amadey | 78e2f38bb4be0a9d28529d34db464229b16af7916b00a657091a3213f03841f5

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20240709-en
resource tags

arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
submitted
18/07/2024, 04:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
78e2f38bb4be0a9d28529d34db464229b16af7916b00a657091a3213f03841f5.exe
Size 1.8MB
Sample240718-ffkk4awark
SHA256 78e2f38bb4be0a9d28529d34db464229b16af7916b00a657091a3213f03841f5
MD5 54d07c23819cdec1b8c2ae9ae6dcd414
SHA1 f255a1274e674f27c7160c3066b6c82501fab4db
SHA512 86b0582a9e9912a0266a50c2546233a5807a55973ff20ec6f70c50e005d2db7fc034e00a6e7e042d43eab397230ff1bcf97a10c4c74a9dea9058a3b91325258e
SSDEEP 49152:MFW07vtswESO9dCFjPpXnLwwqklLVbhYe:MHT+96jP9nZdX
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey stealc 4dd39d funny discovery evasion spyware stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.30

Botnet

4dd39d

http://77.91.77.82

Attributes

install_dir
ad40971b6b
install_file
explorti.exe
strings_key
a434973ad22def7137dbb5e059b7081e
url_paths
/Hun4Ko/index.php

rc4.plain

Extracted

Family

stealc

Botnet

funny

http://85.28.47.30

Attributes

url_path
/920475a59bac849d.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Stealc
Stealc is an infostealer written in C++.
stealer stealc

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	78e2f38bb4be0a9d28529d34db464229b16af7916b00a657091a3213f03841f5.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	KECBFBAEBK.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 12 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	KECBFBAEBK.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	78e2f38bb4be0a9d28529d34db464229b16af7916b00a657091a3213f03841f5.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	KECBFBAEBK.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	78e2f38bb4be0a9d28529d34db464229b16af7916b00a657091a3213f03841f5.exe

Executes dropped EXE 7 IoCs

pid	Process
3220	explorti.exe
484	explorti.exe
4384	b0977837f7.exe
4860	05ba5940dd.exe
4828	KECBFBAEBK.exe
5308	explorti.exe
3288	explorti.exe

Identifies Wine through registry keys 2 TTPs 6 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3866437728-1832012455-4133739663-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-3866437728-1832012455-4133739663-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-3866437728-1832012455-4133739663-1000\Software\Wine	78e2f38bb4be0a9d28529d34db464229b16af7916b00a657091a3213f03841f5.exe
Key opened	\REGISTRY\USER\S-1-5-21-3866437728-1832012455-4133739663-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-3866437728-1832012455-4133739663-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-3866437728-1832012455-4133739663-1000\Software\Wine	KECBFBAEBK.exe

Loads dropped DLL 2 IoCs

pid	Process
4384	b0977837f7.exe
4384	b0977837f7.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x000100000002aaa7-47.dat	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs

pid	Process
1908	78e2f38bb4be0a9d28529d34db464229b16af7916b00a657091a3213f03841f5.exe
3220	explorti.exe
484	explorti.exe
4384	b0977837f7.exe
4384	b0977837f7.exe
4828	KECBFBAEBK.exe
5308	explorti.exe
3288	explorti.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\explorti.job	78e2f38bb4be0a9d28529d34db464229b16af7916b00a657091a3213f03841f5.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	b0977837f7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	b0977837f7.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3866437728-1832012455-4133739663-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
1908	78e2f38bb4be0a9d28529d34db464229b16af7916b00a657091a3213f03841f5.exe
1908	78e2f38bb4be0a9d28529d34db464229b16af7916b00a657091a3213f03841f5.exe
3220	explorti.exe
3220	explorti.exe
484	explorti.exe
484	explorti.exe
4384	b0977837f7.exe
4384	b0977837f7.exe
4384	b0977837f7.exe
4384	b0977837f7.exe
4828	KECBFBAEBK.exe
4828	KECBFBAEBK.exe
5308	explorti.exe
5308	explorti.exe
3288	explorti.exe
3288	explorti.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1188	firefox.exe
Token: SeDebugPrivilege	1188	firefox.exe
Token: SeDebugPrivilege	1188	firefox.exe
Token: SeDebugPrivilege	1188	firefox.exe
Token: SeDebugPrivilege	1188	firefox.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4860	05ba5940dd.exe
4860	05ba5940dd.exe
4860	05ba5940dd.exe
4860	05ba5940dd.exe
4860	05ba5940dd.exe
4860	05ba5940dd.exe
1188	firefox.exe
1188	firefox.exe
1188	firefox.exe
1188	firefox.exe
4860	05ba5940dd.exe
1188	firefox.exe
1188	firefox.exe
1188	firefox.exe
1188	firefox.exe
1188	firefox.exe
1188	firefox.exe
1188	firefox.exe
1188	firefox.exe
1188	firefox.exe
1188	firefox.exe
1188	firefox.exe
1188	firefox.exe
1188	firefox.exe
1188	firefox.exe
1188	firefox.exe
1188	firefox.exe
1188	firefox.exe
4860	05ba5940dd.exe
4860	05ba5940dd.exe
4860	05ba5940dd.exe
4860	05ba5940dd.exe
4860	05ba5940dd.exe
4860	05ba5940dd.exe
4860	05ba5940dd.exe
4860	05ba5940dd.exe
4860	05ba5940dd.exe
4860	05ba5940dd.exe
4860	05ba5940dd.exe
4860	05ba5940dd.exe
4860	05ba5940dd.exe
4860	05ba5940dd.exe
4860	05ba5940dd.exe
4860	05ba5940dd.exe
4860	05ba5940dd.exe
4860	05ba5940dd.exe
4860	05ba5940dd.exe
4860	05ba5940dd.exe
4860	05ba5940dd.exe
4860	05ba5940dd.exe
4860	05ba5940dd.exe
4860	05ba5940dd.exe
4860	05ba5940dd.exe
4860	05ba5940dd.exe
4860	05ba5940dd.exe
4860	05ba5940dd.exe
4860	05ba5940dd.exe
4860	05ba5940dd.exe
4860	05ba5940dd.exe
4860	05ba5940dd.exe
4860	05ba5940dd.exe
4860	05ba5940dd.exe
4860	05ba5940dd.exe
4860	05ba5940dd.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4860	05ba5940dd.exe
4860	05ba5940dd.exe
4860	05ba5940dd.exe
4860	05ba5940dd.exe
4860	05ba5940dd.exe
4860	05ba5940dd.exe
4860	05ba5940dd.exe
4860	05ba5940dd.exe
4860	05ba5940dd.exe
4860	05ba5940dd.exe
4860	05ba5940dd.exe
4860	05ba5940dd.exe
4860	05ba5940dd.exe
4860	05ba5940dd.exe
4860	05ba5940dd.exe
4860	05ba5940dd.exe
4860	05ba5940dd.exe
4860	05ba5940dd.exe
4860	05ba5940dd.exe
4860	05ba5940dd.exe
4860	05ba5940dd.exe
4860	05ba5940dd.exe
4860	05ba5940dd.exe
4860	05ba5940dd.exe
4860	05ba5940dd.exe
4860	05ba5940dd.exe
4860	05ba5940dd.exe
4860	05ba5940dd.exe
4860	05ba5940dd.exe
4860	05ba5940dd.exe
4860	05ba5940dd.exe
4860	05ba5940dd.exe
4860	05ba5940dd.exe
4860	05ba5940dd.exe
4860	05ba5940dd.exe
4860	05ba5940dd.exe
4860	05ba5940dd.exe
4860	05ba5940dd.exe
4860	05ba5940dd.exe
4860	05ba5940dd.exe
4860	05ba5940dd.exe
4860	05ba5940dd.exe
4860	05ba5940dd.exe
4860	05ba5940dd.exe
4860	05ba5940dd.exe
4860	05ba5940dd.exe
4860	05ba5940dd.exe
4860	05ba5940dd.exe
4860	05ba5940dd.exe
4860	05ba5940dd.exe
4860	05ba5940dd.exe
4860	05ba5940dd.exe
4860	05ba5940dd.exe
4860	05ba5940dd.exe
4860	05ba5940dd.exe
4860	05ba5940dd.exe
4860	05ba5940dd.exe
4860	05ba5940dd.exe
4860	05ba5940dd.exe
4860	05ba5940dd.exe
4860	05ba5940dd.exe
4860	05ba5940dd.exe
4860	05ba5940dd.exe
4860	05ba5940dd.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4384	b0977837f7.exe
1188	firefox.exe
3196	cmd.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1908 wrote to memory of 3220	1908	78e2f38bb4be0a9d28529d34db464229b16af7916b00a657091a3213f03841f5.exe	82
PID 1908 wrote to memory of 3220	1908	78e2f38bb4be0a9d28529d34db464229b16af7916b00a657091a3213f03841f5.exe	82
PID 1908 wrote to memory of 3220	1908	78e2f38bb4be0a9d28529d34db464229b16af7916b00a657091a3213f03841f5.exe	82
PID 3220 wrote to memory of 4384	3220	explorti.exe	86
PID 3220 wrote to memory of 4384	3220	explorti.exe	86
PID 3220 wrote to memory of 4384	3220	explorti.exe	86
PID 3220 wrote to memory of 4860	3220	explorti.exe	87
PID 3220 wrote to memory of 4860	3220	explorti.exe	87
PID 3220 wrote to memory of 4860	3220	explorti.exe	87
PID 4860 wrote to memory of 4112	4860	05ba5940dd.exe	88
PID 4860 wrote to memory of 4112	4860	05ba5940dd.exe	88
PID 4112 wrote to memory of 1188	4112	firefox.exe	91
PID 4112 wrote to memory of 1188	4112	firefox.exe	91
PID 4112 wrote to memory of 1188	4112	firefox.exe	91
PID 4112 wrote to memory of 1188	4112	firefox.exe	91
PID 4112 wrote to memory of 1188	4112	firefox.exe	91
PID 4112 wrote to memory of 1188	4112	firefox.exe	91
PID 4112 wrote to memory of 1188	4112	firefox.exe	91
PID 4112 wrote to memory of 1188	4112	firefox.exe	91
PID 4112 wrote to memory of 1188	4112	firefox.exe	91
PID 4112 wrote to memory of 1188	4112	firefox.exe	91
PID 4112 wrote to memory of 1188	4112	firefox.exe	91
PID 1188 wrote to memory of 4332	1188	firefox.exe	92
PID 1188 wrote to memory of 4332	1188	firefox.exe	92
PID 1188 wrote to memory of 4332	1188	firefox.exe	92
PID 1188 wrote to memory of 4332	1188	firefox.exe	92
PID 1188 wrote to memory of 4332	1188	firefox.exe	92
PID 1188 wrote to memory of 4332	1188	firefox.exe	92
PID 1188 wrote to memory of 4332	1188	firefox.exe	92
PID 1188 wrote to memory of 4332	1188	firefox.exe	92
PID 1188 wrote to memory of 4332	1188	firefox.exe	92
PID 1188 wrote to memory of 4332	1188	firefox.exe	92
PID 1188 wrote to memory of 4332	1188	firefox.exe	92
PID 1188 wrote to memory of 4332	1188	firefox.exe	92
PID 1188 wrote to memory of 4332	1188	firefox.exe	92
PID 1188 wrote to memory of 4332	1188	firefox.exe	92
PID 1188 wrote to memory of 4332	1188	firefox.exe	92
PID 1188 wrote to memory of 4332	1188	firefox.exe	92
PID 1188 wrote to memory of 4332	1188	firefox.exe	92
PID 1188 wrote to memory of 4332	1188	firefox.exe	92
PID 1188 wrote to memory of 4332	1188	firefox.exe	92
PID 1188 wrote to memory of 4332	1188	firefox.exe	92
PID 1188 wrote to memory of 4332	1188	firefox.exe	92
PID 1188 wrote to memory of 4332	1188	firefox.exe	92
PID 1188 wrote to memory of 4332	1188	firefox.exe	92
PID 1188 wrote to memory of 4332	1188	firefox.exe	92
PID 1188 wrote to memory of 4332	1188	firefox.exe	92
PID 1188 wrote to memory of 4332	1188	firefox.exe	92
PID 1188 wrote to memory of 4332	1188	firefox.exe	92
PID 1188 wrote to memory of 4332	1188	firefox.exe	92
PID 1188 wrote to memory of 4332	1188	firefox.exe	92
PID 1188 wrote to memory of 4332	1188	firefox.exe	92
PID 1188 wrote to memory of 4332	1188	firefox.exe	92
PID 1188 wrote to memory of 4332	1188	firefox.exe	92
PID 1188 wrote to memory of 4332	1188	firefox.exe	92
PID 1188 wrote to memory of 4332	1188	firefox.exe	92
PID 1188 wrote to memory of 4332	1188	firefox.exe	92
PID 1188 wrote to memory of 4332	1188	firefox.exe	92
PID 1188 wrote to memory of 4332	1188	firefox.exe	92
PID 1188 wrote to memory of 4332	1188	firefox.exe	92
PID 1188 wrote to memory of 4332	1188	firefox.exe	92
PID 1188 wrote to memory of 4332	1188	firefox.exe	92
PID 1188 wrote to memory of 4332	1188	firefox.exe	92
PID 1188 wrote to memory of 4332	1188	firefox.exe	92

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\78e2f38bb4be0a9d28529d34db464229b16af7916b00a657091a3213f03841f5.exe
"C:\Users\Admin\AppData\Local\Temp\78e2f38bb4be0a9d28529d34db464229b16af7916b00a657091a3213f03841f5.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1908
- C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
  "C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3220
- - C:\Users\Admin\AppData\Local\Temp\1000006001\b0977837f7.exe
    "C:\Users\Admin\AppData\Local\Temp\1000006001\b0977837f7.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:4384
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\KECBFBAEBK.exe"
      4⤵
      PID:2252
    - - C:\Users\Admin\AppData\Local\Temp\KECBFBAEBK.exe
        
        "C:\Users\Admin\AppData\Local\Temp\KECBFBAEBK.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        
        PID:4828
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\KKKEBKJJDG.exe"
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:3196
- - C:\Users\Admin\AppData\Local\Temp\1000011001\05ba5940dd.exe
    "C:\Users\Admin\AppData\Local\Temp\1000011001\05ba5940dd.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:4860
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4112
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
        5⤵
        Checks processor information in registry
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1188
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1992 -parentBuildID 20240401114208 -prefsHandle 1908 -prefMapHandle 1900 -prefsLen 25749 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ca76e1a0-956a-4797-b405-b8b7ab5747e4} 1188 "\\.\pipe\gecko-crash-server-pipe.1188" gpu
        6⤵
        
        PID:4332
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2412 -parentBuildID 20240401114208 -prefsHandle 2388 -prefMapHandle 2384 -prefsLen 26669 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4761814d-7fb0-4598-9f82-972bfe84929c} 1188 "\\.\pipe\gecko-crash-server-pipe.1188" socket
        6⤵
        
        PID:2856
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3016 -childID 1 -isForBrowser -prefsHandle 3104 -prefMapHandle 3136 -prefsLen 22698 -prefMapSize 244658 -jsInitHandle 1160 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {90088871-8d92-46e2-9679-6c06999fcbba} 1188 "\\.\pipe\gecko-crash-server-pipe.1188" tab
        6⤵
        
        PID:2656
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3964 -childID 2 -isForBrowser -prefsHandle 3956 -prefMapHandle 3952 -prefsLen 31159 -prefMapSize 244658 -jsInitHandle 1160 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {83759b24-9d3d-4392-9257-565be9bc072b} 1188 "\\.\pipe\gecko-crash-server-pipe.1188" tab
        6⤵
        
        PID:4276
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4728 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4720 -prefMapHandle 4808 -prefsLen 31159 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ba3a41b8-4263-409e-9b53-e9b99351cbb1} 1188 "\\.\pipe\gecko-crash-server-pipe.1188" utility
        6⤵
        Checks processor information in registry
        
        PID:5228
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5500 -childID 3 -isForBrowser -prefsHandle 5528 -prefMapHandle 5188 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1160 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {64bd8b60-7d4d-45dd-a77b-85cb429fcb25} 1188 "\\.\pipe\gecko-crash-server-pipe.1188" tab
        6⤵
        
        PID:2288
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5656 -childID 4 -isForBrowser -prefsHandle 5664 -prefMapHandle 5536 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1160 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7e43834a-579b-418c-95b4-4bcbd91174a8} 1188 "\\.\pipe\gecko-crash-server-pipe.1188" tab
        6⤵
        
        PID:832
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5848 -childID 5 -isForBrowser -prefsHandle 5856 -prefMapHandle 5860 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1160 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {15ada4e8-2118-4a3c-8d76-44d1e9fd4d41} 1188 "\\.\pipe\gecko-crash-server-pipe.1188" tab
        6⤵
        
        PID:788

C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:484

C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5308

C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3288

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mozglue.dll

Path C:\ProgramData\mozglue.dll
Size 593KB
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
SSDEEP 12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5 SHA1 SHA512 SSDEEP

Submit Download

nss3.dll

Path C:\ProgramData\nss3.dll
Size 2.0MB
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
SSDEEP 49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5 SHA1 SHA512 SSDEEP

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\t4hat1k8.default-release\activity-stream.discovery_stream.json
Size 22KB
SHA256 0686361d98bf7da1cc3ba71776306583ede69a30d37e76f1d2742abd6e1f5133
MD5 244b1e22158f4b09f45410c42f363b2a
SHA1 c013a06c14eb39ba941ad7c0ae4e8dbe48e11a47
SHA512 0fe5a85612705aab988d91d0f49a4ea352f60ebb3fbcd2cde7dbe0fe79a1599c89df03ecf5b0c89a5ab90e2676cef97c0810472858caad340581b47a40d15624
SSDEEP 384:I0ADykB+/AZ3rgS1YCcaKkT0CcKBryhm1g+OweGve9RbHfs66B7410w6yaujp/wC:ehlZ3UGcaKkT0emLyeG2bfks1YydjOAn
MD5 SHA1 SHA512 SSDEEP

Submit Download

8A2034D325DC0B5C9E11EDDA3FC70A54C8DC1C0D

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\t4hat1k8.default-release\cache2\entries\8A2034D325DC0B5C9E11EDDA3FC70A54C8DC1C0D
Size 13KB
SHA256 c0063ec32742dae87ba28b97489197104e20af693afd4f6352cfacde6b9377d9
MD5 caed24b42db0ee7a45764e3b4320ede9
SHA1 99e481b0a9a1caab060c879d173ed710a4dc2d4d
SHA512 e52d666e2e5d482b6f1fa9df811cbbd9c4d4b52687c705080e0c883d5b6ab5f34d4a7496303250fa3881e4c3c95ea18d70e6db29109db6d7c42c79c05c05a3c4
SSDEEP 384:H485u9fiGLm4pUXLft2WlOX8lPLZZB7t0lpDII1jajn:nUBi8mCU7ft2WAX8tzB7eD8p
MD5 SHA1 SHA512 SSDEEP

Submit Download

b0977837f7.exe

Path C:\Users\Admin\AppData\Local\Temp\1000006001\b0977837f7.exe
Size 1.1MB
SHA256 4268b79fc5d2b0b8336762dcde3a36fb630176c62e3096a26981815a84d37506
MD5 a28948dbe563fa7f2fa559c7a84f2c99
SHA1 d79ffb809cb0d51314a7392007df635289f175b8
SHA512 96682d9edab610a9d834a20935d4b1580c0108731c94daa4b2b96e9348eade2edbfae21962ffe8afd9f4dce2a5ec1984aae0f1d6a33ceb639326cdfaf3bdf51c
SSDEEP 24576:yhqNmSyVJqviZvoEV+bpojj7dxNMf3se3K6tr54mQgUpQC:PkvZVAoj3PNI3K6QzgI7
MD5 SHA1 SHA512 SSDEEP

Submit Download

05ba5940dd.exe

Path C:\Users\Admin\AppData\Local\Temp\1000011001\05ba5940dd.exe
Size 1.2MB
SHA256 37f4feb433dca380113a2b4a67dc5dbf70f67e31537bd94da9396af5c63f1473
MD5 7db296a5f3818d7d11d994f2a26cc6c3
SHA1 7e56f88358d914b90ee037145b14c622a52dd47b
SHA512 fb498212823d9c1b13d1179ff37bbf6fd1fe671206f3021f5418fe47814ac6ef99149cef4434c46fa438f0a73a1c73304e41bf3629c1438a7176354b0086d065
SSDEEP 24576:qqDEvCTbMWu7rQYlBQcBiT6rprG8aLo2Sbly7TWEPje:qTvC/MTQYxsWR7aLo2dW
MD5 SHA1 SHA512 SSDEEP

Submit Download

explorti.exe

Path C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
Size 1.8MB
SHA256 78e2f38bb4be0a9d28529d34db464229b16af7916b00a657091a3213f03841f5
MD5 54d07c23819cdec1b8c2ae9ae6dcd414
SHA1 f255a1274e674f27c7160c3066b6c82501fab4db
SHA512 86b0582a9e9912a0266a50c2546233a5807a55973ff20ec6f70c50e005d2db7fc034e00a6e7e042d43eab397230ff1bcf97a10c4c74a9dea9058a3b91325258e
SSDEEP 49152:MFW07vtswESO9dCFjPpXnLwwqklLVbhYe:MHT+96jP9nZdX
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 479KB
SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
MD5 09372174e83dbbf696ee732fd2e875bb
SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 13.8MB
SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
MD5 0a8747a2ac9ac08ae9508f36c6d75692
SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\t4hat1k8.default-release\AlternateServices.bin
Size 11KB
SHA256 a7d20818c66aa2e1f55161d12ffd318f646f08754634f1ec84fff46a0d6e6e11
MD5 78bfe84920175751a8cc036dc0cf01fc
SHA1 abad237ead79466a8babf2b9c7413e1aec10ab02
SHA512 48f9878bbca4e091ca88885299cdbc5e76ed811dffcdef2b35cc659492e14a954ea7cd5ee87686d3f62d3eb8372cfd2922dbe80532801fcc2ac49341f07fdcc8
SSDEEP 96:plJ5oIIsebOJObWJpebvpf+Oba9bobY2gbgzrb:N5zu
MD5 SHA1 SHA512 SSDEEP

Submit Download

cookies.sqlite-wal

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\t4hat1k8.default-release\cookies.sqlite-wal
Size 192KB
SHA256 fb3bfc8670ca9ce403f60c570527479227738d8488e8c7bf157da16f85256b83
MD5 be7dce79005ab9611027ba48e6ddfb3c
SHA1 44bb280bdb04f4a5a70acf8d277cdbcfbf9f7a66
SHA512 31c7b1edae6b69a64e95dab44adb813dfdd212a76848e75c5656a4e1e861d44b1aa5f603909b5c8edeb28eb41bb86aeb1d2f21a78d99e184dcf041cfb65cfd9a
SSDEEP 48:JGj2gz26gYGjb+xWoUjO26gYGjmo5oGUh+G:YaI26Ov+/Uq26OaoKGUh+G
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\t4hat1k8.default-release\datareporting\glean\db\data.safe.tmp
Size 16KB
SHA256 ed9e397bd845da49bf2fbffc0c4d95790a63a552b9d388263e14d7af4b428ea1
MD5 9ed965a8d893aaff44b2c91c594ef326
SHA1 e95707c824f8ecaaec7f8184bd583b3c917f9600
SHA512 2e4ad8db8b67111c68db43aaa559f59fb1bfca09c446e8fd6ae4bb906aed544a0c68c70fc0d1915ee5bc604905a3fe3c30ff722743f783e99f99fd05f54bb41c
SSDEEP 384:PjGKzF8nsED51/Mb0bGReX9kboByN6cPxpepvs/66JozQzgC1bM:bfzaDD51/Mb0bJanB/epvpmm
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\t4hat1k8.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 9d3affbd84dd77baac05b5dc9d9942aaf25edaeea59b2eb6332cca521231a891
MD5 73c4cee000cdcbbe1cec64c7a9a54786
SHA1 6fad5c638a9b7e5909c0d547173383b729a90cfc
SHA512 bac08490b7f5d7135e81215b51b99642e1a31ba841879333f786669191c12b5e23b4824ce1840e63a88aababccdd521ed9cb8403668a0993b45014f48de0e585
SSDEEP 96:3qvKQfGfxfvsFl66Joz0dzgClKtmSSkBESMF9ZbkW6QX0BBhhmlF5PP/PrWZ:Oepvs/66Joz0dzgCl6mSSjrvZboHhhgG
MD5 SHA1 SHA512 SSDEEP

Submit Download

1dcd5648-9b32-4cf5-8165-ab44ad4932dc

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\t4hat1k8.default-release\datareporting\glean\pending_pings\1dcd5648-9b32-4cf5-8165-ab44ad4932dc
Size 26KB
SHA256 5761b2a0ebbdb16f58f2af7dc8e501e55dc98ca8b9abd4c9c773e7c3276537f3
MD5 93e2d4036a78d423689508d74fe43595
SHA1 3a94a7a7bb29fb6295e9bd7d57df1312c3451844
SHA512 798f448184a2c8d88fed3750a75ee7acf1b866e3d5109dec1e40b80790dd6a451b928f41a5ec4d236baa9e2e7e850ff582c476c330912485d532b5b1518580b7
SSDEEP 384:nJ7R4mtof9A88BFi2SR7jm1SjJYvdNyKg:nJ1RtoffKMVzV
MD5 SHA1 SHA512 SSDEEP

Submit Download

987b4e45-ef88-45fd-8fcb-65c72291fbe9

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\t4hat1k8.default-release\datareporting\glean\pending_pings\987b4e45-ef88-45fd-8fcb-65c72291fbe9
Size 982B
SHA256 1bf350dc4a8173d000ece1f45e78de6af70f312b2454b8dccc3d17979abcf2b1
MD5 67effbfbf32b2e190e33ef2b09260679
SHA1 ea3823b62ce089616afb3dcb61357190acd47e52
SHA512 ec3a0c38294cd7cce5267ca4fc286863911004051d0263c194aa474185c99420edc1ebea1e70f026e86b1573c03680016d6a7a2642492ca2a3938742129a271f
MD5 SHA1 SHA512

Submit Download

b4f97249-4354-4309-90c9-9d1d1fbba8f7

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\t4hat1k8.default-release\datareporting\glean\pending_pings\b4f97249-4354-4309-90c9-9d1d1fbba8f7
Size 671B
SHA256 e386b797fb6d6b22db44a4c16623220841c2c59c9b6bbd5b3be30a4eb18551be
MD5 e4ffbe2657f6df16675e100a1309f6a7
SHA1 9a5aeadeb1673bf19e07e93cf743ee1544236a74
SHA512 fe6fb98b4b06f098641806beb38f22b09bd61c497b034e70fade0491585ee16fd24343bf85c8385fd4caa1cbae4f2c70a791b31e0f598e363cde6d495ec5adad
MD5 SHA1 SHA512

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\t4hat1k8.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Size 1.1MB
SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
MD5 842039753bf41fa5e11b3a1383061a87
SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\t4hat1k8.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Size 116B
SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
MD5 2a461e9eb87fd1955cea740a3444ee7a
SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\t4hat1k8.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Size 372B
SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
MD5 bf957ad58b55f64219ab3f793e374316
SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\t4hat1k8.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Size 17.8MB
SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
MD5 daf7ef3acccab478aaa7d6dc1c60f865
SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
MD5 SHA1 SHA512 SSDEEP

Submit Download

places.sqlite-wal

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\t4hat1k8.default-release\places.sqlite-wal
Size 992KB
SHA256 429a78c56514e67664d404725ec43cb5a422b4598be39e6fa1b67422e113c7c5
MD5 dc51ed94781970f4f1db9724bb7b910f
SHA1 683a71671bdf4cf3940c6a25b1785ed1458aee28
SHA512 52a675c8885cf86df46ead66b0849ce11e6efdb331ca8b2d51869a0544021c4e8e02c7113a032f902b59a164a0150558221b91732b36fddb5d3dac2e5fbedc79
SSDEEP 192:TdMwHBrAT/Ougx/YdMw+hKQYeXdSTz7crx/xpdMwL:TiwHoXgSiwtQtKUhiwL
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\t4hat1k8.default-release\prefs-1.js
Size 12KB
SHA256 45d0a0e0e934a2988483bd60068f6e658efc3dd1735031fc2b88d255d891c589
MD5 26decce0790bb8c7a1194336ff23ca0d
SHA1 4fb0c5704604b57d0b87a379a9c256a7ccd37a94
SHA512 2c1dac9ee72afea1836d8e97a4efddb86b8e43772db565993415dba5cd679906bc8736e81898e91072f085a1a8978875017d921c4a1aa991cfa509edadc54c82
SSDEEP 192:Dx5n/RhkfoVbz1uKzJWcdpizyFQHrb60DaXBhDadclBw8HkxRmO:DwuhzJDWzKQLe7bwLxQO
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\t4hat1k8.default-release\prefs.js
Size 11KB
SHA256 d5cf5ab1d9fee7d33f13caa4d815146629fd67edbd709951e702d4aa71e21bbc
MD5 015f173df70862ab1056fb9dc158cbe3
SHA1 44cdd3eeccac868da14a62ed397b449a42f82636
SHA512 af1d8a1db57eab7afa59dc738ee3746e166822bb337108e417771354d9a0675c614ea936a18bdb1ff4276587b531f6102ed0bd39129cb090382a6a21d1000812
SSDEEP 192:Ex5n/RhkfoVbz1uKzJWcdpizyFQHrb60DaXBhDadccBw8HW:EwuhzJDWzKQLe7ew7
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\t4hat1k8.default-release\prefs.js
Size 8KB
SHA256 dcdad95fc4288a25d461e9e136649f48890028b761691b57927f6152424823c8
MD5 c5bc5ab3ed3ec922eef9c3ee78bd0737
SHA1 3bc249a8a70803442a29dd029576e7d71fd7a928
SHA512 20aec1d4523e3fa306fa5cd16e46d26b281775c1bd3ce887bceae1a5c7cb44aa0c76c7a6276d18857ad84d6d8747369f76d4e4d6de84cd9e6453a66391bd3a55
SSDEEP 192:Ex5n/RhkfoVRINFP5cdTWPtTU60OaXKhDadccBw8HW:Ew1FOMdtew7
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/484-22-0x0000000000130000-0x00000000005F1000-memory.dmp

Download

memory/484-23-0x0000000000130000-0x00000000005F1000-memory.dmp

Download

memory/484-24-0x0000000000130000-0x00000000005F1000-memory.dmp

Download

memory/484-26-0x0000000000130000-0x00000000005F1000-memory.dmp

Download

memory/1908-17-0x00000000005E0000-0x0000000000AA1000-memory.dmp

Download

memory/1908-2-0x00000000005E1000-0x000000000060F000-memory.dmp

Download

memory/1908-1-0x0000000077D16000-0x0000000077D18000-memory.dmp

Download

memory/1908-3-0x00000000005E0000-0x0000000000AA1000-memory.dmp

Download

memory/1908-0-0x00000000005E0000-0x0000000000AA1000-memory.dmp

Download

memory/1908-5-0x00000000005E0000-0x0000000000AA1000-memory.dmp

Download

memory/3220-18-0x0000000000130000-0x00000000005F1000-memory.dmp

Download

memory/3220-2648-0x0000000000130000-0x00000000005F1000-memory.dmp

Download

memory/3220-482-0x0000000000130000-0x00000000005F1000-memory.dmp

Download

memory/3220-491-0x0000000000130000-0x00000000005F1000-memory.dmp

Download

memory/3220-492-0x0000000000130000-0x00000000005F1000-memory.dmp

Download

memory/3220-497-0x0000000000130000-0x00000000005F1000-memory.dmp

Download

memory/3220-19-0x0000000000130000-0x00000000005F1000-memory.dmp

Download

memory/3220-2661-0x0000000000130000-0x00000000005F1000-memory.dmp

Download

memory/3220-2660-0x0000000000130000-0x00000000005F1000-memory.dmp

Download

memory/3220-2651-0x0000000000130000-0x00000000005F1000-memory.dmp

Download

memory/3220-2650-0x0000000000130000-0x00000000005F1000-memory.dmp

Download

memory/3220-462-0x0000000000130000-0x00000000005F1000-memory.dmp

Download

memory/3220-20-0x0000000000130000-0x00000000005F1000-memory.dmp

Download

memory/3220-25-0x0000000000130000-0x00000000005F1000-memory.dmp

Download

memory/3220-2649-0x0000000000130000-0x00000000005F1000-memory.dmp

Download

memory/3220-1059-0x0000000000130000-0x00000000005F1000-memory.dmp

Download

memory/3220-2220-0x0000000000130000-0x00000000005F1000-memory.dmp

Download

memory/3220-2636-0x0000000000130000-0x00000000005F1000-memory.dmp

Download

memory/3220-481-0x0000000000130000-0x00000000005F1000-memory.dmp

Download

memory/3220-2647-0x0000000000130000-0x00000000005F1000-memory.dmp

Download

memory/3220-2645-0x0000000000130000-0x00000000005F1000-memory.dmp

Download

memory/3288-2653-0x0000000000130000-0x00000000005F1000-memory.dmp

Download

memory/3288-2654-0x0000000000130000-0x00000000005F1000-memory.dmp

Download

memory/4384-42-0x0000000000AE0000-0x0000000001071000-memory.dmp

Download

memory/4384-466-0x0000000000AE0000-0x0000000001071000-memory.dmp

Download

memory/4384-61-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Download

memory/4828-470-0x00000000004B0000-0x0000000000971000-memory.dmp

Download

memory/4828-475-0x00000000004B0000-0x0000000000971000-memory.dmp

Download

memory/5308-2639-0x0000000000130000-0x00000000005F1000-memory.dmp

Download

memory/5308-2638-0x0000000000130000-0x00000000005F1000-memory.dmp

Download