amadey | 88a73f617072b319fd87cbce1a0874c705ef077fcc0bb09a7037f9762368a0ca

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20240709-en
resource tags

arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
submitted
17/07/2024, 03:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
88a73f617072b319fd87cbce1a0874c705ef077fcc0bb09a7037f9762368a0ca.exe
Size 1.1MB
Sample240717-ec6tgsvbql
SHA256 88a73f617072b319fd87cbce1a0874c705ef077fcc0bb09a7037f9762368a0ca
MD5 9ab68ef496dc8989b5cc7f5397298529
SHA1 410ba11d1025142dcd2238e7c4e905a543fafdd6
SHA512 dba4a4f1db9d9ac254e26d5729f0acc7ac6d5a4b2c1236bde52586f280877b50d153075c22ff41bc8e7cc016c73c577d8abc171a925b5918055d5abe7c69f95d
SSDEEP 24576:B3eWhI+8Km/oikwjmZM2wv3bHi2ZdiXxWTpvFInaqLMxx:B3eWCkHm2wv3bCSdiXUFvFIxAj
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey stealc 4dd39d funny discovery evasion spyware stealer trojan

Malware Config

Extracted

Family

stealc

Botnet

funny

http://85.28.47.30

Attributes

url_path
/920475a59bac849d.php

Extracted

Family

amadey

Version

4.30

Botnet

4dd39d

http://77.91.77.82

Attributes

install_dir
ad40971b6b
install_file
explorti.exe
strings_key
a434973ad22def7137dbb5e059b7081e
url_paths
/Hun4Ko/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Stealc
Stealc is an infostealer written in C++.
stealer stealc

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	FIIDBKJJDG.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 8 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	FIIDBKJJDG.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	FIIDBKJJDG.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe

Executes dropped EXE 6 IoCs

pid	Process
656	FIIDBKJJDG.exe
1052	explorti.exe
3164	9c1d5ca899.exe
2388	37d489b8f8.exe
4972	explorti.exe
3556	explorti.exe

Identifies Wine through registry keys 2 TTPs 4 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3866437728-1832012455-4133739663-1000\Software\Wine	FIIDBKJJDG.exe
Key opened	\REGISTRY\USER\S-1-5-21-3866437728-1832012455-4133739663-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-3866437728-1832012455-4133739663-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-3866437728-1832012455-4133739663-1000\Software\Wine	explorti.exe

Loads dropped DLL 2 IoCs

pid	Process
3672	88a73f617072b319fd87cbce1a0874c705ef077fcc0bb09a7037f9762368a0ca.exe
3672	88a73f617072b319fd87cbce1a0874c705ef077fcc0bb09a7037f9762368a0ca.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x000100000002aa9c-116.dat	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs

pid	Process
3672	88a73f617072b319fd87cbce1a0874c705ef077fcc0bb09a7037f9762368a0ca.exe
3672	88a73f617072b319fd87cbce1a0874c705ef077fcc0bb09a7037f9762368a0ca.exe
656	FIIDBKJJDG.exe
1052	explorti.exe
3164	9c1d5ca899.exe
4972	explorti.exe
3556	explorti.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\explorti.job	FIIDBKJJDG.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	88a73f617072b319fd87cbce1a0874c705ef077fcc0bb09a7037f9762368a0ca.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	88a73f617072b319fd87cbce1a0874c705ef077fcc0bb09a7037f9762368a0ca.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3866437728-1832012455-4133739663-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3672	88a73f617072b319fd87cbce1a0874c705ef077fcc0bb09a7037f9762368a0ca.exe
3672	88a73f617072b319fd87cbce1a0874c705ef077fcc0bb09a7037f9762368a0ca.exe
3672	88a73f617072b319fd87cbce1a0874c705ef077fcc0bb09a7037f9762368a0ca.exe
3672	88a73f617072b319fd87cbce1a0874c705ef077fcc0bb09a7037f9762368a0ca.exe
656	FIIDBKJJDG.exe
656	FIIDBKJJDG.exe
1052	explorti.exe
1052	explorti.exe
4972	explorti.exe
4972	explorti.exe
3556	explorti.exe
3556	explorti.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4792	firefox.exe
Token: SeDebugPrivilege	4792	firefox.exe
Token: SeDebugPrivilege	4792	firefox.exe
Token: SeDebugPrivilege	4792	firefox.exe
Token: SeDebugPrivilege	4792	firefox.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2388	37d489b8f8.exe
2388	37d489b8f8.exe
2388	37d489b8f8.exe
2388	37d489b8f8.exe
2388	37d489b8f8.exe
2388	37d489b8f8.exe
4792	firefox.exe
4792	firefox.exe
4792	firefox.exe
4792	firefox.exe
2388	37d489b8f8.exe
4792	firefox.exe
4792	firefox.exe
4792	firefox.exe
4792	firefox.exe
4792	firefox.exe
4792	firefox.exe
4792	firefox.exe
4792	firefox.exe
4792	firefox.exe
4792	firefox.exe
4792	firefox.exe
4792	firefox.exe
4792	firefox.exe
4792	firefox.exe
4792	firefox.exe
4792	firefox.exe
4792	firefox.exe
2388	37d489b8f8.exe
2388	37d489b8f8.exe
2388	37d489b8f8.exe
2388	37d489b8f8.exe
2388	37d489b8f8.exe
2388	37d489b8f8.exe
2388	37d489b8f8.exe
2388	37d489b8f8.exe
2388	37d489b8f8.exe
2388	37d489b8f8.exe
2388	37d489b8f8.exe
2388	37d489b8f8.exe
2388	37d489b8f8.exe
2388	37d489b8f8.exe
2388	37d489b8f8.exe
2388	37d489b8f8.exe
2388	37d489b8f8.exe
2388	37d489b8f8.exe
2388	37d489b8f8.exe
2388	37d489b8f8.exe
2388	37d489b8f8.exe
2388	37d489b8f8.exe
2388	37d489b8f8.exe
2388	37d489b8f8.exe
2388	37d489b8f8.exe
2388	37d489b8f8.exe
2388	37d489b8f8.exe
2388	37d489b8f8.exe
2388	37d489b8f8.exe
2388	37d489b8f8.exe
2388	37d489b8f8.exe
2388	37d489b8f8.exe
2388	37d489b8f8.exe
2388	37d489b8f8.exe
2388	37d489b8f8.exe
2388	37d489b8f8.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2388	37d489b8f8.exe
2388	37d489b8f8.exe
2388	37d489b8f8.exe
2388	37d489b8f8.exe
2388	37d489b8f8.exe
2388	37d489b8f8.exe
2388	37d489b8f8.exe
2388	37d489b8f8.exe
2388	37d489b8f8.exe
2388	37d489b8f8.exe
2388	37d489b8f8.exe
2388	37d489b8f8.exe
2388	37d489b8f8.exe
2388	37d489b8f8.exe
2388	37d489b8f8.exe
2388	37d489b8f8.exe
2388	37d489b8f8.exe
2388	37d489b8f8.exe
2388	37d489b8f8.exe
2388	37d489b8f8.exe
2388	37d489b8f8.exe
2388	37d489b8f8.exe
2388	37d489b8f8.exe
2388	37d489b8f8.exe
2388	37d489b8f8.exe
2388	37d489b8f8.exe
2388	37d489b8f8.exe
2388	37d489b8f8.exe
2388	37d489b8f8.exe
2388	37d489b8f8.exe
2388	37d489b8f8.exe
2388	37d489b8f8.exe
2388	37d489b8f8.exe
2388	37d489b8f8.exe
2388	37d489b8f8.exe
2388	37d489b8f8.exe
2388	37d489b8f8.exe
2388	37d489b8f8.exe
2388	37d489b8f8.exe
2388	37d489b8f8.exe
2388	37d489b8f8.exe
2388	37d489b8f8.exe
2388	37d489b8f8.exe
2388	37d489b8f8.exe
2388	37d489b8f8.exe
2388	37d489b8f8.exe
2388	37d489b8f8.exe
2388	37d489b8f8.exe
2388	37d489b8f8.exe
2388	37d489b8f8.exe
2388	37d489b8f8.exe
2388	37d489b8f8.exe
2388	37d489b8f8.exe
2388	37d489b8f8.exe
2388	37d489b8f8.exe
2388	37d489b8f8.exe
2388	37d489b8f8.exe
2388	37d489b8f8.exe
2388	37d489b8f8.exe
2388	37d489b8f8.exe
2388	37d489b8f8.exe
2388	37d489b8f8.exe
2388	37d489b8f8.exe
2388	37d489b8f8.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3672	88a73f617072b319fd87cbce1a0874c705ef077fcc0bb09a7037f9762368a0ca.exe
1264	cmd.exe
3164	9c1d5ca899.exe
4792	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3672 wrote to memory of 4544	3672	88a73f617072b319fd87cbce1a0874c705ef077fcc0bb09a7037f9762368a0ca.exe	78
PID 3672 wrote to memory of 4544	3672	88a73f617072b319fd87cbce1a0874c705ef077fcc0bb09a7037f9762368a0ca.exe	78
PID 3672 wrote to memory of 4544	3672	88a73f617072b319fd87cbce1a0874c705ef077fcc0bb09a7037f9762368a0ca.exe	78
PID 3672 wrote to memory of 1264	3672	88a73f617072b319fd87cbce1a0874c705ef077fcc0bb09a7037f9762368a0ca.exe	80
PID 3672 wrote to memory of 1264	3672	88a73f617072b319fd87cbce1a0874c705ef077fcc0bb09a7037f9762368a0ca.exe	80
PID 3672 wrote to memory of 1264	3672	88a73f617072b319fd87cbce1a0874c705ef077fcc0bb09a7037f9762368a0ca.exe	80
PID 4544 wrote to memory of 656	4544	cmd.exe	82
PID 4544 wrote to memory of 656	4544	cmd.exe	82
PID 4544 wrote to memory of 656	4544	cmd.exe	82
PID 656 wrote to memory of 1052	656	FIIDBKJJDG.exe	83
PID 656 wrote to memory of 1052	656	FIIDBKJJDG.exe	83
PID 656 wrote to memory of 1052	656	FIIDBKJJDG.exe	83
PID 1052 wrote to memory of 3164	1052	explorti.exe	84
PID 1052 wrote to memory of 3164	1052	explorti.exe	84
PID 1052 wrote to memory of 3164	1052	explorti.exe	84
PID 1052 wrote to memory of 2388	1052	explorti.exe	85
PID 1052 wrote to memory of 2388	1052	explorti.exe	85
PID 1052 wrote to memory of 2388	1052	explorti.exe	85
PID 2388 wrote to memory of 3016	2388	37d489b8f8.exe	86
PID 2388 wrote to memory of 3016	2388	37d489b8f8.exe	86
PID 3016 wrote to memory of 4792	3016	firefox.exe	89
PID 3016 wrote to memory of 4792	3016	firefox.exe	89
PID 3016 wrote to memory of 4792	3016	firefox.exe	89
PID 3016 wrote to memory of 4792	3016	firefox.exe	89
PID 3016 wrote to memory of 4792	3016	firefox.exe	89
PID 3016 wrote to memory of 4792	3016	firefox.exe	89
PID 3016 wrote to memory of 4792	3016	firefox.exe	89
PID 3016 wrote to memory of 4792	3016	firefox.exe	89
PID 3016 wrote to memory of 4792	3016	firefox.exe	89
PID 3016 wrote to memory of 4792	3016	firefox.exe	89
PID 3016 wrote to memory of 4792	3016	firefox.exe	89
PID 4792 wrote to memory of 4088	4792	firefox.exe	90
PID 4792 wrote to memory of 4088	4792	firefox.exe	90
PID 4792 wrote to memory of 4088	4792	firefox.exe	90
PID 4792 wrote to memory of 4088	4792	firefox.exe	90
PID 4792 wrote to memory of 4088	4792	firefox.exe	90
PID 4792 wrote to memory of 4088	4792	firefox.exe	90
PID 4792 wrote to memory of 4088	4792	firefox.exe	90
PID 4792 wrote to memory of 4088	4792	firefox.exe	90
PID 4792 wrote to memory of 4088	4792	firefox.exe	90
PID 4792 wrote to memory of 4088	4792	firefox.exe	90
PID 4792 wrote to memory of 4088	4792	firefox.exe	90
PID 4792 wrote to memory of 4088	4792	firefox.exe	90
PID 4792 wrote to memory of 4088	4792	firefox.exe	90
PID 4792 wrote to memory of 4088	4792	firefox.exe	90
PID 4792 wrote to memory of 4088	4792	firefox.exe	90
PID 4792 wrote to memory of 4088	4792	firefox.exe	90
PID 4792 wrote to memory of 4088	4792	firefox.exe	90
PID 4792 wrote to memory of 4088	4792	firefox.exe	90
PID 4792 wrote to memory of 4088	4792	firefox.exe	90
PID 4792 wrote to memory of 4088	4792	firefox.exe	90
PID 4792 wrote to memory of 4088	4792	firefox.exe	90
PID 4792 wrote to memory of 4088	4792	firefox.exe	90
PID 4792 wrote to memory of 4088	4792	firefox.exe	90
PID 4792 wrote to memory of 4088	4792	firefox.exe	90
PID 4792 wrote to memory of 4088	4792	firefox.exe	90
PID 4792 wrote to memory of 4088	4792	firefox.exe	90
PID 4792 wrote to memory of 4088	4792	firefox.exe	90
PID 4792 wrote to memory of 4088	4792	firefox.exe	90
PID 4792 wrote to memory of 4088	4792	firefox.exe	90
PID 4792 wrote to memory of 4088	4792	firefox.exe	90
PID 4792 wrote to memory of 4088	4792	firefox.exe	90
PID 4792 wrote to memory of 4088	4792	firefox.exe	90
PID 4792 wrote to memory of 4088	4792	firefox.exe	90

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\88a73f617072b319fd87cbce1a0874c705ef077fcc0bb09a7037f9762368a0ca.exe
"C:\Users\Admin\AppData\Local\Temp\88a73f617072b319fd87cbce1a0874c705ef077fcc0bb09a7037f9762368a0ca.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3672
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\FIIDBKJJDG.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4544
- - C:\Users\Admin\AppData\Local\Temp\FIIDBKJJDG.exe
    "C:\Users\Admin\AppData\Local\Temp\FIIDBKJJDG.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:656
  - - C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
      "C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1052
    - - C:\Users\Admin\AppData\Local\Temp\1000006001\9c1d5ca899.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000006001\9c1d5ca899.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetWindowsHookEx
        
        PID:3164
    - - C:\Users\Admin\AppData\Local\Temp\1000011001\37d489b8f8.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000011001\37d489b8f8.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:2388
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3016
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
        7⤵
        Checks processor information in registry
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4792
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1980 -parentBuildID 20240401114208 -prefsHandle 1896 -prefMapHandle 1864 -prefsLen 25751 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {15c0e323-9587-4eb0-bef5-544eb8e61072} 4792 "\\.\pipe\gecko-crash-server-pipe.4792" gpu
        8⤵
        
        PID:4088
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2400 -parentBuildID 20240401114208 -prefsHandle 2392 -prefMapHandle 2388 -prefsLen 26671 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {99c8ae14-c286-492d-a1ad-fb70b19eb784} 4792 "\\.\pipe\gecko-crash-server-pipe.4792" socket
        8⤵
        
        PID:4104
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3268 -childID 1 -isForBrowser -prefsHandle 2820 -prefMapHandle 3260 -prefsLen 22698 -prefMapSize 244658 -jsInitHandle 1100 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {39b41b2d-83a1-4d80-bd9e-585cf0a78c78} 4792 "\\.\pipe\gecko-crash-server-pipe.4792" tab
        8⤵
        
        PID:1664
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3636 -childID 2 -isForBrowser -prefsHandle 3060 -prefMapHandle 3008 -prefsLen 31161 -prefMapSize 244658 -jsInitHandle 1100 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2e663f97-7e0d-4695-918a-f12c13240e62} 4792 "\\.\pipe\gecko-crash-server-pipe.4792" tab
        8⤵
        
        PID:4436
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4676 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4668 -prefMapHandle 4648 -prefsLen 31161 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9b426d85-9e3b-42d0-9ec6-dc9a2e76da92} 4792 "\\.\pipe\gecko-crash-server-pipe.4792" utility
        8⤵
        Checks processor information in registry
        
        PID:4216
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5560 -childID 3 -isForBrowser -prefsHandle 5568 -prefMapHandle 5564 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1100 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {87e96bc9-aa6e-4946-8fe5-42341940c0cf} 4792 "\\.\pipe\gecko-crash-server-pipe.4792" tab
        8⤵
        
        PID:2088
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5836 -childID 4 -isForBrowser -prefsHandle 5756 -prefMapHandle 5760 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1100 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c8ebd5f8-6174-486c-84aa-8268ca1af623} 4792 "\\.\pipe\gecko-crash-server-pipe.4792" tab
        8⤵
        
        PID:4396
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5732 -childID 5 -isForBrowser -prefsHandle 5964 -prefMapHandle 5968 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1100 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {124e81ea-0f3b-414a-a580-396340c94c93} 4792 "\\.\pipe\gecko-crash-server-pipe.4792" tab
        8⤵
        
        PID:4940
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\EHJKFCGHID.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1264

C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4972

C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mozglue.dll

Path C:\ProgramData\mozglue.dll
Size 593KB
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
SSDEEP 12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5 SHA1 SHA512 SSDEEP

Submit Download

nss3.dll

Path C:\ProgramData\nss3.dll
Size 2.0MB
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
SSDEEP 49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5 SHA1 SHA512 SSDEEP

Submit Download

activity-stream.discovery_stream.json.tmp

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\t4hat1k8.default-release\activity-stream.discovery_stream.json.tmp
Size 19KB
SHA256 34aa4814cecc781e0cdc6c605ae6c23ac33e724656aa5d5309c9c204638a24ed
MD5 3a6bd9d1366b56d6eeed0e138de4fdc8
SHA1 94bc55658d70fa761596178d1538a44bc79998e5
SHA512 5940e87df36ee5cee6d7371539e21d0488ad320409e9c065be19e5622c7c4ede75b47d5644bd7b9e575d706f645a21d84910ff391160a3e68315530b9d9e78a8
SSDEEP 384:0H10tez6BwcR+bHfsTPGvEKCnOwch7W/fzTw9vniO0BXY+dErgyaE:0H1Zkk6PGcKCxcxW/rTwhD2IVgyp
MD5 SHA1 SHA512 SSDEEP

Submit Download

8A2034D325DC0B5C9E11EDDA3FC70A54C8DC1C0D

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\t4hat1k8.default-release\cache2\entries\8A2034D325DC0B5C9E11EDDA3FC70A54C8DC1C0D
Size 13KB
SHA256 82a144a67b40b47b2cd0a4ad2d6ad0602367e91f39356ac86eb70af05f2b0928
MD5 3e9ff344eff224496da7399258d122d1
SHA1 d22fe2d5dfe32e003acdf75353f54216567090a2
SHA512 61ed4830c773b43c050b95dda19ed8c6735386127d1f393106eb4a669985c4507604989f70b3fce5fd6713066800fe3db6baaec40c7ecd5a26ae2e17a24f852a
SSDEEP 384:H485u9fiGLm4pUvft2WlOX8lPLZZB7t0lpDIIXnln2:nUBi8mCUvft2WAX8tzB7eD8F
MD5 SHA1 SHA512 SSDEEP

Submit Download

9c1d5ca899.exe

Path C:\Users\Admin\AppData\Local\Temp\1000006001\9c1d5ca899.exe
Size 1.1MB
SHA256 88a73f617072b319fd87cbce1a0874c705ef077fcc0bb09a7037f9762368a0ca
MD5 9ab68ef496dc8989b5cc7f5397298529
SHA1 410ba11d1025142dcd2238e7c4e905a543fafdd6
SHA512 dba4a4f1db9d9ac254e26d5729f0acc7ac6d5a4b2c1236bde52586f280877b50d153075c22ff41bc8e7cc016c73c577d8abc171a925b5918055d5abe7c69f95d
SSDEEP 24576:B3eWhI+8Km/oikwjmZM2wv3bHi2ZdiXxWTpvFInaqLMxx:B3eWCkHm2wv3bCSdiXUFvFIxAj
MD5 SHA1 SHA512 SSDEEP

Submit Download

37d489b8f8.exe

Path C:\Users\Admin\AppData\Local\Temp\1000011001\37d489b8f8.exe
Size 1.2MB
SHA256 fbdd974a0c3fd11ac9428cc2c063b87d91b8e94dc4982e8c1a34b038c4cce60d
MD5 f4fd8ba47af2817710e14132081f2ecd
SHA1 f9b3fbcca8fea4d052e8e0c94faa1485d240e99a
SHA512 dd1d9beb8190dcc45c0ed09fb91ace02a9f131067e5e185d7a737f65aca5ab7343e20c337cf4331c102cf3cc4f66d87d7a287e5482ec0099023a3de9d32e1c6d
SSDEEP 24576:UqDEvCTbMWu7rQYlBQcBiT6rprG8aLE2Sbly7TWEPje:UTvC/MTQYxsWR7aLE2dW
MD5 SHA1 SHA512 SSDEEP

Submit Download

FIIDBKJJDG.exe

Path C:\Users\Admin\AppData\Local\Temp\FIIDBKJJDG.exe
Size 1.8MB
SHA256 5f604c9dee557d923eb3154fa0e6a2265f9ba440fd7e4a2ca1d58559516d5667
MD5 df7944e35afb3a8f0c3ac3846fba8b4a
SHA1 4cdeaa78a2e8a2d077ff1ad879a523ea9c651ba9
SHA512 2fa602d8d618d8c36fe3680645e085877041a77f43560b10f76b044ea64ccffd50bba7861a394f0d2a2f67bae4b64e1d42b6bf4408ade63f84f442be3ec2b4af
SSDEEP 49152:Sof4h1zzMyC2Nz2hJLLpg5B4MdUGqQdts+:dfazwyjqhp2fSy3
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 479KB
SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
MD5 09372174e83dbbf696ee732fd2e875bb
SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 13.8MB
SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
MD5 0a8747a2ac9ac08ae9508f36c6d75692
SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\t4hat1k8.default-release\AlternateServices.bin
Size 17KB
SHA256 eabd6aa65815aa7c682e22aabe20b58a1c8de20a9e91cd921cf315fcded34813
MD5 461cf2c2c04e65adb17b6bcec476608b
SHA1 7e7f58f261e688cf1d312c4f2cc830ff20bb2cf5
SHA512 a8897c070c28b2b86df6fe52d482eff6770187e3989020111e8b7eddc7a018e6ff9006c041839c09e87b10f750f1cbc8887be41a6893e3d82a0cc2d48a1cc8bf
SSDEEP 96:v5oSebOJ6bApebvpf+0bTNblbxgbgz3bIbAbZbpbkHVbb8b:v53u
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\t4hat1k8.default-release\AlternateServices.bin
Size 11KB
SHA256 76c5175e9032fa56dc609172e1ae99a40bb987c614346968dc6b584e7e4d5a18
MD5 76418b13a2866cbeb14aea5bb2650605
SHA1 c97ad1a8774f9d802946c13988644ddb1269a334
SHA512 39268e5b7a1fc78f7a86ec2cae13b4363e76ff7bd77c15bd3bf6d19b311f689cbe598a562ab0e1d53d3d14dd705000d99bd86a09e90e455d6fd6461f762d5817
SSDEEP 48:f5om9cOjebOJ6bnpebvpf+Nbfb3b72gbgzcb:f5oSebOJ6bnpebvpf+Nbfb3bagbgzcb
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\t4hat1k8.default-release\datareporting\glean\db\data.safe.tmp
Size 22KB
SHA256 b7d7d2b051f97e6292311e75980038aa94a8924f4e20e6c7588c55b95683815c
MD5 abcd666f917eb3eb398ee6806082d2b4
SHA1 31c8fe423d5894c608737c168cad903aae9202a7
SHA512 ce949cb71c724b4c0bdaca64431ecc6b25071ed05ca5a249231a7db22c82f0054d373b4a0761efd54e39c0e900d3e0d9eb03f65842b9d59bfab0b207b0fd81f6
SSDEEP 384:A/66JozQzgC1bYboyoP6YLPBZ1Iv2FjwihU3vAPRG+Nh9ZD7xbLbjbubhbSbwb5A:tmWS/PBZ1I/idPRG+Nh9ZD7xbLbjbubI
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\t4hat1k8.default-release\datareporting\glean\db\data.safe.tmp
Size 25KB
SHA256 995803cb6b027a587c3ee88b28885e66cd37210a2b7abbe76b9bec1f3ae4b339
MD5 40d7abf355c1678eda65ea6d2322bb3a
SHA1 2988cb13ddb2ac14d42522af2fbe23566fd62fd1
SHA512 c8e331cdbb06b0cef71ae23cd2925cfdaebc516a3ccec50ecc40be0c698ec5621ef942f390226319a2e57a852553f2669981518dc13fb4c8deb62e1b1d6c2ecf
SSDEEP 768:Ls5mT54uBp/gwBCyDRG4ph9ZDSVbLbjbLbGbSbwb5bPpIiIb4imm:Lss14uBp/XUOpIiIb4U
MD5 SHA1 SHA512 SSDEEP

Submit Download

b7613fe6-97d9-4192-a4a0-2a7aca75ef10

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\t4hat1k8.default-release\datareporting\glean\pending_pings\b7613fe6-97d9-4192-a4a0-2a7aca75ef10
Size 659B
SHA256 daee4db4357c48e1249bafe0977c0877cae5715f55ce576973a5e4bf779c655a
MD5 6fc2698f4ca1e5c8f781936309ca2031
SHA1 cc9128d688bac4c7b5de34db223d06565a26518f
SHA512 7f49b5c62990cf5df4b91639724d6e2e17d2283c7d8af4f6619e1ea50435edd60154cfa856e526f21dac8b5c7fad90dedd4240540179abafaf8d30a0b417985a
MD5 SHA1 SHA512

Submit Download

d324439e-3923-44ff-9dd2-20933ffebe26

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\t4hat1k8.default-release\datareporting\glean\pending_pings\d324439e-3923-44ff-9dd2-20933ffebe26
Size 982B
SHA256 9232cb4112fb5043924662e95c45b3a0a36b1c61ec83d7457c0cb24649e25131
MD5 e0cec0f6cb14d44c668f2825afaa1482
SHA1 1d28b363c977fc8908f03f3239795bfb586721c9
SHA512 f7261bc369fba52631a1a9cbff369ecd9371b1ad550c1c7ce6433ec825866cb41609c3f3fc5bd430604cd606393cc8f072a9afac8f1e4ab18b963b8d0562ae04
MD5 SHA1 SHA512

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\t4hat1k8.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Size 1.1MB
SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
MD5 842039753bf41fa5e11b3a1383061a87
SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\t4hat1k8.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Size 116B
SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
MD5 2a461e9eb87fd1955cea740a3444ee7a
SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\t4hat1k8.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Size 372B
SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
MD5 bf957ad58b55f64219ab3f793e374316
SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\t4hat1k8.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Size 17.8MB
SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
MD5 daf7ef3acccab478aaa7d6dc1c60f865
SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\t4hat1k8.default-release\prefs-1.js
Size 13KB
SHA256 6489a8d0628cea02a470c5c26a86bcd8f55769aa36e2143cbb7d9a8fab6a20aa
MD5 8b6c5ec0b54d5a224727696ec015500d
SHA1 9d044f078f5f9499fc4b93bdaa94f6a1f2cc45b9
SHA512 2f937528ef23b8053b4e71c146c4a09a3cb5737e4f2c9d18a386726fe0b7597859855473ffdcde54f5df79cf02cf6c471b17e826d0e708f4caf54ef779df3073
SSDEEP 192:Dx5n/RhkfoVWthQorPIWBEkeVlYcd3IW2+QHrx60zKaXGhDadcfBw8HIx:DwhNDFB9IZFhQLotdwV
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\t4hat1k8.default-release\prefs-1.js
Size 16KB
SHA256 79178902a7cd60791d817ba03c4ec19fba6f709deca5d33e2a7527119f3adb22
MD5 373a48d62a54bf678ecc92387d8a6641
SHA1 538eff354bf90653cd489e8d9068234800f1ae4f
SHA512 5727f4ad580b49f872afc7bcb4ad0209bec4444c5dfafd5382d2caea3a2ea0679e2303253eb003a8e94409a95b24a9afafab4920e58a4ebb8d860de68f239170
SSDEEP 192:Dx6n/RhkfmWthQorPIWBEkeVlYcd3IW2+QHrx60zKaXC+hDadcbiBw8HjtJ4DW:DhrNDFB9IZFhQLoeIwwL
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\t4hat1k8.default-release\prefs.js
Size 11KB
SHA256 9b743117439d0aba71af180433881f6d6e281eab5b959a0d510bf9198fc7a434
MD5 e8ffc13e56b90985a11dba96f3094897
SHA1 262719a5178454a3303d6d2346d53140acc09a45
SHA512 08576fb1a5c120300c1fa3e144ed631a74e015976699ab2d402b63bfa3e6008cf783995db8553b4076c68b3fea7ce43b8501776827ea16c5337aef2371f3df73
SSDEEP 192:Ex5n/RhkfoVWthQorPIWBEkeVlYcd3IW2+QHrx60zKaXGhDadccBw8Hy:EwhNDFB9IZFhQLotewX
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\t4hat1k8.default-release\prefs.js
Size 8KB
SHA256 e3e2d7c1efa2372e2b8e37e6418b33adfccf1e024a70e832419b2e10e69d6956
MD5 0cc8204651f5cd5e8e1146d8f79f55bb
SHA1 8ad0cb744b52293d6bfa2b105d21f2c8960a94ec
SHA512 9d31699b5543dbd2dcfe8abf5df0895be22626c7cd981eebc750439864ecf5ef0b4973a2ff94c589d953245e40c25461d03142c06e31e51985bdde249ad1a852
SSDEEP 192:Ex5n/RhkfoVRIHtxUcdzky60zuaXwvhDadccBw8Vy:EwVx5yxDew9
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/656-80-0x00000000006C0000-0x0000000000B73000-memory.dmp

Download

memory/656-93-0x00000000006C0000-0x0000000000B73000-memory.dmp

Download

memory/1052-2603-0x0000000000360000-0x0000000000813000-memory.dmp

Download

memory/1052-2612-0x0000000000360000-0x0000000000813000-memory.dmp

Download

memory/1052-2619-0x0000000000360000-0x0000000000813000-memory.dmp

Download

memory/1052-461-0x0000000000360000-0x0000000000813000-memory.dmp

Download

memory/1052-448-0x0000000000360000-0x0000000000813000-memory.dmp

Download

memory/1052-2615-0x0000000000360000-0x0000000000813000-memory.dmp

Download

memory/1052-137-0x0000000000360000-0x0000000000813000-memory.dmp

Download

memory/1052-792-0x0000000000360000-0x0000000000813000-memory.dmp

Download

memory/1052-2613-0x0000000000360000-0x0000000000813000-memory.dmp

Download

memory/1052-1750-0x0000000000360000-0x0000000000813000-memory.dmp

Download

memory/1052-2611-0x0000000000360000-0x0000000000813000-memory.dmp

Download

memory/1052-2610-0x0000000000360000-0x0000000000813000-memory.dmp

Download

memory/1052-2602-0x0000000000360000-0x0000000000813000-memory.dmp

Download

memory/1052-94-0x0000000000360000-0x0000000000813000-memory.dmp

Download

memory/3164-111-0x00000000007D0000-0x0000000000D61000-memory.dmp

Download

memory/3164-110-0x00000000007D0000-0x0000000000D61000-memory.dmp

Download

memory/3556-2616-0x0000000000360000-0x0000000000813000-memory.dmp

Download

memory/3556-2618-0x0000000000360000-0x0000000000813000-memory.dmp

Download

memory/3672-0-0x0000000000840000-0x0000000000DD1000-memory.dmp

Download

memory/3672-76-0x0000000000840000-0x0000000000DD1000-memory.dmp

Download

memory/3672-1-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Download

memory/4972-2601-0x0000000000360000-0x0000000000813000-memory.dmp

Download

memory/4972-2599-0x0000000000360000-0x0000000000813000-memory.dmp

Download