amadey | c460b6c9a405590d6645002fce45eff0dde2504dffd7712bf2ba67a9b9662e09

Analysis

max time kernel
149s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20240709-en
resource tags

arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
submitted
18/07/2024, 03:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c460b6c9a405590d6645002fce45eff0dde2504dffd7712bf2ba67a9b9662e09.exe
Size 1.8MB
Sample240718-dmmmxsseml
SHA256 c460b6c9a405590d6645002fce45eff0dde2504dffd7712bf2ba67a9b9662e09
MD5 4c79d5d844800d3d0ce53dfcb74b7fcc
SHA1 b349059a1fa8076898650d0ba25811b60e61a98b
SHA512 77feb9d6cb1930ac48845c0b6df2cb85e4bb6eefbf37f85f96abbb11a4d3df4eff4fdc7bab2fb8a86f747a8533cbdc2e287b6a804f7536be80abd2e2175fc30f
SSDEEP 49152:W5g8GB0QDR539/jJ0UJXYxzZUISV57QelU5:d8GBPDxrJpoxzZUrznlU
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey stealc 4dd39d funny discovery evasion spyware stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.30

Botnet

4dd39d

http://77.91.77.82

Attributes

install_dir
ad40971b6b
install_file
explorti.exe
strings_key
a434973ad22def7137dbb5e059b7081e
url_paths
/Hun4Ko/index.php

rc4.plain

Extracted

Family

stealc

Botnet

funny

http://85.28.47.30

Attributes

url_path
/920475a59bac849d.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Stealc
Stealc is an infostealer written in C++.
stealer stealc

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	FBFCFIEBKE.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	c460b6c9a405590d6645002fce45eff0dde2504dffd7712bf2ba67a9b9662e09.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 12 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	c460b6c9a405590d6645002fce45eff0dde2504dffd7712bf2ba67a9b9662e09.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	c460b6c9a405590d6645002fce45eff0dde2504dffd7712bf2ba67a9b9662e09.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	FBFCFIEBKE.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	FBFCFIEBKE.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe

Executes dropped EXE 7 IoCs

pid	Process
2148	explorti.exe
4408	5c1695e8f8.exe
2360	b0068637fa.exe
4904	FBFCFIEBKE.exe
3684	explorti.exe
1044	explorti.exe
3184	explorti.exe

Identifies Wine through registry keys 2 TTPs 6 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000\Software\Wine	c460b6c9a405590d6645002fce45eff0dde2504dffd7712bf2ba67a9b9662e09.exe
Key opened	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000\Software\Wine	FBFCFIEBKE.exe
Key opened	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000\Software\Wine	explorti.exe

Loads dropped DLL 2 IoCs

pid	Process
4408	5c1695e8f8.exe
4408	5c1695e8f8.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x000100000002aa7a-58.dat	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs

pid	Process
4744	c460b6c9a405590d6645002fce45eff0dde2504dffd7712bf2ba67a9b9662e09.exe
2148	explorti.exe
4408	5c1695e8f8.exe
4408	5c1695e8f8.exe
4904	FBFCFIEBKE.exe
3684	explorti.exe
1044	explorti.exe
3184	explorti.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\explorti.job	c460b6c9a405590d6645002fce45eff0dde2504dffd7712bf2ba67a9b9662e09.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	5c1695e8f8.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	5c1695e8f8.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
4744	c460b6c9a405590d6645002fce45eff0dde2504dffd7712bf2ba67a9b9662e09.exe
4744	c460b6c9a405590d6645002fce45eff0dde2504dffd7712bf2ba67a9b9662e09.exe
2148	explorti.exe
2148	explorti.exe
4408	5c1695e8f8.exe
4408	5c1695e8f8.exe
4408	5c1695e8f8.exe
4408	5c1695e8f8.exe
4904	FBFCFIEBKE.exe
4904	FBFCFIEBKE.exe
3684	explorti.exe
3684	explorti.exe
1044	explorti.exe
1044	explorti.exe
3184	explorti.exe
3184	explorti.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2916	firefox.exe
Token: SeDebugPrivilege	2916	firefox.exe
Token: SeDebugPrivilege	2916	firefox.exe
Token: SeDebugPrivilege	2916	firefox.exe
Token: SeDebugPrivilege	2916	firefox.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2360	b0068637fa.exe
2360	b0068637fa.exe
2360	b0068637fa.exe
2360	b0068637fa.exe
2360	b0068637fa.exe
2360	b0068637fa.exe
2916	firefox.exe
2916	firefox.exe
2916	firefox.exe
2916	firefox.exe
2916	firefox.exe
2916	firefox.exe
2916	firefox.exe
2916	firefox.exe
2916	firefox.exe
2916	firefox.exe
2916	firefox.exe
2916	firefox.exe
2916	firefox.exe
2916	firefox.exe
2916	firefox.exe
2916	firefox.exe
2916	firefox.exe
2916	firefox.exe
2916	firefox.exe
2916	firefox.exe
2916	firefox.exe
2360	b0068637fa.exe
2360	b0068637fa.exe
2360	b0068637fa.exe
2360	b0068637fa.exe
2360	b0068637fa.exe
2360	b0068637fa.exe
2360	b0068637fa.exe
2360	b0068637fa.exe
2360	b0068637fa.exe
2360	b0068637fa.exe
2360	b0068637fa.exe
2360	b0068637fa.exe
2360	b0068637fa.exe
2360	b0068637fa.exe
2360	b0068637fa.exe
2360	b0068637fa.exe
2360	b0068637fa.exe
2360	b0068637fa.exe
2360	b0068637fa.exe
2360	b0068637fa.exe
2360	b0068637fa.exe
2360	b0068637fa.exe
2360	b0068637fa.exe
2360	b0068637fa.exe
2360	b0068637fa.exe
2360	b0068637fa.exe
2360	b0068637fa.exe
2360	b0068637fa.exe
2360	b0068637fa.exe
2360	b0068637fa.exe
2360	b0068637fa.exe
2360	b0068637fa.exe
2360	b0068637fa.exe
2360	b0068637fa.exe
2360	b0068637fa.exe
2360	b0068637fa.exe
2360	b0068637fa.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2360	b0068637fa.exe
2360	b0068637fa.exe
2360	b0068637fa.exe
2360	b0068637fa.exe
2360	b0068637fa.exe
2360	b0068637fa.exe
2360	b0068637fa.exe
2360	b0068637fa.exe
2360	b0068637fa.exe
2360	b0068637fa.exe
2360	b0068637fa.exe
2360	b0068637fa.exe
2360	b0068637fa.exe
2360	b0068637fa.exe
2360	b0068637fa.exe
2360	b0068637fa.exe
2360	b0068637fa.exe
2360	b0068637fa.exe
2360	b0068637fa.exe
2360	b0068637fa.exe
2360	b0068637fa.exe
2360	b0068637fa.exe
2360	b0068637fa.exe
2360	b0068637fa.exe
2360	b0068637fa.exe
2360	b0068637fa.exe
2360	b0068637fa.exe
2360	b0068637fa.exe
2360	b0068637fa.exe
2360	b0068637fa.exe
2360	b0068637fa.exe
2360	b0068637fa.exe
2360	b0068637fa.exe
2360	b0068637fa.exe
2360	b0068637fa.exe
2360	b0068637fa.exe
2360	b0068637fa.exe
2360	b0068637fa.exe
2360	b0068637fa.exe
2360	b0068637fa.exe
2360	b0068637fa.exe
2360	b0068637fa.exe
2360	b0068637fa.exe
2360	b0068637fa.exe
2360	b0068637fa.exe
2360	b0068637fa.exe
2360	b0068637fa.exe
2360	b0068637fa.exe
2360	b0068637fa.exe
2360	b0068637fa.exe
2360	b0068637fa.exe
2360	b0068637fa.exe
2360	b0068637fa.exe
2360	b0068637fa.exe
2360	b0068637fa.exe
2360	b0068637fa.exe
2360	b0068637fa.exe
2360	b0068637fa.exe
2360	b0068637fa.exe
2360	b0068637fa.exe
2360	b0068637fa.exe
2360	b0068637fa.exe
2360	b0068637fa.exe
2360	b0068637fa.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4408	5c1695e8f8.exe
2916	firefox.exe
4632	cmd.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4744 wrote to memory of 2148	4744	c460b6c9a405590d6645002fce45eff0dde2504dffd7712bf2ba67a9b9662e09.exe	78
PID 4744 wrote to memory of 2148	4744	c460b6c9a405590d6645002fce45eff0dde2504dffd7712bf2ba67a9b9662e09.exe	78
PID 4744 wrote to memory of 2148	4744	c460b6c9a405590d6645002fce45eff0dde2504dffd7712bf2ba67a9b9662e09.exe	78
PID 2148 wrote to memory of 4408	2148	explorti.exe	79
PID 2148 wrote to memory of 4408	2148	explorti.exe	79
PID 2148 wrote to memory of 4408	2148	explorti.exe	79
PID 2148 wrote to memory of 2360	2148	explorti.exe	80
PID 2148 wrote to memory of 2360	2148	explorti.exe	80
PID 2148 wrote to memory of 2360	2148	explorti.exe	80
PID 2360 wrote to memory of 3108	2360	b0068637fa.exe	81
PID 2360 wrote to memory of 3108	2360	b0068637fa.exe	81
PID 3108 wrote to memory of 2916	3108	firefox.exe	84
PID 3108 wrote to memory of 2916	3108	firefox.exe	84
PID 3108 wrote to memory of 2916	3108	firefox.exe	84
PID 3108 wrote to memory of 2916	3108	firefox.exe	84
PID 3108 wrote to memory of 2916	3108	firefox.exe	84
PID 3108 wrote to memory of 2916	3108	firefox.exe	84
PID 3108 wrote to memory of 2916	3108	firefox.exe	84
PID 3108 wrote to memory of 2916	3108	firefox.exe	84
PID 3108 wrote to memory of 2916	3108	firefox.exe	84
PID 3108 wrote to memory of 2916	3108	firefox.exe	84
PID 3108 wrote to memory of 2916	3108	firefox.exe	84
PID 2916 wrote to memory of 432	2916	firefox.exe	85
PID 2916 wrote to memory of 432	2916	firefox.exe	85
PID 2916 wrote to memory of 432	2916	firefox.exe	85
PID 2916 wrote to memory of 432	2916	firefox.exe	85
PID 2916 wrote to memory of 432	2916	firefox.exe	85
PID 2916 wrote to memory of 432	2916	firefox.exe	85
PID 2916 wrote to memory of 432	2916	firefox.exe	85
PID 2916 wrote to memory of 432	2916	firefox.exe	85
PID 2916 wrote to memory of 432	2916	firefox.exe	85
PID 2916 wrote to memory of 432	2916	firefox.exe	85
PID 2916 wrote to memory of 432	2916	firefox.exe	85
PID 2916 wrote to memory of 432	2916	firefox.exe	85
PID 2916 wrote to memory of 432	2916	firefox.exe	85
PID 2916 wrote to memory of 432	2916	firefox.exe	85
PID 2916 wrote to memory of 432	2916	firefox.exe	85
PID 2916 wrote to memory of 432	2916	firefox.exe	85
PID 2916 wrote to memory of 432	2916	firefox.exe	85
PID 2916 wrote to memory of 432	2916	firefox.exe	85
PID 2916 wrote to memory of 432	2916	firefox.exe	85
PID 2916 wrote to memory of 432	2916	firefox.exe	85
PID 2916 wrote to memory of 432	2916	firefox.exe	85
PID 2916 wrote to memory of 432	2916	firefox.exe	85
PID 2916 wrote to memory of 432	2916	firefox.exe	85
PID 2916 wrote to memory of 432	2916	firefox.exe	85
PID 2916 wrote to memory of 432	2916	firefox.exe	85
PID 2916 wrote to memory of 432	2916	firefox.exe	85
PID 2916 wrote to memory of 432	2916	firefox.exe	85
PID 2916 wrote to memory of 432	2916	firefox.exe	85
PID 2916 wrote to memory of 432	2916	firefox.exe	85
PID 2916 wrote to memory of 432	2916	firefox.exe	85
PID 2916 wrote to memory of 432	2916	firefox.exe	85
PID 2916 wrote to memory of 432	2916	firefox.exe	85
PID 2916 wrote to memory of 432	2916	firefox.exe	85
PID 2916 wrote to memory of 432	2916	firefox.exe	85
PID 2916 wrote to memory of 432	2916	firefox.exe	85
PID 2916 wrote to memory of 432	2916	firefox.exe	85
PID 2916 wrote to memory of 432	2916	firefox.exe	85
PID 2916 wrote to memory of 432	2916	firefox.exe	85
PID 2916 wrote to memory of 432	2916	firefox.exe	85
PID 2916 wrote to memory of 432	2916	firefox.exe	85
PID 2916 wrote to memory of 432	2916	firefox.exe	85
PID 2916 wrote to memory of 432	2916	firefox.exe	85

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\c460b6c9a405590d6645002fce45eff0dde2504dffd7712bf2ba67a9b9662e09.exe
"C:\Users\Admin\AppData\Local\Temp\c460b6c9a405590d6645002fce45eff0dde2504dffd7712bf2ba67a9b9662e09.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4744
- C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
  "C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2148
- - C:\Users\Admin\AppData\Local\Temp\1000006001\5c1695e8f8.exe
    "C:\Users\Admin\AppData\Local\Temp\1000006001\5c1695e8f8.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:4408
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\FBFCFIEBKE.exe"
      4⤵
      PID:4724
    - - C:\Users\Admin\AppData\Local\Temp\FBFCFIEBKE.exe
        
        "C:\Users\Admin\AppData\Local\Temp\FBFCFIEBKE.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        
        PID:4904
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\ECAKECAEGD.exe"
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:4632
- - C:\Users\Admin\AppData\Local\Temp\1000011001\b0068637fa.exe
    "C:\Users\Admin\AppData\Local\Temp\1000011001\b0068637fa.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2360
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3108
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
        5⤵
        Checks processor information in registry
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2916
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1932 -parentBuildID 20240401114208 -prefsHandle 1824 -prefMapHandle 1828 -prefsLen 25751 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {13cb4933-161a-431f-ae62-70bad3d24857} 2916 "\\.\pipe\gecko-crash-server-pipe.2916" gpu
        6⤵
        
        PID:432
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2352 -parentBuildID 20240401114208 -prefsHandle 2344 -prefMapHandle 2340 -prefsLen 26671 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {89edb7ab-c53e-4e54-8ea0-8d80022ff9db} 2916 "\\.\pipe\gecko-crash-server-pipe.2916" socket
        6⤵
        
        PID:4680
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2956 -childID 1 -isForBrowser -prefsHandle 2876 -prefMapHandle 3088 -prefsLen 22698 -prefMapSize 244658 -jsInitHandle 1400 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b095f7cf-8dec-47ba-a918-865523ebd7dd} 2916 "\\.\pipe\gecko-crash-server-pipe.2916" tab
        6⤵
        
        PID:2160
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3808 -childID 2 -isForBrowser -prefsHandle 2888 -prefMapHandle 1320 -prefsLen 31161 -prefMapSize 244658 -jsInitHandle 1400 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bb92826d-29f5-4ced-a2ce-bb917e13645c} 2916 "\\.\pipe\gecko-crash-server-pipe.2916" tab
        6⤵
        
        PID:1956
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4760 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4752 -prefMapHandle 4728 -prefsLen 31161 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3dbbee59-b443-45b8-9504-a51f28707ae8} 2916 "\\.\pipe\gecko-crash-server-pipe.2916" utility
        6⤵
        Checks processor information in registry
        
        PID:3844
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5692 -childID 3 -isForBrowser -prefsHandle 5680 -prefMapHandle 5660 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1400 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1a4f1212-2a28-4f31-b4b5-ec9adb335c17} 2916 "\\.\pipe\gecko-crash-server-pipe.2916" tab
        6⤵
        
        PID:1960
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5832 -childID 4 -isForBrowser -prefsHandle 5912 -prefMapHandle 5908 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1400 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a017cd1c-578b-4a85-acb9-fff5a230adb8} 2916 "\\.\pipe\gecko-crash-server-pipe.2916" tab
        6⤵
        
        PID:4952
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5692 -childID 5 -isForBrowser -prefsHandle 6048 -prefMapHandle 6052 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1400 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {460d4dbd-8255-4d7a-b4c0-ebb7dd932baf} 2916 "\\.\pipe\gecko-crash-server-pipe.2916" tab
        6⤵
        
        PID:1868

C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3684

C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1044

C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AKEGIIJDGHCAKFHJEHCF

Path C:\ProgramData\AKEGIIJDGHCAKFHJEHCF
Size 8KB
SHA256 70e21f632f2b90decf660384a29f46ee9951d15e0fac7dabafefacf57d006dfb
MD5 9976da56641b865c898edec456441977
SHA1 4c8592e9f56f32759dd34599ab015262d6064517
SHA512 268d082bb5a71f7a24b148208c3fb321a763aaded6be5df5b5fc3f0b302275afaecfc16746173f7f52f00d59b48d4aa32160fed2adfd528da3daa45c7ea6f3ce
SSDEEP 192:A5nu2RUfp5k0whilcdVBA60raXrd4uIxEBw8HW:7T+FnRNdVXwr
MD5 SHA1 SHA512 SSDEEP

Submit Download

mozglue.dll

Path C:\ProgramData\mozglue.dll
Size 593KB
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
SSDEEP 12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5 SHA1 SHA512 SSDEEP

Submit Download

nss3.dll

Path C:\ProgramData\nss3.dll
Size 2.0MB
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
SSDEEP 49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5 SHA1 SHA512 SSDEEP

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\tu0k8f5w.default-release\activity-stream.discovery_stream.json
Size 18KB
SHA256 2052a144b635a3ccf99ec44f11dcc6e6870c9a839f404398f1aba5149474dbd6
MD5 4c9b828361453d43a66c52bfeb60aa1a
SHA1 1a7d93dd7d3b6f2e4cc5d25a20249fe339bd0159
SHA512 5eac3aa9e54ff74abc7b69ce4b80f6cb1abcb50df12b7956efc6b00b29c55c0d7ee801085a6872c45f8772ac33ebc07464c9c78f932574c05945239117628278
SSDEEP 384:8Y10+/AZ3rfJSSMK20AgT+FcxB6NzN2bHfsrGvD9oKOw66Bn10jGbyaE:f0lZ3TJKKkgT++aN6AGL/6kn1Typ
MD5 SHA1 SHA512 SSDEEP

Submit Download

8A2034D325DC0B5C9E11EDDA3FC70A54C8DC1C0D

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\tu0k8f5w.default-release\cache2\entries\8A2034D325DC0B5C9E11EDDA3FC70A54C8DC1C0D
Size 13KB
SHA256 a8acf0b0fee9abe552769d58c772776ad01ce861ec8fccf8341f11ea85cdf3f3
MD5 00e314071d16f2c7feafb37fd962c51b
SHA1 8236ef8248499a95bee25b7199827e86956fe16d
SHA512 3be6217ad15666a90a35a183d58b544f261da0596391797b813c73e5ca4cfe9046462ed753e9261496e900f57725a8da0ce417c375e210528ed671b41d5c1a4c
SSDEEP 384:H485u9fiGLm4pUQft2WlOX8lPLZZB7t0lpDII0fjRfjh:nUBi8mCUQft2WAX8tzB7eD8R1l
MD5 SHA1 SHA512 SSDEEP

Submit Download

5c1695e8f8.exe

Path C:\Users\Admin\AppData\Local\Temp\1000006001\5c1695e8f8.exe
Size 1.1MB
SHA256 383442ecd4bff5dc709ad467a2852d0a7cb79c38c09b1f3e612bacfaa0ceb92f
MD5 4367b1db8ee57c606a7a8f12c153f876
SHA1 6715acb953b6ebc65727c8fa4490a6d62f86e7c9
SHA512 34cb861515577cf61f1c30db2f1f5aa4dc4037f68784bd0fbbe8464833b90c1fdc552bb5cf0914a905b31f5e8e3ee495d2611db03818a1df7bcce383fb20b3c1
SSDEEP 24576:rPt6GHkSUG0EZnwiOjAFf+RjHG+m7FKAcFUvNiool/:J7HkSUG1ZnEsp+RjHG+AMAkUvN
MD5 SHA1 SHA512 SSDEEP

Submit Download

b0068637fa.exe

Path C:\Users\Admin\AppData\Local\Temp\1000011001\b0068637fa.exe
Size 1.2MB
SHA256 14f8e04ba398830da5c552a507e5d025090a64517e89900ef170bb145be38aad
MD5 3594bfa1c6bcfd8eff4ee54745862e9d
SHA1 b6ea9df4ce15ab4a51a51aa370395edcc933e9e6
SHA512 51cea9262de5ae9f93f1590ec00b00e88650b397dc53c8148d2dc3bc8d14797bb7f4278c65d0650459dde43d3bbbe3f23875d612987d43ffc424bb51eb8d1e6e
SSDEEP 24576:+qDEvCTbMWu7rQYlBQcBiT6rprG8aLR2Sbly7TWEPje:+TvC/MTQYxsWR7aLR2dW
MD5 SHA1 SHA512 SSDEEP

Submit Download

explorti.exe

Path C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
Size 1.8MB
SHA256 c460b6c9a405590d6645002fce45eff0dde2504dffd7712bf2ba67a9b9662e09
MD5 4c79d5d844800d3d0ce53dfcb74b7fcc
SHA1 b349059a1fa8076898650d0ba25811b60e61a98b
SHA512 77feb9d6cb1930ac48845c0b6df2cb85e4bb6eefbf37f85f96abbb11a4d3df4eff4fdc7bab2fb8a86f747a8533cbdc2e287b6a804f7536be80abd2e2175fc30f
SSDEEP 49152:W5g8GB0QDR539/jJ0UJXYxzZUISV57QelU5:d8GBPDxrJpoxzZUrznlU
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 479KB
SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
MD5 09372174e83dbbf696ee732fd2e875bb
SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 13.8MB
SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
MD5 0a8747a2ac9ac08ae9508f36c6d75692
SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tu0k8f5w.default-release\AlternateServices.bin
Size 17KB
SHA256 f4d0815e105994f302905ea12a924a5c4e84ffc5ec7143d095937bb00be43b8b
MD5 1d7035d0b8703374a3b9eebf60076ff8
SHA1 3a936c463781410df721dba121af2716be826f43
SHA512 8b38277174ff4f25df4f477d85f631dd7003c3c5b7312ee07070d16cbc6288a29773da294adf4fec0a95d7823a1163dcc09c41b8893a26528803dcf03b52e091
SSDEEP 96:ufJ5oRx0lVsebOJUbgJpebvpf+sbn9bRbq0bFb92gbgzCbvZbdb9pekHVNgb4b:e5OXu
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tu0k8f5w.default-release\AlternateServices.bin
Size 12KB
SHA256 0045a0e83697391d7c0d3a9d2b9de52ad39ff96855902ce66cf1c93ed2869f2c
MD5 d062e50b75c8473970549b70a117443f
SHA1 efcc6b9931f03e5b07c89c8fc02b9834fd9b23d9
SHA512 e8ee5c1072d470921265241ebf39617d110f55592a7e963b6758a4089dae9b88562791721f25fca053367697b433e47653735610886cb0530db2568f93554316
SSDEEP 96:KJ5oRx0lVsebOJUbAJpebvpf+Ubs9bCbB0bOb+2gbgzRb:25OPu
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tu0k8f5w.default-release\datareporting\glean\db\data.safe.tmp
Size 22KB
SHA256 81c7bce3ede8ea47a0fc496894b1b00acf614a7b51f92097e26cb896c3a133f7
MD5 858efc2a1952e5f2c68d73b6ba17ce2a
SHA1 4dac4fc02b2a14caf81b5d734564a26407d87f1b
SHA512 01d559d3ff0bf1c4ecbd62ab049e1d4a99c68db6baae458cef2e3063cb4f0e8510b49b2baaecc2caae1eb0368fa45f83d1c5fbe620f89eaf8b3a1cca4b9e5c0f
SSDEEP 384:3/66JozQzgC1btboKUPWgeY66O2pndOiYcjKPv/Vc5p3EmRGbDUbBbEbqb4bFb1O:SmjmteY66Hp7GPv/Vc5p3EmRGbDUbBbv
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tu0k8f5w.default-release\datareporting\glean\db\data.safe.tmp
Size 26KB
SHA256 8cd7ee10ee148306f9fee484793999ceaef2298fcaf0577874806881896659a2
MD5 aac8a61b41fe219c5afbda6a5a7fe07a
SHA1 6d7a6b72d6cc2952302866f6d1eb1cd3d6e3f529
SHA512 4eb843e0fef050361329769c29ab051012c8b80d1675f451fbab8755fd671abaf46b6b82381198fcca9007e5ddcd2ab2c2c1cbbf644d1ef34d614ffc96b55dcf
SSDEEP 768:2QO93lrqDv/Iw5p3EmasbDUbBb9bpb4bFb1bvbyS8q657Tsf50mm:2QO9VfS8q657Tsc
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tu0k8f5w.default-release\datareporting\glean\db\data.safe.tmp
Size 23KB
SHA256 ba1a28c2644b4678f4bcb615bafbb12bf844a993c8355d029bc25e013905fab9
MD5 907fab74b152120dc9a3dbd324307e55
SHA1 c50db75d853129f7bc1733d8e5fe471b2f33631a
SHA512 9d8cc905b366cd45c8b55db7ba7888de2f60e23aec630531cf06b1e201278db51fc1109ae14fc02d26446ad42d497e78ec262f5bd2573aac3a67028823a5421e
SSDEEP 384:EbokUPWgeY66O2pndOiYcjKPv/Vc5p3EmRGbDUbBbEbqb4bFb1bvbCcYy6GztF58:sIteY66Hp7GPv/Vc5p3EmRGbDUbBbEbm
MD5 SHA1 SHA512 SSDEEP

Submit Download

14e3afd2-38d1-4723-b2eb-2da22ad5ff90

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tu0k8f5w.default-release\datareporting\glean\pending_pings\14e3afd2-38d1-4723-b2eb-2da22ad5ff90
Size 659B
SHA256 a47afffb795acc33ca7661de363d90fc60d5a00a89e31eb22055aae8eac9010d
MD5 73d691e983c070d1e386eac8457673c5
SHA1 8dc8aa4279528a0ee3c88bed209e05171c4296b2
SHA512 44b8e40cedfd6342789198681cc6adf1595b02a5d22ead188c44106228af2c8d8864323f807124785d4fcfa8603db9dcae144f6c3c19d6e1d2ccbe044f8ee0b0
MD5 SHA1 SHA512

Submit Download

8eb339f1-e607-4ef1-9f8b-90859e1be048

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tu0k8f5w.default-release\datareporting\glean\pending_pings\8eb339f1-e607-4ef1-9f8b-90859e1be048
Size 982B
SHA256 ccf1cad997aca6472eab281738933c29750aaff396f04a966f49ebcc76634476
MD5 2eeb880cc84a15572d373c9f0b7be2d6
SHA1 454f5b46ca4aa886026da1394706cb08bc6dce4a
SHA512 00aa3f1074efd2aba8c3bd82cb348e6b9fb6b48607a1820209720908189c66c1e346cbbe35f01a3697fef16df18d41879989fad677c1e6a0bfb775b3ec696fd6
MD5 SHA1 SHA512

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tu0k8f5w.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Size 1.1MB
SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
MD5 842039753bf41fa5e11b3a1383061a87
SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tu0k8f5w.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Size 116B
SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
MD5 2a461e9eb87fd1955cea740a3444ee7a
SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tu0k8f5w.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Size 372B
SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
MD5 bf957ad58b55f64219ab3f793e374316
SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tu0k8f5w.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Size 17.8MB
SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
MD5 daf7ef3acccab478aaa7d6dc1c60f865
SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
MD5 SHA1 SHA512 SSDEEP

Submit Download

places.sqlite-wal

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tu0k8f5w.default-release\places.sqlite-wal
Size 992KB
SHA256 f19172dc16ab4a554457c5318c1cdd5fd4ea20b1a1f4ab7a26809e759890e875
MD5 43ad1b15baa1271da477a44258bb873b
SHA1 8775a2c2d5f91c3a78dd06cab94350d468a89cb2
SHA512 3fdfa9ad8c94787bf7bd8f6f2a9f680816d03963365cff5832149e0f013c6ccdd444e06135da58ea9a1059c3b7ebe2af38482e27eebd23453e30538b40a56903
SSDEEP 192:lFndQ8fsGFhvbrpygx/KFndQRhKWYxSkGFLv8ys4x/xXFndQn:l/TEg4/VWwSV//G
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tu0k8f5w.default-release\prefs-1.js
Size 12KB
SHA256 9a6330056803f26e7089a251f04f10600912c8a3da505c266429399dadc26721
MD5 590e490a7cc3569f9c2a528b1c910daf
SHA1 0c9f6803087ecaaa3733e8bed158d1e621755fbd
SHA512 c6818a0c0b6511eb9bb9cb9c75199fc960d0fb29d67121fd179cf0a8f31bbc5c12e49d5d78b66ccf7897066ad5a274b0ef988c8f387428cb8694def737f8ca32
SSDEEP 192:G5nu2RUfpoexoJzyEsOlJcdQUzZKQHrs600aXZd4uIxiBw8Hbuq:VlQzyhx7zAQLH4dVzwkB
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1044-2598-0x00000000009B0000-0x0000000000E75000-memory.dmp

Download

memory/1044-2599-0x00000000009B0000-0x0000000000E75000-memory.dmp

Download

memory/2148-2584-0x00000000009B0000-0x0000000000E75000-memory.dmp

Download

memory/2148-18-0x00000000009B0000-0x0000000000E75000-memory.dmp

Download

memory/2148-2615-0x00000000009B0000-0x0000000000E75000-memory.dmp

Download

memory/2148-2610-0x00000000009B0000-0x0000000000E75000-memory.dmp

Download

memory/2148-2604-0x00000000009B0000-0x0000000000E75000-memory.dmp

Download

memory/2148-449-0x00000000009B0000-0x0000000000E75000-memory.dmp

Download

memory/2148-2603-0x00000000009B0000-0x0000000000E75000-memory.dmp

Download

memory/2148-460-0x00000000009B0000-0x0000000000E75000-memory.dmp

Download

memory/2148-461-0x00000000009B0000-0x0000000000E75000-memory.dmp

Download

memory/2148-466-0x00000000009B0000-0x0000000000E75000-memory.dmp

Download

memory/2148-430-0x00000000009B0000-0x0000000000E75000-memory.dmp

Download

memory/2148-2602-0x00000000009B0000-0x0000000000E75000-memory.dmp

Download

memory/2148-2601-0x00000000009B0000-0x0000000000E75000-memory.dmp

Download

memory/2148-21-0x00000000009B0000-0x0000000000E75000-memory.dmp

Download

memory/2148-20-0x00000000009B0000-0x0000000000E75000-memory.dmp

Download

memory/2148-19-0x00000000009B1000-0x00000000009DF000-memory.dmp

Download

memory/2148-2600-0x00000000009B0000-0x0000000000E75000-memory.dmp

Download

memory/2148-2594-0x00000000009B0000-0x0000000000E75000-memory.dmp

Download

memory/2148-2587-0x00000000009B0000-0x0000000000E75000-memory.dmp

Download

memory/2148-1220-0x00000000009B0000-0x0000000000E75000-memory.dmp

Download

memory/3184-2614-0x00000000009B0000-0x0000000000E75000-memory.dmp

Download

memory/3184-2612-0x00000000009B0000-0x0000000000E75000-memory.dmp

Download

memory/3684-450-0x00000000009B0000-0x0000000000E75000-memory.dmp

Download

memory/3684-451-0x00000000009B0000-0x0000000000E75000-memory.dmp

Download

memory/4408-37-0x0000000000120000-0x00000000006B1000-memory.dmp

Download

memory/4408-434-0x0000000000120000-0x00000000006B1000-memory.dmp

Download

memory/4408-38-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Download

memory/4744-3-0x0000000000980000-0x0000000000E45000-memory.dmp

Download

memory/4744-17-0x0000000000980000-0x0000000000E45000-memory.dmp

Download

memory/4744-1-0x0000000077446000-0x0000000077448000-memory.dmp

Download

memory/4744-2-0x0000000000981000-0x00000000009AF000-memory.dmp

Download

memory/4744-0-0x0000000000980000-0x0000000000E45000-memory.dmp

Download

memory/4744-5-0x0000000000980000-0x0000000000E45000-memory.dmp

Download

memory/4904-439-0x0000000000130000-0x00000000005F5000-memory.dmp

Download

memory/4904-438-0x0000000000130000-0x00000000005F5000-memory.dmp

Download