amadey | 1326a5c22f188c3fb78e59dc0e0f634f4534d6cd4e7621e02c2d7d74ac023128

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20240709-en
resource tags

arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
submitted
15/07/2024, 10:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1326a5c22f188c3fb78e59dc0e0f634f4534d6cd4e7621e02c2d7d74ac023128.exe
Size 1.8MB
Sample240715-mkb8vasamr
SHA256 1326a5c22f188c3fb78e59dc0e0f634f4534d6cd4e7621e02c2d7d74ac023128
MD5 a8c65cc05327c34801572d74ed6235ff
SHA1 a70aab162f01ae5d30de9e88405f991e073dc1b6
SHA512 39bd812719ca0024f51193b2891730e53a28c548102e1fb60819f95c05e0d2fb5f24ca1eca055543c753f0f30fd91ac78573d77d67b9bc924a6d6890fa18653c
SSDEEP 49152:RKVr73llEwe8xsmRxw74P2zSAdXJDulxokqUZBMsU:kVr7jeOs4xGzSuZic
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey stealc 4dd39d funny discovery evasion spyware stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.30

Botnet

4dd39d

http://77.91.77.82

Attributes

install_dir
ad40971b6b
install_file
explorti.exe
strings_key
a434973ad22def7137dbb5e059b7081e
url_paths
/Hun4Ko/index.php

rc4.plain

Extracted

Family

stealc

Botnet

funny

http://85.28.47.30

Attributes

url_path
/920475a59bac849d.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Stealc
Stealc is an infostealer written in C++.
stealer stealc

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	1326a5c22f188c3fb78e59dc0e0f634f4534d6cd4e7621e02c2d7d74ac023128.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	IEHJJECBKK.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 10 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	IEHJJECBKK.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	IEHJJECBKK.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	1326a5c22f188c3fb78e59dc0e0f634f4534d6cd4e7621e02c2d7d74ac023128.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	1326a5c22f188c3fb78e59dc0e0f634f4534d6cd4e7621e02c2d7d74ac023128.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe

Executes dropped EXE 6 IoCs

pid	Process
4392	explorti.exe
336	665b78ed3c.exe
248	ba7204ab8f.exe
2472	IEHJJECBKK.exe
4376	explorti.exe
3848	explorti.exe

Identifies Wine through registry keys 2 TTPs 5 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-126710838-2490174220-686410903-1000\Software\Wine	1326a5c22f188c3fb78e59dc0e0f634f4534d6cd4e7621e02c2d7d74ac023128.exe
Key opened	\REGISTRY\USER\S-1-5-21-126710838-2490174220-686410903-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-126710838-2490174220-686410903-1000\Software\Wine	IEHJJECBKK.exe
Key opened	\REGISTRY\USER\S-1-5-21-126710838-2490174220-686410903-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-126710838-2490174220-686410903-1000\Software\Wine	explorti.exe

Loads dropped DLL 2 IoCs

pid	Process
336	665b78ed3c.exe
336	665b78ed3c.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x000100000002aac5-42.dat	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs

pid	Process
4052	1326a5c22f188c3fb78e59dc0e0f634f4534d6cd4e7621e02c2d7d74ac023128.exe
4392	explorti.exe
336	665b78ed3c.exe
336	665b78ed3c.exe
336	665b78ed3c.exe
2472	IEHJJECBKK.exe
4376	explorti.exe
3848	explorti.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\explorti.job	1326a5c22f188c3fb78e59dc0e0f634f4534d6cd4e7621e02c2d7d74ac023128.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	665b78ed3c.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	665b78ed3c.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-126710838-2490174220-686410903-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4052	1326a5c22f188c3fb78e59dc0e0f634f4534d6cd4e7621e02c2d7d74ac023128.exe
4052	1326a5c22f188c3fb78e59dc0e0f634f4534d6cd4e7621e02c2d7d74ac023128.exe
4392	explorti.exe
4392	explorti.exe
336	665b78ed3c.exe
336	665b78ed3c.exe
336	665b78ed3c.exe
336	665b78ed3c.exe
2472	IEHJJECBKK.exe
2472	IEHJJECBKK.exe
4376	explorti.exe
4376	explorti.exe
3848	explorti.exe
3848	explorti.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4632	firefox.exe
Token: SeDebugPrivilege	4632	firefox.exe
Token: SeDebugPrivilege	4632	firefox.exe
Token: SeDebugPrivilege	4632	firefox.exe
Token: SeDebugPrivilege	4632	firefox.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4052	1326a5c22f188c3fb78e59dc0e0f634f4534d6cd4e7621e02c2d7d74ac023128.exe
248	ba7204ab8f.exe
248	ba7204ab8f.exe
248	ba7204ab8f.exe
248	ba7204ab8f.exe
248	ba7204ab8f.exe
248	ba7204ab8f.exe
248	ba7204ab8f.exe
4632	firefox.exe
4632	firefox.exe
4632	firefox.exe
4632	firefox.exe
4632	firefox.exe
4632	firefox.exe
4632	firefox.exe
4632	firefox.exe
4632	firefox.exe
4632	firefox.exe
4632	firefox.exe
4632	firefox.exe
4632	firefox.exe
4632	firefox.exe
4632	firefox.exe
4632	firefox.exe
4632	firefox.exe
4632	firefox.exe
4632	firefox.exe
4632	firefox.exe
4632	firefox.exe
248	ba7204ab8f.exe
248	ba7204ab8f.exe
248	ba7204ab8f.exe
248	ba7204ab8f.exe
248	ba7204ab8f.exe
248	ba7204ab8f.exe
248	ba7204ab8f.exe
248	ba7204ab8f.exe
248	ba7204ab8f.exe
248	ba7204ab8f.exe
248	ba7204ab8f.exe
248	ba7204ab8f.exe
248	ba7204ab8f.exe
248	ba7204ab8f.exe
248	ba7204ab8f.exe
248	ba7204ab8f.exe
248	ba7204ab8f.exe
248	ba7204ab8f.exe
248	ba7204ab8f.exe
248	ba7204ab8f.exe
248	ba7204ab8f.exe
248	ba7204ab8f.exe
248	ba7204ab8f.exe
248	ba7204ab8f.exe
248	ba7204ab8f.exe
248	ba7204ab8f.exe
248	ba7204ab8f.exe
248	ba7204ab8f.exe
248	ba7204ab8f.exe
248	ba7204ab8f.exe
248	ba7204ab8f.exe
248	ba7204ab8f.exe
248	ba7204ab8f.exe
248	ba7204ab8f.exe
248	ba7204ab8f.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
248	ba7204ab8f.exe
248	ba7204ab8f.exe
248	ba7204ab8f.exe
248	ba7204ab8f.exe
248	ba7204ab8f.exe
248	ba7204ab8f.exe
248	ba7204ab8f.exe
248	ba7204ab8f.exe
248	ba7204ab8f.exe
248	ba7204ab8f.exe
248	ba7204ab8f.exe
248	ba7204ab8f.exe
248	ba7204ab8f.exe
248	ba7204ab8f.exe
248	ba7204ab8f.exe
248	ba7204ab8f.exe
248	ba7204ab8f.exe
248	ba7204ab8f.exe
248	ba7204ab8f.exe
248	ba7204ab8f.exe
248	ba7204ab8f.exe
248	ba7204ab8f.exe
248	ba7204ab8f.exe
248	ba7204ab8f.exe
248	ba7204ab8f.exe
248	ba7204ab8f.exe
248	ba7204ab8f.exe
248	ba7204ab8f.exe
248	ba7204ab8f.exe
248	ba7204ab8f.exe
248	ba7204ab8f.exe
248	ba7204ab8f.exe
248	ba7204ab8f.exe
248	ba7204ab8f.exe
248	ba7204ab8f.exe
248	ba7204ab8f.exe
248	ba7204ab8f.exe
248	ba7204ab8f.exe
248	ba7204ab8f.exe
248	ba7204ab8f.exe
248	ba7204ab8f.exe
248	ba7204ab8f.exe
248	ba7204ab8f.exe
248	ba7204ab8f.exe
248	ba7204ab8f.exe
248	ba7204ab8f.exe
248	ba7204ab8f.exe
248	ba7204ab8f.exe
248	ba7204ab8f.exe
248	ba7204ab8f.exe
248	ba7204ab8f.exe
248	ba7204ab8f.exe
248	ba7204ab8f.exe
248	ba7204ab8f.exe
248	ba7204ab8f.exe
248	ba7204ab8f.exe
248	ba7204ab8f.exe
248	ba7204ab8f.exe
248	ba7204ab8f.exe
248	ba7204ab8f.exe
248	ba7204ab8f.exe
248	ba7204ab8f.exe
248	ba7204ab8f.exe
248	ba7204ab8f.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
336	665b78ed3c.exe
4632	firefox.exe
2380	cmd.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4052 wrote to memory of 4392	4052	1326a5c22f188c3fb78e59dc0e0f634f4534d6cd4e7621e02c2d7d74ac023128.exe	78
PID 4052 wrote to memory of 4392	4052	1326a5c22f188c3fb78e59dc0e0f634f4534d6cd4e7621e02c2d7d74ac023128.exe	78
PID 4052 wrote to memory of 4392	4052	1326a5c22f188c3fb78e59dc0e0f634f4534d6cd4e7621e02c2d7d74ac023128.exe	78
PID 4392 wrote to memory of 336	4392	explorti.exe	79
PID 4392 wrote to memory of 336	4392	explorti.exe	79
PID 4392 wrote to memory of 336	4392	explorti.exe	79
PID 4392 wrote to memory of 248	4392	explorti.exe	80
PID 4392 wrote to memory of 248	4392	explorti.exe	80
PID 4392 wrote to memory of 248	4392	explorti.exe	80
PID 248 wrote to memory of 628	248	ba7204ab8f.exe	81
PID 248 wrote to memory of 628	248	ba7204ab8f.exe	81
PID 628 wrote to memory of 4632	628	firefox.exe	84
PID 628 wrote to memory of 4632	628	firefox.exe	84
PID 628 wrote to memory of 4632	628	firefox.exe	84
PID 628 wrote to memory of 4632	628	firefox.exe	84
PID 628 wrote to memory of 4632	628	firefox.exe	84
PID 628 wrote to memory of 4632	628	firefox.exe	84
PID 628 wrote to memory of 4632	628	firefox.exe	84
PID 628 wrote to memory of 4632	628	firefox.exe	84
PID 628 wrote to memory of 4632	628	firefox.exe	84
PID 628 wrote to memory of 4632	628	firefox.exe	84
PID 628 wrote to memory of 4632	628	firefox.exe	84
PID 4632 wrote to memory of 2800	4632	firefox.exe	85
PID 4632 wrote to memory of 2800	4632	firefox.exe	85
PID 4632 wrote to memory of 2800	4632	firefox.exe	85
PID 4632 wrote to memory of 2800	4632	firefox.exe	85
PID 4632 wrote to memory of 2800	4632	firefox.exe	85
PID 4632 wrote to memory of 2800	4632	firefox.exe	85
PID 4632 wrote to memory of 2800	4632	firefox.exe	85
PID 4632 wrote to memory of 2800	4632	firefox.exe	85
PID 4632 wrote to memory of 2800	4632	firefox.exe	85
PID 4632 wrote to memory of 2800	4632	firefox.exe	85
PID 4632 wrote to memory of 2800	4632	firefox.exe	85
PID 4632 wrote to memory of 2800	4632	firefox.exe	85
PID 4632 wrote to memory of 2800	4632	firefox.exe	85
PID 4632 wrote to memory of 2800	4632	firefox.exe	85
PID 4632 wrote to memory of 2800	4632	firefox.exe	85
PID 4632 wrote to memory of 2800	4632	firefox.exe	85
PID 4632 wrote to memory of 2800	4632	firefox.exe	85
PID 4632 wrote to memory of 2800	4632	firefox.exe	85
PID 4632 wrote to memory of 2800	4632	firefox.exe	85
PID 4632 wrote to memory of 2800	4632	firefox.exe	85
PID 4632 wrote to memory of 2800	4632	firefox.exe	85
PID 4632 wrote to memory of 2800	4632	firefox.exe	85
PID 4632 wrote to memory of 2800	4632	firefox.exe	85
PID 4632 wrote to memory of 2800	4632	firefox.exe	85
PID 4632 wrote to memory of 2800	4632	firefox.exe	85
PID 4632 wrote to memory of 2800	4632	firefox.exe	85
PID 4632 wrote to memory of 2800	4632	firefox.exe	85
PID 4632 wrote to memory of 2800	4632	firefox.exe	85
PID 4632 wrote to memory of 2800	4632	firefox.exe	85
PID 4632 wrote to memory of 2800	4632	firefox.exe	85
PID 4632 wrote to memory of 2800	4632	firefox.exe	85
PID 4632 wrote to memory of 2800	4632	firefox.exe	85
PID 4632 wrote to memory of 2800	4632	firefox.exe	85
PID 4632 wrote to memory of 2800	4632	firefox.exe	85
PID 4632 wrote to memory of 2800	4632	firefox.exe	85
PID 4632 wrote to memory of 2800	4632	firefox.exe	85
PID 4632 wrote to memory of 2800	4632	firefox.exe	85
PID 4632 wrote to memory of 2800	4632	firefox.exe	85
PID 4632 wrote to memory of 2800	4632	firefox.exe	85
PID 4632 wrote to memory of 2800	4632	firefox.exe	85
PID 4632 wrote to memory of 2800	4632	firefox.exe	85
PID 4632 wrote to memory of 2800	4632	firefox.exe	85

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\1326a5c22f188c3fb78e59dc0e0f634f4534d6cd4e7621e02c2d7d74ac023128.exe
"C:\Users\Admin\AppData\Local\Temp\1326a5c22f188c3fb78e59dc0e0f634f4534d6cd4e7621e02c2d7d74ac023128.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4052
- C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
  "C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4392
- - C:\Users\Admin\AppData\Local\Temp\1000006001\665b78ed3c.exe
    "C:\Users\Admin\AppData\Local\Temp\1000006001\665b78ed3c.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:336
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\IEHJJECBKK.exe"
      4⤵
      PID:1440
    - - C:\Users\Admin\AppData\Local\Temp\IEHJJECBKK.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IEHJJECBKK.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        
        PID:2472
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\FBGHIIJDGH.exe"
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:2380
- - C:\Users\Admin\AppData\Local\Temp\1000011001\ba7204ab8f.exe
    "C:\Users\Admin\AppData\Local\Temp\1000011001\ba7204ab8f.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:248
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
      4⤵
      Suspicious use of WriteProcessMemory
      PID:628
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
        5⤵
        Checks processor information in registry
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4632
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1932 -parentBuildID 20240401114208 -prefsHandle 1864 -prefMapHandle 1852 -prefsLen 25751 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {dda593ec-bdde-40c1-8ad2-555ac2c44ace} 4632 "\\.\pipe\gecko-crash-server-pipe.4632" gpu
        6⤵
        
        PID:2800
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2352 -parentBuildID 20240401114208 -prefsHandle 2344 -prefMapHandle 2340 -prefsLen 26671 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {84325267-66ee-4616-97e6-4161855abb23} 4632 "\\.\pipe\gecko-crash-server-pipe.4632" socket
        6⤵
        
        PID:1876
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3032 -childID 1 -isForBrowser -prefsHandle 3036 -prefMapHandle 2988 -prefsLen 22698 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b14a0398-cf34-4649-a66b-9a45fc475eb6} 4632 "\\.\pipe\gecko-crash-server-pipe.4632" tab
        6⤵
        
        PID:4776
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4020 -childID 2 -isForBrowser -prefsHandle 4012 -prefMapHandle 4008 -prefsLen 31161 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2b375ba4-6ce3-4e68-8d0a-c123a6e4b0f9} 4632 "\\.\pipe\gecko-crash-server-pipe.4632" tab
        6⤵
        
        PID:3544
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4580 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4812 -prefMapHandle 4808 -prefsLen 31161 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2e081171-032b-486b-921f-faf5b3d14e0b} 4632 "\\.\pipe\gecko-crash-server-pipe.4632" utility
        6⤵
        Checks processor information in registry
        
        PID:2128
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5596 -childID 3 -isForBrowser -prefsHandle 5492 -prefMapHandle 5488 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {644c11ff-477a-408a-aa5e-bf28ec45fee2} 4632 "\\.\pipe\gecko-crash-server-pipe.4632" tab
        6⤵
        
        PID:4512
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3476 -childID 4 -isForBrowser -prefsHandle 5704 -prefMapHandle 5708 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {87d7e4fa-7dc5-458b-a6a5-4660b7e6e95e} 4632 "\\.\pipe\gecko-crash-server-pipe.4632" tab
        6⤵
        
        PID:5104
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5884 -childID 5 -isForBrowser -prefsHandle 5892 -prefMapHandle 5900 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {079ef30f-9264-409c-89c0-7c0da4b80397} 4632 "\\.\pipe\gecko-crash-server-pipe.4632" tab
        6⤵
        
        PID:2640

C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4376

C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mozglue.dll

Path C:\ProgramData\mozglue.dll
Size 593KB
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
SSDEEP 12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5 SHA1 SHA512 SSDEEP

Submit Download

nss3.dll

Path C:\ProgramData\nss3.dll
Size 2.0MB
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
SSDEEP 49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5 SHA1 SHA512 SSDEEP

Submit Download

activity-stream.discovery_stream.json.tmp

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\b0ht3gr0.default-release\activity-stream.discovery_stream.json.tmp
Size 18KB
SHA256 f8bb836bc44885dc976b92e41781699ffc9f50d61da0ca037554c2fa9e31fd4b
MD5 e540baa8e7cb03502efcd2407ec0ebfb
SHA1 6162483d03387d0e49ffaba001fa8ff0045a07cd
SHA512 e75dc25a4112310ee9ac94b0cd905544ee8ab82b7340a66577e759061ad27f664cf1e1924aa2ac580804be5d9809ec7769280515644c136d861133035b5e277c
SSDEEP 384:W6h0UFmecgcZe129WIFKgEsuI1X9l1zofiK5si2bCd+r/Z67gyaE:W6hvb1aHFZUI1KqVJwoSgyp
MD5 SHA1 SHA512 SSDEEP

Submit Download

8A2034D325DC0B5C9E11EDDA3FC70A54C8DC1C0D

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\b0ht3gr0.default-release\cache2\entries\8A2034D325DC0B5C9E11EDDA3FC70A54C8DC1C0D
Size 13KB
SHA256 199358065a7ca91ed2a2b18f28effb0d31f306d2ec329ef564b1144f6d82301d
MD5 fc9d1ce3d0735b13c1d32c8e6f2e67f1
SHA1 3b418d4981a5fce55a7a2fa5158890a365de0f21
SHA512 429d45284f69a508c2a3cb183d194f2d3436be0b5def1a6db0386b8224564dcc4a974fc355fe61d6c9e38d5169f15196b785f295f42a3b925f4e59fa7f26d14a
SSDEEP 384:H485u9fiGLm4pUbft2WlOX8lPLZZB7t0lpDIIty2yn:nUBi8mCUbft2WAX8tzB7eD80RU
MD5 SHA1 SHA512 SSDEEP

Submit Download

665b78ed3c.exe

Path C:\Users\Admin\AppData\Local\Temp\1000006001\665b78ed3c.exe
Size 2.4MB
SHA256 a1eff1aaed6950dd710f372001f4cb1cf4092b0af4c9d9527db0b267624b3f4f
MD5 b26dcc8942a0a048f694c735358ddf33
SHA1 1fa45273a085340e7797e9e2a039f9fc9391744c
SHA512 f03c88c854cd4ddb1bfda877e49a86705dbf55095235b632b9f42772f7b6f1bad049d01558a96652b9873f510428d90d8188a43ca14e3381c0fd5f766f49580f
SSDEEP 49152:bgZBZajIJYae4a3JWHlBEhCh/bsc2eCIpsAG2ECHUe1R1qpNmIE7gd:U1oie3cFLFyUCAhHUe1R1qpNZr
MD5 SHA1 SHA512 SSDEEP

Submit Download

ba7204ab8f.exe

Path C:\Users\Admin\AppData\Local\Temp\1000011001\ba7204ab8f.exe
Size 1.2MB
SHA256 95f8fd1ba8517dd6f425c4a171507a14631b825509ec33a7dda627cc20346dcd
MD5 dcfe8238a720153d4b6fc788c224fc10
SHA1 284cce21452b57e35c1d192eb77919e948bd19f1
SHA512 90875026c07d84c7781d6436fef99dda9ca8ff3ad98ddfccd5a6c149b192b40b07f131e8843087eef3e94496129694ec3ecf8f3f49e353ec3066956a15f69525
SSDEEP 24576:7qDEvCTbMWu7rQYlBQcBiT6rprG8aLj2Sbly7TWEPje:7TvC/MTQYxsWR7aLj2dW
MD5 SHA1 SHA512 SSDEEP

Submit Download

explorti.exe

Path C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
Size 1.8MB
SHA256 1326a5c22f188c3fb78e59dc0e0f634f4534d6cd4e7621e02c2d7d74ac023128
MD5 a8c65cc05327c34801572d74ed6235ff
SHA1 a70aab162f01ae5d30de9e88405f991e073dc1b6
SHA512 39bd812719ca0024f51193b2891730e53a28c548102e1fb60819f95c05e0d2fb5f24ca1eca055543c753f0f30fd91ac78573d77d67b9bc924a6d6890fa18653c
SSDEEP 49152:RKVr73llEwe8xsmRxw74P2zSAdXJDulxokqUZBMsU:kVr7jeOs4xGzSuZic
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 479KB
SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
MD5 09372174e83dbbf696ee732fd2e875bb
SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 13.8MB
SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
MD5 0a8747a2ac9ac08ae9508f36c6d75692
SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\b0ht3gr0.default-release\AlternateServices.bin
Size 12KB
SHA256 58117317807937edd93870d540fe40b8774973040c2d7ff0b87d0e0dc67a38b1
MD5 3fe19f87e71f78c62e8713fe17dcb1bd
SHA1 1ed5d46317f539e7828a77485113cbd3e21ca953
SHA512 76dd27a118ff7ca2c8131edcf285d12c4be1f328c9f6d15e85ef95bcac21476d67aad520e2551f8b4043b6a127d2ea1c85bb145f79ff50a291a40ab0835c0e24
SSDEEP 96:v5oaOebOJztbzpebvpf+ztbQbYtbtgbgzhtbmbatb:v56FugHDn
MD5 SHA1 SHA512 SSDEEP

Submit Download

cookies.sqlite-wal

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\b0ht3gr0.default-release\cookies.sqlite-wal
Size 256KB
SHA256 a74434d1ca5e2dce271fe39a9a887a4b7a3866c7816994abba267114f3af1fd3
MD5 4a98ddc8e38705ab8d9855d6a0dd5934
SHA1 a8fe5b339203489ce4b0d7e43a430020fc582ee0
SHA512 744462643908aa1be0b0f96db1693804a741e9772fef9b317a9656c06d8efc3982cf334663a516d76d4869ca2ec1cdf52ec7dea92294125b73bb040b6b825c61
SSDEEP 96:5jq492a3t+RjW2a3voKGUh+lhkjW2a31auGUh+G:jO8K
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\b0ht3gr0.default-release\datareporting\glean\db\data.safe.tmp
Size 16KB
SHA256 0d2cf18c5886088e1ca1c05a712bf299be3f0497cb26e58b2205fa47bd5f2252
MD5 c5ec9c77eac31ff7ebf1087edaeb33bb
SHA1 ae36b5af5cbf267c8793d650bf94459a1b1472b3
SHA512 1b85e6489cf1d08a2beee4f71f3d8ae4b99e10b06d97c4cea0156ac444dc82580cb1624ae88d795360dcc3697f9ad566d0786f53610e997cc91f111fe206684e
SSDEEP 384:jbolygPpq1JPLoDo4KGbYbce4/66JozQzgC1bM:XE69UDo4KGbYbnFmm
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\b0ht3gr0.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 4ea04ab31a4d153407c4cf5680a7d3e500183fc39b0b761fe900f71c77edf7fc
MD5 a0c512ab9b11978626a73618adad8a64
SHA1 c6b6f97d0a0a4758944f454945e5a4e7b584f776
SHA512 4916aeaaf019702687a815e3157b0bcb33c4bf10c9c61a5ac93c17f4e9a2ae80405d7c752bdefd09d7fd66e20ebf09077cc8a0895cb837da19eb68145b4fdba2
SSDEEP 96:cpKQmIUFl66Joz0dzgClKtmSStBgSMF9ZbkW6QX0BBFhm7/PP/PhxkW://66Joz0dzgCl6mSSArvZboHFhUXPDf
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\b0ht3gr0.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 7855a95fca1d8dace90c36b1d9cbc2bd59a1840ceffa5e527645edbfb2a01982
MD5 505665a18d8365ca15c2de9e49f51257
SHA1 3e9273b32a26b3c43eca70e544a166947624c666
SHA512 d4b68fc697e6c6d2d09f0c54f90529b9d5d59304d20f03dc103ba4028e662e031eda41d30694794510f51fad75f83d9a10e31d6b604697a3a94b288d7cadb31a
SSDEEP 96:7pKQmIUFl66Joz0dzgClKtmSSDBgSMF9ZbkW6QX0BBFhm4/PP/PaxvWI:Y/66Joz0dzgCl6mSSqrvZboHFhxXP0OI
MD5 SHA1 SHA512 SSDEEP

Submit Download

5d5f5b71-3ec5-4ae3-8cbe-13b54fd42005

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\b0ht3gr0.default-release\datareporting\glean\pending_pings\5d5f5b71-3ec5-4ae3-8cbe-13b54fd42005
Size 26KB
SHA256 4479faa63b024ad4728f00c702e7097d1ba768c97e33d65919e0460f6949a3a8
MD5 067adfa5029af4a1e9778b558b081287
SHA1 edf3e898e86dacc5525d34111845ced36e3e29c8
SHA512 b4c6fa6600483fb10f4a657142ef9ce29fe4851ade66c9a5ac276c2a83df83d56a8c3a9b9af204741701be05862130ae4a0f5e6366971ae68e15d2e1b5b444ad
SSDEEP 192:KejrjdnSirObcz+CsLiA7TsrJBy5ebr+oWF0fa9OCps7SJQGWDwMoQ89/URaB6aV:KSZn3ObcC9iA7F4A3TCiW4Mgjhnjw0j
MD5 SHA1 SHA512 SSDEEP

Submit Download

ad195a58-41c0-4414-8bee-cfce42a17f80

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\b0ht3gr0.default-release\datareporting\glean\pending_pings\ad195a58-41c0-4414-8bee-cfce42a17f80
Size 982B
SHA256 8b2bf1dcd9762716e4ac0672a9321809f1bce6eb2b43daf401bcd5d7b4758cfb
MD5 50776a818e048d986a2d952443036841
SHA1 6945f9d4bc569ee21c82fcaa968f4987e00ae455
SHA512 abaaaf3893bf6190430c8852d4836790274e250c9460057196d544a686dc4eaff9dc76aa54a7d06bfe234d671a5ffc3c381576a9bef5f389b471c29d620e1f01
MD5 SHA1 SHA512

Submit Download

fe871da6-2627-4217-a62f-aedae9b09ed5

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\b0ht3gr0.default-release\datareporting\glean\pending_pings\fe871da6-2627-4217-a62f-aedae9b09ed5
Size 671B
SHA256 31260d33fec2bf22773af062aeeb002373dfccb1bb81ddde629c7100fcbd3770
MD5 f9783f3d591556e7c7f9a0c3e440f39f
SHA1 0d47801406abbb9940d75323201f569c3a4b3fee
SHA512 f16382d55101bbf255ceb2e92356267e30d22c69b3fa2da4b00028f438c8cea392a3038d85d3b429386157730aa664b1ff44b031104b3938aa90a1eabd83d4a4
MD5 SHA1 SHA512

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\b0ht3gr0.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Size 1.1MB
SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
MD5 842039753bf41fa5e11b3a1383061a87
SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\b0ht3gr0.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Size 116B
SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
MD5 2a461e9eb87fd1955cea740a3444ee7a
SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\b0ht3gr0.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Size 372B
SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
MD5 bf957ad58b55f64219ab3f793e374316
SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\b0ht3gr0.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Size 17.8MB
SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
MD5 daf7ef3acccab478aaa7d6dc1c60f865
SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
MD5 SHA1 SHA512 SSDEEP

Submit Download

places.sqlite-wal

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\b0ht3gr0.default-release\places.sqlite-wal
Size 992KB
SHA256 8a1f650408b9368b81f1db5b3fe6d39c8c626fa7ff1f5a7cbdfef6206a981ce0
MD5 84715f7507d3c7f1bad374ced7bae8d1
SHA1 52e3a2992e713d61b2c6a6fdc73603497c6ee257
SHA512 67a547e3042c6b812245417e9543720c0df305d29b8060d5c17457e2be40e47d747f7c1187d0f482236b4ed3b1ca2e2c006b155160a74322bdd647c2d272784d
SSDEEP 192:TfYCZLKquubHZgx/kfYCZfhKUuYfrrbuZMEZpx/xFfYCZI:TdLWAgOdQUuQzapddI
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\b0ht3gr0.default-release\prefs-1.js
Size 11KB
SHA256 3a0924a654e07569154dc09f843220c06746970ed92e7f633d77286218ae67a6
MD5 8eafadd482924033e22a514f393e8e2d
SHA1 20ee051b01ed0db04e4a3840da21195438fe4efc
SHA512 485daccce94ce9adc36753cc15a18af13c2aa75b4fa54574b82d84d399d6db6dfe13dd3b7003349247cf1d4362fce34020a64e4332ce4a8cfd0127c0e87d1c24
SSDEEP 192:/5nTQRjfNYs7+YzOdTgJlcd7zLQHr160vaXu6t6icD0vBw8Ha:q5+YzO9fpzLQL8w6t5cwpwj
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\b0ht3gr0.default-release\prefs-1.js
Size 12KB
SHA256 26fed78c052c8b1ed95e8e9d10af4ffcd96942b0cdd6778ae895b502d7632f0f
MD5 b1bf45be64f9a5b8a8082d244f159f40
SHA1 a2877d6a6817862baeb5b2024b5b4d3afe0e7aaa
SHA512 2dcf199c4dbdb8ef697a8e6c00bea4a6594baa18465cf3f850f3acaa38ba81895cd9477cc1276db3ae7b3a21e9d7b1b0fc3adab489863011d9f80cccec512a10
SSDEEP 192:Y5nTQRjfNYs7+YzOdTgJlcd7zLQHr160vaXu6t6icD0aBw8HFD:d5+YzO9fpzLQL8w6t5cwowiD
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\b0ht3gr0.default-release\prefs-1.js
Size 16KB
SHA256 6c67ecb4227df9e5dd22d09bedfee25f0c0c75d5a4dbce0ce3af1a0b297a57ca
MD5 4c43f95a93f301104061fd94436aac58
SHA1 211f5ff13a7c42875d5b42c4d08643a7842a004c
SHA512 1caca3f206b4a9bde40291fdbcbcc51b2a4800d7ccbe9a205b99781b52652c1bd3aeaa76344f6a1046b422b189e0831665cf5e50dd8aba7e0e7b1be8889c4086
SSDEEP 192:YinTQRjfkYs7+YzOdTgJlcd7zLQHr160vaXq+6t6icD0qiBw8HFvrb12n:KW+YzO9fpzLQL8t6t5cwBwijQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\b0ht3gr0.default-release\prefs.js
Size 8KB
SHA256 a803c388f33c88364c15e93494fc75d5af15b91b0bb3ab2c16cd2a0d92b336da
MD5 1da2b26be96fd28961e1fbed9a699121
SHA1 c413ff30d89a37ef2eceb48e384b57985b73795e
SHA512 4cfea38e87718b22d3439b3c0b677c0e243bbd914ab5908d7b2ec2d5106eec4e306f235c8cb8c77bf2ee3ed1cb20b1fe53880a4f0ae8b65ef726a15e36e674b1
SSDEEP 192:/5nTQRjfNGB+qwhilcdVBA60caXu6t6icD0vBw8Va:qa+FnR76t5cwpwd
MD5 SHA1 SHA512 SSDEEP

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\b0ht3gr0.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 4.7MB
SHA256 3d3c0f72cdeb3b6eeb612344e5f374a4cff19859b89efc597bf0c7b807fd3b15
MD5 b712700a23687e05db5b5a517a6a5cbc
SHA1 2eb6f542d6c052624e2173b34565373403466d7e
SHA512 594bbd3a45df2ba95db4a3673fbdb95294c442f5bd1dbaa7c8b627de869bb23cf2ff576e4327121985d203576d4c62e8531481c0f3717a64a296670ab999e37b
SSDEEP 49152:naC5ChiDNezybOxzUaYxiBnOPqafHy6jvzJmP5A1r74ExujaUgHQI5Cz5aK+0ePQ:G0w
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/336-56-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Download

memory/336-37-0x0000000000280000-0x0000000000E6B000-memory.dmp

Download

memory/336-485-0x0000000000280000-0x0000000000E6B000-memory.dmp

Download

memory/336-488-0x0000000000280000-0x0000000000E6B000-memory.dmp

Download

memory/2472-492-0x00000000003C0000-0x000000000088E000-memory.dmp

Download

memory/2472-498-0x00000000003C0000-0x000000000088E000-memory.dmp

Download

memory/3848-2632-0x0000000000570000-0x0000000000A3E000-memory.dmp

Download

memory/3848-2630-0x0000000000570000-0x0000000000A3E000-memory.dmp

Download

memory/4052-2-0x0000000001001000-0x000000000102F000-memory.dmp

Download

memory/4052-18-0x0000000001000000-0x00000000014CE000-memory.dmp

Download

memory/4052-0-0x0000000001000000-0x00000000014CE000-memory.dmp

Download

memory/4052-4-0x0000000001000000-0x00000000014CE000-memory.dmp

Download

memory/4052-1-0x0000000077AC6000-0x0000000077AC8000-memory.dmp

Download

memory/4052-3-0x0000000001000000-0x00000000014CE000-memory.dmp

Download

memory/4376-2311-0x0000000000570000-0x0000000000A3E000-memory.dmp

Download

memory/4376-2157-0x0000000000570000-0x0000000000A3E000-memory.dmp

Download

memory/4392-20-0x0000000000570000-0x0000000000A3E000-memory.dmp

Download

memory/4392-2617-0x0000000000570000-0x0000000000A3E000-memory.dmp

Download

memory/4392-16-0x0000000000570000-0x0000000000A3E000-memory.dmp

Download

memory/4392-19-0x0000000000571000-0x000000000059F000-memory.dmp

Download

memory/4392-21-0x0000000000570000-0x0000000000A3E000-memory.dmp

Download

memory/4392-798-0x0000000000570000-0x0000000000A3E000-memory.dmp

Download

memory/4392-1824-0x0000000000570000-0x0000000000A3E000-memory.dmp

Download

memory/4392-514-0x0000000000570000-0x0000000000A3E000-memory.dmp

Download

memory/4392-509-0x0000000000570000-0x0000000000A3E000-memory.dmp

Download

memory/4392-474-0x0000000000570000-0x0000000000A3E000-memory.dmp

Download

memory/4392-2621-0x0000000000570000-0x0000000000A3E000-memory.dmp

Download

memory/4392-2625-0x0000000000570000-0x0000000000A3E000-memory.dmp

Download

memory/4392-2626-0x0000000000570000-0x0000000000A3E000-memory.dmp

Download

memory/4392-2627-0x0000000000570000-0x0000000000A3E000-memory.dmp

Download

memory/4392-2628-0x0000000000570000-0x0000000000A3E000-memory.dmp

Download

memory/4392-508-0x0000000000570000-0x0000000000A3E000-memory.dmp

Download

memory/4392-507-0x0000000000570000-0x0000000000A3E000-memory.dmp

Download

memory/4392-2633-0x0000000000570000-0x0000000000A3E000-memory.dmp

Download

memory/4392-2634-0x0000000000570000-0x0000000000A3E000-memory.dmp

Download

memory/4392-2640-0x0000000000570000-0x0000000000A3E000-memory.dmp

Download