amadey | b7d6f48f1394d606af1d8afebec9d8510873672ab453fb787cff3a7faf65a6b2

Analysis

max time kernel
149s
max time network
145s
platform
windows11-21h2_x64
resource
win11-20240709-en
resource tags

arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
submitted
16/07/2024, 16:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b7d6f48f1394d606af1d8afebec9d8510873672ab453fb787cff3a7faf65a6b2.exe
Size 1.8MB
Sample240716-tpy2qstbrf
SHA256 b7d6f48f1394d606af1d8afebec9d8510873672ab453fb787cff3a7faf65a6b2
MD5 2a84a11b2e9398b0f3f529b783a34364
SHA1 b2c50dd866c2402451d943cd39bc88fb066f0c32
SHA512 090b92d0d011ab4951b10ffb228d2cd8dd89e51301c1de5817d8a8b5a0f9dd38c4f065e360f8b12f13f34b5cea3444fdef260a262ca9f0061965510264572136
SSDEEP 49152:wWgW4njxmmSqeC1mL+w3qwyX2hBjItBF93feNru:w71ntmNJCGL6d0BqRfur
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey stealc 4dd39d funny discovery evasion spyware stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.30

Botnet

4dd39d

http://77.91.77.82

Attributes

install_dir
ad40971b6b
install_file
explorti.exe
strings_key
a434973ad22def7137dbb5e059b7081e
url_paths
/Hun4Ko/index.php

rc4.plain

Extracted

Family

stealc

Botnet

funny

http://85.28.47.30

Attributes

url_path
/920475a59bac849d.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Stealc
Stealc is an infostealer written in C++.
stealer stealc

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	b7d6f48f1394d606af1d8afebec9d8510873672ab453fb787cff3a7faf65a6b2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	JDGCGDBGCA.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 12 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	b7d6f48f1394d606af1d8afebec9d8510873672ab453fb787cff3a7faf65a6b2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	b7d6f48f1394d606af1d8afebec9d8510873672ab453fb787cff3a7faf65a6b2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	JDGCGDBGCA.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	JDGCGDBGCA.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe

Executes dropped EXE 7 IoCs

pid	Process
2452	explorti.exe
1660	28dd802ab9.exe
3416	aa6d9cf349.exe
3572	JDGCGDBGCA.exe
1664	explorti.exe
5856	explorti.exe
1764	explorti.exe

Identifies Wine through registry keys 2 TTPs 6 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3866437728-1832012455-4133739663-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-3866437728-1832012455-4133739663-1000\Software\Wine	b7d6f48f1394d606af1d8afebec9d8510873672ab453fb787cff3a7faf65a6b2.exe
Key opened	\REGISTRY\USER\S-1-5-21-3866437728-1832012455-4133739663-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-3866437728-1832012455-4133739663-1000\Software\Wine	JDGCGDBGCA.exe
Key opened	\REGISTRY\USER\S-1-5-21-3866437728-1832012455-4133739663-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-3866437728-1832012455-4133739663-1000\Software\Wine	explorti.exe

Loads dropped DLL 2 IoCs

pid	Process
1660	28dd802ab9.exe
1660	28dd802ab9.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x000100000002aace-42.dat	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs

pid	Process
2700	b7d6f48f1394d606af1d8afebec9d8510873672ab453fb787cff3a7faf65a6b2.exe
2452	explorti.exe
1660	28dd802ab9.exe
1660	28dd802ab9.exe
3572	JDGCGDBGCA.exe
1664	explorti.exe
5856	explorti.exe
1764	explorti.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\explorti.job	b7d6f48f1394d606af1d8afebec9d8510873672ab453fb787cff3a7faf65a6b2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	28dd802ab9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	28dd802ab9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3866437728-1832012455-4133739663-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
2700	b7d6f48f1394d606af1d8afebec9d8510873672ab453fb787cff3a7faf65a6b2.exe
2700	b7d6f48f1394d606af1d8afebec9d8510873672ab453fb787cff3a7faf65a6b2.exe
2452	explorti.exe
2452	explorti.exe
1660	28dd802ab9.exe
1660	28dd802ab9.exe
1660	28dd802ab9.exe
1660	28dd802ab9.exe
3572	JDGCGDBGCA.exe
3572	JDGCGDBGCA.exe
1664	explorti.exe
1664	explorti.exe
5856	explorti.exe
5856	explorti.exe
1764	explorti.exe
1764	explorti.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	280	firefox.exe
Token: SeDebugPrivilege	280	firefox.exe
Token: SeDebugPrivilege	280	firefox.exe
Token: SeDebugPrivilege	280	firefox.exe
Token: SeDebugPrivilege	280	firefox.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2700	b7d6f48f1394d606af1d8afebec9d8510873672ab453fb787cff3a7faf65a6b2.exe
3416	aa6d9cf349.exe
3416	aa6d9cf349.exe
3416	aa6d9cf349.exe
3416	aa6d9cf349.exe
3416	aa6d9cf349.exe
3416	aa6d9cf349.exe
3416	aa6d9cf349.exe
280	firefox.exe
280	firefox.exe
280	firefox.exe
280	firefox.exe
280	firefox.exe
280	firefox.exe
280	firefox.exe
280	firefox.exe
280	firefox.exe
280	firefox.exe
280	firefox.exe
280	firefox.exe
280	firefox.exe
280	firefox.exe
280	firefox.exe
280	firefox.exe
280	firefox.exe
280	firefox.exe
280	firefox.exe
280	firefox.exe
280	firefox.exe
3416	aa6d9cf349.exe
3416	aa6d9cf349.exe
3416	aa6d9cf349.exe
3416	aa6d9cf349.exe
3416	aa6d9cf349.exe
3416	aa6d9cf349.exe
3416	aa6d9cf349.exe
3416	aa6d9cf349.exe
3416	aa6d9cf349.exe
3416	aa6d9cf349.exe
3416	aa6d9cf349.exe
3416	aa6d9cf349.exe
3416	aa6d9cf349.exe
3416	aa6d9cf349.exe
3416	aa6d9cf349.exe
3416	aa6d9cf349.exe
3416	aa6d9cf349.exe
3416	aa6d9cf349.exe
3416	aa6d9cf349.exe
3416	aa6d9cf349.exe
3416	aa6d9cf349.exe
3416	aa6d9cf349.exe
3416	aa6d9cf349.exe
3416	aa6d9cf349.exe
3416	aa6d9cf349.exe
3416	aa6d9cf349.exe
3416	aa6d9cf349.exe
3416	aa6d9cf349.exe
3416	aa6d9cf349.exe
3416	aa6d9cf349.exe
3416	aa6d9cf349.exe
3416	aa6d9cf349.exe
3416	aa6d9cf349.exe
3416	aa6d9cf349.exe
3416	aa6d9cf349.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3416	aa6d9cf349.exe
3416	aa6d9cf349.exe
3416	aa6d9cf349.exe
3416	aa6d9cf349.exe
3416	aa6d9cf349.exe
3416	aa6d9cf349.exe
3416	aa6d9cf349.exe
3416	aa6d9cf349.exe
3416	aa6d9cf349.exe
3416	aa6d9cf349.exe
3416	aa6d9cf349.exe
3416	aa6d9cf349.exe
3416	aa6d9cf349.exe
3416	aa6d9cf349.exe
3416	aa6d9cf349.exe
3416	aa6d9cf349.exe
3416	aa6d9cf349.exe
3416	aa6d9cf349.exe
3416	aa6d9cf349.exe
3416	aa6d9cf349.exe
3416	aa6d9cf349.exe
3416	aa6d9cf349.exe
3416	aa6d9cf349.exe
3416	aa6d9cf349.exe
3416	aa6d9cf349.exe
3416	aa6d9cf349.exe
3416	aa6d9cf349.exe
3416	aa6d9cf349.exe
3416	aa6d9cf349.exe
3416	aa6d9cf349.exe
3416	aa6d9cf349.exe
3416	aa6d9cf349.exe
3416	aa6d9cf349.exe
3416	aa6d9cf349.exe
3416	aa6d9cf349.exe
3416	aa6d9cf349.exe
3416	aa6d9cf349.exe
3416	aa6d9cf349.exe
3416	aa6d9cf349.exe
3416	aa6d9cf349.exe
3416	aa6d9cf349.exe
3416	aa6d9cf349.exe
3416	aa6d9cf349.exe
3416	aa6d9cf349.exe
3416	aa6d9cf349.exe
3416	aa6d9cf349.exe
3416	aa6d9cf349.exe
3416	aa6d9cf349.exe
3416	aa6d9cf349.exe
3416	aa6d9cf349.exe
3416	aa6d9cf349.exe
3416	aa6d9cf349.exe
3416	aa6d9cf349.exe
3416	aa6d9cf349.exe
3416	aa6d9cf349.exe
3416	aa6d9cf349.exe
3416	aa6d9cf349.exe
3416	aa6d9cf349.exe
3416	aa6d9cf349.exe
3416	aa6d9cf349.exe
3416	aa6d9cf349.exe
3416	aa6d9cf349.exe
3416	aa6d9cf349.exe
3416	aa6d9cf349.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1660	28dd802ab9.exe
280	firefox.exe
2700	cmd.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2700 wrote to memory of 2452	2700	b7d6f48f1394d606af1d8afebec9d8510873672ab453fb787cff3a7faf65a6b2.exe	82
PID 2700 wrote to memory of 2452	2700	b7d6f48f1394d606af1d8afebec9d8510873672ab453fb787cff3a7faf65a6b2.exe	82
PID 2700 wrote to memory of 2452	2700	b7d6f48f1394d606af1d8afebec9d8510873672ab453fb787cff3a7faf65a6b2.exe	82
PID 2452 wrote to memory of 1660	2452	explorti.exe	85
PID 2452 wrote to memory of 1660	2452	explorti.exe	85
PID 2452 wrote to memory of 1660	2452	explorti.exe	85
PID 2452 wrote to memory of 3416	2452	explorti.exe	89
PID 2452 wrote to memory of 3416	2452	explorti.exe	89
PID 2452 wrote to memory of 3416	2452	explorti.exe	89
PID 3416 wrote to memory of 4796	3416	aa6d9cf349.exe	90
PID 3416 wrote to memory of 4796	3416	aa6d9cf349.exe	90
PID 4796 wrote to memory of 280	4796	firefox.exe	93
PID 4796 wrote to memory of 280	4796	firefox.exe	93
PID 4796 wrote to memory of 280	4796	firefox.exe	93
PID 4796 wrote to memory of 280	4796	firefox.exe	93
PID 4796 wrote to memory of 280	4796	firefox.exe	93
PID 4796 wrote to memory of 280	4796	firefox.exe	93
PID 4796 wrote to memory of 280	4796	firefox.exe	93
PID 4796 wrote to memory of 280	4796	firefox.exe	93
PID 4796 wrote to memory of 280	4796	firefox.exe	93
PID 4796 wrote to memory of 280	4796	firefox.exe	93
PID 4796 wrote to memory of 280	4796	firefox.exe	93
PID 280 wrote to memory of 2460	280	firefox.exe	94
PID 280 wrote to memory of 2460	280	firefox.exe	94
PID 280 wrote to memory of 2460	280	firefox.exe	94
PID 280 wrote to memory of 2460	280	firefox.exe	94
PID 280 wrote to memory of 2460	280	firefox.exe	94
PID 280 wrote to memory of 2460	280	firefox.exe	94
PID 280 wrote to memory of 2460	280	firefox.exe	94
PID 280 wrote to memory of 2460	280	firefox.exe	94
PID 280 wrote to memory of 2460	280	firefox.exe	94
PID 280 wrote to memory of 2460	280	firefox.exe	94
PID 280 wrote to memory of 2460	280	firefox.exe	94
PID 280 wrote to memory of 2460	280	firefox.exe	94
PID 280 wrote to memory of 2460	280	firefox.exe	94
PID 280 wrote to memory of 2460	280	firefox.exe	94
PID 280 wrote to memory of 2460	280	firefox.exe	94
PID 280 wrote to memory of 2460	280	firefox.exe	94
PID 280 wrote to memory of 2460	280	firefox.exe	94
PID 280 wrote to memory of 2460	280	firefox.exe	94
PID 280 wrote to memory of 2460	280	firefox.exe	94
PID 280 wrote to memory of 2460	280	firefox.exe	94
PID 280 wrote to memory of 2460	280	firefox.exe	94
PID 280 wrote to memory of 2460	280	firefox.exe	94
PID 280 wrote to memory of 2460	280	firefox.exe	94
PID 280 wrote to memory of 2460	280	firefox.exe	94
PID 280 wrote to memory of 2460	280	firefox.exe	94
PID 280 wrote to memory of 2460	280	firefox.exe	94
PID 280 wrote to memory of 2460	280	firefox.exe	94
PID 280 wrote to memory of 2460	280	firefox.exe	94
PID 280 wrote to memory of 2460	280	firefox.exe	94
PID 280 wrote to memory of 2460	280	firefox.exe	94
PID 280 wrote to memory of 2460	280	firefox.exe	94
PID 280 wrote to memory of 2460	280	firefox.exe	94
PID 280 wrote to memory of 2460	280	firefox.exe	94
PID 280 wrote to memory of 2460	280	firefox.exe	94
PID 280 wrote to memory of 2460	280	firefox.exe	94
PID 280 wrote to memory of 2460	280	firefox.exe	94
PID 280 wrote to memory of 2460	280	firefox.exe	94
PID 280 wrote to memory of 2460	280	firefox.exe	94
PID 280 wrote to memory of 2460	280	firefox.exe	94
PID 280 wrote to memory of 2460	280	firefox.exe	94
PID 280 wrote to memory of 2460	280	firefox.exe	94
PID 280 wrote to memory of 2460	280	firefox.exe	94

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\b7d6f48f1394d606af1d8afebec9d8510873672ab453fb787cff3a7faf65a6b2.exe
"C:\Users\Admin\AppData\Local\Temp\b7d6f48f1394d606af1d8afebec9d8510873672ab453fb787cff3a7faf65a6b2.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
  "C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2452
- - C:\Users\Admin\AppData\Local\Temp\1000006001\28dd802ab9.exe
    "C:\Users\Admin\AppData\Local\Temp\1000006001\28dd802ab9.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:1660
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\JDGCGDBGCA.exe"
      4⤵
      PID:468
    - - C:\Users\Admin\AppData\Local\Temp\JDGCGDBGCA.exe
        
        "C:\Users\Admin\AppData\Local\Temp\JDGCGDBGCA.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        
        PID:3572
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\BAEBFIIECB.exe"
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:2700
- - C:\Users\Admin\AppData\Local\Temp\1000011001\aa6d9cf349.exe
    "C:\Users\Admin\AppData\Local\Temp\1000011001\aa6d9cf349.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:3416
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4796
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
        5⤵
        Checks processor information in registry
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:280
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1980 -parentBuildID 20240401114208 -prefsHandle 1908 -prefMapHandle 1896 -prefsLen 25751 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d736fcd8-4091-4169-94a8-054d678671ba} 280 "\\.\pipe\gecko-crash-server-pipe.280" gpu
        6⤵
        
        PID:2460
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2400 -parentBuildID 20240401114208 -prefsHandle 2392 -prefMapHandle 2388 -prefsLen 26671 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e36422fc-cf7d-45cd-8e29-dba04f4ea9ab} 280 "\\.\pipe\gecko-crash-server-pipe.280" socket
        6⤵
        
        PID:3456
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3328 -childID 1 -isForBrowser -prefsHandle 3300 -prefMapHandle 3332 -prefsLen 22698 -prefMapSize 244658 -jsInitHandle 1320 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {45e1235d-1ebe-4cd5-83b5-40837f0c9653} 280 "\\.\pipe\gecko-crash-server-pipe.280" tab
        6⤵
        
        PID:2696
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3116 -childID 2 -isForBrowser -prefsHandle 3984 -prefMapHandle 3980 -prefsLen 31161 -prefMapSize 244658 -jsInitHandle 1320 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cc9c23e7-98bf-4158-a33e-acca7631c051} 280 "\\.\pipe\gecko-crash-server-pipe.280" tab
        6⤵
        
        PID:1828
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4800 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4792 -prefMapHandle 4788 -prefsLen 31161 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {58525c4e-d762-4861-8f04-512589889f03} 280 "\\.\pipe\gecko-crash-server-pipe.280" utility
        6⤵
        Checks processor information in registry
        
        PID:5256
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5672 -childID 3 -isForBrowser -prefsHandle 5644 -prefMapHandle 5656 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1320 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {aec26f2b-8499-44be-9b18-607a1d6a15ae} 280 "\\.\pipe\gecko-crash-server-pipe.280" tab
        6⤵
        
        PID:2544
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5796 -childID 4 -isForBrowser -prefsHandle 5804 -prefMapHandle 5808 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1320 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e0dc799c-ea6a-41ea-b5b0-7ca47da4695d} 280 "\\.\pipe\gecko-crash-server-pipe.280" tab
        6⤵
        
        PID:5376
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5596 -childID 5 -isForBrowser -prefsHandle 6000 -prefMapHandle 6004 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1320 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f0164344-24bd-47f2-95f5-9c136f7d0df1} 280 "\\.\pipe\gecko-crash-server-pipe.280" tab
        6⤵
        
        PID:3912

C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1664

C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5856

C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

JJJECFIECBGDGCAAAEHI

Path C:\ProgramData\JJJECFIECBGDGCAAAEHI
Size 8KB
SHA256 b88230ef202ffdc8c8283b27f525112359254f15539b73552231c8242e3ecae6
MD5 1d86b4705b868bee216226c04198ea56
SHA1 7332abd58a865b5f87b6b55812a0fcc9db39a61a
SHA512 c82d0d0ef2b85884d1b2050a76e479625533fd7d6ed7b88fb074a43c212476fd9263009fb72fcf1e6162f04c59be67b550b4f6ea4ea955864ade30f6cacf3ac2
SSDEEP 192:Ex5n/RhkfoVRI5xUcdzky60zqaXLhDadccBw8Va:EwRx5yxEewt
MD5 SHA1 SHA512 SSDEEP

Submit Download

mozglue.dll

Path C:\ProgramData\mozglue.dll
Size 593KB
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
SSDEEP 12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5 SHA1 SHA512 SSDEEP

Submit Download

nss3.dll

Path C:\ProgramData\nss3.dll
Size 2.0MB
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
SSDEEP 49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5 SHA1 SHA512 SSDEEP

Submit Download

activity-stream.discovery_stream.json.tmp

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\t4hat1k8.default-release\activity-stream.discovery_stream.json.tmp
Size 18KB
SHA256 8c68acd2ec4887a3736a1372457da1983f364982f9913e532e1a516b44e03dba
MD5 675e3b99cf74e43fbdc5262923309d63
SHA1 2c519836b59ffeeea387a8ef8e7d7e526e5fec01
SHA512 848de5d25fc86529098115f377b8b2ed8007984c543f440719e26ac214151a2f326b96a0ad440f397eedd9d642d61d0a1300cfc0d86eac5a8a57de67c920478c
SSDEEP 384:omYmecdNG1jpPWICe412A4IbxdzofiA5LlViiZ6wM2I7yaE:otr1jtHO1RLEq+7Y2Yyp
MD5 SHA1 SHA512 SSDEEP

Submit Download

8A2034D325DC0B5C9E11EDDA3FC70A54C8DC1C0D

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\t4hat1k8.default-release\cache2\entries\8A2034D325DC0B5C9E11EDDA3FC70A54C8DC1C0D
Size 13KB
SHA256 945da217697637fc3d9f6180d7ccd1aaa09453514e870766440cfd452427a4a3
MD5 8760b81bc18047f9c2fbdfd00c5ccfa0
SHA1 77a0029851ccd8ec3448b994cb281fb7c148c01b
SHA512 69dfeff87c16bc82dc8ec4c3628800c7906829ee0d9734b6461b1367cb77f454d56e1dd8c43c7705463cf85c405dba022db393c508336a9b873416a1af67a611
SSDEEP 384:H485u9fiGLm4pUScft2WlOX8lPLZZB7t0lpDIIuFyFM:nUBi8mCUScft2WAX8tzB7eD8t
MD5 SHA1 SHA512 SSDEEP

Submit Download

F8CBD54DDA10F4286A41EC6A537240712D6C2308

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\t4hat1k8.default-release\cache2\entries\F8CBD54DDA10F4286A41EC6A537240712D6C2308
Size 9KB
SHA256 e26e81dbe79825da155bf943b13596444dbf76d2b0e9e000d6ba45999b2a9217
MD5 6977f8c3e7e1d14f7821b249c7b4bc6f
SHA1 4c960efb8b767738f2adec01eca4ac93fb866cf2
SHA512 86495e6696b06821aad1f33d43795dc50ab959c965415c661018e05c627846f0bae4949ad66b5b9ca396fe35a5b5b54d11bead76aecbfa2964105145ead54126
SSDEEP 192:MrFv82+9EcRKAqkI82+9EcRKA91ZpgLd9w0LDiro15j75ywpskCDcdSQdSg:MrFvJcRKZkIJcRKspg/PirIVy8e4SISg
MD5 SHA1 SHA512 SSDEEP

Submit Download

28dd802ab9.exe

Path C:\Users\Admin\AppData\Local\Temp\1000006001\28dd802ab9.exe
Size 1.1MB
SHA256 a84519749f8ad340ae767ffce46acc77280b130fcf079a0a089a18f1428dc747
MD5 6c2c96d6bc678bdf4aa876a1e6253701
SHA1 2a0c1f635d233506d1311ad384d414e646200cd7
SHA512 11da76abf026323ae53db6ddef07914db63febcfe70f823f53ef08d94e0e1fe1b09d328abf5236f49a522f54d409852a3eb3d14b09542d903fb712721ad57539
SSDEEP 24576:zu+sxK0feOYuoEBEr5wA8sZVucaoRkiAUTRwqoFz:zds00mOLoEywulRNzTRhoB
MD5 SHA1 SHA512 SSDEEP

Submit Download

aa6d9cf349.exe

Path C:\Users\Admin\AppData\Local\Temp\1000011001\aa6d9cf349.exe
Size 1.2MB
SHA256 1ba88764eab20691524d8ed9cea61601b53d762eb94c4a78cf72071dc17627d8
MD5 a9189a0c11e860800e8f7100d6567ad1
SHA1 0e05ccb7e0b15da313c00bd2e6cefb8b7a885549
SHA512 16468f075c0e653d68d808c361fc0210174174bb48d3ae9c41a63c22c7ae1f30ef865c5e1f81a3e994999a2285002e838efed13bed07c2af03e5b5736762acaf
SSDEEP 24576:/qDEvCTbMWu7rQYlBQcBiT6rprG8aLu2Sbly7TWEPje:/TvC/MTQYxsWR7aLu2dW
MD5 SHA1 SHA512 SSDEEP

Submit Download

explorti.exe

Path C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
Size 1.8MB
SHA256 b7d6f48f1394d606af1d8afebec9d8510873672ab453fb787cff3a7faf65a6b2
MD5 2a84a11b2e9398b0f3f529b783a34364
SHA1 b2c50dd866c2402451d943cd39bc88fb066f0c32
SHA512 090b92d0d011ab4951b10ffb228d2cd8dd89e51301c1de5817d8a8b5a0f9dd38c4f065e360f8b12f13f34b5cea3444fdef260a262ca9f0061965510264572136
SSDEEP 49152:wWgW4njxmmSqeC1mL+w3qwyX2hBjItBF93feNru:w71ntmNJCGL6d0BqRfur
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 479KB
SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
MD5 09372174e83dbbf696ee732fd2e875bb
SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 13.8MB
SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
MD5 0a8747a2ac9ac08ae9508f36c6d75692
SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\t4hat1k8.default-release\AlternateServices.bin
Size 12KB
SHA256 59237c922c10ce7337be4e10d53b45a80076dfd39cffd77e9ac9fd96900443a9
MD5 a6da94a5c02af85c8032628ed1d140a1
SHA1 a901315c24519fd76c6a9ab823aadf48014b13ec
SHA512 661235fb071dde1c71c82c796f438b4d4812ef2e37819f0b39d534e7c3724525f74e7cd090a2570d53c2e3d3a5726d147fc1507d177f4362c3bd4776aeb4195a
SSDEEP 96:05ocebOJZbnpebvpf+Zb8bIbZgbgznbIbkb:05Xu
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\t4hat1k8.default-release\datareporting\glean\db\data.safe.tmp
Size 16KB
SHA256 b93adeb0b12ce8ec700a49e4e0d32977bdbf9345e29696639c26b375dfc73207
MD5 cdc1a4834c28ea1918e68cd705093975
SHA1 1b1140d9c7ce2de4329066c0e5c3c04dc3f6c62e
SHA512 27431039bc5bbe4774350ec6c4f7f139c2f50d767010192d7cbbad818f867f475fc5744c79a13625bddd2b4491e54219a3bc4fa8e3c4c2f4498d07b3f35d4d2e
SSDEEP 384:R/66JozQzgC1bGE/ldM+NwDPHvHblb0eAboP63PU:UmN/0VDPHvHblbvops
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\t4hat1k8.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 7b2a2cfc7f9102414455242ce0c71e919ba2531083d29680dc00d7d8beed05dc
MD5 5744057bafbbad7e7e85000791f5222e
SHA1 f3fa5abbbe5ade05edada8232116f126b1920e83
SHA512 0dd9f55ede9c1bb0c294ce9deeb5e75180bdf068080fbdc1ab9731f18994a40057446dd33ab182ebec16cfd7424570394e464a7418e04d4acbf809ef20931888
SSDEEP 96:3qvKQno8SFl66Joz0dzgClKtmSSbBGSMF9ZbkW6QX0BBvhmqiPP/PrWI:R/66Joz0dzgCl6mSSwrvZboHvhbEPCI
MD5 SHA1 SHA512 SSDEEP

Submit Download

1deb6af1-98d3-4951-b3e4-c58dd4438243

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\t4hat1k8.default-release\datareporting\glean\pending_pings\1deb6af1-98d3-4951-b3e4-c58dd4438243
Size 671B
SHA256 49a838455b1f404b3476e6b4a66abb406e6c92dc19fc4ccdd7eef4814e19cffe
MD5 f892c21e6241b98535677819a1b23a31
SHA1 bb59b6bced1c9a72945d3744a461b23fb6564ad7
SHA512 56428b71846aac2598c2b74ebb7d1f7baf3edc346e532203327d8bfa1fecfbcedd73eacc07be8148229b624b920f287d9c3e4dd6b1c59e4cae337a351c4af00c
MD5 SHA1 SHA512

Submit Download

5d596298-d673-4cf5-9a11-9676ee42e706

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\t4hat1k8.default-release\datareporting\glean\pending_pings\5d596298-d673-4cf5-9a11-9676ee42e706
Size 982B
SHA256 b0db6921c3dab7aa3b8988ef93806b057ad0d2ffa97d2eb6e08a1f94c1b719ce
MD5 a6a039ac8bcb721243863da9fea627df
SHA1 acc6eb9a26e1340c83465a9dd8724c11351ab9ec
SHA512 9cd789c180b52ffaa3e2aa2e4545ff2c0ab807d40a81e23e0473e2091a68edf2315e15a18b1d75c03352d892ff76e457423cc8d6cfd478ca9977d08fe7054a4c
MD5 SHA1 SHA512

Submit Download

d7cd5a55-4f0a-4bc6-ab96-83d11b2d92ca

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\t4hat1k8.default-release\datareporting\glean\pending_pings\d7cd5a55-4f0a-4bc6-ab96-83d11b2d92ca
Size 26KB
SHA256 99544e5407d1be4ace5ce70223791cf62916e92507132e3f5f0498b9dc17ebc2
MD5 80b8312b01ccf2292c13b698abfd7561
SHA1 c39ef6a9f4591309bc736251b3209917a155d83a
SHA512 3c5a292823c471c2aa41de7fb68b17853427a58ef60eab34d44069a7cf13c7a6dc23d85f4e4d9c71f029cb9bda1d56470efef6de4a61d6f2abd3cc2486314c2f
SSDEEP 384:OBIFt9aLRzQmF70RKSRiW3bkWKXXWb+0wj:yI70Q9bsXXWbdM
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\t4hat1k8.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Size 1.1MB
SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
MD5 842039753bf41fa5e11b3a1383061a87
SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\t4hat1k8.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Size 116B
SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
MD5 2a461e9eb87fd1955cea740a3444ee7a
SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\t4hat1k8.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Size 372B
SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
MD5 bf957ad58b55f64219ab3f793e374316
SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\t4hat1k8.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Size 17.8MB
SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
MD5 daf7ef3acccab478aaa7d6dc1c60f865
SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\t4hat1k8.default-release\prefs-1.js
Size 12KB
SHA256 d29dbb2f836c9bfbfe8a9c7c7448e470295a1de7360168012cea4d0787a85458
MD5 2bcc797f8218ea53b11090892f2ba009
SHA1 824bf4d6af2da118602b7be9c78c189590fddbfa
SHA512 6726b95e1b228192d106ad85202d967310b4906fe2a3d8ff886a2a2c5869080f1ce1620f9534f77011a1d1c6b83be74f15a5598cf2993ec10666911489f94809
SSDEEP 192:Dx5n/RhkfoVOJ0aRYhd3ZzxcdNYXdrf1I0O60gaXChDadczBw8H/:DwyaRIZz+rU9rRwa
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\t4hat1k8.default-release\prefs.js
Size 8KB
SHA256 fcfe05ea4fc42e9606481de6457f7e2d2ce8322aa4db370fd1ba3623079ea7fc
MD5 90f1d052806e558a8df552235fc5ee51
SHA1 e35e94801038bfe53e25ef859bdac597cefc3a7e
SHA512 8b13cbc6936abca943b949a9596c714c8252fb4fcffaa22b1dd0cf9fc8b1a2dd7da54d4e92783053b1c963836aefff545e8d85df502ac26a8e5a24ab6baa3d61
SSDEEP 192:Ex5n/RhkfoVRI/xUcdzky60zzaXLhDadccBw8Ha:EwHx5yxlewn
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1660-56-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Download

memory/1660-459-0x00000000001F0000-0x0000000000781000-memory.dmp

Download

memory/1660-463-0x00000000001F0000-0x0000000000781000-memory.dmp

Download

memory/1660-37-0x00000000001F0000-0x0000000000781000-memory.dmp

Download

memory/1664-475-0x00000000005A0000-0x0000000000A6A000-memory.dmp

Download

memory/1664-470-0x00000000005A0000-0x0000000000A6A000-memory.dmp

Download

memory/1764-2619-0x00000000005A0000-0x0000000000A6A000-memory.dmp

Download

memory/1764-2618-0x00000000005A0000-0x0000000000A6A000-memory.dmp

Download

memory/2452-683-0x00000000005A0000-0x0000000000A6A000-memory.dmp

Download

memory/2452-2607-0x00000000005A0000-0x0000000000A6A000-memory.dmp

Download

memory/2452-482-0x00000000005A0000-0x0000000000A6A000-memory.dmp

Download

memory/2452-481-0x00000000005A0000-0x0000000000A6A000-memory.dmp

Download

memory/2452-495-0x00000000005A0000-0x0000000000A6A000-memory.dmp

Download

memory/2452-2620-0x00000000005A0000-0x0000000000A6A000-memory.dmp

Download

memory/2452-21-0x00000000005A0000-0x0000000000A6A000-memory.dmp

Download

memory/2452-20-0x00000000005A0000-0x0000000000A6A000-memory.dmp

Download

memory/2452-19-0x00000000005A0000-0x0000000000A6A000-memory.dmp

Download

memory/2452-18-0x00000000005A0000-0x0000000000A6A000-memory.dmp

Download

memory/2452-467-0x00000000005A0000-0x0000000000A6A000-memory.dmp

Download

memory/2452-92-0x00000000005A0000-0x0000000000A6A000-memory.dmp

Download

memory/2452-2611-0x00000000005A0000-0x0000000000A6A000-memory.dmp

Download

memory/2452-2610-0x00000000005A0000-0x0000000000A6A000-memory.dmp

Download

memory/2452-2609-0x00000000005A0000-0x0000000000A6A000-memory.dmp

Download

memory/2452-2608-0x00000000005A0000-0x0000000000A6A000-memory.dmp

Download

memory/2452-1617-0x00000000005A0000-0x0000000000A6A000-memory.dmp

Download

memory/2452-2594-0x00000000005A0000-0x0000000000A6A000-memory.dmp

Download

memory/2452-2595-0x00000000005A0000-0x0000000000A6A000-memory.dmp

Download

memory/2452-2606-0x00000000005A0000-0x0000000000A6A000-memory.dmp

Download

memory/2700-1-0x0000000077DB6000-0x0000000077DB8000-memory.dmp

Download

memory/2700-2-0x00000000009E1000-0x0000000000A0F000-memory.dmp

Download

memory/2700-3-0x00000000009E0000-0x0000000000EAA000-memory.dmp

Download

memory/2700-4-0x00000000009E0000-0x0000000000EAA000-memory.dmp

Download

memory/2700-17-0x00000000009E0000-0x0000000000EAA000-memory.dmp

Download

memory/2700-0-0x00000000009E0000-0x0000000000EAA000-memory.dmp

Download

memory/3572-474-0x0000000000850000-0x0000000000D1A000-memory.dmp

Download

memory/3572-468-0x0000000000850000-0x0000000000D1A000-memory.dmp

Download

memory/5856-2605-0x00000000005A0000-0x0000000000A6A000-memory.dmp

Download

memory/5856-2602-0x00000000005A0000-0x0000000000A6A000-memory.dmp

Download