amadey | b4d362fb58716654174acdd61c48ae2c3835929344d12301a29c7e2e26618dbc

Analysis

max time kernel
149s
max time network
146s
platform
windows11-21h2_x64
resource
win11-20240709-en
resource tags

arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
submitted
16/07/2024, 21:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b4d362fb58716654174acdd61c48ae2c3835929344d12301a29c7e2e26618dbc.exe
Size 1.9MB
Sample240716-1wafaavejf
SHA256 b4d362fb58716654174acdd61c48ae2c3835929344d12301a29c7e2e26618dbc
MD5 8252a8604837f464b2d2bb4819f0cab6
SHA1 8f105d323f17ea6a921c8bf061bdc4bc10bcbd67
SHA512 31016977f5fafe3422d6b3c03219a51eb3bbc97d3ebad7ed6f99b580209953f54432951fb700a709f492984fb051b96702db694b4d95985f974b0333a313637b
SSDEEP 49152:Ivh2AGUdEDIwW22L/qEc6bfkXuX0fdviiIwpaNIqoYc:IvsAGc/22LRfkXuE1XpdqTc
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey stealc 4dd39d funny discovery evasion spyware stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.30

Botnet

4dd39d

http://77.91.77.82

Attributes

install_dir
ad40971b6b
install_file
explorti.exe
strings_key
a434973ad22def7137dbb5e059b7081e
url_paths
/Hun4Ko/index.php

rc4.plain

Extracted

Family

stealc

Botnet

funny

http://85.28.47.30

Attributes

url_path
/920475a59bac849d.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Stealc
Stealc is an infostealer written in C++.
stealer stealc

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	b4d362fb58716654174acdd61c48ae2c3835929344d12301a29c7e2e26618dbc.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	AFCBFIJEHD.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 6 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	AFCBFIJEHD.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	AFCBFIJEHD.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	b4d362fb58716654174acdd61c48ae2c3835929344d12301a29c7e2e26618dbc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	b4d362fb58716654174acdd61c48ae2c3835929344d12301a29c7e2e26618dbc.exe

Executes dropped EXE 4 IoCs

pid	Process
4084	explorti.exe
2228	05e19d9cc4.exe
3456	b42e687739.exe
4328	AFCBFIJEHD.exe

Identifies Wine through registry keys 2 TTPs 3 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1376880307-1734125928-2892936080-1000\Software\Wine	b4d362fb58716654174acdd61c48ae2c3835929344d12301a29c7e2e26618dbc.exe
Key opened	\REGISTRY\USER\S-1-5-21-1376880307-1734125928-2892936080-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-1376880307-1734125928-2892936080-1000\Software\Wine	AFCBFIJEHD.exe

Loads dropped DLL 2 IoCs

pid	Process
2228	05e19d9cc4.exe
2228	05e19d9cc4.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x000100000002aa9e-58.dat	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

pid	Process
4420	b4d362fb58716654174acdd61c48ae2c3835929344d12301a29c7e2e26618dbc.exe
4084	explorti.exe
2228	05e19d9cc4.exe
2228	05e19d9cc4.exe
4328	AFCBFIJEHD.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\explorti.job	b4d362fb58716654174acdd61c48ae2c3835929344d12301a29c7e2e26618dbc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	05e19d9cc4.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	05e19d9cc4.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1376880307-1734125928-2892936080-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4420	b4d362fb58716654174acdd61c48ae2c3835929344d12301a29c7e2e26618dbc.exe
4420	b4d362fb58716654174acdd61c48ae2c3835929344d12301a29c7e2e26618dbc.exe
4084	explorti.exe
4084	explorti.exe
2228	05e19d9cc4.exe
2228	05e19d9cc4.exe
2228	05e19d9cc4.exe
2228	05e19d9cc4.exe
4328	AFCBFIJEHD.exe
4328	AFCBFIJEHD.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2892	firefox.exe
Token: SeDebugPrivilege	2892	firefox.exe
Token: SeDebugPrivilege	2892	firefox.exe
Token: SeDebugPrivilege	2892	firefox.exe
Token: SeDebugPrivilege	2892	firefox.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4420	b4d362fb58716654174acdd61c48ae2c3835929344d12301a29c7e2e26618dbc.exe
3456	b42e687739.exe
3456	b42e687739.exe
3456	b42e687739.exe
3456	b42e687739.exe
3456	b42e687739.exe
3456	b42e687739.exe
3456	b42e687739.exe
2892	firefox.exe
2892	firefox.exe
2892	firefox.exe
2892	firefox.exe
2892	firefox.exe
2892	firefox.exe
2892	firefox.exe
2892	firefox.exe
2892	firefox.exe
2892	firefox.exe
2892	firefox.exe
2892	firefox.exe
2892	firefox.exe
2892	firefox.exe
2892	firefox.exe
2892	firefox.exe
2892	firefox.exe
2892	firefox.exe
2892	firefox.exe
2892	firefox.exe
2892	firefox.exe
3456	b42e687739.exe
3456	b42e687739.exe
3456	b42e687739.exe
3456	b42e687739.exe
3456	b42e687739.exe
3456	b42e687739.exe
3456	b42e687739.exe
3456	b42e687739.exe
3456	b42e687739.exe
3456	b42e687739.exe
3456	b42e687739.exe
3456	b42e687739.exe
3456	b42e687739.exe
3456	b42e687739.exe
3456	b42e687739.exe
3456	b42e687739.exe
3456	b42e687739.exe
3456	b42e687739.exe
3456	b42e687739.exe
3456	b42e687739.exe
3456	b42e687739.exe
3456	b42e687739.exe
3456	b42e687739.exe
3456	b42e687739.exe
3456	b42e687739.exe
3456	b42e687739.exe
3456	b42e687739.exe
3456	b42e687739.exe
3456	b42e687739.exe
3456	b42e687739.exe
3456	b42e687739.exe
3456	b42e687739.exe
3456	b42e687739.exe
3456	b42e687739.exe
3456	b42e687739.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3456	b42e687739.exe
3456	b42e687739.exe
3456	b42e687739.exe
3456	b42e687739.exe
3456	b42e687739.exe
3456	b42e687739.exe
3456	b42e687739.exe
3456	b42e687739.exe
3456	b42e687739.exe
3456	b42e687739.exe
3456	b42e687739.exe
3456	b42e687739.exe
3456	b42e687739.exe
3456	b42e687739.exe
3456	b42e687739.exe
3456	b42e687739.exe
3456	b42e687739.exe
3456	b42e687739.exe
3456	b42e687739.exe
3456	b42e687739.exe
3456	b42e687739.exe
3456	b42e687739.exe
3456	b42e687739.exe
3456	b42e687739.exe
3456	b42e687739.exe
3456	b42e687739.exe
3456	b42e687739.exe
3456	b42e687739.exe
3456	b42e687739.exe
3456	b42e687739.exe
3456	b42e687739.exe
3456	b42e687739.exe
3456	b42e687739.exe
3456	b42e687739.exe
3456	b42e687739.exe
3456	b42e687739.exe
3456	b42e687739.exe
3456	b42e687739.exe
3456	b42e687739.exe
3456	b42e687739.exe
3456	b42e687739.exe
3456	b42e687739.exe
3456	b42e687739.exe
3456	b42e687739.exe
3456	b42e687739.exe
3456	b42e687739.exe
3456	b42e687739.exe
3456	b42e687739.exe
3456	b42e687739.exe
3456	b42e687739.exe
3456	b42e687739.exe
3456	b42e687739.exe
3456	b42e687739.exe
3456	b42e687739.exe
3456	b42e687739.exe
3456	b42e687739.exe
3456	b42e687739.exe
3456	b42e687739.exe
3456	b42e687739.exe
3456	b42e687739.exe
3456	b42e687739.exe
3456	b42e687739.exe
3456	b42e687739.exe
3456	b42e687739.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2228	05e19d9cc4.exe
2892	firefox.exe
3376	cmd.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4420 wrote to memory of 4084	4420	b4d362fb58716654174acdd61c48ae2c3835929344d12301a29c7e2e26618dbc.exe	82
PID 4420 wrote to memory of 4084	4420	b4d362fb58716654174acdd61c48ae2c3835929344d12301a29c7e2e26618dbc.exe	82
PID 4420 wrote to memory of 4084	4420	b4d362fb58716654174acdd61c48ae2c3835929344d12301a29c7e2e26618dbc.exe	82
PID 4084 wrote to memory of 2228	4084	explorti.exe	83
PID 4084 wrote to memory of 2228	4084	explorti.exe	83
PID 4084 wrote to memory of 2228	4084	explorti.exe	83
PID 4084 wrote to memory of 3456	4084	explorti.exe	84
PID 4084 wrote to memory of 3456	4084	explorti.exe	84
PID 4084 wrote to memory of 3456	4084	explorti.exe	84
PID 3456 wrote to memory of 1104	3456	b42e687739.exe	85
PID 3456 wrote to memory of 1104	3456	b42e687739.exe	85
PID 1104 wrote to memory of 2892	1104	firefox.exe	88
PID 1104 wrote to memory of 2892	1104	firefox.exe	88
PID 1104 wrote to memory of 2892	1104	firefox.exe	88
PID 1104 wrote to memory of 2892	1104	firefox.exe	88
PID 1104 wrote to memory of 2892	1104	firefox.exe	88
PID 1104 wrote to memory of 2892	1104	firefox.exe	88
PID 1104 wrote to memory of 2892	1104	firefox.exe	88
PID 1104 wrote to memory of 2892	1104	firefox.exe	88
PID 1104 wrote to memory of 2892	1104	firefox.exe	88
PID 1104 wrote to memory of 2892	1104	firefox.exe	88
PID 1104 wrote to memory of 2892	1104	firefox.exe	88
PID 2892 wrote to memory of 1948	2892	firefox.exe	89
PID 2892 wrote to memory of 1948	2892	firefox.exe	89
PID 2892 wrote to memory of 1948	2892	firefox.exe	89
PID 2892 wrote to memory of 1948	2892	firefox.exe	89
PID 2892 wrote to memory of 1948	2892	firefox.exe	89
PID 2892 wrote to memory of 1948	2892	firefox.exe	89
PID 2892 wrote to memory of 1948	2892	firefox.exe	89
PID 2892 wrote to memory of 1948	2892	firefox.exe	89
PID 2892 wrote to memory of 1948	2892	firefox.exe	89
PID 2892 wrote to memory of 1948	2892	firefox.exe	89
PID 2892 wrote to memory of 1948	2892	firefox.exe	89
PID 2892 wrote to memory of 1948	2892	firefox.exe	89
PID 2892 wrote to memory of 1948	2892	firefox.exe	89
PID 2892 wrote to memory of 1948	2892	firefox.exe	89
PID 2892 wrote to memory of 1948	2892	firefox.exe	89
PID 2892 wrote to memory of 1948	2892	firefox.exe	89
PID 2892 wrote to memory of 1948	2892	firefox.exe	89
PID 2892 wrote to memory of 1948	2892	firefox.exe	89
PID 2892 wrote to memory of 1948	2892	firefox.exe	89
PID 2892 wrote to memory of 1948	2892	firefox.exe	89
PID 2892 wrote to memory of 1948	2892	firefox.exe	89
PID 2892 wrote to memory of 1948	2892	firefox.exe	89
PID 2892 wrote to memory of 1948	2892	firefox.exe	89
PID 2892 wrote to memory of 1948	2892	firefox.exe	89
PID 2892 wrote to memory of 1948	2892	firefox.exe	89
PID 2892 wrote to memory of 1948	2892	firefox.exe	89
PID 2892 wrote to memory of 1948	2892	firefox.exe	89
PID 2892 wrote to memory of 1948	2892	firefox.exe	89
PID 2892 wrote to memory of 1948	2892	firefox.exe	89
PID 2892 wrote to memory of 1948	2892	firefox.exe	89
PID 2892 wrote to memory of 1948	2892	firefox.exe	89
PID 2892 wrote to memory of 1948	2892	firefox.exe	89
PID 2892 wrote to memory of 1948	2892	firefox.exe	89
PID 2892 wrote to memory of 1948	2892	firefox.exe	89
PID 2892 wrote to memory of 1948	2892	firefox.exe	89
PID 2892 wrote to memory of 1948	2892	firefox.exe	89
PID 2892 wrote to memory of 1948	2892	firefox.exe	89
PID 2892 wrote to memory of 1948	2892	firefox.exe	89
PID 2892 wrote to memory of 1948	2892	firefox.exe	89
PID 2892 wrote to memory of 1948	2892	firefox.exe	89
PID 2892 wrote to memory of 1948	2892	firefox.exe	89
PID 2892 wrote to memory of 1948	2892	firefox.exe	89

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\b4d362fb58716654174acdd61c48ae2c3835929344d12301a29c7e2e26618dbc.exe
"C:\Users\Admin\AppData\Local\Temp\b4d362fb58716654174acdd61c48ae2c3835929344d12301a29c7e2e26618dbc.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4420
- C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
  "C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4084
- - C:\Users\Admin\AppData\Local\Temp\1000006001\05e19d9cc4.exe
    "C:\Users\Admin\AppData\Local\Temp\1000006001\05e19d9cc4.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:2228
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\AFCBFIJEHD.exe"
      4⤵
      PID:5076
    - - C:\Users\Admin\AppData\Local\Temp\AFCBFIJEHD.exe
        
        "C:\Users\Admin\AppData\Local\Temp\AFCBFIJEHD.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        
        PID:4328
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\CGHDAKKJJJ.exe"
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:3376
- - C:\Users\Admin\AppData\Local\Temp\1000011001\b42e687739.exe
    "C:\Users\Admin\AppData\Local\Temp\1000011001\b42e687739.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:3456
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1104
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
        5⤵
        Checks processor information in registry
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2892
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1992 -parentBuildID 20240401114208 -prefsHandle 1920 -prefMapHandle 1900 -prefsLen 25751 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5fa208a4-79d9-4be5-838f-dc9a0023d3e5} 2892 "\\.\pipe\gecko-crash-server-pipe.2892" gpu
        6⤵
        
        PID:1948
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2396 -parentBuildID 20240401114208 -prefsHandle 2388 -prefMapHandle 2376 -prefsLen 26671 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7f57341c-23c6-4fbc-9fa9-f8b699496fdf} 2892 "\\.\pipe\gecko-crash-server-pipe.2892" socket
        6⤵
        
        PID:2464
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3132 -childID 1 -isForBrowser -prefsHandle 3248 -prefMapHandle 2948 -prefsLen 22698 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7c793bcf-b550-478d-926c-8208d00fb770} 2892 "\\.\pipe\gecko-crash-server-pipe.2892" tab
        6⤵
        
        PID:3632
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3856 -childID 2 -isForBrowser -prefsHandle 3848 -prefMapHandle 3844 -prefsLen 31161 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {43193929-a475-48f5-8378-bee54a021ecb} 2892 "\\.\pipe\gecko-crash-server-pipe.2892" tab
        6⤵
        
        PID:3352
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4832 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4896 -prefMapHandle 4892 -prefsLen 31161 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {88d53a85-3413-4223-a827-56bedcdf139b} 2892 "\\.\pipe\gecko-crash-server-pipe.2892" utility
        6⤵
        Checks processor information in registry
        
        PID:5144
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5472 -childID 3 -isForBrowser -prefsHandle 5624 -prefMapHandle 5572 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {777da9b5-9661-44cb-9bc9-77e337fdb188} 2892 "\\.\pipe\gecko-crash-server-pipe.2892" tab
        6⤵
        
        PID:6092
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5744 -childID 4 -isForBrowser -prefsHandle 5820 -prefMapHandle 5816 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {694c100f-c3ac-42df-9d49-897cb3e71960} 2892 "\\.\pipe\gecko-crash-server-pipe.2892" tab
        6⤵
        
        PID:6116
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6000 -childID 5 -isForBrowser -prefsHandle 5920 -prefMapHandle 5924 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f8d064ec-b3f9-4a3c-9c7d-22d661b72028} 2892 "\\.\pipe\gecko-crash-server-pipe.2892" tab
        6⤵
        
        PID:6128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mozglue.dll

Path C:\ProgramData\mozglue.dll
Size 593KB
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
SSDEEP 12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5 SHA1 SHA512 SSDEEP

Submit Download

nss3.dll

Path C:\ProgramData\nss3.dll
Size 2.0MB
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
SSDEEP 49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5 SHA1 SHA512 SSDEEP

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n9orreff.default-release\activity-stream.discovery_stream.json
Size 21KB
SHA256 29889d1d8e50568de96207012b7ce133fcd9fe88322b9972e25fa22ff2894f42
MD5 9a3e61bfafcd8389e2792b6244f73719
SHA1 f3635fd2b597b336dee12a6b8a43bebbe7632752
SHA512 e4c1af9adfcfac284c78ad6e78a34f64831120a765efee7c5057e592f6afeb2cc3ac1456f3f1a51f77e72c74fbc4599c1c57062912edf9e32ba7376cad6e34ce
SSDEEP 384:FsdiQ47rJRKvew0vAo/MdxYX6zxF8yau/TxSTxa5:FVTKr0bMsK9WydrsE5
MD5 SHA1 SHA512 SSDEEP

Submit Download

8A2034D325DC0B5C9E11EDDA3FC70A54C8DC1C0D

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n9orreff.default-release\cache2\entries\8A2034D325DC0B5C9E11EDDA3FC70A54C8DC1C0D
Size 13KB
SHA256 0d482b04966411e892f34ce849072aa66769373adbc76edcaa914ac2e84ab206
MD5 c3402b6d74b362a0641b8a0ba8e74ffb
SHA1 5e2871594a48b8a03039ec3cc989a332133bad01
SHA512 6cc71961260f7bb2011826538a61ce3cf44ef5912a326e476f1710fe5b6e1174920cbd9da6e480184992cdb3cd2376ac36b16ae760d7244cf956c385fbf0f17e
SSDEEP 384:H485u9fiGLm4pUBft2WlOX8lPLZZB7t0lpDIIlTu:nUBi8mCUBft2WAX8tzB7eD8h
MD5 SHA1 SHA512 SSDEEP

Submit Download

05e19d9cc4.exe

Path C:\Users\Admin\AppData\Local\Temp\1000006001\05e19d9cc4.exe
Size 1.1MB
SHA256 931076586d551cccba6532aeb6393cc64ab293035c582125ef32e7eb82e3b0e5
MD5 73aa6448467db3d1ac25f7e9d8cf1cd4
SHA1 caaa71cdfbc3b33438766aff9bb536422721e5cd
SHA512 1647a8512a273e605756e3a23b81fcf9d7525ea4d0a2f4ff1e7695b11702c8a7336625edca9cbeb1d73ff592e5c038e02d780fa6c0eca5c31781a38bb4d8ba07
SSDEEP 24576:tUFuDtv4dsn0Ff5qI/z8L642KlCWZr9zs7wKztmZ7RGP3Wg+8o:tvDtvnn0R5h3cLZ9smNR0W4o
MD5 SHA1 SHA512 SSDEEP

Submit Download

b42e687739.exe

Path C:\Users\Admin\AppData\Local\Temp\1000011001\b42e687739.exe
Size 1.2MB
SHA256 cb765bbce969e3ea3892f51f918e3bd3f812ad2b4ffeaf2a930ad6e234c61b75
MD5 c4cdf23a1358f28bc374bc4a437ee42e
SHA1 fd6abde76777f16b9abda8e7076a65e4d9846990
SHA512 285f6a35da2e0d016462137ff5372f0d93ebb743f6d9cae812849246b31e7679597f8712523722f1db974d6ecfdc22b8ee79ef37b54a018cf43375005941a600
SSDEEP 24576:5qDEvCTbMWu7rQYlBQcBiT6rprG8aL02Sbly7TWEPje:5TvC/MTQYxsWR7aL02dW
MD5 SHA1 SHA512 SSDEEP

Submit Download

explorti.exe

Path C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
Size 1.9MB
SHA256 b4d362fb58716654174acdd61c48ae2c3835929344d12301a29c7e2e26618dbc
MD5 8252a8604837f464b2d2bb4819f0cab6
SHA1 8f105d323f17ea6a921c8bf061bdc4bc10bcbd67
SHA512 31016977f5fafe3422d6b3c03219a51eb3bbc97d3ebad7ed6f99b580209953f54432951fb700a709f492984fb051b96702db694b4d95985f974b0333a313637b
SSDEEP 49152:Ivh2AGUdEDIwW22L/qEc6bfkXuX0fdviiIwpaNIqoYc:IvsAGc/22LRfkXuE1XpdqTc
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 479KB
SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
MD5 09372174e83dbbf696ee732fd2e875bb
SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 13.8MB
SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
MD5 0a8747a2ac9ac08ae9508f36c6d75692
SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9orreff.default-release\AlternateServices.bin
Size 12KB
SHA256 94abc8c2c570b676bf3a149b05ea51d9edd1cfb27c845142687afe36fb6a1003
MD5 3c1f5683f95a8df0a2e336cf757a9696
SHA1 aed59b5f641347b79cd30f4f778627360b9ec3d7
SHA512 07ec9e84cdc3bdf4d3fad4b5dc0af98c9c8bb657d39bf07bd1d229c851134212f5db68a01801b949d530a412b05fd2c3bf621a5b0e5ff69dbb70f84caba9f3b8
SSDEEP 96:45owebOJNbe0pebvpf+NbVbhbIXtgbgzybFbNb:45TuB
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9orreff.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 785360da4e397a1489f7d948db9856f5a2d5f87f049c0b81bdbbda077728d41a
MD5 24088f9f839befb72f62aea3e353ab17
SHA1 1b997f78053a3a3c6cfa555c1233cad4d01229c3
SHA512 f310649b92eb25f8e73f158ad7256e337dc9da7f2db22c069eebc72ed94cf17730f47f3e3c4dde6ebbb35ab1b55cb76ec759d0281a714fd143effa5ad0871b2b
SSDEEP 96:Q4nR9PkFl66Joz0dzgClKtmSSpSMF9ZbkW6QXNhmiJPP/PrWI:I/66Joz0dzgCl6mSSprvZboKhnNPCI
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9orreff.default-release\datareporting\glean\db\data.safe.tmp
Size 15KB
SHA256 b8c3811e9896360bb5294fc283152acc76ba0332912c9a1763d35b31c7b0b13d
MD5 de12f1d4a7cc4c5bb17a562b1cf06ad6
SHA1 c418a4340c984fe0fd624ce251f0297ba50c2d87
SHA512 a7b7df31ac976d857f53cb45d90b13a4c964111a4c74cef465125a0ce06344a44173d45a6b59c00335cc2adb0cae34ad329c4ed846c1e401495343e0f57cf9a2
SSDEEP 384:ZaoiV6lvFzWDm/aPbqb2b/66JozQzgC1bIboGUDhPjM:coiGtzWDm/aPbqb2Wme2hbM
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9orreff.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 f6a3727c5eb8dcc161c441d02414b41d79067a4f1f2b02c9ec148f54d365cc25
MD5 32587ea05799ed3c9eeee6d7392a24fa
SHA1 36d2d4f1d0a4978eec34066848c659f500fb50ff
SHA512 f7610192bac74a36b4f9741f39dbe43a56347916e58ed4ed9e1810ceb4cd2d7709fc0e9e27b2472ebfc2c4df120f1a30573c143a613a6afc7a0c0e2f986f986f
SSDEEP 96:qB9SMF9ZbkW6QX0BBmhmiJPP/PrWZQ4nR9PkFl66Joz0dzgClKtmSSM:QrvZboHmhnNPCK/66Joz0dzgCl6mSSM
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9orreff.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 678f03343b213eda45ef9fc671f8803dad1976becfab743d2d7f3660b0d9ef8c
MD5 c3dc5a9a20c644c599fac8e7779d0a1e
SHA1 6313078a001ab6ae27d361fd91af00fbacbaae61
SHA512 504676b16e9d34de249788e6d2adbc969953dba78f2e688547201f0bfdd474e8f779f5d98084554f9467239e866330d81537b3efa0d4b400f40823087eba3a52
SSDEEP 192:I/66Joz0dzgCl6mSScrvZboHmhnNPDMOM:I/66JozQzgC1bqboGbPPM
MD5 SHA1 SHA512 SSDEEP

Submit Download

10775089-7b89-49bd-8196-19d3bb7eaec6

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9orreff.default-release\datareporting\glean\pending_pings\10775089-7b89-49bd-8196-19d3bb7eaec6
Size 25KB
SHA256 da2bedeb99c9044ea7b67a68bc098b8e60121f39db76e4fb9a534613e43bd6a6
MD5 916d21f49c22bd175861cfd07a167e4f
SHA1 6815d40dff0d10d75f52beb4945d18738d1b1ef2
SHA512 2c01ca7624e2bebdb30d42b84e5daaa8aafd5c14963e0cdc38253fee2fbb1d6819479deb117fcaa4868083e6f7e63a6d3c3711f8d125af4669396b71ebb69741
SSDEEP 192:M1wWLJs7lL/CzI2J8hr8GsnH7jOfgW2MwSbnM0KrmqTTdX4jbK2dp7/WN4jL2CwP:MC1msPWR3hGzkdEg/SVsKgbDuKR
MD5 SHA1 SHA512 SSDEEP

Submit Download

2611b12e-8cd2-420b-b386-8e54b26f35a5

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9orreff.default-release\datareporting\glean\pending_pings\2611b12e-8cd2-420b-b386-8e54b26f35a5
Size 671B
SHA256 b56873f841819054e230ce82c278a010cc408ebd19fae47a71d19cc53d7c8233
MD5 7f0294b9c2b6a5099b338351385da20a
SHA1 c21ed4b338d35aeeeafca3dca26b67d566024e49
SHA512 e5257fd80a1d928f794d5ad7aff73ed7bea353f6e62bcc8a9efb257ab0b7f74cd993ebe090a947efd49dcc43202ea5087a839b2234ecd0ff9cffefd7c363c107
MD5 SHA1 SHA512

Submit Download

33aea65c-fc5d-4ced-99ce-371982ae770f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9orreff.default-release\datareporting\glean\pending_pings\33aea65c-fc5d-4ced-99ce-371982ae770f
Size 982B
SHA256 de8223759baaa96aafa75c7b674df1935160f5e19355b66b79920f8dc245cbd6
MD5 37bbe4b60c2b3036f5c3ce93c73b3267
SHA1 a2337e9acfa334d210ef946054ef8f55a64ed4ab
SHA512 8c208475434f57ef18b9bc24135f569d7fbc7dd4f58f5ed81e6e00a5cdbdad610e3b6df3b92d7cec7c7b8260bbfbe9d24f3d9a287f30d196ec2eb5a51912a79b
MD5 SHA1 SHA512

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9orreff.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Size 1.1MB
SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
MD5 842039753bf41fa5e11b3a1383061a87
SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9orreff.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Size 116B
SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
MD5 2a461e9eb87fd1955cea740a3444ee7a
SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9orreff.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Size 372B
SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
MD5 bf957ad58b55f64219ab3f793e374316
SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9orreff.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Size 17.8MB
SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
MD5 daf7ef3acccab478aaa7d6dc1c60f865
SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
MD5 SHA1 SHA512 SSDEEP

Submit Download

places.sqlite-wal

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9orreff.default-release\places.sqlite-wal
Size 992KB
SHA256 c914515c9ba26b97ecded49ba6891e84e1152bbcab8a28603f6704ac125b8447
MD5 52ee154fe95dfc69253a98d105f0c53d
SHA1 10925f587b21e9bf11934391b8325493e0e9d1f5
SHA512 f5066d9d8a16c23e24a0b284c5bd7d8827d92dee428d676b26710302defc8b3aab1d92ff92e7f3a8b0e7962ff247c61b7f718d4e0f115b0c9da606da145a2573
SSDEEP 192:5VB/lroMQQZgx/KmVB8hKlYzntEQJUXx/x3mVBE:57/wqg97HlQDCX+7E
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9orreff.default-release\prefs-1.js
Size 12KB
SHA256 7a448c24456edd5b212f21819b59d5a561f63ef20bb42e462c3136d8cf988996
MD5 3a527ac178ba8953cffc90f9a4b63574
SHA1 40e7c059b700f5e096a902e28a33966711a346a5
SHA512 1ecbc5a3327d254b21a62eaae30766f0243c36804a3d2f4df8285a4f86a326e99473dc19c4a7d705589664219cff5a7c4c1b40cd91e94c5a5e9f500b790a7b1a
SSDEEP 192:U5nKRJfKmY/V/V7IW2xZliicdWIWgKWQHrk60UaXjhs72Bw8HcC:RRk/FF2xKvYFgNQL/22gwi
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9orreff.default-release\prefs-1.js
Size 15KB
SHA256 c767e9ef152116bf362a20683d4f5f857b0f5845b7cd273bb5faab0cb1df376e
MD5 02232851394d8d214d8f767ff5e1f7c9
SHA1 a11d9a1dc726ba68bbf7d30c6e7cf72e490e5933
SHA512 50f57dcb62844a1eee24a7ea861f9a9249bd0c36a77f8476f31f69ae74af7134a348446158c8e9a57a70f3a150bba3b27453137606f66a8a696efc2b9b99390f
SSDEEP 192:UenKRJfemY/V/V7IW2xZliicdWIWgKWQHrk60UaXl+hs7eBw8HcGTsd:Ctk/FF2xKvYFgNQL/r2owl
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9orreff.default-release\prefs.js
Size 11KB
SHA256 e2fcc6c88a422fadaa869ef262c53e0de24adba7eb7b55e4f6200f122a14243f
MD5 a24aeb5a233108fb9066fbb9b5a74f6e
SHA1 66b3466c110db2c0025ad02495905b530d2e6afb
SHA512 310a5d20546e75b713ab051637a0c50654183c816e70a333455da2e1d40ebead2f700e212bb90c4e6da18ada16c3b6aad25f044c6d472732caf00f48d07edae0
SSDEEP 192:R5nKRJfKmY/V/V7IW2xZliicdWIWgKWQHrk60UaXjhs7aBw8HY:ERk/FF2xKvYFgNQL/22Uw9
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9orreff.default-release\prefs.js
Size 8KB
SHA256 9b823b415b0048aa8e0dc6f18bb96c6a4c6daa0ce39e5543b6225beb895988a0
MD5 a79a482dbecf6b42d9472b6639b25c0f
SHA1 fa783c9f4970d6a14e953cb6def837b8a6ee0a89
SHA512 a7cefee54c449687a5da41ef324fb80a230898b0972b5fd27f9d601eb5001f038cb3b24b8aeb3e13d5457ff90635c1c1b8b60af65c714f8f5abc67ccb7196616
SSDEEP 192:R5nKRJfKTye2xUcdzky60zLaXmhs7aBw8VY:E7x5yxs2Uw3
MD5 SHA1 SHA512 SSDEEP

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9orreff.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 1.2MB
SHA256 6df8cefbce9a4d9911fdf56e91968eb5f45b1c387fe5b983d19419f1281f0b2b
MD5 dfb978c393ff3a376a26b88162c22283
SHA1 0fd41dea5c12c2ef2cbf74c02626deb7552ef42d
SHA512 d05dac8ca79cb97bb7374dd458ace6242adb0f402146f573d04d1a3e4f6b49d79a1c6643a8532bc40984d8819a299aca5ee3f7ce5ae92197c578b0cc13392421
SSDEEP 6144:v7rST3K393z3m3wTHw/hOisYMFUXsUUVARwmoZmonwPlbytM9eHN1HmcH11HyZm9:gZOisMX2UwtxBuVrLacY
MD5 SHA1 SHA512 SSDEEP

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9orreff.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 9.4MB
SHA256 dbea5b6053bdd6f31747d24999de3f82e93615aa66874b6281ef2189bcdae913
MD5 f1f75808c89c0668189a6b4849eeaa1b
SHA1 f7d5f1f5142db2e93440c8e41c2bd7f5f615c44e
SHA512 793fc9d95ac332502b093a0f0c03d4cf7fafacc95437361c81969293b79895546a8154b45c0778eadc1748da2d48b0d79a80bd443d24b3463a10c28e4402f0f6
SSDEEP 49152:2CC5UhiDNezybOxaUj6xiCNwAsD5kt/ayhdPgnb9x5mexwY+YXse0VTdIjl1gpHE:8OVRR
MD5 SHA1 SHA512 SSDEEP

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9orreff.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 9.4MB
SHA256 cbd6a8855c27321f0724bb75e6182a454af32c1df9beeced6b97e106c76c2281
MD5 3d0670b9881a65c7d6fccddee491a55f
SHA1 546031835cb7f41b2ec876c89e3db0c94912ef42
SHA512 f6ee8eced427a871ae44fbf886af060bb29d838bb423c1308a8bd730ae185bd1224f8ff7f461bbc82f59090c7052b3237ae44d08b469ff0f456a9a242c98494c
SSDEEP 49152:OxC5UhiDNezybOxVUj6xiCNwAsD5kt/ayhdP/nb9x5mexwY+YXse0VTdIjl1gpHP:5OVYR
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2228-38-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Download

memory/2228-453-0x00000000009F0000-0x0000000000F82000-memory.dmp

Download

memory/2228-457-0x00000000009F0000-0x0000000000F82000-memory.dmp

Download

memory/2228-37-0x00000000009F0000-0x0000000000F82000-memory.dmp

Download

memory/4084-473-0x00000000000F0000-0x00000000005C0000-memory.dmp

Download

memory/4084-2708-0x00000000000F0000-0x00000000005C0000-memory.dmp

Download

memory/4084-482-0x00000000000F0000-0x00000000005C0000-memory.dmp

Download

memory/4084-487-0x00000000000F0000-0x00000000005C0000-memory.dmp

Download

memory/4084-472-0x00000000000F0000-0x00000000005C0000-memory.dmp

Download

memory/4084-466-0x00000000000F0000-0x00000000005C0000-memory.dmp

Download

memory/4084-21-0x00000000000F0000-0x00000000005C0000-memory.dmp

Download

memory/4084-20-0x00000000000F0000-0x00000000005C0000-memory.dmp

Download

memory/4084-19-0x00000000000F0000-0x00000000005C0000-memory.dmp

Download

memory/4084-18-0x00000000000F0000-0x00000000005C0000-memory.dmp

Download

memory/4084-98-0x00000000000F0000-0x00000000005C0000-memory.dmp

Download

memory/4084-2698-0x00000000000F0000-0x00000000005C0000-memory.dmp

Download

memory/4084-2702-0x00000000000F0000-0x00000000005C0000-memory.dmp

Download

memory/4084-2697-0x00000000000F0000-0x00000000005C0000-memory.dmp

Download

memory/4084-2701-0x00000000000F0000-0x00000000005C0000-memory.dmp

Download

memory/4084-2693-0x00000000000F0000-0x00000000005C0000-memory.dmp

Download

memory/4084-738-0x00000000000F0000-0x00000000005C0000-memory.dmp

Download

memory/4084-2700-0x00000000000F0000-0x00000000005C0000-memory.dmp

Download

memory/4084-2699-0x00000000000F0000-0x00000000005C0000-memory.dmp

Download

memory/4084-1445-0x00000000000F0000-0x00000000005C0000-memory.dmp

Download

memory/4084-2689-0x00000000000F0000-0x00000000005C0000-memory.dmp

Download

memory/4328-461-0x0000000000F00000-0x00000000013D0000-memory.dmp

Download

memory/4328-465-0x0000000000F00000-0x00000000013D0000-memory.dmp

Download

memory/4420-17-0x0000000000230000-0x0000000000700000-memory.dmp

Download

memory/4420-1-0x0000000077846000-0x0000000077848000-memory.dmp

Download

memory/4420-2-0x0000000000231000-0x000000000025F000-memory.dmp

Download

memory/4420-3-0x0000000000230000-0x0000000000700000-memory.dmp

Download

memory/4420-4-0x0000000000230000-0x0000000000700000-memory.dmp

Download

memory/4420-0-0x0000000000230000-0x0000000000700000-memory.dmp

Download