amadey | 2f7c7831ec85bcff10f6024b2b3388526af669524bb30f34b59fd1f5fbe2cbaf

Analysis

max time kernel
149s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20240709-en
resource tags

arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
submitted
18/07/2024, 03:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2f7c7831ec85bcff10f6024b2b3388526af669524bb30f34b59fd1f5fbe2cbaf.exe
Size 1.8MB
Sample240718-eekn2atfnq
SHA256 2f7c7831ec85bcff10f6024b2b3388526af669524bb30f34b59fd1f5fbe2cbaf
MD5 f352768f97b00b30674c884750f665a9
SHA1 b3eb440ed7164f8984c20a938c5bf180210371ee
SHA512 7c8faef0102040bb32575b262313c0d6bb50e92ea9652c4a6172aaade23a94650feb773142790131cdfcbf595cec8091d7f1334545b40bc1e8f5659a65a803ac
SSDEEP 49152:EwJoseDg2Ox3+4hALK+7QE19AyGzIGwqyrNRn:Cg2OoK+7L1hSyrN
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey stealc 4dd39d funny discovery evasion spyware stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.30

Botnet

4dd39d

http://77.91.77.82

Attributes

install_dir
ad40971b6b
install_file
explorti.exe
strings_key
a434973ad22def7137dbb5e059b7081e
url_paths
/Hun4Ko/index.php

rc4.plain

Extracted

Family

stealc

Botnet

funny

http://85.28.47.30

Attributes

url_path
/920475a59bac849d.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Stealc
Stealc is an infostealer written in C++.
stealer stealc

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	2f7c7831ec85bcff10f6024b2b3388526af669524bb30f34b59fd1f5fbe2cbaf.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	IJKJDAFHJD.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 10 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	IJKJDAFHJD.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2f7c7831ec85bcff10f6024b2b3388526af669524bb30f34b59fd1f5fbe2cbaf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	2f7c7831ec85bcff10f6024b2b3388526af669524bb30f34b59fd1f5fbe2cbaf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	IJKJDAFHJD.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe

Executes dropped EXE 6 IoCs

pid	Process
1624	explorti.exe
1416	81fd831bf5.exe
3676	d831db61f5.exe
4452	IJKJDAFHJD.exe
5176	explorti.exe
2960	explorti.exe

Identifies Wine through registry keys 2 TTPs 5 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000\Software\Wine	2f7c7831ec85bcff10f6024b2b3388526af669524bb30f34b59fd1f5fbe2cbaf.exe
Key opened	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000\Software\Wine	IJKJDAFHJD.exe

Loads dropped DLL 2 IoCs

pid	Process
1416	81fd831bf5.exe
1416	81fd831bf5.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x000100000002aad8-42.dat	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs

pid	Process
4304	2f7c7831ec85bcff10f6024b2b3388526af669524bb30f34b59fd1f5fbe2cbaf.exe
1624	explorti.exe
1416	81fd831bf5.exe
1416	81fd831bf5.exe
4452	IJKJDAFHJD.exe
5176	explorti.exe
2960	explorti.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\explorti.job	2f7c7831ec85bcff10f6024b2b3388526af669524bb30f34b59fd1f5fbe2cbaf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	81fd831bf5.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	81fd831bf5.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4304	2f7c7831ec85bcff10f6024b2b3388526af669524bb30f34b59fd1f5fbe2cbaf.exe
4304	2f7c7831ec85bcff10f6024b2b3388526af669524bb30f34b59fd1f5fbe2cbaf.exe
1624	explorti.exe
1624	explorti.exe
1416	81fd831bf5.exe
1416	81fd831bf5.exe
1416	81fd831bf5.exe
1416	81fd831bf5.exe
4452	IJKJDAFHJD.exe
4452	IJKJDAFHJD.exe
5176	explorti.exe
5176	explorti.exe
2960	explorti.exe
2960	explorti.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	5204	firefox.exe
Token: SeDebugPrivilege	5204	firefox.exe
Token: SeDebugPrivilege	5204	firefox.exe
Token: SeDebugPrivilege	5204	firefox.exe
Token: SeDebugPrivilege	5204	firefox.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4304	2f7c7831ec85bcff10f6024b2b3388526af669524bb30f34b59fd1f5fbe2cbaf.exe
3676	d831db61f5.exe
3676	d831db61f5.exe
3676	d831db61f5.exe
3676	d831db61f5.exe
3676	d831db61f5.exe
3676	d831db61f5.exe
5204	firefox.exe
5204	firefox.exe
5204	firefox.exe
5204	firefox.exe
3676	d831db61f5.exe
5204	firefox.exe
5204	firefox.exe
5204	firefox.exe
5204	firefox.exe
5204	firefox.exe
5204	firefox.exe
5204	firefox.exe
5204	firefox.exe
5204	firefox.exe
5204	firefox.exe
5204	firefox.exe
5204	firefox.exe
5204	firefox.exe
5204	firefox.exe
5204	firefox.exe
5204	firefox.exe
5204	firefox.exe
3676	d831db61f5.exe
3676	d831db61f5.exe
3676	d831db61f5.exe
3676	d831db61f5.exe
3676	d831db61f5.exe
3676	d831db61f5.exe
3676	d831db61f5.exe
3676	d831db61f5.exe
3676	d831db61f5.exe
3676	d831db61f5.exe
3676	d831db61f5.exe
3676	d831db61f5.exe
3676	d831db61f5.exe
3676	d831db61f5.exe
3676	d831db61f5.exe
3676	d831db61f5.exe
3676	d831db61f5.exe
3676	d831db61f5.exe
3676	d831db61f5.exe
3676	d831db61f5.exe
3676	d831db61f5.exe
3676	d831db61f5.exe
3676	d831db61f5.exe
3676	d831db61f5.exe
3676	d831db61f5.exe
3676	d831db61f5.exe
3676	d831db61f5.exe
3676	d831db61f5.exe
3676	d831db61f5.exe
3676	d831db61f5.exe
3676	d831db61f5.exe
3676	d831db61f5.exe
3676	d831db61f5.exe
3676	d831db61f5.exe
3676	d831db61f5.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3676	d831db61f5.exe
3676	d831db61f5.exe
3676	d831db61f5.exe
3676	d831db61f5.exe
3676	d831db61f5.exe
3676	d831db61f5.exe
3676	d831db61f5.exe
3676	d831db61f5.exe
3676	d831db61f5.exe
3676	d831db61f5.exe
3676	d831db61f5.exe
3676	d831db61f5.exe
3676	d831db61f5.exe
3676	d831db61f5.exe
3676	d831db61f5.exe
3676	d831db61f5.exe
3676	d831db61f5.exe
3676	d831db61f5.exe
3676	d831db61f5.exe
3676	d831db61f5.exe
3676	d831db61f5.exe
3676	d831db61f5.exe
3676	d831db61f5.exe
3676	d831db61f5.exe
3676	d831db61f5.exe
3676	d831db61f5.exe
3676	d831db61f5.exe
3676	d831db61f5.exe
3676	d831db61f5.exe
3676	d831db61f5.exe
3676	d831db61f5.exe
3676	d831db61f5.exe
3676	d831db61f5.exe
3676	d831db61f5.exe
3676	d831db61f5.exe
3676	d831db61f5.exe
3676	d831db61f5.exe
3676	d831db61f5.exe
3676	d831db61f5.exe
3676	d831db61f5.exe
3676	d831db61f5.exe
3676	d831db61f5.exe
3676	d831db61f5.exe
3676	d831db61f5.exe
3676	d831db61f5.exe
3676	d831db61f5.exe
3676	d831db61f5.exe
3676	d831db61f5.exe
3676	d831db61f5.exe
3676	d831db61f5.exe
3676	d831db61f5.exe
3676	d831db61f5.exe
3676	d831db61f5.exe
3676	d831db61f5.exe
3676	d831db61f5.exe
3676	d831db61f5.exe
3676	d831db61f5.exe
3676	d831db61f5.exe
3676	d831db61f5.exe
3676	d831db61f5.exe
3676	d831db61f5.exe
3676	d831db61f5.exe
3676	d831db61f5.exe
3676	d831db61f5.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1416	81fd831bf5.exe
5204	firefox.exe
1924	cmd.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4304 wrote to memory of 1624	4304	2f7c7831ec85bcff10f6024b2b3388526af669524bb30f34b59fd1f5fbe2cbaf.exe	82
PID 4304 wrote to memory of 1624	4304	2f7c7831ec85bcff10f6024b2b3388526af669524bb30f34b59fd1f5fbe2cbaf.exe	82
PID 4304 wrote to memory of 1624	4304	2f7c7831ec85bcff10f6024b2b3388526af669524bb30f34b59fd1f5fbe2cbaf.exe	82
PID 1624 wrote to memory of 1416	1624	explorti.exe	83
PID 1624 wrote to memory of 1416	1624	explorti.exe	83
PID 1624 wrote to memory of 1416	1624	explorti.exe	83
PID 1624 wrote to memory of 3676	1624	explorti.exe	84
PID 1624 wrote to memory of 3676	1624	explorti.exe	84
PID 1624 wrote to memory of 3676	1624	explorti.exe	84
PID 3676 wrote to memory of 3756	3676	d831db61f5.exe	85
PID 3676 wrote to memory of 3756	3676	d831db61f5.exe	85
PID 3756 wrote to memory of 5204	3756	firefox.exe	88
PID 3756 wrote to memory of 5204	3756	firefox.exe	88
PID 3756 wrote to memory of 5204	3756	firefox.exe	88
PID 3756 wrote to memory of 5204	3756	firefox.exe	88
PID 3756 wrote to memory of 5204	3756	firefox.exe	88
PID 3756 wrote to memory of 5204	3756	firefox.exe	88
PID 3756 wrote to memory of 5204	3756	firefox.exe	88
PID 3756 wrote to memory of 5204	3756	firefox.exe	88
PID 3756 wrote to memory of 5204	3756	firefox.exe	88
PID 3756 wrote to memory of 5204	3756	firefox.exe	88
PID 3756 wrote to memory of 5204	3756	firefox.exe	88
PID 5204 wrote to memory of 4756	5204	firefox.exe	89
PID 5204 wrote to memory of 4756	5204	firefox.exe	89
PID 5204 wrote to memory of 4756	5204	firefox.exe	89
PID 5204 wrote to memory of 4756	5204	firefox.exe	89
PID 5204 wrote to memory of 4756	5204	firefox.exe	89
PID 5204 wrote to memory of 4756	5204	firefox.exe	89
PID 5204 wrote to memory of 4756	5204	firefox.exe	89
PID 5204 wrote to memory of 4756	5204	firefox.exe	89
PID 5204 wrote to memory of 4756	5204	firefox.exe	89
PID 5204 wrote to memory of 4756	5204	firefox.exe	89
PID 5204 wrote to memory of 4756	5204	firefox.exe	89
PID 5204 wrote to memory of 4756	5204	firefox.exe	89
PID 5204 wrote to memory of 4756	5204	firefox.exe	89
PID 5204 wrote to memory of 4756	5204	firefox.exe	89
PID 5204 wrote to memory of 4756	5204	firefox.exe	89
PID 5204 wrote to memory of 4756	5204	firefox.exe	89
PID 5204 wrote to memory of 4756	5204	firefox.exe	89
PID 5204 wrote to memory of 4756	5204	firefox.exe	89
PID 5204 wrote to memory of 4756	5204	firefox.exe	89
PID 5204 wrote to memory of 4756	5204	firefox.exe	89
PID 5204 wrote to memory of 4756	5204	firefox.exe	89
PID 5204 wrote to memory of 4756	5204	firefox.exe	89
PID 5204 wrote to memory of 4756	5204	firefox.exe	89
PID 5204 wrote to memory of 4756	5204	firefox.exe	89
PID 5204 wrote to memory of 4756	5204	firefox.exe	89
PID 5204 wrote to memory of 4756	5204	firefox.exe	89
PID 5204 wrote to memory of 4756	5204	firefox.exe	89
PID 5204 wrote to memory of 4756	5204	firefox.exe	89
PID 5204 wrote to memory of 4756	5204	firefox.exe	89
PID 5204 wrote to memory of 4756	5204	firefox.exe	89
PID 5204 wrote to memory of 4756	5204	firefox.exe	89
PID 5204 wrote to memory of 4756	5204	firefox.exe	89
PID 5204 wrote to memory of 4756	5204	firefox.exe	89
PID 5204 wrote to memory of 4756	5204	firefox.exe	89
PID 5204 wrote to memory of 4756	5204	firefox.exe	89
PID 5204 wrote to memory of 4756	5204	firefox.exe	89
PID 5204 wrote to memory of 4756	5204	firefox.exe	89
PID 5204 wrote to memory of 4756	5204	firefox.exe	89
PID 5204 wrote to memory of 4756	5204	firefox.exe	89
PID 5204 wrote to memory of 4756	5204	firefox.exe	89
PID 5204 wrote to memory of 4756	5204	firefox.exe	89
PID 5204 wrote to memory of 4756	5204	firefox.exe	89

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2f7c7831ec85bcff10f6024b2b3388526af669524bb30f34b59fd1f5fbe2cbaf.exe
"C:\Users\Admin\AppData\Local\Temp\2f7c7831ec85bcff10f6024b2b3388526af669524bb30f34b59fd1f5fbe2cbaf.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4304
- C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
  "C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1624
- - C:\Users\Admin\AppData\Local\Temp\1000006001\81fd831bf5.exe
    "C:\Users\Admin\AppData\Local\Temp\1000006001\81fd831bf5.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:1416
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\IJKJDAFHJD.exe"
      4⤵
      PID:5172
    - - C:\Users\Admin\AppData\Local\Temp\IJKJDAFHJD.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IJKJDAFHJD.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        
        PID:4452
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\JDHJKKFBAE.exe"
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:1924
- - C:\Users\Admin\AppData\Local\Temp\1000011001\d831db61f5.exe
    "C:\Users\Admin\AppData\Local\Temp\1000011001\d831db61f5.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:3676
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3756
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
        5⤵
        Checks processor information in registry
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:5204
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2000 -parentBuildID 20240401114208 -prefsHandle 1916 -prefMapHandle 1412 -prefsLen 25751 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b46d1503-f901-4fd0-bcc0-cbb8f0d8bcd2} 5204 "\\.\pipe\gecko-crash-server-pipe.5204" gpu
        6⤵
        
        PID:4756
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2412 -parentBuildID 20240401114208 -prefsHandle 2344 -prefMapHandle 2316 -prefsLen 26671 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1cd25805-382f-4168-99ed-64e65be098bb} 5204 "\\.\pipe\gecko-crash-server-pipe.5204" socket
        6⤵
        
        PID:2240
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1528 -childID 1 -isForBrowser -prefsHandle 2860 -prefMapHandle 3100 -prefsLen 22698 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {64401383-b6bd-4eea-830f-d0bc58a1592e} 5204 "\\.\pipe\gecko-crash-server-pipe.5204" tab
        6⤵
        
        PID:5876
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2720 -childID 2 -isForBrowser -prefsHandle 3668 -prefMapHandle 3664 -prefsLen 31161 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f18cdcc5-b56f-43f9-96a9-aae428df9e2e} 5204 "\\.\pipe\gecko-crash-server-pipe.5204" tab
        6⤵
        
        PID:3992
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4308 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4164 -prefMapHandle 4180 -prefsLen 31161 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b452f5d3-2c15-4ec8-ab17-62300df974df} 5204 "\\.\pipe\gecko-crash-server-pipe.5204" utility
        6⤵
        Checks processor information in registry
        
        PID:1988
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5200 -childID 3 -isForBrowser -prefsHandle 5264 -prefMapHandle 5604 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f82b269b-a475-43e6-8274-7e11b6ceb694} 5204 "\\.\pipe\gecko-crash-server-pipe.5204" tab
        6⤵
        
        PID:3528
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5720 -childID 4 -isForBrowser -prefsHandle 5800 -prefMapHandle 5796 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1704c5e5-a563-4dd6-a6b2-69b931bad6f9} 5204 "\\.\pipe\gecko-crash-server-pipe.5204" tab
        6⤵
        
        PID:3696
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5904 -childID 5 -isForBrowser -prefsHandle 5916 -prefMapHandle 5924 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {938f0b53-4d03-4a76-82f3-3dd8122b2572} 5204 "\\.\pipe\gecko-crash-server-pipe.5204" tab
        6⤵
        
        PID:1528

C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5176

C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mozglue.dll

Path C:\ProgramData\mozglue.dll
Size 593KB
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
SSDEEP 12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5 SHA1 SHA512 SSDEEP

Submit Download

nss3.dll

Path C:\ProgramData\nss3.dll
Size 2.0MB
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
SSDEEP 49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5 SHA1 SHA512 SSDEEP

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\tu0k8f5w.default-release\activity-stream.discovery_stream.json
Size 18KB
SHA256 905f77770904ea6cd6892091da9b4fb42ee746f4f691594f0683cda2d1a85e66
MD5 c17b5254da6521de11978bc3fd55aafd
SHA1 12768bbfc80fa572b67e1d215ae10e7ed0771c29
SHA512 778f97286974dc9dbd342a818a5d0e1da3991e6fd85ddda9f8091f2a538ceb9d9b2f2f741e9dc88580c52449eeb820e1bc93c7860d7a2816e208036f300b4840
SSDEEP 384:VSv0ACMvYAUp+/AZ3ruK+hjTkcJBxQZBup9l6B/OwmGvybHfsJTu10byaE:VC5bUplZ3qK+hjTfCup/kJmG2/10yp
MD5 SHA1 SHA512 SSDEEP

Submit Download

8A2034D325DC0B5C9E11EDDA3FC70A54C8DC1C0D

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\tu0k8f5w.default-release\cache2\entries\8A2034D325DC0B5C9E11EDDA3FC70A54C8DC1C0D
Size 13KB
SHA256 21a3c7384809559ba4b170edaa3aa0258049764228213faa2279db387400d146
MD5 9b51516fa8f50c91f66e61d487300cc4
SHA1 889c751c06f6d54a23bf697937e2c96c8016f0e7
SHA512 9eae29193bae40a67c965e673df41a5c240fd3bed9c382bb46659c715182a2ae830a71b349f7269f0f5830df61bff431c1c49545d687a81f8d1b836e34451994
SSDEEP 384:H485u9fiGLm4pUdft2WlOX8lPLZZB7t0lpDII8jKjG:nUBi8mCUdft2WAX8tzB7eD8F
MD5 SHA1 SHA512 SSDEEP

Submit Download

81fd831bf5.exe

Path C:\Users\Admin\AppData\Local\Temp\1000006001\81fd831bf5.exe
Size 1.1MB
SHA256 383442ecd4bff5dc709ad467a2852d0a7cb79c38c09b1f3e612bacfaa0ceb92f
MD5 4367b1db8ee57c606a7a8f12c153f876
SHA1 6715acb953b6ebc65727c8fa4490a6d62f86e7c9
SHA512 34cb861515577cf61f1c30db2f1f5aa4dc4037f68784bd0fbbe8464833b90c1fdc552bb5cf0914a905b31f5e8e3ee495d2611db03818a1df7bcce383fb20b3c1
SSDEEP 24576:rPt6GHkSUG0EZnwiOjAFf+RjHG+m7FKAcFUvNiool/:J7HkSUG1ZnEsp+RjHG+AMAkUvN
MD5 SHA1 SHA512 SSDEEP

Submit Download

d831db61f5.exe

Path C:\Users\Admin\AppData\Local\Temp\1000011001\d831db61f5.exe
Size 1.2MB
SHA256 5c532ce3a19c215499234cb74ba6bf68acea6302040ec273863f8f70ad4784e1
MD5 7efcc2ca8a685652a8fe08ca189555cf
SHA1 8274a92bdb4104cfe63af5121af9f545fd19f67c
SHA512 e471cd76a485c4a5e849009a440a759c71878bd9c38328ef4329fc0a3062c93c3fe403deb96ec9782b22f759fb9469ecb103078892a09fc3eb01e59bada52962
SSDEEP 24576:hqDEvCTbMWu7rQYlBQcBiT6rprG8aLf2Sbly7TWEPje:hTvC/MTQYxsWR7aLf2dW
MD5 SHA1 SHA512 SSDEEP

Submit Download

explorti.exe

Path C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
Size 1.8MB
SHA256 2f7c7831ec85bcff10f6024b2b3388526af669524bb30f34b59fd1f5fbe2cbaf
MD5 f352768f97b00b30674c884750f665a9
SHA1 b3eb440ed7164f8984c20a938c5bf180210371ee
SHA512 7c8faef0102040bb32575b262313c0d6bb50e92ea9652c4a6172aaade23a94650feb773142790131cdfcbf595cec8091d7f1334545b40bc1e8f5659a65a803ac
SSDEEP 49152:EwJoseDg2Ox3+4hALK+7QE19AyGzIGwqyrNRn:Cg2OoK+7L1hSyrN
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 479KB
SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
MD5 09372174e83dbbf696ee732fd2e875bb
SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 13.8MB
SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
MD5 0a8747a2ac9ac08ae9508f36c6d75692
SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tu0k8f5w.default-release\AlternateServices.bin
Size 12KB
SHA256 6067b5cb1a9506bbdf3217fd4993d357907e27ba3aaef0c09562499523bf75e6
MD5 c69ae6f5544357bac7aaa5af976b2969
SHA1 230e2e797736e99db45c894f5b68c1bf9facc6dd
SHA512 d02a359cd54d73e4093c58cc0b7aa863b7c6b751856bf69947b70c0948cae54695c1734d838e70859e329bbca6d207c97ceb96463f77a7f6ebae59d651a1db07
SSDEEP 96:ZJ5oy5pqsebOJEb74Jpebvpf+EbL9bJb62gbgzdbu0blb:r5S0u
MD5 SHA1 SHA512 SSDEEP

Submit Download

cookies.sqlite-wal

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tu0k8f5w.default-release\cookies.sqlite-wal
Size 192KB
SHA256 8a6fcb4059d9f889858f3ad5c0008f19f4089049e8cb36c479e740b49174e9d5
MD5 23f06eba6536ef592c08166edcbd9354
SHA1 bd1cc1348c79e1944c35d3e9720433ed03af3843
SHA512 2fb14327acd3247afff363e2f733107948a9a5bcffefef84cd46440cd3198bfcd0a7726946d73325b7daece192dc20732e60d9f377cb11589210bc05f940dc8e
SSDEEP 24:KCGa0J4Kt62rqIJGa00cO+neWokam62rqIJGa0hcoVHoGUh+G:fG0x2rdGe9+eWoks2rdGPco5oGUh+G
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tu0k8f5w.default-release\datareporting\glean\db\data.safe.tmp
Size 26KB
SHA256 db152ad2f1df010bfd167d4337cd5c20d9f9fccb2b1d0b9d6f7c38186d0debe9
MD5 2b6c15c731595c55395e6b4e51e991b3
SHA1 e8fea572c7028e3ef268ba0dec69dd921832c7ea
SHA512 aec5dedb50f4f71d243ddb2a7f1f5883f8613d1b71e126cfdad95c07e9abb85dd29307a78984c1caf0fd0488674d9768931a1e0c8761e98f9d92c9e9664af578
SSDEEP 768:umnCS9d7AYVbD8F/3438/mPUbKbObnbZbsb6bzbkbNewgPnYaIb:b9dEYvewgPnYaIb
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tu0k8f5w.default-release\datareporting\glean\db\data.safe.tmp
Size 26KB
SHA256 e199578ab662a1625fea110ae63d94fbf56b263bdbbee0e2792a479a48f4c7df
MD5 5fb0c064faddef680aec330e1eb21793
SHA1 3b0702c7ed3504558f6a287b3b91148d49464f08
SHA512 df9a2862f92adcb1c7981d23727995ac503f02ed25fcba876a375cec0c257941681312beed61bba457481b4507809e1102d2ae5598d0bdff060a2448ec937972
SSDEEP 768:v9d7AYVbD8F/3438/mPUbKbObnbZbsb6bzbkbNewgPnYaI/mnwj:v9dEYvewgPnYaIb
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tu0k8f5w.default-release\datareporting\glean\db\data.safe.tmp
Size 23KB
SHA256 026b4ece4011e71dd96ac61d574a7c8ab492063a0719c0df4222ebf7f7e7768c
MD5 bbe0c54d42663a01af77569bf39e2ae1
SHA1 accbb1042169ebe042fad30a6d0d7fef99b1e483
SHA512 abb0eefb0dd34b63623726f42a93a733490b66af39ce87f41ee3d14346dc09cbdcc1ac31355c104ecef61f058e0448a5db0ec377b02c70d37deb7c107b3e5d96
SSDEEP 384:q8Wiv/0akFKbP8FOM438/mLibKbObqbmbsb6bzbkb9MbLjS3KvovJbop3Pk/66Jw:9We/pk6P8FOM438/mLibKbObqbmbsb6d
MD5 SHA1 SHA512 SSDEEP

Submit Download

a8a5b5c5-c8f2-4cfd-8016-7f9c31934894

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tu0k8f5w.default-release\datareporting\glean\pending_pings\a8a5b5c5-c8f2-4cfd-8016-7f9c31934894
Size 659B
SHA256 ffe112817d2923099538e954d876bf33c49b6f0067f0c993d2286b2ab8cad4fa
MD5 ee0193044468b5eb4ce7f80444259574
SHA1 11e8f8fe58f1bb49115e3c5113cf689a7edd3da2
SHA512 e4c9a25023dec0cafe9f4d6e7d858e807cf9fbce18916c38de87dcc27539dcc63d3019a7c2b6a622bd8ec0ad96b546444ff4fa5b2071c3d7281cb10663f62916
MD5 SHA1 SHA512

Submit Download

c09e6aef-645b-4e84-bcf2-5da9361de971

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tu0k8f5w.default-release\datareporting\glean\pending_pings\c09e6aef-645b-4e84-bcf2-5da9361de971
Size 982B
SHA256 f3f2a31fb40c862699bb499878f58fca6347c624a31d37efe3449890940212ef
MD5 44ea489cfa7366d8df9ed5119a6ae128
SHA1 8c5f3db99ba886165544abed250cfe5e0aa4a448
SHA512 ab635ad855f4831f767c8357f0c767cc0938abdb5ddcb00f236e66131830efa09cd70e927e0f196ecba5da81e609644260a97e0c336f234abd074e05bc1ac2d5
MD5 SHA1 SHA512

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tu0k8f5w.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Size 1.1MB
SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
MD5 842039753bf41fa5e11b3a1383061a87
SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tu0k8f5w.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Size 116B
SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
MD5 2a461e9eb87fd1955cea740a3444ee7a
SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tu0k8f5w.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Size 372B
SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
MD5 bf957ad58b55f64219ab3f793e374316
SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tu0k8f5w.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Size 17.8MB
SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
MD5 daf7ef3acccab478aaa7d6dc1c60f865
SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
MD5 SHA1 SHA512 SSDEEP

Submit Download

places.sqlite-wal

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tu0k8f5w.default-release\places.sqlite-wal
Size 992KB
SHA256 97aa0e86df0ec2301e921d966a37fcc05e0c9ebbb587664ba7b87e32b4552aed
MD5 8ae618e76acfe3c5332e1f602ef3574a
SHA1 9c2d8b35d4acbb5db5ff8f91d77c2840754d1dfc
SHA512 6c1df26bcb9cbebda2f5e89bbb9c7ce1d07b4aa87784a6ca37d809e4d46ff915df2a4dd5c528ee876803a2654a84bf1deacaf2aade408c0b6a5d3bf8a0e19efb
SSDEEP 192:KWdQpCBa05Oggx/ZWdQ8hKCY9DfheoHEx/xYWdQn:K2yqgr2wCSpAw2G
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tu0k8f5w.default-release\prefs-1.js
Size 13KB
SHA256 12822cfa24424b12e6862070a472572756dc0d66b203dad14204136fe3731be1
MD5 1d6f6b68ed2e293e8fbba4baaa18e3e0
SHA1 c253df1ef8803ae3af46b18286cd747c799d5090
SHA512 07585eccbf4675fe307f944764ff3bb076723728c6bdbba0d846fdecdbebdd286926e0289732c406a16c849db75d2ba7eaccdf38608237f00368a3fec3883462
SSDEEP 192:G5nu2RUfpjXC7sN8m+zmONEcd8wdzd1xQHrSO60kaXZd4uIxnBw8HvApc:VasNWzmONpaIzfxQLSNIdVGwOAy
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tu0k8f5w.default-release\prefs-1.js
Size 16KB
SHA256 43359037bd68628178763ffc869065c267484258f113b1e423262dacbfbb850e
MD5 456411f0b52c3ad5eae1ea14b478dbab
SHA1 850e083d0a726e57b23e77dcd8ae7ade4e1e2a93
SHA512 9540e0b8c3177917a1a1d6f08b7cfb15e704e5bdd3861a2df080d9a1181aced746f34960410f83de60ea46bb3d5ab4807910d8fbd9de67635c7ebaae25568bd3
SSDEEP 192:G6nu2RUfjjXC7sN8m+zmONEcd8wdzd1xQHrSO60kaXT+d4uIxziBw8HvgMqTJG:SIsNWzmONpaIzfxQLSN1dVZwOhD
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tu0k8f5w.default-release\prefs.js
Size 11KB
SHA256 dea2778f280d59ad90a0e380586d76c55ae9382d773fd873cd8851412355b182
MD5 e60491e1cf584f506735c66af37f4c7d
SHA1 66689f4a8cf3f454ad3cc42d6f8604fefabbea3f
SHA512 fde3d9cdf32dd62bf5c736b71d6743dd35b7bc20accb26c902a91dd613c8c89b6445a52c6b897757c9b0a87c2765d335a173882534f6e68cca279d221df9f591
SSDEEP 192:A5nu2RUfpjXC7sN8m+zmONEcd8wdzd1xQHrSO60kaXZd4uIxEBw8Hw:7asNWzmONpaIzfxQLSNIdVXwd
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tu0k8f5w.default-release\prefs.js
Size 8KB
SHA256 e8a5875acebe3740b98544d34312e7f1855c4923951237345ec6d984f7d62ed7
MD5 308edbd778776726e545c2e34b1ef4ac
SHA1 4deb416bee6a59dc64f63e050c316f5f86e0aebb
SHA512 cdecbca2c92b91c4336d8e50954db48aafe4926cc8b7cc53b1fc25420273c1060c7596b4ad5ebcc3533fd2fa374e467dd55307dd854c2981f7367d9b30e4281a
SSDEEP 192:A5nu2RUfpEnGxUcdzky60zEGaXId4uIxEBw8Vw:7Lx5yxOdVXwz
MD5 SHA1 SHA512 SSDEEP

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tu0k8f5w.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 9.4MB
SHA256 785a94db0103494fef6038ddee12e24b106dbfe3814ce6e53887dea94828a47b
MD5 69c379aba8454bdb4271f4fef829c141
SHA1 3300834f3efa043d267348948489484abc51b312
SHA512 9f0a261269854d9efaea9337e8d2ade15f426524bf90f4a567a975ca1c435aa5b8aabfcab64cdb931ebcb4411a96609003952d283e51258f28de101fabdb7261
SSDEEP 49152:yOC5WhiDNezybOxlURixiN0dlwMp+fdNZqjXaLTgAbdyP429TXse0Vedkfl1gYH7:a26
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1416-37-0x0000000000250000-0x00000000007E1000-memory.dmp

Download

memory/1416-56-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Download

memory/1416-447-0x0000000000250000-0x00000000007E1000-memory.dmp

Download

memory/1416-450-0x0000000000250000-0x00000000007E1000-memory.dmp

Download

memory/1624-2357-0x00000000004B0000-0x0000000000959000-memory.dmp

Download

memory/1624-2638-0x00000000004B0000-0x0000000000959000-memory.dmp

Download

memory/1624-470-0x00000000004B0000-0x0000000000959000-memory.dmp

Download

memory/1624-471-0x00000000004B0000-0x0000000000959000-memory.dmp

Download

memory/1624-476-0x00000000004B0000-0x0000000000959000-memory.dmp

Download

memory/1624-2654-0x00000000004B0000-0x0000000000959000-memory.dmp

Download

memory/1624-21-0x00000000004B0000-0x0000000000959000-memory.dmp

Download

memory/1624-20-0x00000000004B0000-0x0000000000959000-memory.dmp

Download

memory/1624-19-0x00000000004B0000-0x0000000000959000-memory.dmp

Download

memory/1624-18-0x00000000004B0000-0x0000000000959000-memory.dmp

Download

memory/1624-2653-0x00000000004B0000-0x0000000000959000-memory.dmp

Download

memory/1624-2647-0x00000000004B0000-0x0000000000959000-memory.dmp

Download

memory/1624-2646-0x00000000004B0000-0x0000000000959000-memory.dmp

Download

memory/1624-2642-0x00000000004B0000-0x0000000000959000-memory.dmp

Download

memory/1624-2641-0x00000000004B0000-0x0000000000959000-memory.dmp

Download

memory/1624-2640-0x00000000004B0000-0x0000000000959000-memory.dmp

Download

memory/1624-467-0x00000000004B0000-0x0000000000959000-memory.dmp

Download

memory/1624-791-0x00000000004B0000-0x0000000000959000-memory.dmp

Download

memory/1624-2632-0x00000000004B0000-0x0000000000959000-memory.dmp

Download

memory/1624-443-0x00000000004B0000-0x0000000000959000-memory.dmp

Download

memory/2960-2644-0x00000000004B0000-0x0000000000959000-memory.dmp

Download

memory/2960-2645-0x00000000004B0000-0x0000000000959000-memory.dmp

Download

memory/4304-0-0x00000000006D0000-0x0000000000B79000-memory.dmp

Download

memory/4304-1-0x0000000077036000-0x0000000077038000-memory.dmp

Download

memory/4304-2-0x00000000006D1000-0x00000000006FF000-memory.dmp

Download

memory/4304-3-0x00000000006D0000-0x0000000000B79000-memory.dmp

Download

memory/4304-5-0x00000000006D0000-0x0000000000B79000-memory.dmp

Download

memory/4304-17-0x00000000006D0000-0x0000000000B79000-memory.dmp

Download

memory/4452-454-0x00000000000B0000-0x0000000000559000-memory.dmp

Download

memory/4452-460-0x00000000000B0000-0x0000000000559000-memory.dmp

Download

memory/5176-954-0x00000000004B0000-0x0000000000959000-memory.dmp

Download

memory/5176-792-0x00000000004B0000-0x0000000000959000-memory.dmp

Download