Malware Analysis Report

2024-10-18 23:41

Sample ID 240812-frqlgs1crh
Target b24732f7545336b219b6c089e88c2cb8e77aac5cf82c68bbacb3bb5538fa2305
SHA256 b24732f7545336b219b6c089e88c2cb8e77aac5cf82c68bbacb3bb5538fa2305
Tags
amadey stealc 0657d1 kora credential_access discovery evasion persistence stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

b24732f7545336b219b6c089e88c2cb8e77aac5cf82c68bbacb3bb5538fa2305

Threat Level: Known bad

The file b24732f7545336b219b6c089e88c2cb8e77aac5cf82c68bbacb3bb5538fa2305 was found to be: Known bad.

Malicious Activity Summary

amadey stealc 0657d1 kora credential_access discovery evasion persistence stealer trojan

Amadey

Stealc

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Credentials from Password Stores: Credentials from Web Browsers

Downloads MZ/PE file

Executes dropped EXE

Loads dropped DLL

Checks BIOS information in registry

Identifies Wine through registry keys

Adds Run key to start application

Suspicious use of SetThreadContext

AutoIT Executable

Suspicious use of NtSetInformationThreadHideFromDebugger

Drops file in Windows directory

System Location Discovery: System Language Discovery

Unsigned PE

Enumerates physical storage devices

Browser Information Discovery

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of AdjustPrivilegeToken

Modifies registry class

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Suspicious behavior: EnumeratesProcesses

Checks processor information in registry

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-08-12 05:06

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-08-12 05:06

Reported

2024-08-12 05:11

Platform

win7-20240705-en

Max time kernel

300s

Max time network

290s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b24732f7545336b219b6c089e88c2cb8e77aac5cf82c68bbacb3bb5538fa2305.exe"

Signatures

Amadey

trojan amadey

Stealc

stealer stealc

Credentials from Password Stores: Credentials from Web Browsers

credential_access stealer

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\b24732f7545336b219b6c089e88c2cb8e77aac5cf82c68bbacb3bb5538fa2305.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A

Downloads MZ/PE file

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\b24732f7545336b219b6c089e88c2cb8e77aac5cf82c68bbacb3bb5538fa2305.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\b24732f7545336b219b6c089e88c2cb8e77aac5cf82c68bbacb3bb5538fa2305.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A

Identifies Wine through registry keys

evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\b24732f7545336b219b6c089e88c2cb8e77aac5cf82c68bbacb3bb5538fa2305.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\1235c85657.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000036001\\1235c85657.exe" C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\b24732f7545336b219b6c089e88c2cb8e77aac5cf82c68bbacb3bb5538fa2305.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2552 set thread context of 3036 N/A C:\Users\Admin\AppData\Local\Temp\1000036001\1235c85657.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2488 set thread context of 2184 N/A C:\Users\Admin\1000037002\d04f649d03.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\explorti.job C:\Users\Admin\AppData\Local\Temp\b24732f7545336b219b6c089e88c2cb8e77aac5cf82c68bbacb3bb5538fa2305.exe N/A

Browser Information Discovery

discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\1000037002\d04f649d03.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000038001\fd9ed5b2f2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\b24732f7545336b219b6c089e88c2cb8e77aac5cf82c68bbacb3bb5538fa2305.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000036001\1235c85657.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Program Files\Mozilla Firefox\firefox.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_Classes\Local Settings C:\Program Files\Mozilla Firefox\firefox.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\b24732f7545336b219b6c089e88c2cb8e77aac5cf82c68bbacb3bb5538fa2305.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2764 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\b24732f7545336b219b6c089e88c2cb8e77aac5cf82c68bbacb3bb5538fa2305.exe C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
PID 2764 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\b24732f7545336b219b6c089e88c2cb8e77aac5cf82c68bbacb3bb5538fa2305.exe C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
PID 2764 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\b24732f7545336b219b6c089e88c2cb8e77aac5cf82c68bbacb3bb5538fa2305.exe C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
PID 2764 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\b24732f7545336b219b6c089e88c2cb8e77aac5cf82c68bbacb3bb5538fa2305.exe C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
PID 2332 wrote to memory of 2552 N/A C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe C:\Users\Admin\AppData\Local\Temp\1000036001\1235c85657.exe
PID 2332 wrote to memory of 2552 N/A C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe C:\Users\Admin\AppData\Local\Temp\1000036001\1235c85657.exe
PID 2332 wrote to memory of 2552 N/A C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe C:\Users\Admin\AppData\Local\Temp\1000036001\1235c85657.exe
PID 2332 wrote to memory of 2552 N/A C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe C:\Users\Admin\AppData\Local\Temp\1000036001\1235c85657.exe
PID 2552 wrote to memory of 1016 N/A C:\Users\Admin\AppData\Local\Temp\1000036001\1235c85657.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2552 wrote to memory of 1016 N/A C:\Users\Admin\AppData\Local\Temp\1000036001\1235c85657.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2552 wrote to memory of 1016 N/A C:\Users\Admin\AppData\Local\Temp\1000036001\1235c85657.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2552 wrote to memory of 1016 N/A C:\Users\Admin\AppData\Local\Temp\1000036001\1235c85657.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2552 wrote to memory of 1016 N/A C:\Users\Admin\AppData\Local\Temp\1000036001\1235c85657.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2552 wrote to memory of 1016 N/A C:\Users\Admin\AppData\Local\Temp\1000036001\1235c85657.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2552 wrote to memory of 1016 N/A C:\Users\Admin\AppData\Local\Temp\1000036001\1235c85657.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2552 wrote to memory of 3036 N/A C:\Users\Admin\AppData\Local\Temp\1000036001\1235c85657.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2552 wrote to memory of 3036 N/A C:\Users\Admin\AppData\Local\Temp\1000036001\1235c85657.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2552 wrote to memory of 3036 N/A C:\Users\Admin\AppData\Local\Temp\1000036001\1235c85657.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2552 wrote to memory of 3036 N/A C:\Users\Admin\AppData\Local\Temp\1000036001\1235c85657.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2552 wrote to memory of 3036 N/A C:\Users\Admin\AppData\Local\Temp\1000036001\1235c85657.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2552 wrote to memory of 3036 N/A C:\Users\Admin\AppData\Local\Temp\1000036001\1235c85657.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2552 wrote to memory of 3036 N/A C:\Users\Admin\AppData\Local\Temp\1000036001\1235c85657.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2552 wrote to memory of 3036 N/A C:\Users\Admin\AppData\Local\Temp\1000036001\1235c85657.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2552 wrote to memory of 3036 N/A C:\Users\Admin\AppData\Local\Temp\1000036001\1235c85657.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2552 wrote to memory of 3036 N/A C:\Users\Admin\AppData\Local\Temp\1000036001\1235c85657.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2552 wrote to memory of 3036 N/A C:\Users\Admin\AppData\Local\Temp\1000036001\1235c85657.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2552 wrote to memory of 3036 N/A C:\Users\Admin\AppData\Local\Temp\1000036001\1235c85657.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2552 wrote to memory of 3036 N/A C:\Users\Admin\AppData\Local\Temp\1000036001\1235c85657.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2552 wrote to memory of 3036 N/A C:\Users\Admin\AppData\Local\Temp\1000036001\1235c85657.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2332 wrote to memory of 2488 N/A C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe C:\Users\Admin\1000037002\d04f649d03.exe
PID 2332 wrote to memory of 2488 N/A C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe C:\Users\Admin\1000037002\d04f649d03.exe
PID 2332 wrote to memory of 2488 N/A C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe C:\Users\Admin\1000037002\d04f649d03.exe
PID 2332 wrote to memory of 2488 N/A C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe C:\Users\Admin\1000037002\d04f649d03.exe
PID 2488 wrote to memory of 2184 N/A C:\Users\Admin\1000037002\d04f649d03.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2488 wrote to memory of 2184 N/A C:\Users\Admin\1000037002\d04f649d03.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2488 wrote to memory of 2184 N/A C:\Users\Admin\1000037002\d04f649d03.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2488 wrote to memory of 2184 N/A C:\Users\Admin\1000037002\d04f649d03.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2488 wrote to memory of 2184 N/A C:\Users\Admin\1000037002\d04f649d03.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2488 wrote to memory of 2184 N/A C:\Users\Admin\1000037002\d04f649d03.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2488 wrote to memory of 2184 N/A C:\Users\Admin\1000037002\d04f649d03.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2488 wrote to memory of 2184 N/A C:\Users\Admin\1000037002\d04f649d03.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2488 wrote to memory of 2184 N/A C:\Users\Admin\1000037002\d04f649d03.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2488 wrote to memory of 2184 N/A C:\Users\Admin\1000037002\d04f649d03.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2488 wrote to memory of 2184 N/A C:\Users\Admin\1000037002\d04f649d03.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2488 wrote to memory of 2184 N/A C:\Users\Admin\1000037002\d04f649d03.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2488 wrote to memory of 2184 N/A C:\Users\Admin\1000037002\d04f649d03.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2332 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe C:\Users\Admin\AppData\Local\Temp\1000038001\fd9ed5b2f2.exe
PID 2332 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe C:\Users\Admin\AppData\Local\Temp\1000038001\fd9ed5b2f2.exe
PID 2332 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe C:\Users\Admin\AppData\Local\Temp\1000038001\fd9ed5b2f2.exe
PID 2332 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe C:\Users\Admin\AppData\Local\Temp\1000038001\fd9ed5b2f2.exe
PID 3036 wrote to memory of 1536 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3036 wrote to memory of 1536 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3036 wrote to memory of 1536 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3036 wrote to memory of 1536 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1536 wrote to memory of 1820 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1536 wrote to memory of 1820 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1536 wrote to memory of 1820 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1536 wrote to memory of 1820 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1536 wrote to memory of 1820 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1536 wrote to memory of 1820 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1536 wrote to memory of 1820 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1536 wrote to memory of 1820 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1536 wrote to memory of 1820 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1536 wrote to memory of 1820 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\b24732f7545336b219b6c089e88c2cb8e77aac5cf82c68bbacb3bb5538fa2305.exe

"C:\Users\Admin\AppData\Local\Temp\b24732f7545336b219b6c089e88c2cb8e77aac5cf82c68bbacb3bb5538fa2305.exe"

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

"C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"

C:\Users\Admin\AppData\Local\Temp\1000036001\1235c85657.exe

"C:\Users\Admin\AppData\Local\Temp\1000036001\1235c85657.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\1000037002\d04f649d03.exe

"C:\Users\Admin\1000037002\d04f649d03.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\1000038001\fd9ed5b2f2.exe

"C:\Users\Admin\AppData\Local\Temp\1000038001\fd9ed5b2f2.exe"

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1820.0.1204903990\826516625" -parentBuildID 20221007134813 -prefsHandle 1192 -prefMapHandle 1184 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {67304274-10d7-413d-8e96-9a48ae4c1dcc} 1820 "\\.\pipe\gecko-crash-server-pipe.1820" 1308 44d6d58 gpu

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1820.1.2114030815\608259248" -parentBuildID 20221007134813 -prefsHandle 1500 -prefMapHandle 1496 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {602ac85c-3665-4f74-95eb-41fb6dcefd4f} 1820 "\\.\pipe\gecko-crash-server-pipe.1820" 1512 41ec158 socket

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1820.2.393647786\325331038" -childID 1 -isForBrowser -prefsHandle 1864 -prefMapHandle 1860 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 588 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0a2062ad-4c09-4d2a-94cd-b73e99af9ded} 1820 "\\.\pipe\gecko-crash-server-pipe.1820" 1900 18a5ce58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1820.3.530571603\2085508140" -childID 2 -isForBrowser -prefsHandle 2844 -prefMapHandle 2840 -prefsLen 26151 -prefMapSize 233444 -jsInitHandle 588 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {51c3e128-20d5-494e-8126-5d532d96ece6} 1820 "\\.\pipe\gecko-crash-server-pipe.1820" 2856 e63c58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1820.4.1141767691\1527082023" -childID 3 -isForBrowser -prefsHandle 3788 -prefMapHandle 3784 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 588 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {75db6890-8b81-4aec-928e-0de911c5208c} 1820 "\\.\pipe\gecko-crash-server-pipe.1820" 3816 1d71e758 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1820.5.1067155407\1230407588" -childID 4 -isForBrowser -prefsHandle 3944 -prefMapHandle 3948 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 588 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0f1b70dd-e4e2-4fd9-96b2-a39d0607c551} 1820 "\\.\pipe\gecko-crash-server-pipe.1820" 3932 1d71ed58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1820.6.1171688538\1215132251" -childID 5 -isForBrowser -prefsHandle 4112 -prefMapHandle 4116 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 588 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f353670c-0fc4-4694-b1b6-f8d1670b6de3} 1820 "\\.\pipe\gecko-crash-server-pipe.1820" 4100 1d720558 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1820.7.1211029202\1930593296" -childID 6 -isForBrowser -prefsHandle 4156 -prefMapHandle 3956 -prefsLen 26531 -prefMapSize 233444 -jsInitHandle 588 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d53ce134-b797-40b9-a7f9-2e0bb7e40108} 1820 "\\.\pipe\gecko-crash-server-pipe.1820" 4004 23333458 tab

Network

Country Destination Domain Proto
RU 185.215.113.19:80 185.215.113.19 tcp
RU 185.215.113.16:80 185.215.113.16 tcp
RU 185.215.113.100:80 185.215.113.100 tcp
RU 185.215.113.100:80 185.215.113.100 tcp
US 8.8.8.8:53 accounts.google.com udp
US 8.8.8.8:53 spocs.getpocket.com udp
US 8.8.8.8:53 getpocket.cdn.mozilla.net udp
NL 142.250.102.84:443 accounts.google.com tcp
US 8.8.8.8:53 accounts.google.com udp
US 8.8.8.8:53 prod.ads.prod.webservices.mozgcp.net udp
US 34.120.5.221:443 getpocket.cdn.mozilla.net tcp
US 8.8.8.8:53 accounts.google.com udp
US 8.8.8.8:53 prod.ads.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 prod.pocket.prod.cloudops.mozgcp.net udp
US 8.8.8.8:53 prod.content-signature-chains.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 shavar.prod.mozaws.net udp
US 8.8.8.8:53 prod.pocket.prod.cloudops.mozgcp.net udp
US 8.8.8.8:53 prod.content-signature-chains.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 shavar.prod.mozaws.net udp
US 8.8.8.8:53 prod.remote-settings.prod.webservices.mozgcp.net udp
NL 142.250.102.84:443 accounts.google.com udp
US 8.8.8.8:53 prod.remote-settings.prod.webservices.mozgcp.net udp
N/A 127.0.0.1:49312 tcp
N/A 127.0.0.1:49320 tcp
US 8.8.8.8:53 accounts.youtube.com udp
NL 142.250.179.174:443 accounts.youtube.com tcp
US 8.8.8.8:53 www3.l.google.com udp
US 8.8.8.8:53 accounts.google.com udp
US 8.8.8.8:53 www3.l.google.com udp
US 8.8.8.8:53 accounts.google.com udp
NL 142.250.179.174:443 www3.l.google.com udp
US 8.8.8.8:53 play.google.com udp
NL 216.58.214.14:443 play.google.com tcp
NL 216.58.214.14:443 play.google.com tcp
US 8.8.8.8:53 play.google.com udp
US 8.8.8.8:53 play.google.com udp
NL 216.58.214.14:443 play.google.com tcp
NL 216.58.214.14:443 play.google.com tcp
NL 216.58.214.14:443 play.google.com udp
US 8.8.8.8:53 www.google.com udp
US 8.8.8.8:53 www.google.com udp
NL 142.250.179.196:443 www.google.com tcp
US 8.8.8.8:53 www.google.com udp
NL 142.250.179.196:443 www.google.com udp
US 8.8.8.8:53 accounts.google.com udp
US 8.8.8.8:53 accounts.google.com udp
US 8.8.8.8:53 prod.balrog.prod.cloudops.mozgcp.net udp
US 8.8.8.8:53 prod.balrog.prod.cloudops.mozgcp.net udp
US 8.8.8.8:53 ciscobinary.openh264.org udp
GB 88.221.134.209:80 ciscobinary.openh264.org tcp
US 8.8.8.8:53 a19.dscg10.akamai.net udp
US 8.8.8.8:53 a19.dscg10.akamai.net udp
US 8.8.8.8:53 redirector.gvt1.com udp
NL 142.250.179.174:443 redirector.gvt1.com tcp
US 8.8.8.8:53 redirector.gvt1.com udp
US 8.8.8.8:53 redirector.gvt1.com udp
NL 142.250.179.174:443 redirector.gvt1.com udp
US 8.8.8.8:53 r5---sn-4g5lzney.gvt1.com udp
DE 74.125.163.138:443 r5---sn-4g5lzney.gvt1.com tcp
US 8.8.8.8:53 r5.sn-4g5lzney.gvt1.com udp
US 8.8.8.8:53 r5.sn-4g5lzney.gvt1.com udp
DE 74.125.163.138:443 r5.sn-4g5lzney.gvt1.com udp
US 8.8.8.8:53 play.google.com udp
US 8.8.8.8:53 play.google.com udp
US 8.8.8.8:53 accounts.google.com udp
US 8.8.8.8:53 accounts.google.com udp
NL 142.250.102.84:443 accounts.google.com udp
US 8.8.8.8:53 accounts.google.com udp
US 8.8.8.8:53 accounts.google.com udp
NL 142.250.102.84:443 accounts.google.com tcp
RU 185.215.113.19:80 185.215.113.19 tcp
US 8.8.8.8:53 accounts.google.com udp
NL 142.250.102.84:443 accounts.google.com udp
US 8.8.8.8:53 accounts.google.com udp
US 8.8.8.8:53 accounts.google.com udp
NL 142.250.102.84:443 accounts.google.com tcp

Files

memory/2764-0-0x0000000000180000-0x0000000000630000-memory.dmp

memory/2764-1-0x0000000077130000-0x0000000077132000-memory.dmp

memory/2764-2-0x0000000000181000-0x00000000001AF000-memory.dmp

memory/2764-3-0x0000000000180000-0x0000000000630000-memory.dmp

memory/2764-5-0x0000000000180000-0x0000000000630000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

MD5 b411827f67c0ed4ff07ba556a7d02c75
SHA1 116d7057b5a4886604bf5164f09ac3972b410be2
SHA256 b24732f7545336b219b6c089e88c2cb8e77aac5cf82c68bbacb3bb5538fa2305
SHA512 a8bbe86fd08b272065ac648497d3c383ecf9f836e47690182e0992dba6954934d655deed1c3fef05d497519a6b147511e0bcd76f084816c81c943a3066c6c97c

memory/2764-15-0x0000000000180000-0x0000000000630000-memory.dmp

memory/2332-16-0x0000000000370000-0x0000000000820000-memory.dmp

memory/2332-17-0x0000000000371000-0x000000000039F000-memory.dmp

memory/2332-18-0x0000000000370000-0x0000000000820000-memory.dmp

memory/2332-21-0x0000000000370000-0x0000000000820000-memory.dmp

memory/2332-20-0x0000000000370000-0x0000000000820000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000036001\1235c85657.exe

MD5 db946418424011c782182c76ab8c179f
SHA1 d640d54d341cf6341bd434c9015d23d22156612a
SHA256 bfdffea79fd6126c2256fab3f3b0421ec9b3a77a618fc406cd0f2e7d4a38f04e
SHA512 a73c645fe96ff6e49207326af35635998af343d2aa5ddd5e8b2bbd2bcded52869d588bb8c69eb220593d3152be99812e3462b1b09deea80adcac30bed9ed8956

memory/2552-36-0x0000000000870000-0x00000000009A0000-memory.dmp

memory/3036-38-0x0000000000400000-0x000000000052D000-memory.dmp

memory/3036-52-0x0000000000400000-0x000000000052D000-memory.dmp

memory/3036-54-0x0000000000400000-0x000000000052D000-memory.dmp

memory/3036-51-0x0000000000400000-0x000000000052D000-memory.dmp

memory/3036-50-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/3036-46-0x0000000000400000-0x000000000052D000-memory.dmp

memory/3036-44-0x0000000000400000-0x000000000052D000-memory.dmp

memory/3036-42-0x0000000000400000-0x000000000052D000-memory.dmp

memory/3036-40-0x0000000000400000-0x000000000052D000-memory.dmp

memory/3036-49-0x0000000000400000-0x000000000052D000-memory.dmp

C:\Users\Admin\1000037002\d04f649d03.exe

MD5 62c81eb8cd78dbcf5767f84caad6972e
SHA1 9a508e8724c1431394717ebd3c6dee2f9f21d082
SHA256 166a8fac98b553a4e3647cefc034fe826b753958c0be902d9483148edb001250
SHA512 2feaa6cb070e548790b01601fe13846cd7eb005e2f1b8441092f4f92a1e4cfea6c1bc84314f78ea023e10bec8e3d5712ca43336c090eed0073c7ed99ebbf5af5

memory/2488-69-0x0000000000A80000-0x0000000000AB8000-memory.dmp

memory/2184-73-0x0000000000400000-0x0000000000643000-memory.dmp

memory/2184-77-0x0000000000400000-0x0000000000643000-memory.dmp

memory/2184-85-0x0000000000400000-0x0000000000643000-memory.dmp

memory/2184-83-0x0000000000400000-0x0000000000643000-memory.dmp

memory/2184-82-0x0000000000400000-0x0000000000643000-memory.dmp

memory/2184-79-0x0000000000400000-0x0000000000643000-memory.dmp

memory/2184-75-0x0000000000400000-0x0000000000643000-memory.dmp

memory/2184-72-0x0000000000400000-0x0000000000643000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000038001\fd9ed5b2f2.exe

MD5 278ee1426274818874556aa18fd02e3a
SHA1 185a2761330024dec52134df2c8388c461451acb
SHA256 37257ddb1a6f309a6e9d147b5fc2551a9cae3a0e52b191b18d9465bfcb5c18eb
SHA512 07ec6759af5b9a00d8371b9fd9b723012dd0a1614cfcc7cd51975a004f69ffb90083735e9a871a2aa0e8d28799beac53a4748f55f4dd1e7495bc7388ebf4d6a0

memory/2024-102-0x0000000001230000-0x0000000001473000-memory.dmp

memory/2024-103-0x0000000001230000-0x0000000001473000-memory.dmp

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tg2k5l8.default-release\datareporting\glean\pending_pings\23c50d10-dfb0-4cf8-a828-adf4255e523a

MD5 10a4dec15ae1d08e59d17f7f371f45df
SHA1 2abda546753073a11a12a2f44d6061cb930b2f74
SHA256 81802cd8676c974a78fc74df179f3594eb434ac93ccadb79e2b9580136f594a1
SHA512 cf1a4230bd9b0b5b013c763ebab92e7c93ece0c2dea53c7bf0a81615211d50e04c5bb3c6cb0a1c749041affd46662003cf138de6b5eb8cf095230b464d5459e4

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tg2k5l8.default-release\datareporting\glean\db\data.safe.bin

MD5 4c53f200edea432883c17fa4473af52c
SHA1 b7739df7c2c303705bfd79b4c98ae3a5d40ca548
SHA256 df022c25c9a3729f37477a3c7b5fe5384fac7b33031fa490f2777b52982bdfb3
SHA512 3120e8a768d0f0fd80f67a7c78122de01023de571096cda4f9d5612f1842760c5b92e21a1046d60d38e8eb3976b399cdc98df665ed6af94be13dcb4856202915

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tg2k5l8.default-release\datareporting\glean\pending_pings\da759ac9-2b1d-46aa-946b-24a4baa5967d

MD5 e44a403248a3d555fbdc714856507928
SHA1 fd3fab5b473645a4aa8a5944ea3b91e72c83da7f
SHA256 93f800a10d9313046ab4be3a64c888b61f8568d407f7ccbb57bc09cf71078b4f
SHA512 fd0f730aa265500f86299248d68834380dc8c7f2797a3ea6ad55958dc63ed92d08d9ca67c10a919ccfc0fdeb08967c52f3deb510d4cb08cef0e3680dc401c6d0

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tg2k5l8.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

MD5 be1d14bfd1906110a206a4447b1dabad
SHA1 826ba9a35479adaa1c3f6b9185030257a62d4834
SHA256 102c0cf5b5d440a47a01136bf8c5832c16794cc34db55c0ee8a828e47875a89e
SHA512 3c49d88d3217613c238e1e8b9d7dd8094f77bb299a0b57b50eefdbd5836e14513232b4bfca9d3a78ede00e6dff70aaa89bbec44904bf3a658e6c062b208b81b8

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\9tg2k5l8.default-release\activity-stream.discovery_stream.json.tmp

MD5 88ee23d8be33b3422e467965e56f353d
SHA1 220f7f6de71967a73e50464b67304ecb79d1f8c4
SHA256 2c5d0d853362a2fd0ccebd4ca2f23b77f85ee553ccf407d2a3a51a18c9b6f07a
SHA512 3312ee78686229be2e0fdedfa52e88b5dc739f3cfa548a419efaae0b3871903a383b33878ffcbc359bf6f9d45d5f074151d1a99848edf77257d76585f79d6843

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tg2k5l8.default-release\prefs-1.js

MD5 a7943f92e3d5e8ac4594ad12bffb8e2d
SHA1 628437828a79ff6bbec8e9e0f1a9e156404c97e2
SHA256 7e7a85cd8f1f73500063c21dd9e2d58b44ce961e7d07f17c5145c76a74ef3ca7
SHA512 4e6425b2f3e7d8c950efdd5ee3307905bb619e8829b0add80292bd0cab894e83b846b6034d753b8e297c68fc07129d61fc98a66e1a23c91fbeba2899888f21dc

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tg2k5l8.default-release\prefs.js

MD5 ec6a5b2c83d1580db8759abfc8775229
SHA1 65838ac530151df204728bf3da7f63502fc47d1c
SHA256 1d45789a17e58a37d589784ed6973c46a6e5606ad9c36b5ac7ac04278904ebdf
SHA512 fde679eb55ac662bb82b318defb9f09a1f10507ed5468487448a3fe8380c1e14242d776ea8605378d4589aae543413ab9b033640d56276f47321535626147078

memory/2332-258-0x0000000000370000-0x0000000000820000-memory.dmp

memory/2332-264-0x0000000000370000-0x0000000000820000-memory.dmp

memory/2332-265-0x0000000000370000-0x0000000000820000-memory.dmp

memory/2332-266-0x0000000000370000-0x0000000000820000-memory.dmp

memory/2332-275-0x0000000000370000-0x0000000000820000-memory.dmp

memory/2332-277-0x0000000000370000-0x0000000000820000-memory.dmp

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tg2k5l8.default-release\sessionstore-backups\recovery.jsonlz4

MD5 a1b7212cc39f083702ecf2f7085dd27a
SHA1 398cc8e3c4e7bc353f71489cb0fee7f1a4d3b055
SHA256 d8305982d0fa82be099eabcd9a09b35c59ccb2f84fb274f63a81c13e16e45c90
SHA512 55f580ebe4863f4a0fddb4345e5db99798e2e22252199774c1bc9f55039b043af7ce5a92b31b2d1d65a53defeabeab980b335f167e9cee74ff5a8e0f6b2a2a38

memory/2332-283-0x0000000000370000-0x0000000000820000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpaddon

MD5 85430baed3398695717b0263807cf97c
SHA1 fffbee923cea216f50fce5d54219a188a5100f41
SHA256 a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
SHA512 06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tg2k5l8.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

MD5 fe3355639648c417e8307c6d051e3e37
SHA1 f54602d4b4778da21bc97c7238fc66aa68c8ee34
SHA256 1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
SHA512 8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tg2k5l8.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

MD5 3d33cdc0b3d281e67dd52e14435dd04f
SHA1 4db88689282fd4f9e9e6ab95fcbb23df6e6485db
SHA256 f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
SHA512 a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tg2k5l8.default-release\prefs-1.js

MD5 385730c59985c522e949e1078d73bf98
SHA1 26b77e666d5b9e715b71c9a564b983bfaa4f2b1f
SHA256 0ad51c61129d7284304790e9bb217ec8e7173d24a89180f36af7b6f40a9109e0
SHA512 ed0a0f62d350df83d72f6acdb294837daa76d9eb822c1d0baadef402133112db87c45c155b803ed5c4b383ac11d36726bc114ac342a518d24308457af903906e

C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

MD5 a01c5ecd6108350ae23d2cddf0e77c17
SHA1 c6ac28a2cd979f1f9a75d56271821d5ff665e2b6
SHA256 345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42
SHA512 b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tg2k5l8.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

MD5 49ddb419d96dceb9069018535fb2e2fc
SHA1 62aa6fea895a8b68d468a015f6e6ab400d7a7ca6
SHA256 2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
SHA512 48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tg2k5l8.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

MD5 8be33af717bb1b67fbd61c3f4b807e9e
SHA1 7cf17656d174d951957ff36810e874a134dd49e0
SHA256 e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
SHA512 6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tg2k5l8.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

MD5 33bf7b0439480effb9fb212efce87b13
SHA1 cee50f2745edc6dc291887b6075ca64d716f495a
SHA256 8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e
SHA512 d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tg2k5l8.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

MD5 688bed3676d2104e7f17ae1cd2c59404
SHA1 952b2cdf783ac72fcb98338723e9afd38d47ad8e
SHA256 33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
SHA512 7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tg2k5l8.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

MD5 937326fead5fd401f6cca9118bd9ade9
SHA1 4526a57d4ae14ed29b37632c72aef3c408189d91
SHA256 68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
SHA512 b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tg2k5l8.default-release\prefs-1.js

MD5 3987d06407294999edb652474438ee94
SHA1 de1f3e268b1637c4382c5db87b89ff3a4fce80ca
SHA256 849c441f27fd7511c9f48b4b34c24975d697021b236e8d70b79c4b99ae2d9315
SHA512 1ad162a4e96d7b153e087859e963b4267f1a52e432ed4fe8dd9551006645dad929644404a02227a520c40ad5226f5e6cee41abe15300e6b9ec45f7bb45d7ca77

memory/2332-364-0x0000000000370000-0x0000000000820000-memory.dmp

memory/2332-366-0x0000000000370000-0x0000000000820000-memory.dmp

memory/2332-368-0x0000000000370000-0x0000000000820000-memory.dmp

memory/2332-380-0x0000000000370000-0x0000000000820000-memory.dmp

memory/2332-381-0x0000000000370000-0x0000000000820000-memory.dmp

memory/2332-382-0x0000000000370000-0x0000000000820000-memory.dmp

memory/2332-383-0x0000000006BB0000-0x0000000006DF3000-memory.dmp

memory/2332-384-0x0000000000370000-0x0000000000820000-memory.dmp

memory/2332-385-0x0000000000370000-0x0000000000820000-memory.dmp

memory/2332-386-0x0000000000370000-0x0000000000820000-memory.dmp

memory/2332-392-0x0000000000370000-0x0000000000820000-memory.dmp

memory/2332-393-0x0000000000370000-0x0000000000820000-memory.dmp

memory/2332-394-0x0000000000370000-0x0000000000820000-memory.dmp

memory/2332-399-0x0000000000370000-0x0000000000820000-memory.dmp

memory/2332-400-0x0000000000370000-0x0000000000820000-memory.dmp

memory/2332-401-0x0000000000370000-0x0000000000820000-memory.dmp

memory/2332-403-0x0000000000370000-0x0000000000820000-memory.dmp

memory/2332-404-0x0000000000370000-0x0000000000820000-memory.dmp

memory/2332-405-0x0000000000370000-0x0000000000820000-memory.dmp

memory/2332-406-0x0000000000370000-0x0000000000820000-memory.dmp

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tg2k5l8.default-release\prefs-1.js

MD5 90528aced407e4c3c01e9e45be643ea5
SHA1 ba9e785b07f2bdba50bb138d994376a76cb60237
SHA256 60301acb416d3563461388cbdab4228d06e209971e8ba1f879d9bb48a0f3c2e1
SHA512 92b0baa5826f831a8d57cbaffd3d33cb767923b72289c988c037458a4fddd3dab686b82ff08f41c40c3d6bb044be0c53d4bb1d649e64f87832da21a6611a3188

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\9tg2k5l8.default-release\cache2\entries\099EB2BF8827A4F91EAB3E38B14650D0205226F2

MD5 14408fedefe1577265bc7adb21731ee3
SHA1 13f1921ec478605a97b2f47ae0123e12b6dab7fd
SHA256 b3faedf440282eadbbf9a67339a224cea426665a2fea900f0dd6f2c454d3c0bb
SHA512 1091ddb40a459d8e3fa15c8135ea0904e52a2f33e6a81e99f373d86889da9b37e1e63d677e7c210d71b28c0f05ed76e1aa98c1ce7ab3d9f58a712cff663ddd11

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\9tg2k5l8.default-release\cache2\entries\E6F151CD0FC8351F8C47C9C26F7DED69ECAF854E

MD5 d608776f991a779be840f3453efaad9a
SHA1 a50f9b1a7753f82b38a3040b85f8a057148b7c13
SHA256 7e978d22f723c9b6559c5552a0b41cf230ecd0a62a74eadd527df6a10d1296a0
SHA512 da978241714bb2f6d7578f3a287f5a9e84dcd332dfa25bf6565346820556c3fcc0a3663dec00c0eb41f33de3cddbaf235ddba2ace1d588fbc0a8c7241b199ad7

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\9tg2k5l8.default-release\cache2\entries\F210D48319A1879FD1C5213FA010C613B99BA085

MD5 bffd90a8655bd3f61f767c5dce229fea
SHA1 b67b2f6bc191255716b394cc44945e04666d1895
SHA256 9c8478e5409a46b56666267831c3d45fafa3c50e90026d43946e6dc1d3d5440f
SHA512 015ad7e026a769f681770f4c7b0a6bc61c7c50d8cc89b3d0ef9e1c85147199979f067f7f84a6525e77245125a9c58afe4785542617c70d58339ec11548212d9b

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\9tg2k5l8.default-release\cache2\entries\5CD1EBDF6B57F13C7E783CE5E6D8E9C44014FE1A

MD5 33169825658cf53520864821c8f595c0
SHA1 5df70315420c4a3dae6c84ca0a92ad41dae2f89f
SHA256 54018c6d4fa3dd98212dc3046eddb03657b04f663066584e7093267b484fdf09
SHA512 c958921e29723cc85684bb536997353da5de0fb715740df4f91c83298be7c83109ccd0aad9f48c881654ddd264d07fd91e574700ab2dcd54bd07d91274e38e1d

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\9tg2k5l8.default-release\cache2\entries\254256B27E0C48CF9B80B695F0B3B8CA84610495

MD5 92b4a0ea59b829a20c98d40ca743b04a
SHA1 86212fc5eeecd1667b73b0cc2be129e0f7df0f01
SHA256 afaf83d68000269f9a7fd4d2910634764f51a6e1d12c579cb3721ddf1d4d30ac
SHA512 9cf21e2bacc912162cf1513e7bceedc75e6b3cb12ca209fbe8dc1ab395ad1a806f17e35f6c3b482c101b65435b495f7c7fddfb07fa2063d79e833ec95fe73ae4

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\9tg2k5l8.default-release\cache2\entries\037778A55E1B7E9BED3390289866D09402D6C913

MD5 88386897d8eb1f2940fc594e9220e9ec
SHA1 b4df6c7b55b55d478197e6fc0deb3f19f1267206
SHA256 1259969eee38379ce57ffb9047090e693cc2d291c0b2f9d2b31253634d8c5b8e
SHA512 00211c2deb188b33538d7452a8f21b8b0c9991536315af52abb51d42adfb340f64c7e946d1c86ec3a983e65575f087c7b38b0f51b530bd22e2d2ad3a023fb9a3

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\9tg2k5l8.default-release\cache2\entries\E449899591A9BC91DFBA673EC0589B51E541A88B

MD5 09201c3318c78b02c516dfea2dbc66d0
SHA1 5bcf9f529f5a293723842064f9a12b011fa04391
SHA256 fca9351ce3e7086d71d2b2e5b95bd565a0df88d7a9ab4aecd91ad93943aaa2df
SHA512 362b898d5010fee8389451ddf14527c3edc418afb83f9911296074ca253fb00b97907006ae74a7ab8d49d1128484a1340aae79ca67dde95788d9f94c207cb62b

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\9tg2k5l8.default-release\cache2\entries\6D89348819C8881868053197CA0754F36784BF5F

MD5 54b218a215b67fb6b4cfbb3d53ae1046
SHA1 c17951659e97ef5bbb742f79e2de974dfd549172
SHA256 ea11d963a7770336c45ca6b8c9db5927635a6d453e47032b7bf34b50d84b6da9
SHA512 7fae28cb2e633c92cf9483db28c360cb93f7adde3ef90a9a1cddab92c0ec4e10db95344485d68ee06bc05c193c8e94f5618eb174652e7c9b862c33b9e48a8856

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tg2k5l8.default-release\addonStartup.json.lz4

MD5 35860b7440797fdf92b6b343858fae39
SHA1 62c24f43eedf6e71b226f0159dbbfeecc152f47f
SHA256 fa8d0fffa1b53a2ef40a65da9e28fe04dd91f053f4784f542714e60b4290f498
SHA512 5ae3d1a8279ae0fdf7954c3cf2279ea9c525e36547c4ed92049f741be6bd46bfef82b40763c7d01e0620dcf356fc9fc45b12be4dce319d4d9b354f6fa15d1a69

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tg2k5l8.default-release\broadcast-listeners.json

MD5 72c95709e1a3b27919e13d28bbe8e8a2
SHA1 00892decbee63d627057730bfc0c6a4f13099ee4
SHA256 9cf589357fceea2f37cd1a925e5d33fd517a44d22a16c357f7fb5d4d187034aa
SHA512 613ca9dd2d12afe31fb2c4a8d9337eeecfb58dabaeaaba11404b9a736a4073dfd9b473ba27c1183d3cc91d5a9233a83dce5a135a81f755d978cea9e198209182

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tg2k5l8.default-release\sessionCheckpoints.json

MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tg2k5l8.default-release\targeting.snapshot.json

MD5 4604c7fbc52e9f8f8cc64bde6228b8b0
SHA1 3386b4f775ce65a94c041f9e503f7316a33afa8e
SHA256 b326e4990f5f42ab15073466a2b4e42c89b1bf10dc5184d6a24f556427045d19
SHA512 b7549f402885b83a953b878ce128190b10bbb993b446fed38ac49d43b1a2473d411a9843a38e1ed0a40c6087630b08a9ba5778b66dd60bf63062b5a0f131ed52

memory/2332-475-0x0000000000370000-0x0000000000820000-memory.dmp

memory/2332-476-0x0000000000370000-0x0000000000820000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

MD5 38e48f9781033049fa97c03a89a023ca
SHA1 ef81aea8268e73ff6d8ded3c070c2c52888f4bae
SHA256 a006f93487ed9b652d09e3d2309a6b1e5a693117845e095b4060d2237d6318d2
SHA512 9f79c58aed779314e4a5b9bb7524d724e7caf418c83628fdbd70fe66d7284397ac92804539f7e4233590573a1bf131adfeafbc1c5fd4191498afe49efa63947f

memory/2332-488-0x0000000000370000-0x0000000000820000-memory.dmp

memory/2332-489-0x0000000000370000-0x0000000000820000-memory.dmp

memory/2332-490-0x0000000000370000-0x0000000000820000-memory.dmp

memory/2332-495-0x0000000000370000-0x0000000000820000-memory.dmp

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tg2k5l8.default-release\bookmarkbackups\bookmarks-2024-08-12_11_eGOo9s42d0LqSlX+FF4WNg==.jsonlz4

MD5 3f81962185aa138c2df5546f088235b6
SHA1 7337acba5aa3e8bd1f70b1c179d6ce1c8184c7b6
SHA256 e2eec6db65b78d493ef1a8059373a16f86988e3402b2b1ebe029af4c1032fc71
SHA512 466e916a13e4235195da32fb5ce9bde4cd22e0c93998876ef42a101e1dd499dd98d39d002db3d869c54888412ac66588c6f70edacba28a254297fde9c939a232

memory/2332-503-0x0000000000370000-0x0000000000820000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-08-12 05:06

Reported

2024-08-12 05:11

Platform

win10-20240404-en

Max time kernel

293s

Max time network

300s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b24732f7545336b219b6c089e88c2cb8e77aac5cf82c68bbacb3bb5538fa2305.exe"

Signatures

Amadey

trojan amadey

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\b24732f7545336b219b6c089e88c2cb8e77aac5cf82c68bbacb3bb5538fa2305.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\b24732f7545336b219b6c089e88c2cb8e77aac5cf82c68bbacb3bb5538fa2305.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\b24732f7545336b219b6c089e88c2cb8e77aac5cf82c68bbacb3bb5538fa2305.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A

Identifies Wine through registry keys

evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\b24732f7545336b219b6c089e88c2cb8e77aac5cf82c68bbacb3bb5538fa2305.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\explorti.job C:\Users\Admin\AppData\Local\Temp\b24732f7545336b219b6c089e88c2cb8e77aac5cf82c68bbacb3bb5538fa2305.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\b24732f7545336b219b6c089e88c2cb8e77aac5cf82c68bbacb3bb5538fa2305.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\b24732f7545336b219b6c089e88c2cb8e77aac5cf82c68bbacb3bb5538fa2305.exe

"C:\Users\Admin\AppData\Local\Temp\b24732f7545336b219b6c089e88c2cb8e77aac5cf82c68bbacb3bb5538fa2305.exe"

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

"C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Network

Country Destination Domain Proto
RU 185.215.113.19:80 185.215.113.19 tcp
US 8.8.8.8:53 19.113.215.185.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
RU 185.215.113.19:80 185.215.113.19 tcp
US 8.8.8.8:53 240.143.123.92.in-addr.arpa udp

Files

memory/3616-0-0x0000000001030000-0x00000000014E0000-memory.dmp

memory/3616-1-0x0000000077694000-0x0000000077695000-memory.dmp

memory/3616-2-0x0000000001031000-0x000000000105F000-memory.dmp

memory/3616-3-0x0000000001030000-0x00000000014E0000-memory.dmp

memory/3616-5-0x0000000001030000-0x00000000014E0000-memory.dmp

memory/3616-14-0x0000000001030000-0x00000000014E0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

MD5 b411827f67c0ed4ff07ba556a7d02c75
SHA1 116d7057b5a4886604bf5164f09ac3972b410be2
SHA256 b24732f7545336b219b6c089e88c2cb8e77aac5cf82c68bbacb3bb5538fa2305
SHA512 a8bbe86fd08b272065ac648497d3c383ecf9f836e47690182e0992dba6954934d655deed1c3fef05d497519a6b147511e0bcd76f084816c81c943a3066c6c97c

memory/4484-15-0x0000000000DA0000-0x0000000001250000-memory.dmp

memory/4484-16-0x0000000000DA0000-0x0000000001250000-memory.dmp

memory/4484-17-0x0000000000DA0000-0x0000000001250000-memory.dmp

memory/4484-18-0x0000000000DA0000-0x0000000001250000-memory.dmp

memory/4484-19-0x0000000000DA0000-0x0000000001250000-memory.dmp

memory/4484-20-0x0000000000DA0000-0x0000000001250000-memory.dmp

memory/3868-22-0x0000000000DA0000-0x0000000001250000-memory.dmp

memory/3868-23-0x0000000000DA0000-0x0000000001250000-memory.dmp

memory/4484-24-0x0000000000DA0000-0x0000000001250000-memory.dmp

memory/4484-25-0x0000000000DA0000-0x0000000001250000-memory.dmp

memory/4484-26-0x0000000000DA0000-0x0000000001250000-memory.dmp

memory/4484-27-0x0000000000DA0000-0x0000000001250000-memory.dmp

memory/4484-28-0x0000000000DA0000-0x0000000001250000-memory.dmp

memory/4484-29-0x0000000000DA0000-0x0000000001250000-memory.dmp

memory/4484-30-0x0000000000DA0000-0x0000000001250000-memory.dmp

memory/4484-31-0x0000000000DA0000-0x0000000001250000-memory.dmp

memory/5080-33-0x0000000000DA0000-0x0000000001250000-memory.dmp

memory/5080-35-0x0000000000DA0000-0x0000000001250000-memory.dmp

memory/4484-36-0x0000000000DA0000-0x0000000001250000-memory.dmp

memory/4484-37-0x0000000000DA0000-0x0000000001250000-memory.dmp

memory/4484-38-0x0000000000DA0000-0x0000000001250000-memory.dmp

memory/4484-39-0x0000000000DA0000-0x0000000001250000-memory.dmp

memory/4484-40-0x0000000000DA0000-0x0000000001250000-memory.dmp

memory/4484-41-0x0000000000DA0000-0x0000000001250000-memory.dmp

memory/3484-43-0x0000000000DA0000-0x0000000001250000-memory.dmp

memory/3484-44-0x0000000000DA0000-0x0000000001250000-memory.dmp

memory/4484-45-0x0000000000DA0000-0x0000000001250000-memory.dmp

memory/4484-46-0x0000000000DA0000-0x0000000001250000-memory.dmp

memory/4484-47-0x0000000000DA0000-0x0000000001250000-memory.dmp

memory/4484-48-0x0000000000DA0000-0x0000000001250000-memory.dmp

memory/4484-49-0x0000000000DA0000-0x0000000001250000-memory.dmp

memory/4484-50-0x0000000000DA0000-0x0000000001250000-memory.dmp

memory/4904-52-0x0000000000DA0000-0x0000000001250000-memory.dmp

memory/4904-54-0x0000000000DA0000-0x0000000001250000-memory.dmp

memory/4484-55-0x0000000000DA0000-0x0000000001250000-memory.dmp

memory/4484-56-0x0000000000DA0000-0x0000000001250000-memory.dmp

memory/4484-57-0x0000000000DA0000-0x0000000001250000-memory.dmp

memory/4484-58-0x0000000000DA0000-0x0000000001250000-memory.dmp

memory/4484-59-0x0000000000DA0000-0x0000000001250000-memory.dmp

memory/4484-60-0x0000000000DA0000-0x0000000001250000-memory.dmp

memory/2540-62-0x0000000000DA0000-0x0000000001250000-memory.dmp

memory/2540-63-0x0000000000DA0000-0x0000000001250000-memory.dmp

memory/4484-64-0x0000000000DA0000-0x0000000001250000-memory.dmp

memory/4484-65-0x0000000000DA0000-0x0000000001250000-memory.dmp

memory/4484-66-0x0000000000DA0000-0x0000000001250000-memory.dmp

memory/4484-67-0x0000000000DA0000-0x0000000001250000-memory.dmp