207c70c14416a2c0844a204c1204c71774275
SSDEEP 24:EuB1ow4Ggu1xgRbJkpR5cOPuhMZ2Fsh2F3LFcFsJbF0Jvib+PWKsJblxWKf+vib:gG5oS9cOTebOJ6b+Ppebvpf+6b
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7qnbgwy0.default-release\AlternateServices.bin
Size 11KB
SHA256 28a6e78aecb958d4353e3ee4a9239d7ac409df840b715eede56dbee71f69f0d7
MD5 1256bf303a727b147bf47c804ddcbe80
SHA1 fb4ad8853181e9cd68acd6e281128daad1e833a9
SHA512 9c7fa48bd86ae8f05df42843665b932a5615704bb5a123508dd338e9cac5ffb76415e65865d7331e736c3dd9eaa9fa8457f3a28220309fe9388f0c47a6412c16
SSDEEP 96:gG5ouebOJ6bypebvpf+6bXbDbSgbgz4b:gG5Vu
MD5 SHA1 SHA512 SSDEEP

Submit Download

cookies.sqlite-wal

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7qnbgwy0.default-release\cookies.sqlite-wal
Size 192KB
SHA256 96eb5bafe396ec83f25226a716c3df36e4308e9a4ce770b2f3c273b6a951ab16
MD5 4d4daf6cc313e4501d120f7c904d919c
SHA1 dd347bc4a3be9f698c8df0f3d2a1ee3e9be5b643
SHA512 d72e165678663f56e5a5e1040fac79e8523ea7c06b1156d581e067af6e727e81b9fd19877aeb6e98f6dc1cc80d68aa79bd79fde1668f14320a895926727a0660
SSDEEP 48:+2rGG250X2BPFG2J+0AWo/Ph2BPFG2OZo5oGUh+G:rMU2BP0W+3/Ph2BP0JoKGUh+G
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7qnbgwy0.default-release\datareporting\glean\db\data.safe.tmp
Size 15KB
SHA256 f71c085b95dbd56a38dbcfe3a0921a8756afeac30871ca27e42265c513d1391b
MD5 b16f33e14e0b42cb9c8373b62ef4042f
SHA1 bd5a2d6551d3630562f64b48148d44d6ca655877
SHA512 477ecc436175c1920c529809eea579e35c9d214edc898349bcaaeca249db4649f5dce56466c04de54e2739de54e00a17430661131436851ef946e7a30fc13f0d
SSDEEP 384:yaRnxGg2yWD5FvRbrbrez/66JozQzgC1bPbofc0jPY:5UgMD5FvRbrbyum1sQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7qnbgwy0.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 6c6b0482eaa3b864d7c8d2b18814f08e680aa5e766391ab214e3cba0cb808798
MD5 cb39307d33755c34c385cae3df599916
SHA1 4d3b151bb82da416bb55e791ed0e989c53a6333c
SHA512 ff7154aff2cd48df2c00212129b122c55edd398f35cb38012b773a1c06725a7d407eed6bb3938892c62bb2b6096f9bc529a743addb49f681fc96c69de1f50d2a
SSDEEP 96:qBmSMF9ZbkW6QX0BB/hmtkPP/PrWZyXQ5cD7Fl66Joz0dzgClKtmSS:nrvZboH/hEaPCI/66Joz0dzgCl6mSS
MD5 SHA1 SHA512 SSDEEP

Submit Download

3ac23a78-011f-4cc7-8e12-4d4f33c56d9b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7qnbgwy0.default-release\datareporting\glean\pending_pings\3ac23a78-011f-4cc7-8e12-4d4f33c56d9b
Size 671B
SHA256 3d59a074f2bb9a45bd6fc1f7a6d87d1851f4a664c95f06e77091438ca40943c9
MD5 a71e23feef8b1ac48160c1ff72074ca7
SHA1 9b8e5a38a63c05b912ce095dbb553b35c286b70c
SHA512 55b1b520386c87b2779448d12eaa7f515c56c13a6153ee6994d512c321082e897d60f8efb8b174732471482dc86ea9864e8922a959e3a36b6f6cdcb79e33bb8b
MD5 SHA1 SHA512

Submit Download

77200a2e-5768-4fca-ac94-feaaeafd4c03

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7qnbgwy0.default-release\datareporting\glean\pending_pings\77200a2e-5768-4fca-ac94-feaaeafd4c03
Size 982B
SHA256 b7f1026e29c568c9984a324c2d14627042ecc882de4c251fd8f6ed3edba6b81d
MD5 2d41ea27c0e8d2a87bbd07e3e4c8debe
SHA1 4c58ff3be103d3af5eda595062a4d72e05542e22
SHA512 4b9e052512947581d7c0079e1909e489edccf1aba7985b1f51630a41fc2226d6ca76e5e0c16eed2f6fb3a1730d793584c55aa1b610b86d1d04b9a8d0a3eb9da1
MD5 SHA1 SHA512

Submit Download

ca953568-dacc-4208-85f7-ce10ca5c5ee5

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7qnbgwy0.default-release\datareporting\glean\pending_pings\ca953568-dacc-4208-85f7-ce10ca5c5ee5
Size 25KB
SHA256 1a28a9b31d0c35df6a8114683e33fbc23546ebc1ec106dbe480806035b480922
MD5 4e91b8f338f945f5676701504f0a1225
SHA1 38d75b1b8023dcd971b83b4ae74d181ae0582360
SHA512 210924cb81d9b1dae3e0a340c4771e8b40fe5d2818c7ffc1dbe970deb814766c34e34e8a5105a0d91dcdbbc12eaa319648d865ce1c61cf556962af6e70d24c52
SSDEEP 192:jNhaZ0b0FjwsoAz9mzwL8vPj4/LfABjeM/U1Q6N++ejOau0dG/G2e8efVDnbdYRq:jNp0Fx4kRzyaEuDyg7WilOEbK4S
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7qnbgwy0.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Size 1.1MB
SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
MD5 842039753bf41fa5e11b3a1383061a87
SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7qnbgwy0.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Size 116B
SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
MD5 2a461e9eb87fd1955cea740a3444ee7a
SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7qnbgwy0.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Size 372B
SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
MD5 bf957ad58b55f64219ab3f793e374316
SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7qnbgwy0.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Size 17.8MB
SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
MD5 daf7ef3acccab478aaa7d6dc1c60f865
SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
MD5 SHA1 SHA512 SSDEEP

Submit Download

places.sqlite-wal

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7qnbgwy0.default-release\places.sqlite-wal
Size 992KB
SHA256 c1c309dacce732aa3cf601ef8936a9024286bff98920071aba7ee4011aa42860
MD5 1527397b7e6fa722127219a85e29c4bc
SHA1 5580e8089ea3ee808e9de534f9c4d4bef6aab9ef
SHA512 1e1c897dd8e7b1c198867d72b492d9a0a7cda2f9cd5991ca66658eef245f0355b869a59029dd7a87aac26f4d8fe681f2e030b58305bbaa79d08ac5d2556b5d0c
SSDEEP 192:AJIC8EthIgx/S1JIdhKiYATuMj2x/xt1JIf:AuCYgM1uqiHH211uf
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7qnbgwy0.default-release\prefs-1.js
Size 15KB
SHA256 55767257749cc9f05002b879528d04bbc40a0704eb62edd7132a1c057e07e54a
MD5 818becb7dc9955be9a2e46db227352c6
SHA1 4b989d870d3a95fc351c3764d64e285929c96c29
SHA512 58b15fbe65580986d80a049af62dcb77b0a7ca11a036f44c6ae1ab0d89862719d2ee580a82fdf9ce3e8ea155f53c175d2dc93e4cdb23a4fa60d6b70509419c51
SSDEEP 192:CPJunlRMfUvnqT+YzOdTgJlcd7zLQHr160maXTT+a4hiBw8HeEaTJCG:6d5+YzO9fpzLQL8jKwxF
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7qnbgwy0.default-release\prefs.js
Size 11KB
SHA256 4bc0ce2941467b2a163be2975af04cb2c0a40116cf583e7668f987eb5f96d29b
MD5 a1c9ae3f7b108f4a9bd9aebc8d39573e
SHA1 f886b853873e1ad241037b93259d85c8b01182be
SHA512 f8f6485c3c0292096e0ad01e49769bc09f49f58ed77090ed3d60e3ab3af2b62415d0464bd5a334960dce669625be21ac9838a077896354ab28813fa040594e58
SSDEEP 192:CPJ5nlRMftvnqT+YzOdTgJlcd7zLQHr160maXTZa4PBw8He/:6o6+YzO9fpzLQL8+Vwj
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7qnbgwy0.default-release\prefs.js
Size 11KB
SHA256 512acb72e3b8fd9371314f0c1a529e4cb5410df0a5f07059afb05ef45546f4ad
MD5 bab0fed137ed0613d27de9e10dbd2b12
SHA1 3d65d06998f845cfe6167ca111d747e1c6d6e489
SHA512 437d2eee6a5126d642f58cbacaaa56a95259d2d59f2d81f634727d993d59e6cb9b4f1ba7389e71fa9baabcde22a81627e9e11c39a9a63ba62847a71e922d712e
SSDEEP 192:5J5nlRMftvnqT+YzOdTgJlcd7zLQHr160maXTZa4XBw8HM:5o6+YzO9fpzLQL8+twd
MD5 SHA1 SHA512 SSDEEP

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7qnbgwy0.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 976KB
SHA256 71ea4f0b80187a6bcd0ea530ce74ef66106ab24bf5bfbdc5cb8e118562e50a4e
MD5 d90e6383e0b596dd6f9dbdc53822f52a
SHA1 b9ac4db34c45fe59335586adc0a925bbb9ec8d16
SHA512 af325a98b40b5fb94f498f466bdae2ad3029b3734fd7fc2cabd2b942a0c8a2cabca99e9d4c479a93d55675a2e8a4777d1dbc551b78edffaf4496812dd1e0c6ae
SSDEEP 6144:T7rST3K393z3m3LTHT5ns6vB7UlvShQ4Ub9SsHNeHN1HmcH11HFZmz0Pu/el9TDJ:u1s6ZQlvwQZbi36ec0HU4
MD5 SHA1 SHA512 SSDEEP

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7qnbgwy0.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 2.3MB
SHA256 ae23d550f1079f2ecdf6263b27b9b1782f80c604c561598046a8898f4046e208
MD5 6311df21fb67c80c68fc005c29ffbbfe
SHA1 49722d7ef465fbc41d3dac406ff51f34fc24a639
SHA512 c38833d8711c800d03caa8d10feb1115515b47f111897888e706ec665697d240c6925128f83b79e508aecb8cbe333782ee0cf7089ac26d74b4764db01a469677
SSDEEP 49152:7BCC5FhiDNezybOxgUJYxivIsYTfmwcSFZN3nrruAyDf08nxujaU0Hm+5CV5xK++:Dv
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/756-462-0x0000000000980000-0x0000000000E30000-memory.dmp

Download

memory/756-466-0x0000000000980000-0x0000000000E30000-memory.dmp

Download

memory/1916-490-0x0000000000E40000-0x00000000012F0000-memory.dmp

Download

memory/1916-491-0x0000000000E40000-0x00000000012F0000-memory.dmp

Download

memory/2328-1477-0x0000000000E40000-0x00000000012F0000-memory.dmp

Download

memory/2328-2636-0x0000000000E40000-0x00000000012F0000-memory.dmp

Download

memory/2328-483-0x0000000000E40000-0x00000000012F0000-memory.dmp

Download

memory/2328-488-0x0000000000E40000-0x00000000012F0000-memory.dmp

Download

memory/2328-473-0x0000000000E40000-0x00000000012F0000-memory.dmp

Download

memory/2328-472-0x0000000000E40000-0x00000000012F0000-memory.dmp

Download

memory/2328-19-0x0000000000E41000-0x0000000000E6F000-memory.dmp

Download

memory/2328-2643-0x0000000000E40000-0x00000000012F0000-memory.dmp

Download

memory/2328-482-0x0000000000E40000-0x00000000012F0000-memory.dmp

Download

memory/2328-16-0x0000000000E40000-0x00000000012F0000-memory.dmp

Download

memory/2328-2637-0x0000000000E40000-0x00000000012F0000-memory.dmp

Download

memory/2328-2629-0x0000000000E40000-0x00000000012F0000-memory.dmp

Download

memory/2328-455-0x0000000000E40000-0x00000000012F0000-memory.dmp

Download

memory/2328-20-0x0000000000E40000-0x00000000012F0000-memory.dmp

Download

memory/2328-2635-0x0000000000E40000-0x00000000012F0000-memory.dmp

Download

memory/2328-2634-0x0000000000E40000-0x00000000012F0000-memory.dmp

Download

memory/2328-2625-0x0000000000E40000-0x00000000012F0000-memory.dmp

Download

memory/2328-21-0x0000000000E40000-0x00000000012F0000-memory.dmp

Download

memory/2328-2334-0x0000000000E40000-0x00000000012F0000-memory.dmp

Download

memory/2328-796-0x0000000000E40000-0x00000000012F0000-memory.dmp

Download

memory/2328-2630-0x0000000000E40000-0x00000000012F0000-memory.dmp

Download

memory/2868-2632-0x0000000000E40000-0x00000000012F0000-memory.dmp

Download

memory/2868-2633-0x0000000000E40000-0x00000000012F0000-memory.dmp

Download

memory/3336-18-0x00000000000F0000-0x00000000005A0000-memory.dmp

Download

memory/3336-0-0x00000000000F0000-0x00000000005A0000-memory.dmp

Download

memory/3336-1-0x0000000077486000-0x0000000077488000-memory.dmp

Download

memory/3336-2-0x00000000000F1000-0x000000000011F000-memory.dmp

Download

memory/3336-3-0x00000000000F0000-0x00000000005A0000-memory.dmp

Download

memory/3336-5-0x00000000000F0000-0x00000000005A0000-memory.dmp

Download

memory/4548-56-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Download

memory/4548-37-0x00000000008A0000-0x000000000148B000-memory.dmp

Download

memory/4548-458-0x00000000008A0000-0x000000000148B000-memory.dmp

Download