amadey | 31264693ec1e14e7c1ac8e55a0a0a8fa8982eb066ec3927a7fa88c734d6e76db

Analysis

max time kernel
150s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20240709-en
resource tags

arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
submitted
16/07/2024, 01:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
31264693ec1e14e7c1ac8e55a0a0a8fa8982eb066ec3927a7fa88c734d6e76db.exe
Size 1.8MB
Sample240716-bdv7lazhpg
SHA256 31264693ec1e14e7c1ac8e55a0a0a8fa8982eb066ec3927a7fa88c734d6e76db
MD5 7bcd2531931daa2c351ed145df5cd95f
SHA1 117f5840022d7863ec0cb4f94e5dba23cf341d1a
SHA512 ebb4615407dea20c499a2969c516833741606c9ac05411b527ba4760273ebf574642b4d3b3eafff42f36293aed6f7c0d89fac1770ab4b708827acf990c88f087
SSDEEP 49152:sQflbygwrDpGHyns4IUSOdHxqFKSvcvsgmcOc/:5lw8X4+OdRqFFvcvszcOc
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey stealc 4dd39d funny discovery evasion spyware stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.30

Botnet

4dd39d

http://77.91.77.82

Attributes

install_dir
ad40971b6b
install_file
explorti.exe
strings_key
a434973ad22def7137dbb5e059b7081e
url_paths
/Hun4Ko/index.php

rc4.plain

Extracted

Family

stealc

Botnet

funny

http://85.28.47.30

Attributes

url_path
/920475a59bac849d.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Stealc
Stealc is an infostealer written in C++.
stealer stealc

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	31264693ec1e14e7c1ac8e55a0a0a8fa8982eb066ec3927a7fa88c734d6e76db.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	FHJEGIIEGI.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 10 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	FHJEGIIEGI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	FHJEGIIEGI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	31264693ec1e14e7c1ac8e55a0a0a8fa8982eb066ec3927a7fa88c734d6e76db.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	31264693ec1e14e7c1ac8e55a0a0a8fa8982eb066ec3927a7fa88c734d6e76db.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe

Executes dropped EXE 6 IoCs

pid	Process
4936	explorti.exe
4352	90412ef116.exe
4304	85a60ef60e.exe
1196	FHJEGIIEGI.exe
1300	explorti.exe
5312	explorti.exe

Identifies Wine through registry keys 2 TTPs 5 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2087971895-212656400-463594913-1000\Software\Wine	31264693ec1e14e7c1ac8e55a0a0a8fa8982eb066ec3927a7fa88c734d6e76db.exe
Key opened	\REGISTRY\USER\S-1-5-21-2087971895-212656400-463594913-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-2087971895-212656400-463594913-1000\Software\Wine	FHJEGIIEGI.exe
Key opened	\REGISTRY\USER\S-1-5-21-2087971895-212656400-463594913-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-2087971895-212656400-463594913-1000\Software\Wine	explorti.exe

Loads dropped DLL 2 IoCs

pid	Process
4352	90412ef116.exe
4352	90412ef116.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x000100000002aa81-43.dat	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs

pid	Process
1152	31264693ec1e14e7c1ac8e55a0a0a8fa8982eb066ec3927a7fa88c734d6e76db.exe
4936	explorti.exe
4352	90412ef116.exe
4352	90412ef116.exe
1196	FHJEGIIEGI.exe
1300	explorti.exe
5312	explorti.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\explorti.job	31264693ec1e14e7c1ac8e55a0a0a8fa8982eb066ec3927a7fa88c734d6e76db.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	90412ef116.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	90412ef116.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2087971895-212656400-463594913-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1152	31264693ec1e14e7c1ac8e55a0a0a8fa8982eb066ec3927a7fa88c734d6e76db.exe
1152	31264693ec1e14e7c1ac8e55a0a0a8fa8982eb066ec3927a7fa88c734d6e76db.exe
4936	explorti.exe
4936	explorti.exe
4352	90412ef116.exe
4352	90412ef116.exe
4352	90412ef116.exe
4352	90412ef116.exe
1196	FHJEGIIEGI.exe
1196	FHJEGIIEGI.exe
1300	explorti.exe
1300	explorti.exe
5312	explorti.exe
5312	explorti.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2456	firefox.exe
Token: SeDebugPrivilege	2456	firefox.exe
Token: SeDebugPrivilege	2456	firefox.exe
Token: SeDebugPrivilege	2456	firefox.exe
Token: SeDebugPrivilege	2456	firefox.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1152	31264693ec1e14e7c1ac8e55a0a0a8fa8982eb066ec3927a7fa88c734d6e76db.exe
4304	85a60ef60e.exe
4304	85a60ef60e.exe
4304	85a60ef60e.exe
4304	85a60ef60e.exe
4304	85a60ef60e.exe
4304	85a60ef60e.exe
4304	85a60ef60e.exe
2456	firefox.exe
2456	firefox.exe
2456	firefox.exe
2456	firefox.exe
2456	firefox.exe
2456	firefox.exe
2456	firefox.exe
2456	firefox.exe
2456	firefox.exe
2456	firefox.exe
2456	firefox.exe
2456	firefox.exe
2456	firefox.exe
2456	firefox.exe
2456	firefox.exe
2456	firefox.exe
2456	firefox.exe
2456	firefox.exe
2456	firefox.exe
2456	firefox.exe
2456	firefox.exe
4304	85a60ef60e.exe
4304	85a60ef60e.exe
4304	85a60ef60e.exe
4304	85a60ef60e.exe
4304	85a60ef60e.exe
4304	85a60ef60e.exe
4304	85a60ef60e.exe
4304	85a60ef60e.exe
4304	85a60ef60e.exe
4304	85a60ef60e.exe
4304	85a60ef60e.exe
4304	85a60ef60e.exe
4304	85a60ef60e.exe
4304	85a60ef60e.exe
4304	85a60ef60e.exe
4304	85a60ef60e.exe
4304	85a60ef60e.exe
4304	85a60ef60e.exe
4304	85a60ef60e.exe
4304	85a60ef60e.exe
4304	85a60ef60e.exe
4304	85a60ef60e.exe
4304	85a60ef60e.exe
4304	85a60ef60e.exe
4304	85a60ef60e.exe
4304	85a60ef60e.exe
4304	85a60ef60e.exe
4304	85a60ef60e.exe
4304	85a60ef60e.exe
4304	85a60ef60e.exe
4304	85a60ef60e.exe
4304	85a60ef60e.exe
4304	85a60ef60e.exe
4304	85a60ef60e.exe
4304	85a60ef60e.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4304	85a60ef60e.exe
4304	85a60ef60e.exe
4304	85a60ef60e.exe
4304	85a60ef60e.exe
4304	85a60ef60e.exe
4304	85a60ef60e.exe
4304	85a60ef60e.exe
4304	85a60ef60e.exe
4304	85a60ef60e.exe
4304	85a60ef60e.exe
4304	85a60ef60e.exe
4304	85a60ef60e.exe
4304	85a60ef60e.exe
4304	85a60ef60e.exe
4304	85a60ef60e.exe
4304	85a60ef60e.exe
4304	85a60ef60e.exe
4304	85a60ef60e.exe
4304	85a60ef60e.exe
4304	85a60ef60e.exe
4304	85a60ef60e.exe
4304	85a60ef60e.exe
4304	85a60ef60e.exe
4304	85a60ef60e.exe
4304	85a60ef60e.exe
4304	85a60ef60e.exe
4304	85a60ef60e.exe
4304	85a60ef60e.exe
4304	85a60ef60e.exe
4304	85a60ef60e.exe
4304	85a60ef60e.exe
4304	85a60ef60e.exe
4304	85a60ef60e.exe
4304	85a60ef60e.exe
4304	85a60ef60e.exe
4304	85a60ef60e.exe
4304	85a60ef60e.exe
4304	85a60ef60e.exe
4304	85a60ef60e.exe
4304	85a60ef60e.exe
4304	85a60ef60e.exe
4304	85a60ef60e.exe
4304	85a60ef60e.exe
4304	85a60ef60e.exe
4304	85a60ef60e.exe
4304	85a60ef60e.exe
4304	85a60ef60e.exe
4304	85a60ef60e.exe
4304	85a60ef60e.exe
4304	85a60ef60e.exe
4304	85a60ef60e.exe
4304	85a60ef60e.exe
4304	85a60ef60e.exe
4304	85a60ef60e.exe
4304	85a60ef60e.exe
4304	85a60ef60e.exe
4304	85a60ef60e.exe
4304	85a60ef60e.exe
4304	85a60ef60e.exe
4304	85a60ef60e.exe
4304	85a60ef60e.exe
4304	85a60ef60e.exe
4304	85a60ef60e.exe
4304	85a60ef60e.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4352	90412ef116.exe
2456	firefox.exe
4960	cmd.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1152 wrote to memory of 4936	1152	31264693ec1e14e7c1ac8e55a0a0a8fa8982eb066ec3927a7fa88c734d6e76db.exe	82
PID 1152 wrote to memory of 4936	1152	31264693ec1e14e7c1ac8e55a0a0a8fa8982eb066ec3927a7fa88c734d6e76db.exe	82
PID 1152 wrote to memory of 4936	1152	31264693ec1e14e7c1ac8e55a0a0a8fa8982eb066ec3927a7fa88c734d6e76db.exe	82
PID 4936 wrote to memory of 4352	4936	explorti.exe	83
PID 4936 wrote to memory of 4352	4936	explorti.exe	83
PID 4936 wrote to memory of 4352	4936	explorti.exe	83
PID 4936 wrote to memory of 4304	4936	explorti.exe	84
PID 4936 wrote to memory of 4304	4936	explorti.exe	84
PID 4936 wrote to memory of 4304	4936	explorti.exe	84
PID 4304 wrote to memory of 2704	4304	85a60ef60e.exe	85
PID 4304 wrote to memory of 2704	4304	85a60ef60e.exe	85
PID 2704 wrote to memory of 2456	2704	firefox.exe	88
PID 2704 wrote to memory of 2456	2704	firefox.exe	88
PID 2704 wrote to memory of 2456	2704	firefox.exe	88
PID 2704 wrote to memory of 2456	2704	firefox.exe	88
PID 2704 wrote to memory of 2456	2704	firefox.exe	88
PID 2704 wrote to memory of 2456	2704	firefox.exe	88
PID 2704 wrote to memory of 2456	2704	firefox.exe	88
PID 2704 wrote to memory of 2456	2704	firefox.exe	88
PID 2704 wrote to memory of 2456	2704	firefox.exe	88
PID 2704 wrote to memory of 2456	2704	firefox.exe	88
PID 2704 wrote to memory of 2456	2704	firefox.exe	88
PID 2456 wrote to memory of 3204	2456	firefox.exe	89
PID 2456 wrote to memory of 3204	2456	firefox.exe	89
PID 2456 wrote to memory of 3204	2456	firefox.exe	89
PID 2456 wrote to memory of 3204	2456	firefox.exe	89
PID 2456 wrote to memory of 3204	2456	firefox.exe	89
PID 2456 wrote to memory of 3204	2456	firefox.exe	89
PID 2456 wrote to memory of 3204	2456	firefox.exe	89
PID 2456 wrote to memory of 3204	2456	firefox.exe	89
PID 2456 wrote to memory of 3204	2456	firefox.exe	89
PID 2456 wrote to memory of 3204	2456	firefox.exe	89
PID 2456 wrote to memory of 3204	2456	firefox.exe	89
PID 2456 wrote to memory of 3204	2456	firefox.exe	89
PID 2456 wrote to memory of 3204	2456	firefox.exe	89
PID 2456 wrote to memory of 3204	2456	firefox.exe	89
PID 2456 wrote to memory of 3204	2456	firefox.exe	89
PID 2456 wrote to memory of 3204	2456	firefox.exe	89
PID 2456 wrote to memory of 3204	2456	firefox.exe	89
PID 2456 wrote to memory of 3204	2456	firefox.exe	89
PID 2456 wrote to memory of 3204	2456	firefox.exe	89
PID 2456 wrote to memory of 3204	2456	firefox.exe	89
PID 2456 wrote to memory of 3204	2456	firefox.exe	89
PID 2456 wrote to memory of 3204	2456	firefox.exe	89
PID 2456 wrote to memory of 3204	2456	firefox.exe	89
PID 2456 wrote to memory of 3204	2456	firefox.exe	89
PID 2456 wrote to memory of 3204	2456	firefox.exe	89
PID 2456 wrote to memory of 3204	2456	firefox.exe	89
PID 2456 wrote to memory of 3204	2456	firefox.exe	89
PID 2456 wrote to memory of 3204	2456	firefox.exe	89
PID 2456 wrote to memory of 3204	2456	firefox.exe	89
PID 2456 wrote to memory of 3204	2456	firefox.exe	89
PID 2456 wrote to memory of 3204	2456	firefox.exe	89
PID 2456 wrote to memory of 3204	2456	firefox.exe	89
PID 2456 wrote to memory of 3204	2456	firefox.exe	89
PID 2456 wrote to memory of 3204	2456	firefox.exe	89
PID 2456 wrote to memory of 3204	2456	firefox.exe	89
PID 2456 wrote to memory of 3204	2456	firefox.exe	89
PID 2456 wrote to memory of 3204	2456	firefox.exe	89
PID 2456 wrote to memory of 3204	2456	firefox.exe	89
PID 2456 wrote to memory of 3204	2456	firefox.exe	89
PID 2456 wrote to memory of 3204	2456	firefox.exe	89
PID 2456 wrote to memory of 3204	2456	firefox.exe	89
PID 2456 wrote to memory of 3204	2456	firefox.exe	89

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\31264693ec1e14e7c1ac8e55a0a0a8fa8982eb066ec3927a7fa88c734d6e76db.exe
"C:\Users\Admin\AppData\Local\Temp\31264693ec1e14e7c1ac8e55a0a0a8fa8982eb066ec3927a7fa88c734d6e76db.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1152
- C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
  "C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4936
- - C:\Users\Admin\AppData\Local\Temp\1000006001\90412ef116.exe
    "C:\Users\Admin\AppData\Local\Temp\1000006001\90412ef116.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:4352
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\FHJEGIIEGI.exe"
      4⤵
      PID:1944
    - - C:\Users\Admin\AppData\Local\Temp\FHJEGIIEGI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\FHJEGIIEGI.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        
        PID:1196
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\IEHCBAFIDA.exe"
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:4960
- - C:\Users\Admin\AppData\Local\Temp\1000011001\85a60ef60e.exe
    "C:\Users\Admin\AppData\Local\Temp\1000011001\85a60ef60e.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:4304
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2704
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
        5⤵
        Checks processor information in registry
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2456
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1960 -parentBuildID 20240401114208 -prefsHandle 1876 -prefMapHandle 1872 -prefsLen 25749 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c4416c6a-9632-47c8-997d-25f58a4a4aa5} 2456 "\\.\pipe\gecko-crash-server-pipe.2456" gpu
        6⤵
        
        PID:3204
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2380 -parentBuildID 20240401114208 -prefsHandle 2372 -prefMapHandle 2368 -prefsLen 26669 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {77373f0c-1b1e-471d-9bd6-da659ccb6d22} 2456 "\\.\pipe\gecko-crash-server-pipe.2456" socket
        6⤵
        
        PID:4608
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2784 -childID 1 -isForBrowser -prefsHandle 3004 -prefMapHandle 3192 -prefsLen 22698 -prefMapSize 244658 -jsInitHandle 1396 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3ca92584-d205-4559-9c5f-cfdb8cfa02de} 2456 "\\.\pipe\gecko-crash-server-pipe.2456" tab
        6⤵
        
        PID:3132
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3896 -childID 2 -isForBrowser -prefsHandle 3892 -prefMapHandle 3888 -prefsLen 31159 -prefMapSize 244658 -jsInitHandle 1396 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {73e8b063-4bb9-4346-a51e-3221fbc415f5} 2456 "\\.\pipe\gecko-crash-server-pipe.2456" tab
        6⤵
        
        PID:352
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4740 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4704 -prefMapHandle 4720 -prefsLen 31159 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8c0fa729-ec73-4222-b1fa-1c3b11b07cde} 2456 "\\.\pipe\gecko-crash-server-pipe.2456" utility
        6⤵
        Checks processor information in registry
        
        PID:3692
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5560 -childID 3 -isForBrowser -prefsHandle 5572 -prefMapHandle 5568 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1396 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {30d63fb8-96a4-4906-9da5-5073e6a535c4} 2456 "\\.\pipe\gecko-crash-server-pipe.2456" tab
        6⤵
        
        PID:5880
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4680 -childID 4 -isForBrowser -prefsHandle 5584 -prefMapHandle 5580 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1396 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {032bd533-23ab-4c62-a881-8da026590e04} 2456 "\\.\pipe\gecko-crash-server-pipe.2456" tab
        6⤵
        
        PID:5888
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5792 -childID 5 -isForBrowser -prefsHandle 5800 -prefMapHandle 5804 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1396 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1e45a5d9-5791-49ab-a7ad-37a147169718} 2456 "\\.\pipe\gecko-crash-server-pipe.2456" tab
        6⤵
        
        PID:5904

C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1300

C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

JJJKFBAAAFHJEBFIEGID

Path C:\ProgramData\JJJKFBAAAFHJEBFIEGID
Size 11KB
SHA256 5db0c6729e4b72e0bec28289275691b62e003ec63590a4bcbf2e14ac11e67aa5
MD5 ec9d87dc3f6addfa1e5db1510ac76aa0
SHA1 0483a81cb3a9c525a5ef804e954d69b61bf5bb5b
SHA512 906aecb5c584e9d5fff3974d2117cab98b817a4b6361bc9bb6046d9eceb82f9dbf9c7847037bd70d0e90280c71f0c62cdc3f9a3a5327979133067ec44f2ad202
SSDEEP 192:5J5nlRMftPZ1tDzUwcdii8z2QHrGk60jaXNra4XBw8Hy:5oxtDzUVgz2QLIrrtwX
MD5 SHA1 SHA512 SSDEEP

Submit Download

mozglue.dll

Path C:\ProgramData\mozglue.dll
Size 593KB
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
SSDEEP 12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5 SHA1 SHA512 SSDEEP

Submit Download

nss3.dll

Path C:\ProgramData\nss3.dll
Size 2.0MB
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
SSDEEP 49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5 SHA1 SHA512 SSDEEP

Submit Download

activity-stream.discovery_stream.json.tmp

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\7qnbgwy0.default-release\activity-stream.discovery_stream.json.tmp
Size 18KB
SHA256 312c0fa6076bd641e551441f21a44140dbd896bced165925359cd126253a6131
MD5 55ac5264d690f5365ec99678ec66834d
SHA1 608ffd7c38a20bccf2fbc27e2837d3808d048828
SHA512 d65b434d89874ade1905cddc5d84f3951d358a2de21b5553e770d4682092d62f163eb27d9c5bd3bca5e384b18926b879e86a35b4b0a33927ec3f9807d5105508
SSDEEP 384:KtZmec8S158WIODUYii121zofiQVbf5flUZ6S50HH6ya3:KH21SHOB91xq+kb6H6yE
MD5 SHA1 SHA512 SSDEEP

Submit Download

8A2034D325DC0B5C9E11EDDA3FC70A54C8DC1C0D

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\7qnbgwy0.default-release\cache2\entries\8A2034D325DC0B5C9E11EDDA3FC70A54C8DC1C0D
Size 13KB
SHA256 0f62bad0f289f4f5b0f532d53fa8b57ed2253e860796b9f3cee3462947dc148b
MD5 51d385804ae1a60ee16d69b2ecee6803
SHA1 1d03bacb143130b657bf15a53263f53283ff5fb2
SHA512 39a1bfc117a8efd7bc6838bfb5e1620e5d0a26268634a77ef810fc1eece06a6216a399e806ad1a04ef94c042ee4bfc3351ff7b96f737483a0625da4b3df1ad1b
SSDEEP 384:H485u9fiGLm4pUNft2WlOX8lPLZZB7t0lpDIIz7Y:nUBi8mCUNft2WAX8tzB7eD8h
MD5 SHA1 SHA512 SSDEEP

Submit Download

90412ef116.exe

Path C:\Users\Admin\AppData\Local\Temp\1000006001\90412ef116.exe
Size 2.4MB
SHA256 aff20c28bd7188b03932a3ca44c307de9df1ec97c69d41ff3c6153e31d077b47
MD5 57a80d7e7f4ed41e5bb11364220136d5
SHA1 d5e6f7bffb60fa6f231bee4763a331ee24b6ff7c
SHA512 507ff461e0b681f897fda7e689d1c8f8d2b2f8f2d1f0808216768e8be72999eed05142011f5ddfb66dbaec5606d08050531e18672b5b9402c5171b20b934086d
SSDEEP 49152:CaPzQMiYR361Fvh0LH+D9xQjgCEMVEMDyOeAZOaONpQ+Z/Pj+EXFqhxYSp3ENE:CaPsrYRKrhAHS9YgCEMVEk9ONyVEXkzZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

85a60ef60e.exe

Path C:\Users\Admin\AppData\Local\Temp\1000011001\85a60ef60e.exe
Size 1.2MB
SHA256 cfe653200c640207d1036539356209c7ff4c1ddd410e599508131543fa9a9472
MD5 b591f9647f4b4d7ed58a030df16084e6
SHA1 efec7efcc0869e024270b5927627bfc1631032d7
SHA512 6842cc2441a8e3d38acebfc6ec57d760b5c0fa5a468cfe5a44796ffa33e2d76121d2fdf03128cf50914008be6ec78b5f1f2206b7688521eb510ce6da2e069e5f
SSDEEP 24576:9qDEvCTbMWu7rQYlBQcBiT6rprG8aLg2Sbly7TWEPje:9TvC/MTQYxsWR7aLg2dW
MD5 SHA1 SHA512 SSDEEP

Submit Download

explorti.exe

Path C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
Size 1.8MB
SHA256 31264693ec1e14e7c1ac8e55a0a0a8fa8982eb066ec3927a7fa88c734d6e76db
MD5 7bcd2531931daa2c351ed145df5cd95f
SHA1 117f5840022d7863ec0cb4f94e5dba23cf341d1a
SHA512 ebb4615407dea20c499a2969c516833741606c9ac05411b527ba4760273ebf574642b4d3b3eafff42f36293aed6f7c0d89fac1770ab4b708827acf990c88f087
SSDEEP 49152:sQflbygwrDpGHyns4IUSOdHxqFKSvcvsgmcOc/:5lw8X4+OdRqFFvcvszcOc
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 479KB
SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
MD5 09372174e83dbbf696ee732fd2e875bb
SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 13.8MB
SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
MD5 0a8747a2ac9ac08ae9508f36c6d75692
SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7qnbgwy0.default-release\AlternateServices.bin
Size 17KB
SHA256 6c4e8a32078258273e6ff82b8b08166b26914c4caa7da4f553ed71bd43453928
MD5 5356c574685260f27723ad60c2237052
SHA1 92bc12ca2fa64afbc7538761f27641783fd7b4d1
SHA512 bd816c2b3eee5eb8f385d5c9e2117e1f0d40e32f1d4c80d14c1086618f3205522c599dbd14a0b5b37cbb03b71bc62b6a774cabc67cd924342ea5dff0ed6a602b
SSDEEP 96:/5oBebOJPb4pebvpf+QbwbkbGgbgzcbrbXbDbPbuHVmbjb:/5ju
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7qnbgwy0.default-release\AlternateServices.bin
Size 10KB
SHA256 a7390cb901b33b583800bad3091f862cbcac482ed75803531c12398be68fe463
MD5 1c204610410496132406b287ebdb1866
SHA1 2f8653d4ec7905593baa41098040cdc570c81cff
SHA512 f3f08173d9bed0a6ad5a996ce4d8e101dac388260041932d03bf83758d10c4917a1aaccb543c8ad8d9bcacefb511d5a069777029f670053d3ba11ad71c777e7e
SSDEEP 24:EuB1owOUgu1xgRbDKKpR5cOuuhMZiXFsh2F3LFZBpsJbF0JZFbVWKsJblxWKf+Zt:75of9cOzvebOJPbVpebvpf+PbIb8b
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7qnbgwy0.default-release\AlternateServices.bin
Size 12KB
SHA256 6dc2b7a7a4d5e227f31ea9d8d3b2c7c7a47864b06df3ed445b37ff3c0eda59a0
MD5 8886b82302b8a274fecb8540ebf1ea7c
SHA1 6e7a68597b2c5e2b01d0c73daa7b11a468793752
SHA512 de817a8fd6154dd41bb5f9bb3efc0e4232cb88f6c3d267fc0aecaf0da295022dca2a540047ed0926d81b4e670cfa7d3222f3eed191847b817bac9a465f56a34d
SSDEEP 96:75oBebOJPbVpebvpf+PbbbrbGgbgzcbrbXb:75au
MD5 SHA1 SHA512 SSDEEP

Submit Download

cookies.sqlite-wal

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7qnbgwy0.default-release\cookies.sqlite-wal
Size 256KB
SHA256 73a6e9a9615785c31279f5c0735d7fcca4a4465855c9e8c04663e607e0e400b4
MD5 1ac21c8506fbcdaacf1c30760e405c0d
SHA1 aca435d9b2e9cb260cfe0c370ea5cfa25f106323
SHA512 c98decea08812f28a480018783ca4c40bffd86b3828050b58284d2fe839d86c1f874ea5c180bee8e91b6bba23cee81c5dc4794dc6588be95fcb7b3b301c0e640
SSDEEP 96:Plk2IcR+C8B2IcSoKGUh+iNz+8B2IcTauGUh+G:KOMK
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7qnbgwy0.default-release\datareporting\glean\db\data.safe.tmp
Size 24KB
SHA256 1dbc4f01bb45324d7f3bde20c1adf798fdd9e8f9272fb116799a7552e9542f4b
MD5 3b060d5ee6a233568a101717c86bb395
SHA1 434a66d5ba86c01ef4a7affd7a2bf9d74e801ca6
SHA512 ded30bd7b0aeb7b6bb06d7acc3cb67817b71527353e01506fec7b60ac0e99512fd4bf63902a879077756407291290a264d09f1c46c26494900bbea4963ed6ae3
SSDEEP 768:7I2mcdLRPuwt0D9/l2qNMUvfDb3bbbxbCbwb/bDb9bq+bPok:VdtPuUn+bPok
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7qnbgwy0.default-release\datareporting\glean\db\data.safe.tmp
Size 21KB
SHA256 cf70aa99d5ccf7726ff0f273c523c4c638045fb1b23410065a8fa6fdfd81f6a0
MD5 9b562c83c24d46d226a8d1933eb2c587
SHA1 f7e9b99a7569603c81f756c1056bd85bed84eabe
SHA512 48e0fd5fbf44ecfb47b6fc4e819cdfdb55602e87e449c44be36e88d0bc8fb36c914bf0c592158a4c355b54609a9a6b968ea45dda1a6ddd0a92d3abf393fdd6cd
SSDEEP 384:x/66JozQzgC1bQtJVj9GTyzP9/yWqNMUvmob3bbbmSbAbwb/bDb9bd6KfsVZboRc:0matL9PP9/yWqNMUvmob3bbbmSbAbwbi
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7qnbgwy0.default-release\datareporting\glean\db\data.safe.tmp
Size 22KB
SHA256 e1f6f3439eff0a8004380c77c76cbd89d157c5c215f155cdeaca8a65584fe524
MD5 6f3bd1e4a42c0571e3d60dfd177b2fb7
SHA1 567c3d8a26dbfcbe5b2ca325553b7b7828ed2848
SHA512 54aa1ff19489874daa338d738d5d16d8652911afd9b7ad3f768574e010a60767103ebe8884bc96913add6b2ad441f3de0d3296b3a6ed371cbdc4372236feeb5f
SSDEEP 384:OtJVj9GTyzP9/yWqNMUvmob3bbbmSbAbwb/bDb9bd6KfsVVboRsPl/66JozQzgCm:OtL9PP9/yWqNMUvmob3bbbmSbAbwb/bX
MD5 SHA1 SHA512 SSDEEP

Submit Download

70a23f80-1865-424d-9dc0-9630a317bd77

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7qnbgwy0.default-release\datareporting\glean\pending_pings\70a23f80-1865-424d-9dc0-9630a317bd77
Size 982B
SHA256 71ba77f9fff0b5c17a2347f69c9beb88d2a1c46128bb2dce9c458c0ddb3b0c58
MD5 c96aef1c24c941bcb3cb214acb0c054d
SHA1 8416ae5791f01a760188257a1b162139bbe5b23c
SHA512 00bcdffb99a489f440bec99c96f63c92cfc08f9a32cfa2854d69f36a85ce356e11baf8ad7c7f8c6e17f87a2de73e5520974184cbd5402164546931b32d4238c3
MD5 SHA1 SHA512

Submit Download

71b27d3e-e2af-4372-be72-f5dfa0a1b956

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7qnbgwy0.default-release\datareporting\glean\pending_pings\71b27d3e-e2af-4372-be72-f5dfa0a1b956
Size 659B
SHA256 10f862bb54193606523fbcecbe41ef161b8b4c3fea05452da4d2ad6cb3a6f4eb
MD5 42486c1e0096dc0a3750992df63cd8df
SHA1 f08c01f68d29b799dbfa0c29f2377506ae8f830f
SHA512 fa478a8e2ec7cf900f7e0d9bce86a33683ee7515110440a30eaced5f9d203f41f0773828b88742d49eb3f6e426df953e6ef3c87ef7dc70c58ca402e9a2c537d4
MD5 SHA1 SHA512

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7qnbgwy0.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Size 1.1MB
SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
MD5 842039753bf41fa5e11b3a1383061a87
SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7qnbgwy0.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Size 116B
SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
MD5 2a461e9eb87fd1955cea740a3444ee7a
SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7qnbgwy0.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Size 372B
SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
MD5 bf957ad58b55f64219ab3f793e374316
SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7qnbgwy0.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Size 17.8MB
SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
MD5 daf7ef3acccab478aaa7d6dc1c60f865
SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
MD5 SHA1 SHA512 SSDEEP

Submit Download

places.sqlite-wal

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7qnbgwy0.default-release\places.sqlite-wal
Size 992KB
SHA256 d554ffa6910f242cbb40e2b35d5dbd7e944d493057d1ea23134affecd3aa296f
MD5 b286559f018b4a4ba8154120bd7df467
SHA1 f5164ca435e3ede940a149fdcc98d260ffad4425
SHA512 11cedb593d248b447231bafb00e70876be5e3f868cda37f96e965c1b073305296376dd152dbe8f8fc7585763df997555e72c6c18ab9dba36b070ac35a37d01a4
SSDEEP 192:GoFIbThv3regx/7lFIkhKdYTIG1n6gx/x2lFIf:vCb9qgPCfdMygcCf
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7qnbgwy0.default-release\prefs-1.js
Size 12KB
SHA256 07ab0ce579e8bfcf76ae5862af14c07c6b631f53a87a354e65720cf9614e3c0a
MD5 825a7d19bb9b3704f67a88063b00a372
SHA1 d267fc8d881701eee4ff16a43c6e4d74ec7608d6
SHA512 f60c9cd02a085bac0b577fa6093a9f9bd23fb1b4121272cbce52ef10d8651a44a367ac9c87cd812f8258a1b400e3b1e182e2603eae3c9b10e438fe0e2226b1fd
SSDEEP 192:CPJ5nlRMftPZ1tDzUwcdii8z2QHrGk60jaXNra4+Bw8Hgw:6oxtDzUVgz2QLIrrIwJw
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7qnbgwy0.default-release\prefs.js
Size 8KB
SHA256 22d1efe68a06cf31763cfb577092e93c327f949badac9201cbbdee62b45a4602
MD5 b9415b2cad3d7f26f8a8b6cecdc43649
SHA1 12f0181554f823d3242bd804c8c39dddfbd4abf2
SHA512 0f67c8d65f790159dc03fe4ca9832d4da32c0050ad4cf79015bed72e53894877a59f234db99f30297ee5e57d9eef72b644aded12b8bc374bfb55ee7333b50e09
SSDEEP 192:5J5nlRMft3aiQFP5cdTWPtTU607aXfa4XBw8Vy:5o4FOMd9twB
MD5 SHA1 SHA512 SSDEEP

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7qnbgwy0.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 1.1MB
SHA256 85307c942c3d07a67e163849045ec4b49ff015a96e81f438a3c9d95e1bbd3ec8
MD5 3b5c65e89034cad036b7d4b038afb5ae
SHA1 ff9213cb25fb694b79e6086c68dfe46ee79388d9
SHA512 1a03157cf0fba564a6440ea0f45573b498254488beee0f6eda3b6cbe495f4bca8d6a7c770ecfe42a6a4eaf115acea72646d9e3baaac38cd0159550e11d02f202
SSDEEP 6144:B7rST3K393z3m3WTHh8NGsYSUusKAUbPczSSDbsqMueHN1HmcH11HKZmz0Pu/elV:p8NGsOubxbkOBuRrSx+YC
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1152-18-0x0000000000770000-0x0000000000C3E000-memory.dmp

Download

memory/1152-1-0x00000000779A6000-0x00000000779A8000-memory.dmp

Download

memory/1152-0-0x0000000000770000-0x0000000000C3E000-memory.dmp

Download

memory/1152-2-0x0000000000771000-0x000000000079F000-memory.dmp

Download

memory/1152-3-0x0000000000770000-0x0000000000C3E000-memory.dmp

Download

memory/1152-5-0x0000000000770000-0x0000000000C3E000-memory.dmp

Download

memory/1196-463-0x00000000000C0000-0x000000000058E000-memory.dmp

Download

memory/1196-462-0x00000000000C0000-0x000000000058E000-memory.dmp

Download

memory/1300-1081-0x0000000000040000-0x000000000050E000-memory.dmp

Download

memory/1300-1252-0x0000000000040000-0x000000000050E000-memory.dmp

Download

memory/4352-458-0x0000000000640000-0x000000000121F000-memory.dmp

Download

memory/4352-56-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Download

memory/4352-37-0x0000000000640000-0x000000000121F000-memory.dmp

Download

memory/4352-439-0x0000000000640000-0x000000000121F000-memory.dmp

Download

memory/4936-2593-0x0000000000040000-0x000000000050E000-memory.dmp

Download

memory/4936-2585-0x0000000000040000-0x000000000050E000-memory.dmp

Download

memory/4936-20-0x0000000000040000-0x000000000050E000-memory.dmp

Download

memory/4936-21-0x0000000000040000-0x000000000050E000-memory.dmp

Download

memory/4936-418-0x0000000000040000-0x000000000050E000-memory.dmp

Download

memory/4936-472-0x0000000000040000-0x000000000050E000-memory.dmp

Download

memory/4936-479-0x0000000000040000-0x000000000050E000-memory.dmp

Download

memory/4936-982-0x0000000000040000-0x000000000050E000-memory.dmp

Download

memory/4936-17-0x0000000000040000-0x000000000050E000-memory.dmp

Download

memory/4936-2290-0x0000000000040000-0x000000000050E000-memory.dmp

Download

memory/4936-2579-0x0000000000040000-0x000000000050E000-memory.dmp

Download

memory/4936-474-0x0000000000040000-0x000000000050E000-memory.dmp

Download

memory/4936-2587-0x0000000000040000-0x000000000050E000-memory.dmp

Download

memory/4936-2588-0x0000000000040000-0x000000000050E000-memory.dmp

Download

memory/4936-2589-0x0000000000040000-0x000000000050E000-memory.dmp

Download

memory/4936-2605-0x0000000000040000-0x000000000050E000-memory.dmp

Download

memory/4936-19-0x0000000000041000-0x000000000006F000-memory.dmp

Download

memory/4936-473-0x0000000000040000-0x000000000050E000-memory.dmp

Download

memory/4936-2594-0x0000000000040000-0x000000000050E000-memory.dmp

Download

memory/4936-2595-0x0000000000040000-0x000000000050E000-memory.dmp

Download

memory/5312-2592-0x0000000000040000-0x000000000050E000-memory.dmp

Download

memory/5312-2591-0x0000000000040000-0x000000000050E000-memory.dmp

Download