amadey | 075d28e2085d06b4d1e8fc60e3ee784495bebb37e8c3b0c38fbb047138cbf374

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20240709-en
resource tags

arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
submitted
16/07/2024, 22:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
075d28e2085d06b4d1e8fc60e3ee784495bebb37e8c3b0c38fbb047138cbf374.exe
Size 1.8MB
Sample240716-2nn45swhkh
SHA256 075d28e2085d06b4d1e8fc60e3ee784495bebb37e8c3b0c38fbb047138cbf374
MD5 280308d6c9c141d022d1266540208a7c
SHA1 9b58baffb40b0c12a6ec20ef119d2084b82e6843
SHA512 d35c17409d7e644a62079ee797ead5ab6a9cb3c90871e634d5fe2f905ac67bcac42891fe3796a4a3de66e743bf7d48ae210e8702704b5e7e51ba02d57a8bc515
SSDEEP 49152:eeb2iyYdk0tqdBiAwvXtLfqXLXMa54/Ua9QcL0TGb:ewybBovVfqX5548a+JT8
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey stealc 4dd39d funny discovery evasion spyware stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.30

Botnet

4dd39d

http://77.91.77.82

Attributes

install_dir
ad40971b6b
install_file
explorti.exe
strings_key
a434973ad22def7137dbb5e059b7081e
url_paths
/Hun4Ko/index.php

rc4.plain

Extracted

Family

stealc

Botnet

funny

http://85.28.47.30

Attributes

url_path
/920475a59bac849d.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Stealc
Stealc is an infostealer written in C++.
stealer stealc

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	075d28e2085d06b4d1e8fc60e3ee784495bebb37e8c3b0c38fbb047138cbf374.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	CGCFCBAKKF.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	GDGDHJJDGH.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 14 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	075d28e2085d06b4d1e8fc60e3ee784495bebb37e8c3b0c38fbb047138cbf374.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	GDGDHJJDGH.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	075d28e2085d06b4d1e8fc60e3ee784495bebb37e8c3b0c38fbb047138cbf374.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	CGCFCBAKKF.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	CGCFCBAKKF.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	GDGDHJJDGH.exe

Executes dropped EXE 8 IoCs

pid	Process
3552	explorti.exe
3408	explorti.exe
3424	2e25eeff5c.exe
1908	800273810d.exe
472	CGCFCBAKKF.exe
2704	GDGDHJJDGH.exe
2240	explorti.exe
1520	explorti.exe

Identifies Wine through registry keys 2 TTPs 7 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-95457810-830748662-4054918673-1000\Software\Wine	CGCFCBAKKF.exe
Key opened	\REGISTRY\USER\S-1-5-21-95457810-830748662-4054918673-1000\Software\Wine	GDGDHJJDGH.exe
Key opened	\REGISTRY\USER\S-1-5-21-95457810-830748662-4054918673-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-95457810-830748662-4054918673-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-95457810-830748662-4054918673-1000\Software\Wine	075d28e2085d06b4d1e8fc60e3ee784495bebb37e8c3b0c38fbb047138cbf374.exe
Key opened	\REGISTRY\USER\S-1-5-21-95457810-830748662-4054918673-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-95457810-830748662-4054918673-1000\Software\Wine	explorti.exe

Loads dropped DLL 2 IoCs

pid	Process
3424	2e25eeff5c.exe
3424	2e25eeff5c.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x000100000002aae9-47.dat	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 11 IoCs

pid	Process
3128	075d28e2085d06b4d1e8fc60e3ee784495bebb37e8c3b0c38fbb047138cbf374.exe
3552	explorti.exe
3408	explorti.exe
3424	2e25eeff5c.exe
3424	2e25eeff5c.exe
3424	2e25eeff5c.exe
3424	2e25eeff5c.exe
472	CGCFCBAKKF.exe
2704	GDGDHJJDGH.exe
2240	explorti.exe
1520	explorti.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\explorti.job	075d28e2085d06b4d1e8fc60e3ee784495bebb37e8c3b0c38fbb047138cbf374.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2e25eeff5c.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2e25eeff5c.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-95457810-830748662-4054918673-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
3128	075d28e2085d06b4d1e8fc60e3ee784495bebb37e8c3b0c38fbb047138cbf374.exe
3128	075d28e2085d06b4d1e8fc60e3ee784495bebb37e8c3b0c38fbb047138cbf374.exe
3552	explorti.exe
3552	explorti.exe
3408	explorti.exe
3408	explorti.exe
3424	2e25eeff5c.exe
3424	2e25eeff5c.exe
3424	2e25eeff5c.exe
3424	2e25eeff5c.exe
472	CGCFCBAKKF.exe
472	CGCFCBAKKF.exe
2704	GDGDHJJDGH.exe
2704	GDGDHJJDGH.exe
2240	explorti.exe
2240	explorti.exe
1520	explorti.exe
1520	explorti.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	5380	firefox.exe
Token: SeDebugPrivilege	5380	firefox.exe
Token: SeDebugPrivilege	5380	firefox.exe
Token: SeDebugPrivilege	5380	firefox.exe
Token: SeDebugPrivilege	5380	firefox.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3128	075d28e2085d06b4d1e8fc60e3ee784495bebb37e8c3b0c38fbb047138cbf374.exe
1908	800273810d.exe
1908	800273810d.exe
1908	800273810d.exe
1908	800273810d.exe
1908	800273810d.exe
1908	800273810d.exe
5380	firefox.exe
5380	firefox.exe
5380	firefox.exe
5380	firefox.exe
1908	800273810d.exe
5380	firefox.exe
5380	firefox.exe
5380	firefox.exe
5380	firefox.exe
5380	firefox.exe
5380	firefox.exe
5380	firefox.exe
5380	firefox.exe
5380	firefox.exe
5380	firefox.exe
5380	firefox.exe
5380	firefox.exe
5380	firefox.exe
5380	firefox.exe
5380	firefox.exe
5380	firefox.exe
5380	firefox.exe
1908	800273810d.exe
1908	800273810d.exe
1908	800273810d.exe
1908	800273810d.exe
1908	800273810d.exe
1908	800273810d.exe
1908	800273810d.exe
1908	800273810d.exe
1908	800273810d.exe
1908	800273810d.exe
1908	800273810d.exe
1908	800273810d.exe
1908	800273810d.exe
1908	800273810d.exe
1908	800273810d.exe
1908	800273810d.exe
1908	800273810d.exe
1908	800273810d.exe
1908	800273810d.exe
1908	800273810d.exe
1908	800273810d.exe
1908	800273810d.exe
1908	800273810d.exe
1908	800273810d.exe
1908	800273810d.exe
1908	800273810d.exe
1908	800273810d.exe
1908	800273810d.exe
1908	800273810d.exe
1908	800273810d.exe
1908	800273810d.exe
1908	800273810d.exe
1908	800273810d.exe
1908	800273810d.exe
1908	800273810d.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1908	800273810d.exe
1908	800273810d.exe
1908	800273810d.exe
1908	800273810d.exe
1908	800273810d.exe
1908	800273810d.exe
1908	800273810d.exe
1908	800273810d.exe
1908	800273810d.exe
1908	800273810d.exe
1908	800273810d.exe
1908	800273810d.exe
1908	800273810d.exe
1908	800273810d.exe
1908	800273810d.exe
1908	800273810d.exe
1908	800273810d.exe
1908	800273810d.exe
1908	800273810d.exe
1908	800273810d.exe
1908	800273810d.exe
1908	800273810d.exe
1908	800273810d.exe
1908	800273810d.exe
1908	800273810d.exe
1908	800273810d.exe
1908	800273810d.exe
1908	800273810d.exe
1908	800273810d.exe
1908	800273810d.exe
1908	800273810d.exe
1908	800273810d.exe
1908	800273810d.exe
1908	800273810d.exe
1908	800273810d.exe
1908	800273810d.exe
1908	800273810d.exe
1908	800273810d.exe
1908	800273810d.exe
1908	800273810d.exe
1908	800273810d.exe
1908	800273810d.exe
1908	800273810d.exe
1908	800273810d.exe
1908	800273810d.exe
1908	800273810d.exe
1908	800273810d.exe
1908	800273810d.exe
1908	800273810d.exe
1908	800273810d.exe
1908	800273810d.exe
1908	800273810d.exe
1908	800273810d.exe
1908	800273810d.exe
1908	800273810d.exe
1908	800273810d.exe
1908	800273810d.exe
1908	800273810d.exe
1908	800273810d.exe
1908	800273810d.exe
1908	800273810d.exe
1908	800273810d.exe
1908	800273810d.exe
1908	800273810d.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3424	2e25eeff5c.exe
5380	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3128 wrote to memory of 3552	3128	075d28e2085d06b4d1e8fc60e3ee784495bebb37e8c3b0c38fbb047138cbf374.exe	79
PID 3128 wrote to memory of 3552	3128	075d28e2085d06b4d1e8fc60e3ee784495bebb37e8c3b0c38fbb047138cbf374.exe	79
PID 3128 wrote to memory of 3552	3128	075d28e2085d06b4d1e8fc60e3ee784495bebb37e8c3b0c38fbb047138cbf374.exe	79
PID 3552 wrote to memory of 3424	3552	explorti.exe	81
PID 3552 wrote to memory of 3424	3552	explorti.exe	81
PID 3552 wrote to memory of 3424	3552	explorti.exe	81
PID 3552 wrote to memory of 1908	3552	explorti.exe	82
PID 3552 wrote to memory of 1908	3552	explorti.exe	82
PID 3552 wrote to memory of 1908	3552	explorti.exe	82
PID 1908 wrote to memory of 4056	1908	800273810d.exe	83
PID 1908 wrote to memory of 4056	1908	800273810d.exe	83
PID 4056 wrote to memory of 5380	4056	firefox.exe	86
PID 4056 wrote to memory of 5380	4056	firefox.exe	86
PID 4056 wrote to memory of 5380	4056	firefox.exe	86
PID 4056 wrote to memory of 5380	4056	firefox.exe	86
PID 4056 wrote to memory of 5380	4056	firefox.exe	86
PID 4056 wrote to memory of 5380	4056	firefox.exe	86
PID 4056 wrote to memory of 5380	4056	firefox.exe	86
PID 4056 wrote to memory of 5380	4056	firefox.exe	86
PID 4056 wrote to memory of 5380	4056	firefox.exe	86
PID 4056 wrote to memory of 5380	4056	firefox.exe	86
PID 4056 wrote to memory of 5380	4056	firefox.exe	86
PID 5380 wrote to memory of 2316	5380	firefox.exe	87
PID 5380 wrote to memory of 2316	5380	firefox.exe	87
PID 5380 wrote to memory of 2316	5380	firefox.exe	87
PID 5380 wrote to memory of 2316	5380	firefox.exe	87
PID 5380 wrote to memory of 2316	5380	firefox.exe	87
PID 5380 wrote to memory of 2316	5380	firefox.exe	87
PID 5380 wrote to memory of 2316	5380	firefox.exe	87
PID 5380 wrote to memory of 2316	5380	firefox.exe	87
PID 5380 wrote to memory of 2316	5380	firefox.exe	87
PID 5380 wrote to memory of 2316	5380	firefox.exe	87
PID 5380 wrote to memory of 2316	5380	firefox.exe	87
PID 5380 wrote to memory of 2316	5380	firefox.exe	87
PID 5380 wrote to memory of 2316	5380	firefox.exe	87
PID 5380 wrote to memory of 2316	5380	firefox.exe	87
PID 5380 wrote to memory of 2316	5380	firefox.exe	87
PID 5380 wrote to memory of 2316	5380	firefox.exe	87
PID 5380 wrote to memory of 2316	5380	firefox.exe	87
PID 5380 wrote to memory of 2316	5380	firefox.exe	87
PID 5380 wrote to memory of 2316	5380	firefox.exe	87
PID 5380 wrote to memory of 2316	5380	firefox.exe	87
PID 5380 wrote to memory of 2316	5380	firefox.exe	87
PID 5380 wrote to memory of 2316	5380	firefox.exe	87
PID 5380 wrote to memory of 2316	5380	firefox.exe	87
PID 5380 wrote to memory of 2316	5380	firefox.exe	87
PID 5380 wrote to memory of 2316	5380	firefox.exe	87
PID 5380 wrote to memory of 2316	5380	firefox.exe	87
PID 5380 wrote to memory of 2316	5380	firefox.exe	87
PID 5380 wrote to memory of 2316	5380	firefox.exe	87
PID 5380 wrote to memory of 2316	5380	firefox.exe	87
PID 5380 wrote to memory of 2316	5380	firefox.exe	87
PID 5380 wrote to memory of 2316	5380	firefox.exe	87
PID 5380 wrote to memory of 2316	5380	firefox.exe	87
PID 5380 wrote to memory of 2316	5380	firefox.exe	87
PID 5380 wrote to memory of 2316	5380	firefox.exe	87
PID 5380 wrote to memory of 2316	5380	firefox.exe	87
PID 5380 wrote to memory of 2316	5380	firefox.exe	87
PID 5380 wrote to memory of 2316	5380	firefox.exe	87
PID 5380 wrote to memory of 2316	5380	firefox.exe	87
PID 5380 wrote to memory of 2316	5380	firefox.exe	87
PID 5380 wrote to memory of 2316	5380	firefox.exe	87
PID 5380 wrote to memory of 2316	5380	firefox.exe	87
PID 5380 wrote to memory of 2316	5380	firefox.exe	87

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\075d28e2085d06b4d1e8fc60e3ee784495bebb37e8c3b0c38fbb047138cbf374.exe
"C:\Users\Admin\AppData\Local\Temp\075d28e2085d06b4d1e8fc60e3ee784495bebb37e8c3b0c38fbb047138cbf374.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3128
- C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
  "C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3552
- - C:\Users\Admin\AppData\Local\Temp\1000006001\2e25eeff5c.exe
    "C:\Users\Admin\AppData\Local\Temp\1000006001\2e25eeff5c.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:3424
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\CGCFCBAKKF.exe"
      4⤵
      PID:3660
    - - C:\Users\Admin\AppData\Local\Temp\CGCFCBAKKF.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CGCFCBAKKF.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        
        PID:472
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\GDGDHJJDGH.exe"
      4⤵
      PID:1696
    - - C:\Users\Admin\AppData\Local\Temp\GDGDHJJDGH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GDGDHJJDGH.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        
        PID:2704
- - C:\Users\Admin\AppData\Local\Temp\1000011001\800273810d.exe
    "C:\Users\Admin\AppData\Local\Temp\1000011001\800273810d.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:1908
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4056
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
        5⤵
        Checks processor information in registry
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:5380
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1992 -parentBuildID 20240401114208 -prefsHandle 1920 -prefMapHandle 1912 -prefsLen 25757 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c0d1e889-1480-4938-bdcc-a4a2e8834c9e} 5380 "\\.\pipe\gecko-crash-server-pipe.5380" gpu
        6⤵
        
        PID:2316
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2412 -parentBuildID 20240401114208 -prefsHandle 2404 -prefMapHandle 2400 -prefsLen 26677 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {de32f0a6-44e1-4409-ac38-7d8be445ea21} 5380 "\\.\pipe\gecko-crash-server-pipe.5380" socket
        6⤵
        
        PID:452
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3164 -childID 1 -isForBrowser -prefsHandle 2964 -prefMapHandle 3160 -prefsLen 22698 -prefMapSize 244658 -jsInitHandle 1224 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ff6b2f7a-18c9-4ec9-9fc6-e4408c2e0824} 5380 "\\.\pipe\gecko-crash-server-pipe.5380" tab
        6⤵
        
        PID:5252
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3696 -childID 2 -isForBrowser -prefsHandle 3532 -prefMapHandle 3580 -prefsLen 31167 -prefMapSize 244658 -jsInitHandle 1224 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2770494e-5a41-4af0-8c4d-6edfcb06d4a7} 5380 "\\.\pipe\gecko-crash-server-pipe.5380" tab
        6⤵
        
        PID:5068
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4724 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4708 -prefMapHandle 4696 -prefsLen 31167 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cce7f53b-e7a9-41f1-8d01-f2d7d9906c36} 5380 "\\.\pipe\gecko-crash-server-pipe.5380" utility
        6⤵
        Checks processor information in registry
        
        PID:6132
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5492 -childID 3 -isForBrowser -prefsHandle 5484 -prefMapHandle 5480 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1224 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {649eaa8f-bf9a-4ad8-bdd7-d5b55bd1e4a7} 5380 "\\.\pipe\gecko-crash-server-pipe.5380" tab
        6⤵
        
        PID:4936
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4700 -childID 4 -isForBrowser -prefsHandle 5508 -prefMapHandle 5520 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1224 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8a8b6e25-751c-4283-87d0-9b5af626c3f2} 5380 "\\.\pipe\gecko-crash-server-pipe.5380" tab
        6⤵
        
        PID:2168
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5844 -childID 5 -isForBrowser -prefsHandle 5920 -prefMapHandle 5916 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1224 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e696fc80-17dc-49d7-b99f-609b10162533} 5380 "\\.\pipe\gecko-crash-server-pipe.5380" tab
        6⤵
        
        PID:5428

C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3408

C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2240

C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mozglue.dll

Path C:\ProgramData\mozglue.dll
Size 593KB
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
SSDEEP 12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5 SHA1 SHA512 SSDEEP

Submit Download

nss3.dll

Path C:\ProgramData\nss3.dll
Size 2.0MB
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
SSDEEP 49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5 SHA1 SHA512 SSDEEP

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\q0xshw2k.default-release\activity-stream.discovery_stream.json
Size 18KB
SHA256 702979dc86740ae7db069a9a7977d789fd20606c272a536d00f9a5e0e67ac545
MD5 05d566800fb9ba3e43edf436ff0581bd
SHA1 2a07db5228190b7c83166f95fa8e0bfaee2cbbc1
SHA512 f3c0e8110f2d053f14952fdb98b000c513f1bb35b8ae856623052d60d83ff12f4d5a47fa7fa2f505b6996f4537fb37d229883199202c436cde67d7e3a41f7456
SSDEEP 384:KvqJdcXQMKePt0IWR4/a96rKLY9t58IcyaE:KvTKi0YaaP8Icyp
MD5 SHA1 SHA512 SSDEEP

Submit Download

8A2034D325DC0B5C9E11EDDA3FC70A54C8DC1C0D

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\q0xshw2k.default-release\cache2\entries\8A2034D325DC0B5C9E11EDDA3FC70A54C8DC1C0D
Size 13KB
SHA256 3cb106f76972f3aa3a377848c16655b64a8589a3a4f529efc4527a1936be8834
MD5 db93095a1ae99639a39c594d62657bf3
SHA1 2149da19d5067371d06e96428bf036730d2653f1
SHA512 6522d0214e7ed57faead513fbf5faa5e600ec4ee1403d6139369c1136eb3af23ad03ae0af745293467dae8ab9668567c5285d86c128309af4d8ac160804081e0
SSDEEP 384:H485u9fiGLm4pUzft2WlOX8lPLZZB7t0lpDIIuWBWB:nUBi8mCUzft2WAX8tzB7eD8hSc
MD5 SHA1 SHA512 SSDEEP

Submit Download

2e25eeff5c.exe

Path C:\Users\Admin\AppData\Local\Temp\1000006001\2e25eeff5c.exe
Size 1.1MB
SHA256 931076586d551cccba6532aeb6393cc64ab293035c582125ef32e7eb82e3b0e5
MD5 73aa6448467db3d1ac25f7e9d8cf1cd4
SHA1 caaa71cdfbc3b33438766aff9bb536422721e5cd
SHA512 1647a8512a273e605756e3a23b81fcf9d7525ea4d0a2f4ff1e7695b11702c8a7336625edca9cbeb1d73ff592e5c038e02d780fa6c0eca5c31781a38bb4d8ba07
SSDEEP 24576:tUFuDtv4dsn0Ff5qI/z8L642KlCWZr9zs7wKztmZ7RGP3Wg+8o:tvDtvnn0R5h3cLZ9smNR0W4o
MD5 SHA1 SHA512 SSDEEP

Submit Download

800273810d.exe

Path C:\Users\Admin\AppData\Local\Temp\1000011001\800273810d.exe
Size 1.2MB
SHA256 3f2bee94e643be54f48e81b0d24a840cef515b4039531cf5636407b5bc751543
MD5 0b082b0bf85a180df2060281ee5cb447
SHA1 35d5ebc25f238628104d4377446fa0b51634a005
SHA512 558b7cae3042ad107f3ff737a79b81925feb7a27b72fa15141313f58f9d8402c7185598cfe43cb37c486d7717958e24d7400a581ca9f36a9f437f7ffe38cb8f1
SSDEEP 24576:mqDEvCTbMWu7rQYlBQcBiT6rprG8aLK2Sbly7TWEPje:mTvC/MTQYxsWR7aLK2dW
MD5 SHA1 SHA512 SSDEEP

Submit Download

explorti.exe

Path C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
Size 1.8MB
SHA256 075d28e2085d06b4d1e8fc60e3ee784495bebb37e8c3b0c38fbb047138cbf374
MD5 280308d6c9c141d022d1266540208a7c
SHA1 9b58baffb40b0c12a6ec20ef119d2084b82e6843
SHA512 d35c17409d7e644a62079ee797ead5ab6a9cb3c90871e634d5fe2f905ac67bcac42891fe3796a4a3de66e743bf7d48ae210e8702704b5e7e51ba02d57a8bc515
SSDEEP 49152:eeb2iyYdk0tqdBiAwvXtLfqXLXMa54/Ua9QcL0TGb:ewybBovVfqX5548a+JT8
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 479KB
SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
MD5 09372174e83dbbf696ee732fd2e875bb
SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 13.8MB
SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
MD5 0a8747a2ac9ac08ae9508f36c6d75692
SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q0xshw2k.default-release\AlternateServices.bin
Size 17KB
SHA256 2a3d775d7f8d8e05b65d915aca06b96cffd19197e3433aaa20b2928549bd9a58
MD5 40196f42bd310b33b018abac3bca0726
SHA1 db155125535c79d45a7f34a7627afe8cb1752c16
SHA512 68e6e522766b3d374bf806afbb035d81258aead69aafa368cf47125d0f7a43f352598d94b2025a0bf02e5addc913024f64d3fea14d980269e0fd2becd0db236a
SSDEEP 96:mLZ5ogLDmebOJubipebvpf+CbZbxb7gbgzlb27bebZbdbkHVLbQb:e5Uuq
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q0xshw2k.default-release\AlternateServices.bin
Size 12KB
SHA256 48295bb25cda2b7d9a7885bc5636f0665b59dc92e1d2fb1f87ef77fc0358bee4
MD5 15aec8b27bb16b75d9f3f3d0a2332d9e
SHA1 621b6bee177196fe63ce088a176db3aa80e6bd41
SHA512 49b41b98148e34c1d9f9abf24a00e8458aa93fa673e93b625eab2b06332bb2cabead4d0b9e6a7f9b3d873a89dd48e049aa801b4bf7192f3d0cd57a1e2e130053
SSDEEP 96:uLZ5ogLfmebOJubppebvpf+3bSbab7gbgzlbRb9b:G5Xu
MD5 SHA1 SHA512 SSDEEP

Submit Download

cookies.sqlite-wal

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q0xshw2k.default-release\cookies.sqlite-wal
Size 256KB
SHA256 6b1417a09650ba263c7c3ccbc4e96a061ab3756e859d83497340b4c7c6bf6226
MD5 7590a71e377a80252c70ee3e7f759547
SHA1 0c912bc8b6603d663ffd47754f28042520c33ed5
SHA512 675de611c651bb3cc863d32550f39d98d21c975f70c3ee2d0f5ac73df0b0cf7b58fe0e7e9eca23984be6b057c457c0cf0c645fdfb44ef1c656bf20a4f8bcba07
SSDEEP 96:HF93wR3P+ybk3AR3QoKGUh+ZFwk3AR3xauGUh+G:XSanOJJK
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q0xshw2k.default-release\datareporting\glean\db\data.safe.tmp
Size 16KB
SHA256 4e6d72becd0059db0bd9db63336e1d34137d11f04c3f743b55a5019a0ae3d428
MD5 9b25f6577df1640916d2540bd7e170a8
SHA1 ee3f07f4fd99e6e378ccd48b3cb9c91acbb86bd8
SHA512 8c601761c30bdbd81676797675c679c72f6e55abe6cd55c204b6313780b2fd7aea8fd44799c9a25e793bfb4a8c9dc248871a1d851a9ab6790c476729d6cf986d
SSDEEP 384:jbopqYPCgAY/66JozQzgC1b9AQhXh1D3sG4bAbV0:Xw6Plm8Qx/D3sG4bAbV0
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q0xshw2k.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 8f0ecc68a659ee6cfcaae1e3c94fb7533823f910e39284779a9777b4c538e43d
MD5 0731729050aeec5d638d798094bb1565
SHA1 f13534e27c35147fb31f9ce36340ac70640f3ef2
SHA512 a2d15f4675360be8d10ed5748f1a54d60a319bf8171228c027b3d6fe2ff39ac78afecdfdc3903ede767b307d4f405b40c6036d37490ba8b98d09ef44349d49a5
SSDEEP 96:qB8SMF9ZbkW6QX0BBJhmvxPP/PrWZRPUPsoNCFl66Joz0dzgClKtmSSM:lrvZboHJheFPCbPAY/66Joz0dzgCl6mI
MD5 SHA1 SHA512 SSDEEP

Submit Download

47000c3b-8dba-4d76-a75e-215fabcca542

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q0xshw2k.default-release\datareporting\glean\pending_pings\47000c3b-8dba-4d76-a75e-215fabcca542
Size 26KB
SHA256 92ae107b027fb4a9013020c69129e9dc1e053fbc91ba80d1d93c2a94c2104ec2
MD5 602726980df74e8ed38aa5419a31534e
SHA1 4c1a994b298f507a6beb38af273c3e36018c23ae
SHA512 33c3c7cf92e216fa1a1f7ff5d0d3c02b5b36b92208d369e893eb8807a9d7c159b9ab057f5ba38e8c5500482ffd8929e2ead6d99674a8c6dc52550ced2e8e1de4
SSDEEP 192:pC85EIQyvSbI9pWngysgIOJz/9WdCYWYOBVpqyR2Jl1ZnEsBgjvg5ij1WO1Pk6wb:pC80BISTTog2X+Yli1rxl54bCyWlQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

745fcfe4-9464-41a9-9baf-12d592d3d98a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q0xshw2k.default-release\datareporting\glean\pending_pings\745fcfe4-9464-41a9-9baf-12d592d3d98a
Size 671B
SHA256 23f8c589c5535029584518e917c7b700f88c658bf11f83116b90f7dc6a8cbcd4
MD5 a94f660362dbfbdf7ba71ecad8e5208e
SHA1 2632a6d01f4aebf98f9243da524cb83de3c8defa
SHA512 40fc27e2d374e0ffadd486444a3e0164ca8d8798b8db25525117388cbaa96a46412a2e78f92be2268207631dc199aa41f9126aa0aa9d411917232d12adc59423
MD5 SHA1 SHA512

Submit Download

7d14b5c0-f3ab-431c-9b75-cf25a8210fd2

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q0xshw2k.default-release\datareporting\glean\pending_pings\7d14b5c0-f3ab-431c-9b75-cf25a8210fd2
Size 982B
SHA256 e6bf7348e99ff20d9ccbeac26cac875092cfedcbbaf9452c016d8f1f5647c74f
MD5 9d346e2000a9bd75a70940af74f52e95
SHA1 f88d100051533ff71d5dd7a09ac2ef36cc22ec2a
SHA512 1cceacaf3eb3d0049ea8c1473d77868ab36ef83bfa59a66d4e1c155604a5fa9c4a9f6745a00a26622271de0ee20ccb8533dd696a3f5299bfbed504ee1ebc6243
MD5 SHA1 SHA512

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q0xshw2k.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Size 1.1MB
SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
MD5 842039753bf41fa5e11b3a1383061a87
SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q0xshw2k.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Size 116B
SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
MD5 2a461e9eb87fd1955cea740a3444ee7a
SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q0xshw2k.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Size 372B
SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
MD5 bf957ad58b55f64219ab3f793e374316
SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q0xshw2k.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Size 17.8MB
SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
MD5 daf7ef3acccab478aaa7d6dc1c60f865
SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
MD5 SHA1 SHA512 SSDEEP

Submit Download

places.sqlite-wal

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q0xshw2k.default-release\places.sqlite-wal
Size 992KB
SHA256 f11286792b6de50177f2fea8eafdf3f5e338f5e1f41821f78d6d218e968b55fc
MD5 f54a2777b6a9f5e2609a5c15d2f0cabc
SHA1 52febd1b982fb4b9d327189903c9ea37167cc012
SHA512 71d8341c17f7ad54a44eb870559cc53f2d3eea85902b1e4ee944eab653ddfaf27e74c32be96e90875a047d82a085696ec56cce4dcf2d8c74f25bf07aca7fef41
SSDEEP 192:enippNffIoYkZMgx/inipbhKFYYyQvW1Vx/x7nipv:enepFI/gEneUFzzWDnev
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q0xshw2k.default-release\prefs-1.js
Size 11KB
SHA256 fe05d0158aa12df3ae099a6de4ada264a2dd540ea63f5b3e4083e29ee7338778
MD5 65d3160c90ee1506c753c642768edf3d
SHA1 8193622474ee307326225ea0ae7f8d3f6fb2c4d7
SHA512 20a2600a062f534c1d733633cf865acbd57eb992ec8c336c8284d1b182fb95e41fba4ed54b8f96e85b3863ce5ac3a5e933cda75d24ee7b7b7c2c075c7ac5286b
SSDEEP 192:e5npRvfhEfzBNIWWiQcdtIW2bQHrS60waXO/Ja2nOBw8Hs:0ANFWsbFoQLRj/9swZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q0xshw2k.default-release\prefs-1.js
Size 12KB
SHA256 8a6e04747f05cf85b6878eb1b29eb75431e365c3bc14665193e168e89cb512d1
MD5 dba3d4e7a15fe53b3ce4cc3d980c30d7
SHA1 832fe5f82515f4ccec5d1a872ad20097dc5d0df5
SHA512 da31ead72a9ecf0d0853e5cc435f8ec520d94faeba4fc11641afa29d95bbbf78480f0454eae5c0887adc7f6322cbe4b048202fc0740fd158e1bab85a7277c113
SSDEEP 192:J5npRvfhEfzBNIWWiQcdtIW2bQHrS60waXuJ/Ja2nnZxzauBw8HMTDDp7t1r:fANFWsbFoQLR9J/9vwd
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q0xshw2k.default-release\prefs-1.js
Size 16KB
SHA256 4cc53c135176495104628df3ba0dfbc7df61d6a70c14e0660478db85655f6384
MD5 53872cdabcff7e1434fd126ab5947f7d
SHA1 2ce5b348df23277f8355418b646f455c59818f14
SHA512 781334e092e63abab3090fb66b15da8afcfb6a31ee528dc4451920e1fc9ec58da829997aa7ff1841568f01c29a91bc021d015d65f680b8791d8bfbf85592ad00
SSDEEP 192:JCnpRvfZfzBNIWWiQcdtIW2bQHrS60waXuD+/Ja2nnZxzDRiBw8HMxRVIHgWv:SrNFWsbFoQLR9C/9mwHs
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q0xshw2k.default-release\prefs.js
Size 11KB
SHA256 b04b0d44d59d99ffb4f772658e738231298f62aa9fafe5e4221b01b3746867f5
MD5 b01deffdba7fe6fe7b90d12c7dafade2
SHA1 068ced5b2a51341511b3ddd0f278bbb9a90b146c
SHA512 a63ca30b0830c175cf278c4e98a737224414e6e811b2aa99a71548d3ac16165370a591d8e352891807c0d31d12e470ba53e4051f10d97c51f65b8d1e1cb95dd9
SSDEEP 192:e5npRvfhEfzBNIWWiQcdtIW2bQHrS60waXuJ/Ja2nOBw8Hs:0ANFWsbFoQLR9J/9swZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q0xshw2k.default-release\prefs.js
Size 8KB
SHA256 5d330c675c58796caa65a90b504e3f14af7505723ee572961adde50fa30733c3
MD5 d3699845fb8038352e20d3b6404e4dcb
SHA1 23b565506d4f1fa3c6471b74b60435961c6efad6
SHA512 7d22b49173d1b2370ddc96c3dbffb5f1b44e4ee01cdca8f418bfb32e51b4bf2d063a361c7e5433eeb5e6d45e7c9be187f5615d5f1f3dabaf7b0a1363cb01ec9c
SSDEEP 192:e5npRvfhEhYLslcd1y60iaXO/Ja2nOBw8Hs:0dsCHx9/9swZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/472-512-0x00000000001B0000-0x0000000000660000-memory.dmp

Download

memory/472-521-0x00000000001B0000-0x0000000000660000-memory.dmp

Download

memory/1520-3101-0x0000000000510000-0x00000000009C0000-memory.dmp

Download

memory/1520-3102-0x0000000000510000-0x00000000009C0000-memory.dmp

Download

memory/2240-2943-0x0000000000510000-0x00000000009C0000-memory.dmp

Download

memory/2240-3085-0x0000000000510000-0x00000000009C0000-memory.dmp

Download

memory/2704-522-0x0000000000090000-0x0000000000540000-memory.dmp

Download

memory/2704-516-0x0000000000090000-0x0000000000540000-memory.dmp

Download

memory/3128-1-0x00000000770B6000-0x00000000770B8000-memory.dmp

Download

memory/3128-5-0x0000000000980000-0x0000000000E30000-memory.dmp

Download

memory/3128-3-0x0000000000980000-0x0000000000E30000-memory.dmp

Download

memory/3128-0-0x0000000000980000-0x0000000000E30000-memory.dmp

Download

memory/3128-17-0x0000000000980000-0x0000000000E30000-memory.dmp

Download

memory/3128-2-0x0000000000981000-0x00000000009AF000-memory.dmp

Download

memory/3408-25-0x0000000000510000-0x00000000009C0000-memory.dmp

Download

memory/3408-24-0x0000000000510000-0x00000000009C0000-memory.dmp

Download

memory/3408-23-0x0000000000510000-0x00000000009C0000-memory.dmp

Download

memory/3424-333-0x0000000000350000-0x00000000008E2000-memory.dmp

Download

memory/3424-387-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Download

memory/3424-509-0x0000000000350000-0x00000000008E2000-memory.dmp

Download

memory/3424-502-0x0000000000350000-0x00000000008E2000-memory.dmp

Download

memory/3424-41-0x0000000000350000-0x00000000008E2000-memory.dmp

Download

memory/3424-465-0x0000000000350000-0x00000000008E2000-memory.dmp

Download

memory/3552-2537-0x0000000000510000-0x00000000009C0000-memory.dmp

Download

memory/3552-3093-0x0000000000510000-0x00000000009C0000-memory.dmp

Download

memory/3552-447-0x0000000000510000-0x00000000009C0000-memory.dmp

Download

memory/3552-334-0x0000000000510000-0x00000000009C0000-memory.dmp

Download

memory/3552-20-0x0000000000510000-0x00000000009C0000-memory.dmp

Download

memory/3552-61-0x0000000000510000-0x00000000009C0000-memory.dmp

Download

memory/3552-1147-0x0000000000510000-0x00000000009C0000-memory.dmp

Download

memory/3552-523-0x0000000000510000-0x00000000009C0000-memory.dmp

Download

memory/3552-18-0x0000000000510000-0x00000000009C0000-memory.dmp

Download

memory/3552-42-0x0000000000510000-0x00000000009C0000-memory.dmp

Download

memory/3552-3086-0x0000000000510000-0x00000000009C0000-memory.dmp

Download

memory/3552-446-0x0000000000510000-0x00000000009C0000-memory.dmp

Download

memory/3552-501-0x0000000000510000-0x00000000009C0000-memory.dmp

Download

memory/3552-3096-0x0000000000510000-0x00000000009C0000-memory.dmp

Download

memory/3552-3097-0x0000000000510000-0x00000000009C0000-memory.dmp

Download

memory/3552-3098-0x0000000000510000-0x00000000009C0000-memory.dmp

Download

memory/3552-3099-0x0000000000510000-0x00000000009C0000-memory.dmp

Download

memory/3552-19-0x0000000000510000-0x00000000009C0000-memory.dmp

Download

memory/3552-21-0x0000000000510000-0x00000000009C0000-memory.dmp

Download

memory/3552-3103-0x0000000000510000-0x00000000009C0000-memory.dmp

Download

memory/3552-3109-0x0000000000510000-0x00000000009C0000-memory.dmp

Download