amadey | 3064d47103a72d2ca13ca5100686a5243e742ac49f104579f9de7c8c887ae81d

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20240709-en
resource tags

arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
submitted
18/07/2024, 19:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3064d47103a72d2ca13ca5100686a5243e742ac49f104579f9de7c8c887ae81d.exe
Size 1.8MB
Sample240718-ydntvawfmc
SHA256 3064d47103a72d2ca13ca5100686a5243e742ac49f104579f9de7c8c887ae81d
MD5 f46ac068eb7969f2460b0ab97419fc30
SHA1 0c1f1b100b8934ee0c34dd37972bada3dd1d87f0
SHA512 a13c33e34a67106a87158038e455328afe30f805d8bbd6ffc5b68527a84659019ee9900a0aea0be50f43cf5abd92c8ef79cf2c928ed6e3a1f355060d7ce755ec
SSDEEP 49152:YOZEnmKpaDHQqQQnhgduQavKgOxxd5pmcV9W2upKG5q/:Y7paEqQQnYAvOpbznEKG5q
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey stealc 4dd39d funny discovery evasion spyware stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.30

Botnet

4dd39d

http://77.91.77.82

Attributes

install_dir
ad40971b6b
install_file
explorti.exe
strings_key
a434973ad22def7137dbb5e059b7081e
url_paths
/Hun4Ko/index.php

rc4.plain

Extracted

Family

stealc

Botnet

funny

http://85.28.47.30

Attributes

url_path
/920475a59bac849d.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Stealc
Stealc is an infostealer written in C++.
stealer stealc

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	3064d47103a72d2ca13ca5100686a5243e742ac49f104579f9de7c8c887ae81d.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	KEGCFCAKFH.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 10 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	3064d47103a72d2ca13ca5100686a5243e742ac49f104579f9de7c8c887ae81d.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	3064d47103a72d2ca13ca5100686a5243e742ac49f104579f9de7c8c887ae81d.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	KEGCFCAKFH.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	KEGCFCAKFH.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe

Executes dropped EXE 6 IoCs

pid	Process
3892	explorti.exe
5072	ba7e389ac8.exe
4700	explorti.exe
1764	3e6c837998.exe
2984	KEGCFCAKFH.exe
3968	explorti.exe

Identifies Wine through registry keys 2 TTPs 5 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3637748876-3197268895-3385380113-1000\Software\Wine	3064d47103a72d2ca13ca5100686a5243e742ac49f104579f9de7c8c887ae81d.exe
Key opened	\REGISTRY\USER\S-1-5-21-3637748876-3197268895-3385380113-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-3637748876-3197268895-3385380113-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-3637748876-3197268895-3385380113-1000\Software\Wine	KEGCFCAKFH.exe
Key opened	\REGISTRY\USER\S-1-5-21-3637748876-3197268895-3385380113-1000\Software\Wine	explorti.exe

Loads dropped DLL 2 IoCs

pid	Process
1212	RegAsm.exe
1212	RegAsm.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x000100000002aaa7-124.dat	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

pid	Process
2832	3064d47103a72d2ca13ca5100686a5243e742ac49f104579f9de7c8c887ae81d.exe
3892	explorti.exe
4700	explorti.exe
2984	KEGCFCAKFH.exe
3968	explorti.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5072 set thread context of 1212	5072	ba7e389ac8.exe	85

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\explorti.job	3064d47103a72d2ca13ca5100686a5243e742ac49f104579f9de7c8c887ae81d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	RegAsm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RegAsm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3637748876-3197268895-3385380113-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2832	3064d47103a72d2ca13ca5100686a5243e742ac49f104579f9de7c8c887ae81d.exe
2832	3064d47103a72d2ca13ca5100686a5243e742ac49f104579f9de7c8c887ae81d.exe
3892	explorti.exe
3892	explorti.exe
1212	RegAsm.exe
1212	RegAsm.exe
4700	explorti.exe
4700	explorti.exe
1212	RegAsm.exe
1212	RegAsm.exe
2984	KEGCFCAKFH.exe
2984	KEGCFCAKFH.exe
3968	explorti.exe
3968	explorti.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2840	firefox.exe
Token: SeDebugPrivilege	2840	firefox.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2832	3064d47103a72d2ca13ca5100686a5243e742ac49f104579f9de7c8c887ae81d.exe
1764	3e6c837998.exe
1764	3e6c837998.exe
1764	3e6c837998.exe
1764	3e6c837998.exe
1764	3e6c837998.exe
1764	3e6c837998.exe
2840	firefox.exe
2840	firefox.exe
2840	firefox.exe
2840	firefox.exe
2840	firefox.exe
2840	firefox.exe
2840	firefox.exe
2840	firefox.exe
2840	firefox.exe
2840	firefox.exe
2840	firefox.exe
2840	firefox.exe
2840	firefox.exe
2840	firefox.exe
2840	firefox.exe
2840	firefox.exe
2840	firefox.exe
1764	3e6c837998.exe
2840	firefox.exe
2840	firefox.exe
2840	firefox.exe
2840	firefox.exe
1764	3e6c837998.exe
1764	3e6c837998.exe
1764	3e6c837998.exe
1764	3e6c837998.exe
1764	3e6c837998.exe
1764	3e6c837998.exe
1764	3e6c837998.exe
1764	3e6c837998.exe
1764	3e6c837998.exe
1764	3e6c837998.exe
1764	3e6c837998.exe
1764	3e6c837998.exe
1764	3e6c837998.exe
1764	3e6c837998.exe
1764	3e6c837998.exe
1764	3e6c837998.exe
1764	3e6c837998.exe
1764	3e6c837998.exe
1764	3e6c837998.exe
1764	3e6c837998.exe
1764	3e6c837998.exe
1764	3e6c837998.exe
1764	3e6c837998.exe
1764	3e6c837998.exe
1764	3e6c837998.exe
1764	3e6c837998.exe
1764	3e6c837998.exe
1764	3e6c837998.exe
1764	3e6c837998.exe
1764	3e6c837998.exe
1764	3e6c837998.exe
1764	3e6c837998.exe
1764	3e6c837998.exe
1764	3e6c837998.exe
1764	3e6c837998.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1764	3e6c837998.exe
1764	3e6c837998.exe
1764	3e6c837998.exe
1764	3e6c837998.exe
1764	3e6c837998.exe
1764	3e6c837998.exe
1764	3e6c837998.exe
1764	3e6c837998.exe
1764	3e6c837998.exe
1764	3e6c837998.exe
1764	3e6c837998.exe
1764	3e6c837998.exe
1764	3e6c837998.exe
1764	3e6c837998.exe
1764	3e6c837998.exe
1764	3e6c837998.exe
1764	3e6c837998.exe
1764	3e6c837998.exe
1764	3e6c837998.exe
1764	3e6c837998.exe
1764	3e6c837998.exe
1764	3e6c837998.exe
1764	3e6c837998.exe
1764	3e6c837998.exe
1764	3e6c837998.exe
1764	3e6c837998.exe
1764	3e6c837998.exe
1764	3e6c837998.exe
1764	3e6c837998.exe
1764	3e6c837998.exe
1764	3e6c837998.exe
1764	3e6c837998.exe
1764	3e6c837998.exe
1764	3e6c837998.exe
1764	3e6c837998.exe
1764	3e6c837998.exe
1764	3e6c837998.exe
1764	3e6c837998.exe
1764	3e6c837998.exe
1764	3e6c837998.exe
1764	3e6c837998.exe
1764	3e6c837998.exe
1764	3e6c837998.exe
1764	3e6c837998.exe
1764	3e6c837998.exe
1764	3e6c837998.exe
1764	3e6c837998.exe
1764	3e6c837998.exe
1764	3e6c837998.exe
1764	3e6c837998.exe
1764	3e6c837998.exe
1764	3e6c837998.exe
1764	3e6c837998.exe
1764	3e6c837998.exe
1764	3e6c837998.exe
1764	3e6c837998.exe
1764	3e6c837998.exe
1764	3e6c837998.exe
1764	3e6c837998.exe
1764	3e6c837998.exe
1764	3e6c837998.exe
1764	3e6c837998.exe
1764	3e6c837998.exe
1764	3e6c837998.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2840	firefox.exe
872	cmd.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2832 wrote to memory of 3892	2832	3064d47103a72d2ca13ca5100686a5243e742ac49f104579f9de7c8c887ae81d.exe	82
PID 2832 wrote to memory of 3892	2832	3064d47103a72d2ca13ca5100686a5243e742ac49f104579f9de7c8c887ae81d.exe	82
PID 2832 wrote to memory of 3892	2832	3064d47103a72d2ca13ca5100686a5243e742ac49f104579f9de7c8c887ae81d.exe	82
PID 3892 wrote to memory of 5072	3892	explorti.exe	83
PID 3892 wrote to memory of 5072	3892	explorti.exe	83
PID 3892 wrote to memory of 5072	3892	explorti.exe	83
PID 5072 wrote to memory of 1212	5072	ba7e389ac8.exe	85
PID 5072 wrote to memory of 1212	5072	ba7e389ac8.exe	85
PID 5072 wrote to memory of 1212	5072	ba7e389ac8.exe	85
PID 5072 wrote to memory of 1212	5072	ba7e389ac8.exe	85
PID 5072 wrote to memory of 1212	5072	ba7e389ac8.exe	85
PID 5072 wrote to memory of 1212	5072	ba7e389ac8.exe	85
PID 5072 wrote to memory of 1212	5072	ba7e389ac8.exe	85
PID 5072 wrote to memory of 1212	5072	ba7e389ac8.exe	85
PID 5072 wrote to memory of 1212	5072	ba7e389ac8.exe	85
PID 3892 wrote to memory of 1764	3892	explorti.exe	87
PID 3892 wrote to memory of 1764	3892	explorti.exe	87
PID 3892 wrote to memory of 1764	3892	explorti.exe	87
PID 1764 wrote to memory of 4996	1764	3e6c837998.exe	88
PID 1764 wrote to memory of 4996	1764	3e6c837998.exe	88
PID 4996 wrote to memory of 2840	4996	firefox.exe	91
PID 4996 wrote to memory of 2840	4996	firefox.exe	91
PID 4996 wrote to memory of 2840	4996	firefox.exe	91
PID 4996 wrote to memory of 2840	4996	firefox.exe	91
PID 4996 wrote to memory of 2840	4996	firefox.exe	91
PID 4996 wrote to memory of 2840	4996	firefox.exe	91
PID 4996 wrote to memory of 2840	4996	firefox.exe	91
PID 4996 wrote to memory of 2840	4996	firefox.exe	91
PID 4996 wrote to memory of 2840	4996	firefox.exe	91
PID 4996 wrote to memory of 2840	4996	firefox.exe	91
PID 4996 wrote to memory of 2840	4996	firefox.exe	91
PID 2840 wrote to memory of 388	2840	firefox.exe	92
PID 2840 wrote to memory of 388	2840	firefox.exe	92
PID 2840 wrote to memory of 388	2840	firefox.exe	92
PID 2840 wrote to memory of 388	2840	firefox.exe	92
PID 2840 wrote to memory of 388	2840	firefox.exe	92
PID 2840 wrote to memory of 388	2840	firefox.exe	92
PID 2840 wrote to memory of 388	2840	firefox.exe	92
PID 2840 wrote to memory of 388	2840	firefox.exe	92
PID 2840 wrote to memory of 388	2840	firefox.exe	92
PID 2840 wrote to memory of 388	2840	firefox.exe	92
PID 2840 wrote to memory of 388	2840	firefox.exe	92
PID 2840 wrote to memory of 388	2840	firefox.exe	92
PID 2840 wrote to memory of 388	2840	firefox.exe	92
PID 2840 wrote to memory of 388	2840	firefox.exe	92
PID 2840 wrote to memory of 388	2840	firefox.exe	92
PID 2840 wrote to memory of 388	2840	firefox.exe	92
PID 2840 wrote to memory of 388	2840	firefox.exe	92
PID 2840 wrote to memory of 388	2840	firefox.exe	92
PID 2840 wrote to memory of 388	2840	firefox.exe	92
PID 2840 wrote to memory of 388	2840	firefox.exe	92
PID 2840 wrote to memory of 388	2840	firefox.exe	92
PID 2840 wrote to memory of 388	2840	firefox.exe	92
PID 2840 wrote to memory of 388	2840	firefox.exe	92
PID 2840 wrote to memory of 388	2840	firefox.exe	92
PID 2840 wrote to memory of 388	2840	firefox.exe	92
PID 2840 wrote to memory of 388	2840	firefox.exe	92
PID 2840 wrote to memory of 388	2840	firefox.exe	92
PID 2840 wrote to memory of 388	2840	firefox.exe	92
PID 2840 wrote to memory of 388	2840	firefox.exe	92
PID 2840 wrote to memory of 388	2840	firefox.exe	92
PID 2840 wrote to memory of 388	2840	firefox.exe	92
PID 2840 wrote to memory of 388	2840	firefox.exe	92
PID 2840 wrote to memory of 388	2840	firefox.exe	92

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\3064d47103a72d2ca13ca5100686a5243e742ac49f104579f9de7c8c887ae81d.exe
"C:\Users\Admin\AppData\Local\Temp\3064d47103a72d2ca13ca5100686a5243e742ac49f104579f9de7c8c887ae81d.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2832
- C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
  "C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3892
- - C:\Users\Admin\AppData\Local\Temp\1000006001\ba7e389ac8.exe
    "C:\Users\Admin\AppData\Local\Temp\1000006001\ba7e389ac8.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:5072
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      Loads dropped DLL
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      PID:1212
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\KEGCFCAKFH.exe"
        5⤵
        
        PID:2020
      - C:\Users\Admin\AppData\Local\Temp\KEGCFCAKFH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\KEGCFCAKFH.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        
        PID:2984
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\EBAEBFIIEC.exe"
        5⤵
        Suspicious use of SetWindowsHookEx
        
        PID:872
- - C:\Users\Admin\AppData\Local\Temp\1000011001\3e6c837998.exe
    "C:\Users\Admin\AppData\Local\Temp\1000011001\3e6c837998.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:1764
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4996
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
        5⤵
        Checks processor information in registry
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2840
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1996 -parentBuildID 20240401114208 -prefsHandle 1924 -prefMapHandle 1916 -prefsLen 25751 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {97db7b11-8391-44dd-91d0-0e22593edf25} 2840 "\\.\pipe\gecko-crash-server-pipe.2840" gpu
        6⤵
        
        PID:388
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2416 -parentBuildID 20240401114208 -prefsHandle 2400 -prefMapHandle 2396 -prefsLen 26671 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {06fb3a59-e246-49ea-a113-5bd1c12f7cf7} 2840 "\\.\pipe\gecko-crash-server-pipe.2840" socket
        6⤵
        
        PID:4184
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1668 -childID 1 -isForBrowser -prefsHandle 3144 -prefMapHandle 2928 -prefsLen 22698 -prefMapSize 244658 -jsInitHandle 1216 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8d3948b2-4c5d-43c8-b9d8-01d7cc8ceee6} 2840 "\\.\pipe\gecko-crash-server-pipe.2840" tab
        6⤵
        
        PID:1748
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3932 -childID 2 -isForBrowser -prefsHandle 3924 -prefMapHandle 3920 -prefsLen 31161 -prefMapSize 244658 -jsInitHandle 1216 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4bb3df81-2f83-4113-a63d-d76586e3eb60} 2840 "\\.\pipe\gecko-crash-server-pipe.2840" tab
        6⤵
        
        PID:1452
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4888 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4688 -prefMapHandle 1556 -prefsLen 31161 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b1063c37-1b65-4204-a4a5-93d6df110813} 2840 "\\.\pipe\gecko-crash-server-pipe.2840" utility
        6⤵
        Checks processor information in registry
        
        PID:5400
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5228 -childID 3 -isForBrowser -prefsHandle 5288 -prefMapHandle 5196 -prefsLen 26990 -prefMapSize 244658 -jsInitHandle 1216 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {912ab84c-3d97-46ed-a54c-bb57dc3f3b8d} 2840 "\\.\pipe\gecko-crash-server-pipe.2840" tab
        6⤵
        
        PID:5736
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5428 -childID 4 -isForBrowser -prefsHandle 5436 -prefMapHandle 5440 -prefsLen 26990 -prefMapSize 244658 -jsInitHandle 1216 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3bce48ae-d271-48ea-ae74-9b7955e74140} 2840 "\\.\pipe\gecko-crash-server-pipe.2840" tab
        6⤵
        
        PID:5748
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5644 -childID 5 -isForBrowser -prefsHandle 5720 -prefMapHandle 5716 -prefsLen 26990 -prefMapSize 244658 -jsInitHandle 1216 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {07dc75b4-9405-4011-b038-06825e20be44} 2840 "\\.\pipe\gecko-crash-server-pipe.2840" tab
        6⤵
        
        PID:5760

C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4700

C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mozglue.dll

Path C:\ProgramData\mozglue.dll
Size 593KB
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
SSDEEP 12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5 SHA1 SHA512 SSDEEP

Submit Download

nss3.dll

Path C:\ProgramData\nss3.dll
Size 2.0MB
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
SSDEEP 49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5 SHA1 SHA512 SSDEEP

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\s6dardkt.default-release\activity-stream.discovery_stream.json
Size 24KB
SHA256 76d19c83bc14ad92e9d5a8d4ba3a87c5d494229d17d02301fdb951d2e030ab79
MD5 03d6e80008679bfa090920973d21f0d9
SHA1 8824fe6f66bb568381aa62e2db111e687ddbd739
SHA512 dfc6d5c98345ff8b23fccc24292a30c0aa20faf8aaa13081e6e70ae542cc1c7f402f14744ac52aa30ede4c01dbb09a7c32bb11adce770e09ac6e703f1c0d90af
SSDEEP 384:V50AJ6XxGgpYnEBT1PkejX+/AZ3rEdJw2SrcP9mUHKPTAlcxBk0yauoWaOQG:VdJDgoE7xlZ3CJw2ECKPTA6k0ydoWadG
MD5 SHA1 SHA512 SSDEEP

Submit Download

8A2034D325DC0B5C9E11EDDA3FC70A54C8DC1C0D

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\s6dardkt.default-release\cache2\entries\8A2034D325DC0B5C9E11EDDA3FC70A54C8DC1C0D
Size 13KB
SHA256 3d60e72f123164315a879b327f07259c6932bdcf4d00012c6aceebd1464f0bc0
MD5 3e9528b59e9d316ed03692ace35e5551
SHA1 d21b2bdd03f0a61b94537aeb93ef80b9153b53ff
SHA512 b3346ff0eadb0edfb154d12562eb3e1a1dbe4bce23bbb2dfb9e5ebd604c14da8e7a0b763b5efd67e068ca54a940d662fc1daf30a627fdfc4e00fefb4d2b207ab
SSDEEP 384:H485u9fiGLm4pUdft2WlOX8lPLZZB7t0lpDIIJjFjc:nUBi8mCUdft2WAX8tzB7eD81
MD5 SHA1 SHA512 SSDEEP

Submit Download

ba7e389ac8.exe

Path C:\Users\Admin\AppData\Local\Temp\1000006001\ba7e389ac8.exe
Size 370KB
SHA256 f15a1ea66357015df906e30343a67b916e8eed6f542bb9f6a53acaf5ce2849b2
MD5 0a191d15dda81d6110b4fc7c6a24515a
SHA1 50a6ed243451de7764afff537a980d93db20f898
SHA512 52119fe330a3a345c2d0108234668bf239e12875b73b98ac743d00c976de586f1ad8a05b3c9a21a0244f32932f3278f7b85885a38cf8ed9fb398df733db36751
SSDEEP 6144:UTVLdeErsZ/lyvUpo9lqXPT2OL32bkj+7Gt19y/qSp9hdqee:6LgErJ4mbdG/8zFe
MD5 SHA1 SHA512 SSDEEP

Submit Download

3e6c837998.exe

Path C:\Users\Admin\AppData\Local\Temp\1000011001\3e6c837998.exe
Size 1.2MB
SHA256 fd23e8256af3967b6da8cadaf04f978b99ff3da9a94c461f27102371d2e38066
MD5 5c9b00a2be3c3962ff62d3caeada8c78
SHA1 d28f04fd446fb7ee12d7a2c0e37d179b5339a307
SHA512 15342faf2e2075f76119aa2fd0794c705e646ceca9a3cb063eb1a58d7c60a9dd33afbc1ee4bd7250b51bd65ead102dffd27da602b53495e457eb51ab2d721199
SSDEEP 24576:fqDEvCTbMWu7rQYlBQcBiT6rprG8aLA2Sbly7TWEPje:fTvC/MTQYxsWR7aLA2dW
MD5 SHA1 SHA512 SSDEEP

Submit Download

explorti.exe

Path C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
Size 1.8MB
SHA256 3064d47103a72d2ca13ca5100686a5243e742ac49f104579f9de7c8c887ae81d
MD5 f46ac068eb7969f2460b0ab97419fc30
SHA1 0c1f1b100b8934ee0c34dd37972bada3dd1d87f0
SHA512 a13c33e34a67106a87158038e455328afe30f805d8bbd6ffc5b68527a84659019ee9900a0aea0be50f43cf5abd92c8ef79cf2c928ed6e3a1f355060d7ce755ec
SSDEEP 49152:YOZEnmKpaDHQqQQnhgduQavKgOxxd5pmcV9W2upKG5q/:Y7paEqQQnYAvOpbznEKG5q
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 479KB
SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
MD5 09372174e83dbbf696ee732fd2e875bb
SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 13.8MB
SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
MD5 0a8747a2ac9ac08ae9508f36c6d75692
SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s6dardkt.default-release\AlternateServices.bin
Size 6KB
SHA256 58f3feaf3b8c9bd5433b2beff8ec64758c9b7d4ef724336414fa7deb943f55ab
MD5 20225ba4e423f038519f3a888fa3270e
SHA1 869e97534015933ddd6d0fc38c0a3626d808250c
SHA512 3144396ef947b9916157afcf6101471fe312a68a66b15d0f11a62050837f0b2ff600b35e7cc060bbf834a42a2e09b0ef02e30b07c9b50e28a91a59dc277e2782
SSDEEP 24:RuB1ouYeFsh2F3LFiYYJgu1xgRbVHYBpR5cOVoYUuhMZn:aYnYYJ5opYB9cOVoYg
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s6dardkt.default-release\AlternateServices.bin
Size 8KB
SHA256 d569f70589195d7c7bd20e9909575592ebf9384aaed4151be157ad527ebf8012
MD5 cb3a3381bb0de9be855923d689094e86
SHA1 662c281823fa8078a3e72c4e1581bfa99c3e818f
SHA512 a29c66191fe992119bcc888d4d5591022dfd2faf563a8c050abb54c213c22202c6d81882f595cc5aecdda1478c63c1da87e39aec7b9fede44275315333503778
SSDEEP 48:CYM/YJ5o73YB9cOuJYggsebOJ9Pb2Jpebvpf+qb:1lJ5oUZtsebOJBb2Jpebvpf+qb
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s6dardkt.default-release\datareporting\glean\db\data.safe.tmp
Size 15KB
SHA256 00acc6614698cd03a2e31b6d4fb19e23eefda40dad15189980c22f7cbd065848
MD5 50ed111e91e0ab1d2354092678c526c4
SHA1 cdf1f8082d3490b787bad3ee3b6b9a3349cd383a
SHA512 fa78d01131fe88ff2956e25639b3c7c0b3d7ea749eecfdbd17eb950dffd816b76825e01a3a8ceb6f3d95433263f94d3d20135504b1b2fc08e7af11e5ca2ef25c
SSDEEP 384:xp/66JozQzgC1btboNP1PnBF1jIwZD+LWEbWbfeH:SmbQ5F6OD+LWEbWbmH
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s6dardkt.default-release\datareporting\glean\db\data.safe.tmp
Size 15KB
SHA256 4ebf0e886ca7660bfa50c23085f20c1df7a3e7565bbec3b42caba47ec62e1fb2
MD5 93cf8005839f514f97dc33a35acf6aae
SHA1 71c4623e6e3af8d3430e7e7fe69376ae9bf3f06d
SHA512 a63f076fca79bcaaa0a2d8e02fb02677c2ed1a55bafcb70f9a9daff538558dcf22c7557179fa81f199729b6224d0f88f239a6459d2cac6929841c6f81462c640
SSDEEP 384:mBF1jIwZD+LWEbWbfeTboN1Pep/66JozQzgC1bM:YF6OD+LWEbWbmnwHmm
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s6dardkt.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 98a95a20f02627fa692bd38c8d62cb23c0197c11cf5db306bde5a685d53cc6d0
MD5 e2f355e18a92ea0788c242c19b413366
SHA1 4f8bb500cf30f598f379275a9a221fe96279ab92
SHA512 77d8166998d1860cf33c391c04a632bd4f6e801289a7564b56fbdd652e7e7a629760da516e50872b10ed1505669a3d4cb7652c88316086c59256b84caa2cb5de
SSDEEP 96:KMnQDtv/Fl66Joz0dzgClKtmSSkB0SMF9ZbkW6QX0BBthmNyPP/PrWI:Kp/66Joz0dzgCl6mSSvrvZboHthk0PCI
MD5 SHA1 SHA512 SSDEEP

Submit Download

0b03e745-16f3-4cb2-b325-18f776939994

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s6dardkt.default-release\datareporting\glean\pending_pings\0b03e745-16f3-4cb2-b325-18f776939994
Size 23KB
SHA256 810d9a51302a4fab1661c3c6074b8eb29e3012e4e31247e08008e3d479e5f82a
MD5 6dd845587d94e628e563092c606fe029
SHA1 c153507a64406f2afb9dabbd1f8fadccacdfa3fc
SHA512 3cd7cca207f583ab86dd9b3f8aabeedc58fe09aaf1419466e4b52dc34272ba1fb64bc0e72c0ce1708babedbc77b939412de271b8d0259cad99ad87ddfb7729c9
SSDEEP 192:A1x2goIYBPRpRs5NJxV1oonQJY24RR2//+aSmWTPIxJCQOiYS0F+k9KgnStMk4Cz:A15ZYBe/o5l+tJjk+Ttk7nfb1FicB
MD5 SHA1 SHA512 SSDEEP

Submit Download

3d9d49c6-2bf3-431e-bbea-b0f62b9cdad3

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s6dardkt.default-release\datareporting\glean\pending_pings\3d9d49c6-2bf3-431e-bbea-b0f62b9cdad3
Size 982B
SHA256 b107ca983cde43eb38ab75fef7dd5a76aea41f5e42b0c4d442a8d2bb33cdb907
MD5 b185a115ba0b234b11318f7175003f4a
SHA1 04917afc657bc7734d908df89c4484774aa1d8fe
SHA512 5eb91efc4f0c1895fa3c6ef11ad28370c680c114db664a8f7ade615f0f4c28cd9c3d4dbbc60961ffd4acebad0894cf852b9c4942b65a0f2a83ef4a4980ede989
MD5 SHA1 SHA512

Submit Download

5279bee4-3a8f-42d6-81ce-950e7c86c5c0

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s6dardkt.default-release\datareporting\glean\pending_pings\5279bee4-3a8f-42d6-81ce-950e7c86c5c0
Size 671B
SHA256 a0f2b497b7f3f65bde6aa7a223eedf2a50131eb26c92231ad90e844ee862f4ba
MD5 c55d6a0554c42c91354381b6464bea8e
SHA1 195ecbd68c8fbf53efdbf8e50bd91132b09caa29
SHA512 a5db577991ae827cfe476b545f06b036bc56fd908dfa2bcda6e4778eda9e43a5eeff8704a67477ea39dab0752df7839861a4878ecc12970c6e4fb25c101089f1
MD5 SHA1 SHA512

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s6dardkt.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Size 1.1MB
SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
MD5 842039753bf41fa5e11b3a1383061a87
SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s6dardkt.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Size 116B
SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
MD5 2a461e9eb87fd1955cea740a3444ee7a
SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s6dardkt.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Size 372B
SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
MD5 bf957ad58b55f64219ab3f793e374316
SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s6dardkt.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Size 17.8MB
SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
MD5 daf7ef3acccab478aaa7d6dc1c60f865
SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s6dardkt.default-release\prefs-1.js
Size 12KB
SHA256 aaad47cce392ba78b281bbd8e88307877fc1e1675d4ea65fec7f1228256fe9a7
MD5 342a2fdc8cbce5ab1d82c38e87d23d3d
SHA1 10c10d3baceb610373ac4953f99552623072bb10
SHA512 a3dc71ed4be277720ca9de7323e4d5015d9ba004b6f5910b2630e27be0c18eab9aebec0d778f0405bcde9334c2e8d3be59f9d477faa54aa85a78f598a3377403
SSDEEP 192:fK5nU1RJ2fyFMrX0z4gGhJ1Dcdpz6OQHrsi609aXa+loBw8H3f5mC:TEhX0z4gGu3zVQLQi6ews5mC
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s6dardkt.default-release\prefs.js
Size 14KB
SHA256 3ca313e52f435c0cdcfaf12fad54cfaf044c7b23a045aabcd04d86d7b366c045
MD5 3b612ec57debbc77333ad647f90c6c4a
SHA1 460358fcc2a88fdd8782f69529a1bccaa4b5b516
SHA512 d3fc332f37adfe071e53be9ace78709cb62a4dd7ca7969cb5deaaed40677f8f6bf8b8dd59e8e14c94ee963770138f23bc877ad0e3d7e28a966c59b49b91e94df
SSDEEP 192:fK6nU1RJ2fnFMrX0z4gGhJ1Dcdpz6OQHrsi609aXa+lTdlXEiBw8H3f5Ppx:IESX0z4gGu3zVQLQi6TdlXEwws5Pn
MD5 SHA1 SHA512 SSDEEP

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s6dardkt.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 2.1MB
SHA256 d641842c05cf0e2e56bc49dc817bc76b770457d2ecb6e2a8596bf129c2fde06e
MD5 6aa2051fc362369c2a4eadbe70134456
SHA1 a7ef5fa138e07834cd3760a8eb5f39cfaf9b8eea
SHA512 f8fd2e2084723e47aa78740c9543b4927ec9be1a939a7ba1d7a8e4fa3593e6fde20c0dc527e49d192878d92dca7b261f1664af7f1b06e6a2e5ce644f48d9499b
SSDEEP 12288:1eOzxInjJH8HOZGj0zpaQkBqA2oKxNfSeV0kU:8v1c1j0zpFuqA2oKxx/
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1212-43-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Download

memory/1212-40-0x0000000000400000-0x000000000063C000-memory.dmp

Download

memory/1212-37-0x0000000000400000-0x000000000063C000-memory.dmp

Download

memory/1212-81-0x0000000000400000-0x000000000063C000-memory.dmp

Download

memory/1212-424-0x0000000000400000-0x000000000063C000-memory.dmp

Download

memory/1212-41-0x0000000000400000-0x000000000063C000-memory.dmp

Download

memory/2832-3-0x0000000000E50000-0x0000000001318000-memory.dmp

Download

memory/2832-2-0x0000000000E51000-0x0000000000E7F000-memory.dmp

Download

memory/2832-5-0x0000000000E50000-0x0000000001318000-memory.dmp

Download

memory/2832-0-0x0000000000E50000-0x0000000001318000-memory.dmp

Download

memory/2832-1-0x0000000077D96000-0x0000000077D98000-memory.dmp

Download

memory/2832-17-0x0000000000E50000-0x0000000001318000-memory.dmp

Download

memory/2984-452-0x0000000000300000-0x00000000007C8000-memory.dmp

Download

memory/2984-433-0x0000000000300000-0x00000000007C8000-memory.dmp

Download

memory/3892-42-0x0000000000EB0000-0x0000000001378000-memory.dmp

Download

memory/3892-715-0x0000000000EB0000-0x0000000001378000-memory.dmp

Download

memory/3892-18-0x0000000000EB0000-0x0000000001378000-memory.dmp

Download

memory/3892-19-0x0000000000EB1000-0x0000000000EDF000-memory.dmp

Download

memory/3892-504-0x0000000000EB0000-0x0000000001378000-memory.dmp

Download

memory/3892-509-0x0000000000EB0000-0x0000000001378000-memory.dmp

Download

memory/3892-20-0x0000000000EB0000-0x0000000001378000-memory.dmp

Download

memory/3892-21-0x0000000000EB0000-0x0000000001378000-memory.dmp

Download

memory/3892-2840-0x0000000000EB0000-0x0000000001378000-memory.dmp

Download

memory/3892-59-0x0000000000EB0000-0x0000000001378000-memory.dmp

Download

memory/3892-95-0x0000000000EB0000-0x0000000001378000-memory.dmp

Download

memory/3892-85-0x0000000000EB0000-0x0000000001378000-memory.dmp

Download

memory/3892-2115-0x0000000000EB0000-0x0000000001378000-memory.dmp

Download

memory/3892-432-0x0000000000EB0000-0x0000000001378000-memory.dmp

Download

memory/3892-1898-0x0000000000EB0000-0x0000000001378000-memory.dmp

Download

memory/3892-80-0x0000000000EB0000-0x0000000001378000-memory.dmp

Download

memory/3892-79-0x0000000000EB0000-0x0000000001378000-memory.dmp

Download

memory/3892-78-0x0000000000EB0000-0x0000000001378000-memory.dmp

Download

memory/3892-77-0x0000000000EB0000-0x0000000001378000-memory.dmp

Download

memory/3892-1615-0x0000000000EB0000-0x0000000001378000-memory.dmp

Download

memory/3892-1008-0x0000000000EB0000-0x0000000001378000-memory.dmp

Download

memory/3968-957-0x0000000000EB0000-0x0000000001378000-memory.dmp

Download

memory/3968-894-0x0000000000EB0000-0x0000000001378000-memory.dmp

Download

memory/4700-83-0x0000000000EB0000-0x0000000001378000-memory.dmp

Download

memory/4700-84-0x0000000000EB0000-0x0000000001378000-memory.dmp

Download

memory/5072-38-0x0000000002790000-0x0000000002791000-memory.dmp

Download