amadey | c7d2ab3def4b44c1dd3bf44b7138c414c0dc43d2df804bc7e5dadfc6f2f4f523

Analysis

max time kernel
150s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
09/08/2024, 12:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c7d2ab3def4b44c1dd3bf44b7138c414c0dc43d2df804bc7e5dadfc6f2f4f523.exe
Size 1.8MB
Sample240809-n9r62athnd
SHA256 c7d2ab3def4b44c1dd3bf44b7138c414c0dc43d2df804bc7e5dadfc6f2f4f523
MD5 8fb650bf6b6121ba35ee8c9575525b07
SHA1 f4234446dd38152675b5524192cd998a061bde97
SHA512 6f887017da5fada6a4270888d0466deb250d9dbd2a66bbef811aee81836124199462593a18736c2a1cc2e3e4f8f402134502f4d97664ed2a24b15bd95d452ef0
SSDEEP 49152:yC5ZV/O5Z7G8QEn6qrvYFuB+gOg0IkOK:X5f/O5tQEn63S+gOgB
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey stealc 0657d1 kora credential_access discovery evasion persistence stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

0657d1

http://185.215.113.19

Attributes

install_dir
0d8f5eb8a7
install_file
explorti.exe
strings_key
6c55a5f34bb433fbd933a168577b1838
url_paths
/Vi9leo/index.php

rc4.plain

Extracted

Family

stealc

Botnet

kora

http://185.215.113.100

Attributes

url_path
/e2b1563c6670f193.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Stealc
Stealc is an infostealer written in C++.
stealer stealc
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	c7d2ab3def4b44c1dd3bf44b7138c414c0dc43d2df804bc7e5dadfc6f2f4f523.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 8 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	c7d2ab3def4b44c1dd3bf44b7138c414c0dc43d2df804bc7e5dadfc6f2f4f523.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	c7d2ab3def4b44c1dd3bf44b7138c414c0dc43d2df804bc7e5dadfc6f2f4f523.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe

Executes dropped EXE 6 IoCs

pid	Process
2200	explorti.exe
2080	2113bf8214.exe
6136	4ae704e5ea.exe
2380	410caa2637.exe
5456	explorti.exe
2084	explorti.exe

Identifies Wine through registry keys 2 TTPs 4 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1735401866-3802634615-1355934272-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-1735401866-3802634615-1355934272-1000\Software\Wine	c7d2ab3def4b44c1dd3bf44b7138c414c0dc43d2df804bc7e5dadfc6f2f4f523.exe
Key opened	\REGISTRY\USER\S-1-5-21-1735401866-3802634615-1355934272-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-1735401866-3802634615-1355934272-1000\Software\Wine	explorti.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1735401866-3802634615-1355934272-1000\Software\Microsoft\Windows\CurrentVersion\Run\2113bf8214.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000036001\\2113bf8214.exe"	explorti.exe

AutoIT Executable 14 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/2080-431-0x0000000000FC0000-0x0000000001AA1000-memory.dmp	autoit_exe
behavioral2/memory/2080-450-0x0000000000FC0000-0x0000000001AA1000-memory.dmp	autoit_exe
behavioral2/memory/2080-576-0x0000000000FC0000-0x0000000001AA1000-memory.dmp	autoit_exe
behavioral2/memory/2080-1353-0x0000000000FC0000-0x0000000001AA1000-memory.dmp	autoit_exe
behavioral2/memory/2080-2454-0x0000000000FC0000-0x0000000001AA1000-memory.dmp	autoit_exe
behavioral2/memory/2080-2600-0x0000000000FC0000-0x0000000001AA1000-memory.dmp	autoit_exe
behavioral2/memory/2080-2610-0x0000000000FC0000-0x0000000001AA1000-memory.dmp	autoit_exe
behavioral2/memory/2080-2612-0x0000000000FC0000-0x0000000001AA1000-memory.dmp	autoit_exe
behavioral2/memory/2080-2614-0x0000000000FC0000-0x0000000001AA1000-memory.dmp	autoit_exe
behavioral2/memory/2080-2616-0x0000000000FC0000-0x0000000001AA1000-memory.dmp	autoit_exe
behavioral2/memory/2080-2621-0x0000000000FC0000-0x0000000001AA1000-memory.dmp	autoit_exe
behavioral2/memory/2080-2623-0x0000000000FC0000-0x0000000001AA1000-memory.dmp	autoit_exe
behavioral2/memory/2080-2630-0x0000000000FC0000-0x0000000001AA1000-memory.dmp	autoit_exe
behavioral2/memory/2080-2632-0x0000000000FC0000-0x0000000001AA1000-memory.dmp	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 20 IoCs

pid	Process
5520	c7d2ab3def4b44c1dd3bf44b7138c414c0dc43d2df804bc7e5dadfc6f2f4f523.exe
2200	explorti.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
5456	explorti.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
2084	explorti.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
2080	2113bf8214.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 6136 set thread context of 2556	6136	4ae704e5ea.exe	92

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\explorti.job	c7d2ab3def4b44c1dd3bf44b7138c414c0dc43d2df804bc7e5dadfc6f2f4f523.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	410caa2637.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c7d2ab3def4b44c1dd3bf44b7138c414c0dc43d2df804bc7e5dadfc6f2f4f523.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorti.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2113bf8214.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4ae704e5ea.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1735401866-3802634615-1355934272-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5520	c7d2ab3def4b44c1dd3bf44b7138c414c0dc43d2df804bc7e5dadfc6f2f4f523.exe
5520	c7d2ab3def4b44c1dd3bf44b7138c414c0dc43d2df804bc7e5dadfc6f2f4f523.exe
2200	explorti.exe
2200	explorti.exe
5456	explorti.exe
5456	explorti.exe
2084	explorti.exe
2084	explorti.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4164	firefox.exe
Token: SeDebugPrivilege	4164	firefox.exe
Token: SeDebugPrivilege	4164	firefox.exe
Token: SeDebugPrivilege	4164	firefox.exe
Token: SeDebugPrivilege	4164	firefox.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5520	c7d2ab3def4b44c1dd3bf44b7138c414c0dc43d2df804bc7e5dadfc6f2f4f523.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
4164	firefox.exe
4164	firefox.exe
4164	firefox.exe
4164	firefox.exe
2080	2113bf8214.exe
4164	firefox.exe
4164	firefox.exe
4164	firefox.exe
4164	firefox.exe
4164	firefox.exe
4164	firefox.exe
4164	firefox.exe
4164	firefox.exe
4164	firefox.exe
4164	firefox.exe
4164	firefox.exe
4164	firefox.exe
4164	firefox.exe
4164	firefox.exe
4164	firefox.exe
4164	firefox.exe
4164	firefox.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
2080	2113bf8214.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2080	2113bf8214.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
2080	2113bf8214.exe
2080	2113bf8214.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2080	2113bf8214.exe
4164	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5520 wrote to memory of 2200	5520	c7d2ab3def4b44c1dd3bf44b7138c414c0dc43d2df804bc7e5dadfc6f2f4f523.exe	83
PID 5520 wrote to memory of 2200	5520	c7d2ab3def4b44c1dd3bf44b7138c414c0dc43d2df804bc7e5dadfc6f2f4f523.exe	83
PID 5520 wrote to memory of 2200	5520	c7d2ab3def4b44c1dd3bf44b7138c414c0dc43d2df804bc7e5dadfc6f2f4f523.exe	83
PID 2200 wrote to memory of 2080	2200	explorti.exe	89
PID 2200 wrote to memory of 2080	2200	explorti.exe	89
PID 2200 wrote to memory of 2080	2200	explorti.exe	89
PID 2200 wrote to memory of 6136	2200	explorti.exe	91
PID 2200 wrote to memory of 6136	2200	explorti.exe	91
PID 2200 wrote to memory of 6136	2200	explorti.exe	91
PID 6136 wrote to memory of 2556	6136	4ae704e5ea.exe	92
PID 6136 wrote to memory of 2556	6136	4ae704e5ea.exe	92
PID 6136 wrote to memory of 2556	6136	4ae704e5ea.exe	92
PID 6136 wrote to memory of 2556	6136	4ae704e5ea.exe	92
PID 6136 wrote to memory of 2556	6136	4ae704e5ea.exe	92
PID 6136 wrote to memory of 2556	6136	4ae704e5ea.exe	92
PID 6136 wrote to memory of 2556	6136	4ae704e5ea.exe	92
PID 6136 wrote to memory of 2556	6136	4ae704e5ea.exe	92
PID 6136 wrote to memory of 2556	6136	4ae704e5ea.exe	92
PID 2200 wrote to memory of 2380	2200	explorti.exe	93
PID 2200 wrote to memory of 2380	2200	explorti.exe	93
PID 2200 wrote to memory of 2380	2200	explorti.exe	93
PID 2080 wrote to memory of 5056	2080	2113bf8214.exe	94
PID 2080 wrote to memory of 5056	2080	2113bf8214.exe	94
PID 5056 wrote to memory of 4164	5056	firefox.exe	97
PID 5056 wrote to memory of 4164	5056	firefox.exe	97
PID 5056 wrote to memory of 4164	5056	firefox.exe	97
PID 5056 wrote to memory of 4164	5056	firefox.exe	97
PID 5056 wrote to memory of 4164	5056	firefox.exe	97
PID 5056 wrote to memory of 4164	5056	firefox.exe	97
PID 5056 wrote to memory of 4164	5056	firefox.exe	97
PID 5056 wrote to memory of 4164	5056	firefox.exe	97
PID 5056 wrote to memory of 4164	5056	firefox.exe	97
PID 5056 wrote to memory of 4164	5056	firefox.exe	97
PID 5056 wrote to memory of 4164	5056	firefox.exe	97
PID 4164 wrote to memory of 5144	4164	firefox.exe	98
PID 4164 wrote to memory of 5144	4164	firefox.exe	98
PID 4164 wrote to memory of 5144	4164	firefox.exe	98
PID 4164 wrote to memory of 5144	4164	firefox.exe	98
PID 4164 wrote to memory of 5144	4164	firefox.exe	98
PID 4164 wrote to memory of 5144	4164	firefox.exe	98
PID 4164 wrote to memory of 5144	4164	firefox.exe	98
PID 4164 wrote to memory of 5144	4164	firefox.exe	98
PID 4164 wrote to memory of 5144	4164	firefox.exe	98
PID 4164 wrote to memory of 5144	4164	firefox.exe	98
PID 4164 wrote to memory of 5144	4164	firefox.exe	98
PID 4164 wrote to memory of 5144	4164	firefox.exe	98
PID 4164 wrote to memory of 5144	4164	firefox.exe	98
PID 4164 wrote to memory of 5144	4164	firefox.exe	98
PID 4164 wrote to memory of 5144	4164	firefox.exe	98
PID 4164 wrote to memory of 5144	4164	firefox.exe	98
PID 4164 wrote to memory of 5144	4164	firefox.exe	98
PID 4164 wrote to memory of 5144	4164	firefox.exe	98
PID 4164 wrote to memory of 5144	4164	firefox.exe	98
PID 4164 wrote to memory of 5144	4164	firefox.exe	98
PID 4164 wrote to memory of 5144	4164	firefox.exe	98
PID 4164 wrote to memory of 5144	4164	firefox.exe	98
PID 4164 wrote to memory of 5144	4164	firefox.exe	98
PID 4164 wrote to memory of 5144	4164	firefox.exe	98
PID 4164 wrote to memory of 5144	4164	firefox.exe	98
PID 4164 wrote to memory of 5144	4164	firefox.exe	98
PID 4164 wrote to memory of 5144	4164	firefox.exe	98
PID 4164 wrote to memory of 5144	4164	firefox.exe	98
PID 4164 wrote to memory of 5144	4164	firefox.exe	98
PID 4164 wrote to memory of 5144	4164	firefox.exe	98

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\c7d2ab3def4b44c1dd3bf44b7138c414c0dc43d2df804bc7e5dadfc6f2f4f523.exe
"C:\Users\Admin\AppData\Local\Temp\c7d2ab3def4b44c1dd3bf44b7138c414c0dc43d2df804bc7e5dadfc6f2f4f523.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5520
- C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
  "C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2200
- - C:\Users\Admin\AppData\Local\Temp\1000036001\2113bf8214.exe
    "C:\Users\Admin\AppData\Local\Temp\1000036001\2113bf8214.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2080
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5056
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
        5⤵
        Checks processor information in registry
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4164
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2000 -parentBuildID 20240401114208 -prefsHandle 1912 -prefMapHandle 1904 -prefsLen 23678 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b649e11b-87c9-45d8-a0cd-87832241b857} 4164 "\\.\pipe\gecko-crash-server-pipe.4164" gpu
        6⤵
        
        PID:5144
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2412 -parentBuildID 20240401114208 -prefsHandle 2404 -prefMapHandle 2392 -prefsLen 24598 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1dbf23de-0724-416b-bd2d-ebfcfde7e1a9} 4164 "\\.\pipe\gecko-crash-server-pipe.4164" socket
        6⤵
        
        PID:2744
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3156 -childID 1 -isForBrowser -prefsHandle 3104 -prefMapHandle 2968 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 948 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fa32504d-7a8c-46bd-b344-bbfb802db391} 4164 "\\.\pipe\gecko-crash-server-pipe.4164" tab
        6⤵
        
        PID:5428
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3860 -childID 2 -isForBrowser -prefsHandle 3872 -prefMapHandle 3868 -prefsLen 29088 -prefMapSize 244658 -jsInitHandle 948 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {88561610-2c0b-465f-918f-413e8d829059} 4164 "\\.\pipe\gecko-crash-server-pipe.4164" tab
        6⤵
        
        PID:1964
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4760 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4780 -prefMapHandle 4776 -prefsLen 29088 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a2679080-2a61-4bff-a759-00b3425fb63b} 4164 "\\.\pipe\gecko-crash-server-pipe.4164" utility
        6⤵
        Checks processor information in registry
        
        PID:3212
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5608 -childID 3 -isForBrowser -prefsHandle 5600 -prefMapHandle 5596 -prefsLen 27182 -prefMapSize 244658 -jsInitHandle 948 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8207d944-1b24-4c3b-9d12-a07dc1525d80} 4164 "\\.\pipe\gecko-crash-server-pipe.4164" tab
        6⤵
        
        PID:5048
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5904 -childID 4 -isForBrowser -prefsHandle 5908 -prefMapHandle 5920 -prefsLen 27182 -prefMapSize 244658 -jsInitHandle 948 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0bfd338d-8705-40c7-a62d-0febcc986e82} 4164 "\\.\pipe\gecko-crash-server-pipe.4164" tab
        6⤵
        
        PID:2896
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5884 -childID 5 -isForBrowser -prefsHandle 5936 -prefMapHandle 5932 -prefsLen 27182 -prefMapSize 244658 -jsInitHandle 948 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {38c35dea-12ac-4164-9148-9ad1ce71eecb} 4164 "\\.\pipe\gecko-crash-server-pipe.4164" tab
        6⤵
        
        PID:3328
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5772 -childID 6 -isForBrowser -prefsHandle 5600 -prefMapHandle 5516 -prefsLen 27182 -prefMapSize 244658 -jsInitHandle 948 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0dc8d234-4316-429f-8fb6-5cfa405fe577} 4164 "\\.\pipe\gecko-crash-server-pipe.4164" tab
        6⤵
        
        PID:5788
- - C:\Users\Admin\1000037002\4ae704e5ea.exe
    "C:\Users\Admin\1000037002\4ae704e5ea.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6136
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2556
- - C:\Users\Admin\AppData\Local\Temp\1000038001\410caa2637.exe
    "C:\Users\Admin\AppData\Local\Temp\1000038001\410caa2637.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2380

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5456

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4ae704e5ea.exe

Path C:\Users\Admin\1000037002\4ae704e5ea.exe
Size 270KB
SHA256 c0e4e270579d7eba3deede367bf39813ef622948f872a3fc89f7468c53190f68
MD5 625055b4c1f6fb8bbee45e96534f3c3a
SHA1 1e024ae07ebb10edb7e2ae6dc69c6b597f84b2de
SHA512 28d6f4d6921c39577063e2de755ab1171b37268c8795226cd9a969072f70678f5dd027d5725cbe167072c74b3046334c6b613fd2c5bdd7a8b747e3760c7f6bd9
SSDEEP 6144:7wbjC0Ct8cHOK+zMcHr281p73qLrOJf2vsxb05iWYUdIyPUh3r5bAFYEO:8/C0CycuK+zMKp73qLmeCbQYGJUh7RAy
MD5 SHA1 SHA512 SSDEEP

Submit Download

activity-stream.discovery_stream.json.tmp

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yel8o60i.default-release\activity-stream.discovery_stream.json.tmp
Size 18KB
SHA256 8a9053d733754e67eefb0a9e47e94d1a5af1d15a262674f653f30937e4ef96dd
MD5 41753a5af1a0ad515d45fc9a3a5fcd5c
SHA1 72630d1a8ab3b355536feae81c5fb73820b6f12c
SHA512 f0581396b9893c13dac9dc49d417c731fa61bbf9331b4921d88cc8e0528f0bf981747ff8fc489fcd04409d4f00bda6c8a434a014580a3eb1b62e591b9980910a
SSDEEP 384:nQ9TMzJbqQZUJLt1i8gYfPXO1zQYVPcbCkC8f49nlTBdC2naswya3:nQ9KV+aao2Z4rTBdC2afyE
MD5 SHA1 SHA512 SSDEEP

Submit Download

E449899591A9BC91DFBA673EC0589B51E541A88B

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yel8o60i.default-release\cache2\entries\E449899591A9BC91DFBA673EC0589B51E541A88B
Size 13KB
SHA256 2a7b0c2f15684e4b76831b1a2d9473bbb7212b9877108c3130e428c70804a342
MD5 6870e5edce5c901599c60b659ce2de12
SHA1 31d00d63d3d9570aa93969a1a70a42a1e3658110
SHA512 6d99ea25debde858e5720237dafb67ee73ffbe87c28eb7293f395c7dce7998a960f7296ddd186e27b6053ce7a71dbf0bc29a051efbd7979c4b2f5666a9081730
SSDEEP 384:H/Fu9fiGLm4pUpft2WlOX8lPLZZB7t0lpDIIIFLFn:IBi8mCUpft2WAX8tzB7eD8XJn
MD5 SHA1 SHA512 SSDEEP

Submit Download

explorti.exe

Path C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
Size 1.8MB
SHA256 c7d2ab3def4b44c1dd3bf44b7138c414c0dc43d2df804bc7e5dadfc6f2f4f523
MD5 8fb650bf6b6121ba35ee8c9575525b07
SHA1 f4234446dd38152675b5524192cd998a061bde97
SHA512 6f887017da5fada6a4270888d0466deb250d9dbd2a66bbef811aee81836124199462593a18736c2a1cc2e3e4f8f402134502f4d97664ed2a24b15bd95d452ef0
SSDEEP 49152:yC5ZV/O5Z7G8QEn6qrvYFuB+gOg0IkOK:X5f/O5tQEn63S+gOgB
MD5 SHA1 SHA512 SSDEEP

Submit Download

2113bf8214.exe

Path C:\Users\Admin\AppData\Local\Temp\1000036001\2113bf8214.exe
Size 3.1MB
SHA256 e82c9325464276eb6d1889010461d92a89f3b2bf9ee9dee5ccc904ff8b62b205
MD5 b250cf0735cf6897a27c57d26a253639
SHA1 8e981eecf8e728536d574a338aca52dbb2218bd1
SHA512 fcc7b2fdfcab8280fab69a1c4717191de5b46364262a3427965d57cbadb538c3b2ea081c3434e2b34d2b04a73ca89963e10950ed56505901f5f1ec69ce938f00
SSDEEP 49152:MWw/R13O5FDkkSjlJCd6ilqyOZ6KuU/6TrPsERWfaXfR:sJ1sSl4Blqy1vrJZX
MD5 SHA1 SHA512 SSDEEP

Submit Download

410caa2637.exe

Path C:\Users\Admin\AppData\Local\Temp\1000038001\410caa2637.exe
Size 187KB
SHA256 37257ddb1a6f309a6e9d147b5fc2551a9cae3a0e52b191b18d9465bfcb5c18eb
MD5 278ee1426274818874556aa18fd02e3a
SHA1 185a2761330024dec52134df2c8388c461451acb
SHA512 07ec6759af5b9a00d8371b9fd9b723012dd0a1614cfcc7cd51975a004f69ffb90083735e9a871a2aa0e8d28799beac53a4748f55f4dd1e7495bc7388ebf4d6a0
SSDEEP 3072:/k9W0KFj5qj6o8KaxfE54HnnGqaKl+b2n8O43tIFmpKa:/kE/j5K62aOanGqCbAq3SFAKa
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 479KB
SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
MD5 09372174e83dbbf696ee732fd2e875bb
SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 13.8MB
SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
MD5 0a8747a2ac9ac08ae9508f36c6d75692
SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yel8o60i.default-release\AlternateServices.bin
Size 10KB
SHA256 882ed4eb2e2c66a65244850156aa6630a5e7ee0f34d38f40ba8c7b34b0d76021
MD5 eb6538e00e7402270005daa43696f0c2
SHA1 e1ce5c937cff32630142e6243b33bbb73280a124
SHA512 4d6b6b3fd3aceeea0c15dbc74958bb4818bb4ff1e1b2017aede760e695fae6cf65017746180a51b1a26f8e8816665cd77d3315f3e80f3235cc65d38e65b859ea
SSDEEP 24:iuB1o7NpR5cO9Ywxgu1xgRboYwflQuhMZoYwHFsh2F3LFCYwOIWS9htKEYjpNC9i:a9cOm85oHslQsKWA7KXjpNwyjpf12i
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yel8o60i.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 c1e11b26357e5936db46347f93526924f67b30eccadab13113fe19fe01363fe6
MD5 2fd9d87d6737295069427fdfb287c5e3
SHA1 a0ad5eedb8cab714a2f3d8c722b14973ec119cbb
SHA512 fc5ee8945cd531708a042be5502d780a7e00b8c16afca0ce2068ae50ceec6abd5c2b5412a8c9c0d806224ccadbe3bd301eaa61e2214b0903ead7186462100428
SSDEEP 96:VBSSMF9ZbkW6QX0BB7hmY1PP/PrWZ1e92QuXMDFl66Joz0dzgClKtmSSM:6rvZboH7h5pPCzk1/66Joz0dzgCl6mS1
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yel8o60i.default-release\datareporting\glean\db\data.safe.tmp
Size 15KB
SHA256 36945e5c30ee682f6299000e00aa5f345aa40df8b858538263e855a12d5ceea1
MD5 5a2bfd9cc95cc62e24d755dcfbc9762a
SHA1 3b6c1be9ad29e9b8cb06417b75f8512014db1746
SHA512 f96e2d332a8f75ce3a0d3683d546d3e24e27aadb823d53658020fe788c01127e0b1c5facd8a49bf279aafc3c24f7f4bf49f62d47371cbe77388fdcb1de9308c7
SSDEEP 384:y5xgD9BNAsDzbCub3bawk1/66JozQzgC1bnbobvO5P3:PDZrDzbCub3batompbf
MD5 SHA1 SHA512 SSDEEP

Submit Download

5af52be6-a11f-4dbd-b504-f611fd6adbb0

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yel8o60i.default-release\datareporting\glean\pending_pings\5af52be6-a11f-4dbd-b504-f611fd6adbb0
Size 24KB
SHA256 da43350f3721fec8d93f8e5995359b97619b31546ee581c8c6ec09d488fbf3b8
MD5 ccb6e65b1bfea520c4464ead98864092
SHA1 2b292cf5a2e056e0b23083955feedc88f7970bf5
SHA512 60007fa402d718276348ca7bfb6eaf54b4d7016f420ffe5835074f42077e5403275dfad3d139cf5647f3011a0728b9e8dfb405cc7a025f648a621b550cd2e215
SSDEEP 192:oRewXGXnFIlU7KSzZhIP9Wp5Av3kFiQhOJJwiy0CV4BXJX6mVJa9DSLMCCZ2+Y91:oRerXnmlU7KS1DmQxgGxKBYvhnS
MD5 SHA1 SHA512 SSDEEP

Submit Download

7b596b49-5b30-439f-bb60-6535ab41fca2

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yel8o60i.default-release\datareporting\glean\pending_pings\7b596b49-5b30-439f-bb60-6535ab41fca2
Size 671B
SHA256 a4461775f5a6c6f91f91da091a408ca12c805712de780cf3aa3ba7b261796af6
MD5 37b80b8a32865058828b7e93edf355dd
SHA1 e0f7050b1380ea47e1ca5b717a044cb3d17926f4
SHA512 858fea481b1029ead85a108caf76bb05f597739da055445286d5f444691d042c489243c4f2a8bce84b2517b55c138b5f4aa59c5538b736fcf2b37abe5d52cd48
MD5 SHA1 SHA512

Submit Download

ddea7ae2-4850-45ad-923f-de387cf5fbbe

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yel8o60i.default-release\datareporting\glean\pending_pings\ddea7ae2-4850-45ad-923f-de387cf5fbbe
Size 982B
SHA256 6ad3517a732bc096fa0ae346afc840cf63ff62130de7fc76da40c195770682bc
MD5 19f1ef6f789f3b309d34ad805d5f36dc
SHA1 66c3cbb0ef82ace51e985b311cde41b4e5de24af
SHA512 88c1bc29d8c08805b454363934ed8ec038b87a9ceac681150ce1c9e319d10e6ee87c4e4bd976bb1f7ec3bc1197741784b7addfefedf489605be6772dcd22e8f6
MD5 SHA1 SHA512

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yel8o60i.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Size 1.1MB
SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
MD5 842039753bf41fa5e11b3a1383061a87
SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yel8o60i.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Size 116B
SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
MD5 2a461e9eb87fd1955cea740a3444ee7a
SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yel8o60i.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Size 372B
SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
MD5 bf957ad58b55f64219ab3f793e374316
SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yel8o60i.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Size 17.8MB
SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
MD5 daf7ef3acccab478aaa7d6dc1c60f865
SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yel8o60i.default-release\prefs-1.js
Size 12KB
SHA256 63fdcdbc8821144c1b4a724dbcbf3f2a88e35c9546c04b64b6e0984264e1ac7c
MD5 36859343c2ff895bc317ee6092cf14b8
SHA1 1f6ea7a9a10fbf683c39bea24c0452976334f1b7
SHA512 beb6377c0d288e4b190113f6ac3deee3e748b7aeb3398f2dddf3c95e8c5c2fa3d68b69bc891e67ccccac8d52cdafbd81b70e6ca6e83c508c2fa8edebd76fce70
SSDEEP 192:E5nMRefCD2+31gqrfytv/x2Gcd6rfstYQHrj60oKaXPlUeSFBw8HP:UGgqrYv/+UrWYQLGv4wG
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yel8o60i.default-release\prefs-1.js
Size 16KB
SHA256 d4a439a398e0f28b6e580c024ffe43d2cd019175f274b16a4a52d0fa1fba691c
MD5 e405dd9e4375fd2c67ca46e426f2e9ee
SHA1 b7973177f30c2a2aac68b94b1bdff5d60dc9123a
SHA512 7947f33fed9dd5b9c3960d8d091e7fdb0c05cab8be59489b9c4bd9c5ee1d7a5ae73b13dc2c49244c4df4e4837d2482f66461b17e0958fd27cf944549e533b9f8
SSDEEP 192:E6nMRefpD2+31gqrfytv/x2Gcd6rfstYQHrj60oKaXR+lUeSBiBw8HRjr7Qp:nVgqrYv/+UrWYQLGQvwms
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2080-2600-0x0000000000FC0000-0x0000000001AA1000-memory.dmp

Download

memory/2080-2614-0x0000000000FC0000-0x0000000001AA1000-memory.dmp

Download

memory/2080-2632-0x0000000000FC0000-0x0000000001AA1000-memory.dmp

Download

memory/2080-2630-0x0000000000FC0000-0x0000000001AA1000-memory.dmp

Download

memory/2080-2623-0x0000000000FC0000-0x0000000001AA1000-memory.dmp

Download

memory/2080-2621-0x0000000000FC0000-0x0000000001AA1000-memory.dmp

Download

memory/2080-2616-0x0000000000FC0000-0x0000000001AA1000-memory.dmp

Download

memory/2080-431-0x0000000000FC0000-0x0000000001AA1000-memory.dmp

Download

memory/2080-2612-0x0000000000FC0000-0x0000000001AA1000-memory.dmp

Download

memory/2080-2610-0x0000000000FC0000-0x0000000001AA1000-memory.dmp

Download

memory/2080-2454-0x0000000000FC0000-0x0000000001AA1000-memory.dmp

Download

memory/2080-1353-0x0000000000FC0000-0x0000000001AA1000-memory.dmp

Download

memory/2080-450-0x0000000000FC0000-0x0000000001AA1000-memory.dmp

Download

memory/2080-576-0x0000000000FC0000-0x0000000001AA1000-memory.dmp

Download

memory/2080-40-0x0000000000FC0000-0x0000000001AA1000-memory.dmp

Download

memory/2084-2618-0x0000000000390000-0x0000000000841000-memory.dmp

Download

memory/2084-2619-0x0000000000390000-0x0000000000841000-memory.dmp

Download

memory/2200-2606-0x0000000000390000-0x0000000000841000-memory.dmp

Download

memory/2200-441-0x0000000000390000-0x0000000000841000-memory.dmp

Download

memory/2200-16-0x0000000000390000-0x0000000000841000-memory.dmp

Download

memory/2200-451-0x0000000000390000-0x0000000000841000-memory.dmp

Download

memory/2200-2631-0x0000000000390000-0x0000000000841000-memory.dmp

Download

memory/2200-2624-0x0000000000390000-0x0000000000841000-memory.dmp

Download

memory/2200-2622-0x0000000000390000-0x0000000000841000-memory.dmp

Download

memory/2200-2620-0x0000000000390000-0x0000000000841000-memory.dmp

Download

memory/2200-791-0x0000000000390000-0x0000000000841000-memory.dmp

Download

memory/2200-444-0x0000000000390000-0x0000000000841000-memory.dmp

Download

memory/2200-2611-0x0000000000390000-0x0000000000841000-memory.dmp

Download

memory/2200-20-0x0000000000390000-0x0000000000841000-memory.dmp

Download

memory/2200-1922-0x0000000000390000-0x0000000000841000-memory.dmp

Download

memory/2200-445-0x0000000000390000-0x0000000000841000-memory.dmp

Download

memory/2200-2599-0x0000000000390000-0x0000000000841000-memory.dmp

Download

memory/2200-19-0x0000000000391000-0x00000000003BF000-memory.dmp

Download

memory/2200-374-0x0000000000390000-0x0000000000841000-memory.dmp

Download

memory/2200-21-0x0000000000390000-0x0000000000841000-memory.dmp

Download

memory/2200-2615-0x0000000000390000-0x0000000000841000-memory.dmp

Download

memory/2200-432-0x0000000000390000-0x0000000000841000-memory.dmp

Download

memory/2200-2613-0x0000000000390000-0x0000000000841000-memory.dmp

Download

memory/2380-82-0x0000000000CD0000-0x0000000000F13000-memory.dmp

Download

memory/2380-81-0x0000000000CD0000-0x0000000000F13000-memory.dmp

Download

memory/2556-64-0x0000000000400000-0x0000000000643000-memory.dmp

Download

memory/2556-62-0x0000000000400000-0x0000000000643000-memory.dmp

Download

memory/5456-1627-0x0000000000390000-0x0000000000841000-memory.dmp

Download

memory/5456-1662-0x0000000000390000-0x0000000000841000-memory.dmp

Download

memory/5520-4-0x0000000000D00000-0x00000000011B1000-memory.dmp

Download

memory/5520-1-0x0000000077476000-0x0000000077478000-memory.dmp

Download

memory/5520-2-0x0000000000D01000-0x0000000000D2F000-memory.dmp

Download

memory/5520-3-0x0000000000D00000-0x00000000011B1000-memory.dmp

Download

memory/5520-0-0x0000000000D00000-0x00000000011B1000-memory.dmp

Download

memory/5520-18-0x0000000000D00000-0x00000000011B1000-memory.dmp

Download

memory/6136-59-0x00000000004C0000-0x0000000000508000-memory.dmp

Download