amadey | d11f036b752ca3eb57c3373e36f33237154dcd53e9ef00197c2dfc9721f08da9

Analysis

max time kernel
150s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20240709-en
resource tags

arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
submitted
18/07/2024, 08:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d11f036b752ca3eb57c3373e36f33237154dcd53e9ef00197c2dfc9721f08da9.exe
Size 1.1MB
Sample240718-jxmzbsshpc
SHA256 d11f036b752ca3eb57c3373e36f33237154dcd53e9ef00197c2dfc9721f08da9
MD5 aeaee9b126628063a9c15e14d24019f0
SHA1 043cb4a1b6b7ca6c197618a1f74c96c2933ce0e8
SHA512 ca4ea83036a4e4585f5450f34f6a924fee719e7dfa98fd87aa5170a9ccad5d5feee4e7ac79378cf7949ef76823728947fa71af9b0fbd3e090565e55c14c75a38
SSDEEP 24576:vkIcRFWXoCCD3Z95EcsM9ZrVAZBI/iCh2HD0xUG+1NgT2xRk:juFWXfAp3E+9ZwBI6CGDW3MC
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey stealc 4dd39d funny discovery evasion spyware stealer trojan

Malware Config

Extracted

Family

stealc

Botnet

funny

http://85.28.47.30

Attributes

url_path
/920475a59bac849d.php

Extracted

Family

amadey

Version

4.30

Botnet

4dd39d

http://77.91.77.82

Attributes

install_dir
ad40971b6b
install_file
explorti.exe
strings_key
a434973ad22def7137dbb5e059b7081e
url_paths
/Hun4Ko/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Stealc
Stealc is an infostealer written in C++.
stealer stealc

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	JDGCGHCGHC.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 8 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	JDGCGHCGHC.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	JDGCGHCGHC.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe

Executes dropped EXE 6 IoCs

pid	Process
2572	JDGCGHCGHC.exe
2328	explorti.exe
4064	0bfbae2239.exe
1000	7a67c3f450.exe
5876	explorti.exe
5596	explorti.exe

Identifies Wine through registry keys 2 TTPs 4 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-126710838-2490174220-686410903-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-126710838-2490174220-686410903-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-126710838-2490174220-686410903-1000\Software\Wine	JDGCGHCGHC.exe
Key opened	\REGISTRY\USER\S-1-5-21-126710838-2490174220-686410903-1000\Software\Wine	explorti.exe

Loads dropped DLL 2 IoCs

pid	Process
3000	d11f036b752ca3eb57c3373e36f33237154dcd53e9ef00197c2dfc9721f08da9.exe
3000	d11f036b752ca3eb57c3373e36f33237154dcd53e9ef00197c2dfc9721f08da9.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x000100000002aabf-119.dat	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs

pid	Process
3000	d11f036b752ca3eb57c3373e36f33237154dcd53e9ef00197c2dfc9721f08da9.exe
3000	d11f036b752ca3eb57c3373e36f33237154dcd53e9ef00197c2dfc9721f08da9.exe
3000	d11f036b752ca3eb57c3373e36f33237154dcd53e9ef00197c2dfc9721f08da9.exe
2572	JDGCGHCGHC.exe
2328	explorti.exe
4064	0bfbae2239.exe
5876	explorti.exe
5596	explorti.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\explorti.job	JDGCGHCGHC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	d11f036b752ca3eb57c3373e36f33237154dcd53e9ef00197c2dfc9721f08da9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	d11f036b752ca3eb57c3373e36f33237154dcd53e9ef00197c2dfc9721f08da9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-126710838-2490174220-686410903-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3000	d11f036b752ca3eb57c3373e36f33237154dcd53e9ef00197c2dfc9721f08da9.exe
3000	d11f036b752ca3eb57c3373e36f33237154dcd53e9ef00197c2dfc9721f08da9.exe
3000	d11f036b752ca3eb57c3373e36f33237154dcd53e9ef00197c2dfc9721f08da9.exe
3000	d11f036b752ca3eb57c3373e36f33237154dcd53e9ef00197c2dfc9721f08da9.exe
2572	JDGCGHCGHC.exe
2572	JDGCGHCGHC.exe
2328	explorti.exe
2328	explorti.exe
5876	explorti.exe
5876	explorti.exe
5596	explorti.exe
5596	explorti.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2016	firefox.exe
Token: SeDebugPrivilege	2016	firefox.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2572	JDGCGHCGHC.exe
1000	7a67c3f450.exe
1000	7a67c3f450.exe
1000	7a67c3f450.exe
1000	7a67c3f450.exe
1000	7a67c3f450.exe
1000	7a67c3f450.exe
1000	7a67c3f450.exe
2016	firefox.exe
2016	firefox.exe
2016	firefox.exe
2016	firefox.exe
2016	firefox.exe
2016	firefox.exe
2016	firefox.exe
2016	firefox.exe
2016	firefox.exe
2016	firefox.exe
2016	firefox.exe
2016	firefox.exe
2016	firefox.exe
2016	firefox.exe
2016	firefox.exe
2016	firefox.exe
2016	firefox.exe
2016	firefox.exe
2016	firefox.exe
2016	firefox.exe
2016	firefox.exe
1000	7a67c3f450.exe
1000	7a67c3f450.exe
1000	7a67c3f450.exe
1000	7a67c3f450.exe
1000	7a67c3f450.exe
1000	7a67c3f450.exe
1000	7a67c3f450.exe
1000	7a67c3f450.exe
1000	7a67c3f450.exe
1000	7a67c3f450.exe
1000	7a67c3f450.exe
1000	7a67c3f450.exe
1000	7a67c3f450.exe
1000	7a67c3f450.exe
1000	7a67c3f450.exe
1000	7a67c3f450.exe
1000	7a67c3f450.exe
1000	7a67c3f450.exe
1000	7a67c3f450.exe
1000	7a67c3f450.exe
1000	7a67c3f450.exe
1000	7a67c3f450.exe
1000	7a67c3f450.exe
1000	7a67c3f450.exe
1000	7a67c3f450.exe
1000	7a67c3f450.exe
1000	7a67c3f450.exe
1000	7a67c3f450.exe
1000	7a67c3f450.exe
1000	7a67c3f450.exe
1000	7a67c3f450.exe
1000	7a67c3f450.exe
1000	7a67c3f450.exe
1000	7a67c3f450.exe
1000	7a67c3f450.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1000	7a67c3f450.exe
1000	7a67c3f450.exe
1000	7a67c3f450.exe
1000	7a67c3f450.exe
1000	7a67c3f450.exe
1000	7a67c3f450.exe
1000	7a67c3f450.exe
1000	7a67c3f450.exe
1000	7a67c3f450.exe
1000	7a67c3f450.exe
1000	7a67c3f450.exe
1000	7a67c3f450.exe
1000	7a67c3f450.exe
1000	7a67c3f450.exe
1000	7a67c3f450.exe
1000	7a67c3f450.exe
1000	7a67c3f450.exe
1000	7a67c3f450.exe
1000	7a67c3f450.exe
1000	7a67c3f450.exe
1000	7a67c3f450.exe
1000	7a67c3f450.exe
1000	7a67c3f450.exe
1000	7a67c3f450.exe
1000	7a67c3f450.exe
1000	7a67c3f450.exe
1000	7a67c3f450.exe
1000	7a67c3f450.exe
1000	7a67c3f450.exe
1000	7a67c3f450.exe
1000	7a67c3f450.exe
1000	7a67c3f450.exe
1000	7a67c3f450.exe
1000	7a67c3f450.exe
1000	7a67c3f450.exe
1000	7a67c3f450.exe
1000	7a67c3f450.exe
1000	7a67c3f450.exe
1000	7a67c3f450.exe
1000	7a67c3f450.exe
1000	7a67c3f450.exe
1000	7a67c3f450.exe
1000	7a67c3f450.exe
1000	7a67c3f450.exe
1000	7a67c3f450.exe
1000	7a67c3f450.exe
1000	7a67c3f450.exe
1000	7a67c3f450.exe
1000	7a67c3f450.exe
1000	7a67c3f450.exe
1000	7a67c3f450.exe
1000	7a67c3f450.exe
1000	7a67c3f450.exe
1000	7a67c3f450.exe
1000	7a67c3f450.exe
1000	7a67c3f450.exe
1000	7a67c3f450.exe
1000	7a67c3f450.exe
1000	7a67c3f450.exe
1000	7a67c3f450.exe
1000	7a67c3f450.exe
1000	7a67c3f450.exe
1000	7a67c3f450.exe
1000	7a67c3f450.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3000	d11f036b752ca3eb57c3373e36f33237154dcd53e9ef00197c2dfc9721f08da9.exe
1188	cmd.exe
4064	0bfbae2239.exe
2016	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 2864	3000	d11f036b752ca3eb57c3373e36f33237154dcd53e9ef00197c2dfc9721f08da9.exe	83
PID 3000 wrote to memory of 2864	3000	d11f036b752ca3eb57c3373e36f33237154dcd53e9ef00197c2dfc9721f08da9.exe	83
PID 3000 wrote to memory of 2864	3000	d11f036b752ca3eb57c3373e36f33237154dcd53e9ef00197c2dfc9721f08da9.exe	83
PID 3000 wrote to memory of 1188	3000	d11f036b752ca3eb57c3373e36f33237154dcd53e9ef00197c2dfc9721f08da9.exe	85
PID 3000 wrote to memory of 1188	3000	d11f036b752ca3eb57c3373e36f33237154dcd53e9ef00197c2dfc9721f08da9.exe	85
PID 3000 wrote to memory of 1188	3000	d11f036b752ca3eb57c3373e36f33237154dcd53e9ef00197c2dfc9721f08da9.exe	85
PID 2864 wrote to memory of 2572	2864	cmd.exe	87
PID 2864 wrote to memory of 2572	2864	cmd.exe	87
PID 2864 wrote to memory of 2572	2864	cmd.exe	87
PID 2572 wrote to memory of 2328	2572	JDGCGHCGHC.exe	88
PID 2572 wrote to memory of 2328	2572	JDGCGHCGHC.exe	88
PID 2572 wrote to memory of 2328	2572	JDGCGHCGHC.exe	88
PID 2328 wrote to memory of 4064	2328	explorti.exe	89
PID 2328 wrote to memory of 4064	2328	explorti.exe	89
PID 2328 wrote to memory of 4064	2328	explorti.exe	89
PID 2328 wrote to memory of 1000	2328	explorti.exe	90
PID 2328 wrote to memory of 1000	2328	explorti.exe	90
PID 2328 wrote to memory of 1000	2328	explorti.exe	90
PID 1000 wrote to memory of 1196	1000	7a67c3f450.exe	91
PID 1000 wrote to memory of 1196	1000	7a67c3f450.exe	91
PID 1196 wrote to memory of 2016	1196	firefox.exe	94
PID 1196 wrote to memory of 2016	1196	firefox.exe	94
PID 1196 wrote to memory of 2016	1196	firefox.exe	94
PID 1196 wrote to memory of 2016	1196	firefox.exe	94
PID 1196 wrote to memory of 2016	1196	firefox.exe	94
PID 1196 wrote to memory of 2016	1196	firefox.exe	94
PID 1196 wrote to memory of 2016	1196	firefox.exe	94
PID 1196 wrote to memory of 2016	1196	firefox.exe	94
PID 1196 wrote to memory of 2016	1196	firefox.exe	94
PID 1196 wrote to memory of 2016	1196	firefox.exe	94
PID 1196 wrote to memory of 2016	1196	firefox.exe	94
PID 2016 wrote to memory of 4388	2016	firefox.exe	95
PID 2016 wrote to memory of 4388	2016	firefox.exe	95
PID 2016 wrote to memory of 4388	2016	firefox.exe	95
PID 2016 wrote to memory of 4388	2016	firefox.exe	95
PID 2016 wrote to memory of 4388	2016	firefox.exe	95
PID 2016 wrote to memory of 4388	2016	firefox.exe	95
PID 2016 wrote to memory of 4388	2016	firefox.exe	95
PID 2016 wrote to memory of 4388	2016	firefox.exe	95
PID 2016 wrote to memory of 4388	2016	firefox.exe	95
PID 2016 wrote to memory of 4388	2016	firefox.exe	95
PID 2016 wrote to memory of 4388	2016	firefox.exe	95
PID 2016 wrote to memory of 4388	2016	firefox.exe	95
PID 2016 wrote to memory of 4388	2016	firefox.exe	95
PID 2016 wrote to memory of 4388	2016	firefox.exe	95
PID 2016 wrote to memory of 4388	2016	firefox.exe	95
PID 2016 wrote to memory of 4388	2016	firefox.exe	95
PID 2016 wrote to memory of 4388	2016	firefox.exe	95
PID 2016 wrote to memory of 4388	2016	firefox.exe	95
PID 2016 wrote to memory of 4388	2016	firefox.exe	95
PID 2016 wrote to memory of 4388	2016	firefox.exe	95
PID 2016 wrote to memory of 4388	2016	firefox.exe	95
PID 2016 wrote to memory of 4388	2016	firefox.exe	95
PID 2016 wrote to memory of 4388	2016	firefox.exe	95
PID 2016 wrote to memory of 4388	2016	firefox.exe	95
PID 2016 wrote to memory of 4388	2016	firefox.exe	95
PID 2016 wrote to memory of 4388	2016	firefox.exe	95
PID 2016 wrote to memory of 4388	2016	firefox.exe	95
PID 2016 wrote to memory of 4388	2016	firefox.exe	95
PID 2016 wrote to memory of 4388	2016	firefox.exe	95
PID 2016 wrote to memory of 4388	2016	firefox.exe	95
PID 2016 wrote to memory of 4388	2016	firefox.exe	95
PID 2016 wrote to memory of 4388	2016	firefox.exe	95
PID 2016 wrote to memory of 4388	2016	firefox.exe	95

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\d11f036b752ca3eb57c3373e36f33237154dcd53e9ef00197c2dfc9721f08da9.exe
"C:\Users\Admin\AppData\Local\Temp\d11f036b752ca3eb57c3373e36f33237154dcd53e9ef00197c2dfc9721f08da9.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\JDGCGHCGHC.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2864
- - C:\Users\Admin\AppData\Local\Temp\JDGCGHCGHC.exe
    "C:\Users\Admin\AppData\Local\Temp\JDGCGHCGHC.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2572
  - - C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
      "C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2328
    - - C:\Users\Admin\AppData\Local\Temp\1000006001\0bfbae2239.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000006001\0bfbae2239.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetWindowsHookEx
        
        PID:4064
    - - C:\Users\Admin\AppData\Local\Temp\1000011001\7a67c3f450.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000011001\7a67c3f450.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:1000
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1196
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
        7⤵
        Checks processor information in registry
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2016
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1964 -parentBuildID 20240401114208 -prefsHandle 1892 -prefMapHandle 1884 -prefsLen 25751 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {cb85634e-539f-4837-9795-adac7bebb8ee} 2016 "\\.\pipe\gecko-crash-server-pipe.2016" gpu
        8⤵
        
        PID:4388
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2388 -parentBuildID 20240401114208 -prefsHandle 2380 -prefMapHandle 2376 -prefsLen 26671 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c4040ed1-ab39-43d2-b880-f0bb5496efe0} 2016 "\\.\pipe\gecko-crash-server-pipe.2016" socket
        8⤵
        
        PID:1724
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3116 -childID 1 -isForBrowser -prefsHandle 3124 -prefMapHandle 3244 -prefsLen 22698 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3c197f24-bb99-47e7-9f81-47989488a994} 2016 "\\.\pipe\gecko-crash-server-pipe.2016" tab
        8⤵
        
        PID:3768
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4008 -childID 2 -isForBrowser -prefsHandle 4000 -prefMapHandle 3996 -prefsLen 31161 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1222f3f3-ae9c-47cc-9c10-4d9edbc8085d} 2016 "\\.\pipe\gecko-crash-server-pipe.2016" tab
        8⤵
        
        PID:4752
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4796 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4788 -prefMapHandle 4780 -prefsLen 31161 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fe98b90f-2be4-4dda-a650-603a6ed4548e} 2016 "\\.\pipe\gecko-crash-server-pipe.2016" utility
        8⤵
        Checks processor information in registry
        
        PID:784
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5640 -childID 3 -isForBrowser -prefsHandle 5664 -prefMapHandle 5660 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cbe04570-b869-4bca-b728-d1db3a263121} 2016 "\\.\pipe\gecko-crash-server-pipe.2016" tab
        8⤵
        
        PID:6020
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5836 -childID 4 -isForBrowser -prefsHandle 5756 -prefMapHandle 5760 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bfade394-04cd-43e7-ad51-86a65fd2a2e3} 2016 "\\.\pipe\gecko-crash-server-pipe.2016" tab
        8⤵
        
        PID:6032
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6048 -childID 5 -isForBrowser -prefsHandle 6040 -prefMapHandle 6036 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d8dea35f-8eb6-48aa-be3b-ee985407cf31} 2016 "\\.\pipe\gecko-crash-server-pipe.2016" tab
        8⤵
        
        PID:6044
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\ECAKECAEGD.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1188

C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5876

C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mozglue.dll

Path C:\ProgramData\mozglue.dll
Size 593KB
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
SSDEEP 12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5 SHA1 SHA512 SSDEEP

Submit Download

nss3.dll

Path C:\ProgramData\nss3.dll
Size 2.0MB
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
SSDEEP 49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5 SHA1 SHA512 SSDEEP

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\b0ht3gr0.default-release\activity-stream.discovery_stream.json
Size 22KB
SHA256 66a4aa2f00af20ad90d13612493d3404f6b2bad73cbf7f13bd8f6a7c89312046
MD5 db04fb6f033559f59f43c8828e8d62ac
SHA1 11667d348ca660ba1d0f2eeb8dbe88c48af5a717
SHA512 31105fbd30278469befa429992bb6ccd6b62c56f906e82ec2d3c86f8db94cb436ec44d2b7ca2a80073987c16709d2efe569ad5c2ed7671d49d77739b3a634b80
SSDEEP 384:5GjxGgiwclSEj6s9odJtFUpP0AS+/AZ3rc+wYfSAhKATgdcHB0S8yaujFTafTLN7:5ngzJLsrSlZ3Q+93hKATg8b8ydjYXN7
MD5 SHA1 SHA512 SSDEEP

Submit Download

8A2034D325DC0B5C9E11EDDA3FC70A54C8DC1C0D

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\b0ht3gr0.default-release\cache2\entries\8A2034D325DC0B5C9E11EDDA3FC70A54C8DC1C0D
Size 13KB
SHA256 19e2c4038034c85d37f0f9e1315ccf01cc3c61b517fb70bce03ca5ee5cef528d
MD5 4800990db8b6aee19cb16e2f92f18db9
SHA1 5aa2d50031c4f992fd9c91b70ff56321ffc2ae61
SHA512 a0dc8cf3e4c9d3a8d2282cb4889857ee7123e2039ff813294273da019abb8087ccbf4b08afb2965cf97968b41feb21885ce355e8dba14eb7229baf48b0c1e046
SSDEEP 384:H485u9fiGLm4pU+ft2WlOX8lPLZZB7t0lpDIIxjujv:nUBi8mCU+ft2WAX8tzB7eD8x
MD5 SHA1 SHA512 SSDEEP

Submit Download

0bfbae2239.exe

Path C:\Users\Admin\AppData\Local\Temp\1000006001\0bfbae2239.exe
Size 1.1MB
SHA256 d11f036b752ca3eb57c3373e36f33237154dcd53e9ef00197c2dfc9721f08da9
MD5 aeaee9b126628063a9c15e14d24019f0
SHA1 043cb4a1b6b7ca6c197618a1f74c96c2933ce0e8
SHA512 ca4ea83036a4e4585f5450f34f6a924fee719e7dfa98fd87aa5170a9ccad5d5feee4e7ac79378cf7949ef76823728947fa71af9b0fbd3e090565e55c14c75a38
SSDEEP 24576:vkIcRFWXoCCD3Z95EcsM9ZrVAZBI/iCh2HD0xUG+1NgT2xRk:juFWXfAp3E+9ZwBI6CGDW3MC
MD5 SHA1 SHA512 SSDEEP

Submit Download

7a67c3f450.exe

Path C:\Users\Admin\AppData\Local\Temp\1000011001\7a67c3f450.exe
Size 1.2MB
SHA256 b2cdcae2347bea039f6beac85ea99a9e8d8e736c096135a6c5f76a01a7afeab3
MD5 ed3008eb2218e4cc39b488765ea43fb7
SHA1 6cee99d02a5cdb5a570bd00cb11032d9c7984248
SHA512 7b1364b68db091659b0c4af10869625488830ae1a65db5bf93335e937ad5b7328ec090c1ab2374b4e129c40e4632d935012f230b8f660065d09d4cd5f7f947e0
SSDEEP 24576:iqDEvCTbMWu7rQYlBQcBiT6rprG8aLb2Sbly7TWEPje:iTvC/MTQYxsWR7aLb2dW
MD5 SHA1 SHA512 SSDEEP

Submit Download

JDGCGHCGHC.exe

Path C:\Users\Admin\AppData\Local\Temp\JDGCGHCGHC.exe
Size 1.8MB
SHA256 711ced2c2312557c6d18bf214db2155985eb1e32bfc9321b97daa8c890952ad1
MD5 0873079ba1cd9b974f9263447567529e
SHA1 b16b70be50a787dd0e20f6ceb43002f13418ff91
SHA512 f27433bd5e808adad462ea835ccb587d9b7be2e8c1f2b2482cba7f4194a608a171e8833e96c794332d4ccb3e7f6d04bc05d786f3ac0df23bfd9434f58fc431a4
SSDEEP 49152:v0h4A6w8JX4n6uoErlKi0C6si2fG2l+FezvFTQ:vCz8Jois/4FezvVQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 479KB
SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
MD5 09372174e83dbbf696ee732fd2e875bb
SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 13.8MB
SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
MD5 0a8747a2ac9ac08ae9508f36c6d75692
SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\b0ht3gr0.default-release\AlternateServices.bin
Size 8KB
SHA256 8e89c246a9049289fb043ae293a20c3ebd3b25b5bfcf8f8a0c4795926db28210
MD5 a45877a66fa6fb86c104c62abf0d140a
SHA1 72d2137c7d0f22c1b71481480fc2e3dccd6bc2c0
SHA512 9950810c8df9fb6f0ac03f7e6a0cc497274c3d6d3b2a3029a1cf4d2af091cd8715ee5c1d931599bc58957b5b472efc40f12c230264646f179eb669e0025a11ff
SSDEEP 48:w1YSlYJ5o9BYB9cOIdsebOJLibWJpebvpf+Lib:FpJ5o4YsebOJ2bWJpebvpf+2b
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\b0ht3gr0.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 1ed6ff9331f50929b1a788cfd6dc8b924c700300852847819cee1aecffc43f16
MD5 a0ce274df6b1ac421db93f118cbeb375
SHA1 d437ed139c80b9c6c0a1bf59c30751076097c6bf
SHA512 e0ea7678ae9a60a50b9d35407ca729ecfe38986b662a1c886bb0f9649d450ab3114308f451edc915311292481eb6478a414243e8417f646e9f687c230e07d036
SSDEEP 96:c1BeSMF9ZbkW6QX0BBbhmZRPP/PhxkWrpKQDvLBMFl66Joz0dzgClKtmSS:lrvZboHbhQlPDfQ/66Joz0dzgCl6mSS
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\b0ht3gr0.default-release\datareporting\glean\db\data.safe.tmp
Size 16KB
SHA256 9b16852cf456f4cd5e66e6773467a42c0772d1c2bd8d7f5c4986808a02cf1624
MD5 d1bd250c35687fd2bdf7c4ddd25dd75c
SHA1 ab524ace353e5a54111d69debb8a8815242436c2
SHA512 dd19bda7775e09c2b1c474b58aec8d461547476f74f2e3771c87d4494653394c531b85c81cfb00386a22fcaa516f3837ca4daea13831de65c290c3e96ec42e8e
SSDEEP 384:Fudl1/ADToZ2bPbuJ/66JozQzgC1b/bo7ZfP1:EZoDToZ2bPbusm9Od
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\b0ht3gr0.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 ab8dc5f787e8baec9682680042b0de8c39844ce3ad306889006b1511870aa988
MD5 b035f4625fa96da1f4be43e3d9073408
SHA1 48b6876f1ff2ee9a6d21f6e8ee2246057e686bd7
SHA512 c175d752f6df8f7d1236ac9442a9271c42825c6c2f1ba67da1aac4e44394168e615e1c2b5ee9f3845e65ffe3f71bdafe05139192431e6a7841dcaabf8437925e
SSDEEP 96:7pKQDvLBMFl66Joz0dzgClKtmSSDBeSMF9ZbkW6QX0BBbhmZRPP/PaxvWI:A/66Joz0dzgCl6mSSwrvZboHbhQlP0OI
MD5 SHA1 SHA512 SSDEEP

Submit Download

5831aa3e-646e-4daa-a8a8-d2abce69fe01

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\b0ht3gr0.default-release\datareporting\glean\pending_pings\5831aa3e-646e-4daa-a8a8-d2abce69fe01
Size 671B
SHA256 a8617b494b3b3f6be544beb753b607b6d5caf66f7dde79ef489b9ecfd257be4b
MD5 e8e721e7c25a944f982cd83e0dc8ddf7
SHA1 e9f3f737f3ef147413a92bd3a260cb718b5bd6c2
SHA512 44a4a367869e2fff300ceb43a1a46909abc293d9a0c76770a930b7a32060c6f29506aeea9e317ffea40b947a21f1c476520e0211d366affdf15fc0c79b26106d
MD5 SHA1 SHA512

Submit Download

cf7cefff-0d96-4846-a893-c696f020b1b3

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\b0ht3gr0.default-release\datareporting\glean\pending_pings\cf7cefff-0d96-4846-a893-c696f020b1b3
Size 26KB
SHA256 217327873f7e2aa7b4a082b19ebecedd80dd382104dadce87adc9a3af4b9e8c0
MD5 c78f69c346d8dd9d804b337edf16d1bc
SHA1 c59569af40431a7572b0ae57dbc3cc4f60da4d3d
SHA512 5383ba7ea6307e07723c5bbd84ab10cfcb49899c7e70dd5ae071fc4c53db51dd7189dc6fac706417d447fee1b0861b7cab00c1abb19ac796610152474702524b
SSDEEP 192:ICjRUijUIHlOa6G0z0T/S73Rxk0SqtKSbZJooCAJeMNuQemkLP+dbVtbRwhX3GRe:ICjpjJHH0oTS73Rx9Nq83vyDy0FW8
MD5 SHA1 SHA512 SSDEEP

Submit Download

d194b376-9e15-490f-af6f-90e455ddd78f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\b0ht3gr0.default-release\datareporting\glean\pending_pings\d194b376-9e15-490f-af6f-90e455ddd78f
Size 982B
SHA256 452439eef500e7c5246e7181e5fd9fada0778c55c53c2d4959c70e1b935cbe6c
MD5 6ced8546db2316d51303260cd68e62d6
SHA1 e4b4641ec15ee7345bc104102cd2308d67672c73
SHA512 9dc7aa53a2da7662a60a6ad3c96edf406826528749e6f0f5914af6577320fd4a2f2becf05afec8cf98c4d3ee1a1caf7ee6c33beba2a3359a193b00514a5317a7
MD5 SHA1 SHA512

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\b0ht3gr0.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Size 1.1MB
SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
MD5 842039753bf41fa5e11b3a1383061a87
SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\b0ht3gr0.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Size 116B
SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
MD5 2a461e9eb87fd1955cea740a3444ee7a
SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\b0ht3gr0.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Size 372B
SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
MD5 bf957ad58b55f64219ab3f793e374316
SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\b0ht3gr0.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Size 17.8MB
SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
MD5 daf7ef3acccab478aaa7d6dc1c60f865
SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\b0ht3gr0.default-release\prefs-1.js
Size 12KB
SHA256 a85df9fac377cbb35d26132e0e786ff7579fefaeb5439490b6f5579772a28e4f
MD5 36cf9138e5f5f61b62e6411fee5bcdb5
SHA1 8f746c3f16d95b52e609f8a3aecea0f74833e3da
SHA512 8f1d4916bd1e5ae0aed97763a99de7396b95a14f4da0b7eb2632771105d0b609f9b33b8336ca8627a0e47237d9378045f3d24967bdd68ce474c8edd49df1ded7
SSDEEP 192:Y5nTQRjfNpi1Vf1QIW6hKbNnkJcd6vIWEhHPQHro60xaXx6t6icD0VBw8HrBIH:dgV9QF6UbZkWuFEpQLj16t5cw3wiIH
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\b0ht3gr0.default-release\prefs-1.js
Size 16KB
SHA256 7ee37604914295d2c7e3a85e735c447939f0b15246bda3b9b1a7cb21b972f916
MD5 40e4baee4afbc9492af8801acd960d14
SHA1 c54389a9ab32944f354f4235690f934cc3e01ae1
SHA512 4e9c6ee585193e76f8290192e7b1b295758b7c43ab62fc70cbe0180a025b44751bba9dfdc2a054c80dcb6b854cf7e0b31ad482078edb71e247ca66d08b353bfa
SSDEEP 192:YOnTQRjfJpi1Vf1QIW6hKbNnkJcd6vIWEhHPQHro60xaXr+6t6icD0SiBw8HrBqc:ukV9QF6UbZkWuFEpQLj26t5cwpwiOm
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\b0ht3gr0.default-release\prefs.js
Size 16KB
SHA256 28a807eb3df0dcb6e5e941c87e81f33ed378cfcd107eb80c368a52344e0a80fc
MD5 013ba31bafc30eb8b485ee2351eaa00d
SHA1 36cc5163e2e6a204749195c4f2b916fb9a0c729c
SHA512 8574e16849e2084745e8cf2a4f71fa2c97f015c4d5dba8c5966baf3874f03794775888ef5b609edb36624c3705a653769d033b4a9ec6738255cf5fed3bb81e2c
SSDEEP 192:YOnTQRjfNpi1Vf1QIW6hKbNnkJcd6vIWEhHPQHro60xaXr+6t6icD0SiBw8HrBhu:ugV9QF6UbZkWuFEpQLj26t5cwpwiDE
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\b0ht3gr0.default-release\prefs.js
Size 8KB
SHA256 ed80ec0e37fa418cca6892d58d1108e99ee7572f3c05aa9d5a769d3a2bf6dffb
MD5 be7c007286a465516abb13401d580d09
SHA1 2920d23d42de16f4d1bd59dc0c91f96428a544b8
SHA512 dc662227fc0b012f5a5c887e90c43a559a3c693523ebc14c208b5f2c31ac0f726c7aeb2d3b5ed163d564b687443022d5e5453844efd3eff198e8adf784841ac3
SSDEEP 192:/5nTQRjfN244whilcdVBA60raXQk6t6icD0vBw8VB:qo+FnRGk6t5cwpwa
MD5 SHA1 SHA512 SSDEEP

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\b0ht3gr0.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 2.8MB
SHA256 ffe51c559beea00a585f1d44fb25d616e93ba97eadf1e2309bd2ac30dd1afb62
MD5 e5328c414d5dd1c53531b19319d00621
SHA1 d768727a561ab6c0507c698e51e35ab57449b497
SHA512 2a89b722a18e3646975197a3b6811c9a256432589804094500268a3f821373ef0b4903a1741c75f7685468e167bcc10f44910a87aa5f26a45d77260fc2766fd4
SSDEEP 49152:v/QvzL5+aIsUHQI5Cn5aK+0eP4KXse0VWat61yPP88GO2glj9JUkUwSF6LTX/uJW:2I2
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2328-95-0x0000000000480000-0x0000000000949000-memory.dmp

Download

memory/2328-2724-0x0000000000480000-0x0000000000949000-memory.dmp

Download

memory/2328-487-0x0000000000480000-0x0000000000949000-memory.dmp

Download

memory/2328-2726-0x0000000000480000-0x0000000000949000-memory.dmp

Download

memory/2328-2725-0x0000000000480000-0x0000000000949000-memory.dmp

Download

memory/2328-473-0x0000000000480000-0x0000000000949000-memory.dmp

Download

memory/2328-792-0x0000000000480000-0x0000000000949000-memory.dmp

Download

memory/2328-454-0x0000000000480000-0x0000000000949000-memory.dmp

Download

memory/2328-482-0x0000000000480000-0x0000000000949000-memory.dmp

Download

memory/2328-2721-0x0000000000480000-0x0000000000949000-memory.dmp

Download

memory/2328-2719-0x0000000000480000-0x0000000000949000-memory.dmp

Download

memory/2328-2718-0x0000000000480000-0x0000000000949000-memory.dmp

Download

memory/2328-2712-0x0000000000480000-0x0000000000949000-memory.dmp

Download

memory/2328-2702-0x0000000000480000-0x0000000000949000-memory.dmp

Download

memory/2328-1665-0x0000000000480000-0x0000000000949000-memory.dmp

Download

memory/2572-96-0x0000000000B60000-0x0000000001029000-memory.dmp

Download

memory/2572-82-0x0000000000B60000-0x0000000001029000-memory.dmp

Download

memory/3000-1-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Download

memory/3000-0-0x0000000000E00000-0x0000000001391000-memory.dmp

Download

memory/3000-52-0x0000000000E00000-0x0000000001391000-memory.dmp

Download

memory/3000-78-0x0000000000E00000-0x0000000001391000-memory.dmp

Download

memory/4064-112-0x0000000000760000-0x0000000000CF1000-memory.dmp

Download

memory/4064-114-0x0000000000760000-0x0000000000CF1000-memory.dmp

Download

memory/5596-2722-0x0000000000480000-0x0000000000949000-memory.dmp

Download

memory/5596-2723-0x0000000000480000-0x0000000000949000-memory.dmp

Download

memory/5876-765-0x0000000000480000-0x0000000000949000-memory.dmp

Download

memory/5876-725-0x0000000000480000-0x0000000000949000-memory.dmp

Download