Analysis Overview
SHA256
6ea0e93896ccb270f4e5d5cc733acb8bfff3babbcb8ad09573564bb4e5cac089
Threat Level: Known bad
The file AsyncClient.bin was found to be: Known bad.
Malicious Activity Summary
AsyncRat
Async RAT payload
Asyncrat family
Async RAT payload
Loads dropped DLL
Checks computer location settings
Executes dropped EXE
Enumerates physical storage devices
Unsigned PE
Enumerates system info in registry
Modifies registry class
Delays execution with timeout.exe
Suspicious use of WriteProcessMemory
Suspicious use of FindShellTrayWindow
Uses Task Scheduler COM API
Creates scheduled task(s)
Suspicious use of AdjustPrivilegeToken
Suspicious use of SendNotifyMessage
Checks processor information in registry
Suspicious behavior: EnumeratesProcesses
Suspicious use of SetWindowsHookEx
MITRE ATT&CK
Enterprise Matrix V6
Analysis: static1
Detonation Overview
Reported
2023-04-27 01:20
Signatures
Async RAT payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Asyncrat family
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2023-04-27 01:20
Reported
2023-04-27 01:23
Platform
win7-20230220-en
Max time kernel
57s
Max time network
142s
Command Line
Signatures
AsyncRat
Async RAT payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\svhost.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\cmd.exe | N/A |
Enumerates physical storage devices
Creates scheduled task(s)
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
Delays execution with timeout.exe
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\timeout.exe | N/A |
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe
"C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe"
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svhost" /tr '"C:\Users\Admin\AppData\Roaming\svhost.exe"' & exit
C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp193C.tmp.bat""
C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "svhost" /tr '"C:\Users\Admin\AppData\Roaming\svhost.exe"'
C:\Windows\SysWOW64\timeout.exe
timeout 3
C:\Users\Admin\AppData\Roaming\svhost.exe
"C:\Users\Admin\AppData\Roaming\svhost.exe"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef64e9758,0x7fef64e9768,0x7fef64e9778
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1188 --field-trial-handle=1224,i,3859899398050328425,4254014790830658346,131072 /prefetch:2
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1492 --field-trial-handle=1224,i,3859899398050328425,4254014790830658346,131072 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1616 --field-trial-handle=1224,i,3859899398050328425,4254014790830658346,131072 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2244 --field-trial-handle=1224,i,3859899398050328425,4254014790830658346,131072 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2288 --field-trial-handle=1224,i,3859899398050328425,4254014790830658346,131072 /prefetch:1
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=3580 --field-trial-handle=1224,i,3859899398050328425,4254014790830658346,131072 /prefetch:2
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1500 --field-trial-handle=1224,i,3859899398050328425,4254014790830658346,131072 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3784 --field-trial-handle=1224,i,3859899398050328425,4254014790830658346,131072 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3904 --field-trial-handle=1224,i,3859899398050328425,4254014790830658346,131072 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=720 --field-trial-handle=1224,i,3859899398050328425,4254014790830658346,131072 /prefetch:8
Network
| Country | Destination | Domain | Proto |
| MD | 37.75.98.113:6666 | tcp | |
| US | 8.8.8.8:53 | apis.google.com | udp |
| DE | 172.217.23.206:443 | apis.google.com | tcp |
| MD | 37.75.98.113:6666 | tcp | |
| N/A | 224.0.0.251:5353 | udp | |
| MD | 37.75.98.113:6666 | tcp | |
| MD | 37.75.98.113:6666 | tcp | |
| MD | 37.75.98.113:6666 | tcp |
Files
memory/1692-54-0x0000000000B20000-0x0000000000B32000-memory.dmp
memory/1692-55-0x0000000000420000-0x0000000000460000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\tmp193C.tmp.bat
| MD5 | 099f346f110a538f011d74952d1d0b3a |
| SHA1 | 704bcaf5142340e1cee2e56b56b6444abeeffcf2 |
| SHA256 | 0c81a3efa6eb2954f82c6564550595a5cfb309d0ae3359066a64800bf0927bff |
| SHA512 | 7071aa08453bbc7a1a0e2c4a773efca585a3c1f15f6a6fb20098dd755a9c29f9ce8fcbd05f636ac9527f7944e1f838cdc510fba1809bc3c4efd1bbd9c730bfbe |
C:\Users\Admin\AppData\Local\Temp\tmp193C.tmp.bat
| MD5 | 099f346f110a538f011d74952d1d0b3a |
| SHA1 | 704bcaf5142340e1cee2e56b56b6444abeeffcf2 |
| SHA256 | 0c81a3efa6eb2954f82c6564550595a5cfb309d0ae3359066a64800bf0927bff |
| SHA512 | 7071aa08453bbc7a1a0e2c4a773efca585a3c1f15f6a6fb20098dd755a9c29f9ce8fcbd05f636ac9527f7944e1f838cdc510fba1809bc3c4efd1bbd9c730bfbe |
C:\Users\Admin\AppData\Roaming\svhost.exe
| MD5 | cca9008a9ed95dba2d8c936c49a08a30 |
| SHA1 | 31286d0a6f43173be1b8e659616d4459080c4060 |
| SHA256 | 6ea0e93896ccb270f4e5d5cc733acb8bfff3babbcb8ad09573564bb4e5cac089 |
| SHA512 | 3e326b245c2ac068ec3c4c8382b4905bec7ccd8d36352bd31004cf4ad25d9ce8411bfd5000db15a015bb45032a9b13a7c93d4c65c2a34be531021280541417e8 |
\Users\Admin\AppData\Roaming\svhost.exe
| MD5 | cca9008a9ed95dba2d8c936c49a08a30 |
| SHA1 | 31286d0a6f43173be1b8e659616d4459080c4060 |
| SHA256 | 6ea0e93896ccb270f4e5d5cc733acb8bfff3babbcb8ad09573564bb4e5cac089 |
| SHA512 | 3e326b245c2ac068ec3c4c8382b4905bec7ccd8d36352bd31004cf4ad25d9ce8411bfd5000db15a015bb45032a9b13a7c93d4c65c2a34be531021280541417e8 |
C:\Users\Admin\AppData\Roaming\svhost.exe
| MD5 | cca9008a9ed95dba2d8c936c49a08a30 |
| SHA1 | 31286d0a6f43173be1b8e659616d4459080c4060 |
| SHA256 | 6ea0e93896ccb270f4e5d5cc733acb8bfff3babbcb8ad09573564bb4e5cac089 |
| SHA512 | 3e326b245c2ac068ec3c4c8382b4905bec7ccd8d36352bd31004cf4ad25d9ce8411bfd5000db15a015bb45032a9b13a7c93d4c65c2a34be531021280541417e8 |
memory/1644-68-0x0000000000D70000-0x0000000000D82000-memory.dmp
\??\pipe\crashpad_1740_MMSNRCACBPGNBLRP
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000004.dbtmp
| MD5 | 6752a1d65b201c13b62ea44016eb221f |
| SHA1 | 58ecf154d01a62233ed7fb494ace3c3d4ffce08b |
| SHA256 | 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd |
| SHA512 | 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389 |
memory/1644-110-0x00000000044B0000-0x00000000044F0000-memory.dmp
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1
| MD5 | f50f89a0a91564d0b8a211f8921aa7de |
| SHA1 | 112403a17dd69d5b9018b8cede023cb3b54eab7d |
| SHA256 | b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec |
| SHA512 | bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\d83a6925-fec3-4a7d-9198-2273b222820d.tmp
| MD5 | 0ebba4f96ed0f9f1f04fa94262989cc9 |
| SHA1 | ce4ec40080b4146a841bdf536bb9d85c6f85351e |
| SHA256 | f98e856d85579f24462c918b0907ff358e08b14b3691560082442228a18b19eb |
| SHA512 | 2ab57a5fe59afd200aa7bdf3985f68997c96dc0a07a2e55c105dd4b477a6627cfd28b5a00a340485804d7cc72eb23f27925937e73b080c9eaf9a2c95f8a9bc83 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | 8ac1ed3e9955fa550e4f319ac54013e4 |
| SHA1 | 119cb483e5294ba7447a89c1c3e4196d36619c45 |
| SHA256 | a21a70b3022bb29b95d22643c7e77bdec06c7414b71021e2428211f20d53deae |
| SHA512 | 2b6f44d82d57ded2f536f81b46cdc3053a94f1928c378b0aee670a7ebe9e2f625ff6f1142904eabbb61b0ef7a256c2190608e716c3ff0cfa9e6c909ddeade0cc |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT~RF6dbbd1.TMP
| MD5 | 46295cac801e5d4857d09837238a6394 |
| SHA1 | 44e0fa1b517dbf802b18faf0785eeea6ac51594b |
| SHA256 | 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443 |
| SHA512 | 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23 |
Analysis: behavioral2
Detonation Overview
Submitted
2023-04-27 01:20
Reported
2023-04-27 01:22
Platform
win10v2004-20230221-en
Max time kernel
90s
Max time network
92s
Command Line
Signatures
AsyncRat
Async RAT payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\svhost.exe | N/A |
Enumerates physical storage devices
Checks processor information in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 | C:\Program Files\Mozilla Firefox\firefox.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature | C:\Program Files\Mozilla Firefox\firefox.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision | C:\Program Files\Mozilla Firefox\firefox.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz | C:\Program Files\Mozilla Firefox\firefox.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier | C:\Program Files\Mozilla Firefox\firefox.exe | N/A |
Creates scheduled task(s)
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
Delays execution with timeout.exe
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\timeout.exe | N/A |
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings | C:\Program Files\Mozilla Firefox\firefox.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Roaming\svhost.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Roaming\svhost.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Program Files\Mozilla Firefox\firefox.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Program Files\Mozilla Firefox\firefox.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Mozilla Firefox\firefox.exe | N/A |
| N/A | N/A | C:\Program Files\Mozilla Firefox\firefox.exe | N/A |
| N/A | N/A | C:\Program Files\Mozilla Firefox\firefox.exe | N/A |
| N/A | N/A | C:\Program Files\Mozilla Firefox\firefox.exe | N/A |
Suspicious use of SendNotifyMessage
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Mozilla Firefox\firefox.exe | N/A |
| N/A | N/A | C:\Program Files\Mozilla Firefox\firefox.exe | N/A |
| N/A | N/A | C:\Program Files\Mozilla Firefox\firefox.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Mozilla Firefox\firefox.exe | N/A |
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Processes
C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe
"C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe"
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svhost" /tr '"C:\Users\Admin\AppData\Roaming\svhost.exe"' & exit
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp9C93.tmp.bat""
C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "svhost" /tr '"C:\Users\Admin\AppData\Roaming\svhost.exe"'
C:\Windows\SysWOW64\timeout.exe
timeout 3
C:\Users\Admin\AppData\Roaming\svhost.exe
"C:\Users\Admin\AppData\Roaming\svhost.exe"
C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3436.0.180476099\1718462421" -parentBuildID 20221007134813 -prefsHandle 1836 -prefMapHandle 1828 -prefsLen 20890 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {01250ae5-fbcb-4a74-851f-f84ed438a732} 3436 "\\.\pipe\gecko-crash-server-pipe.3436" 1916 1bf11016858 gpu
C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3436.1.906472318\610793524" -parentBuildID 20221007134813 -prefsHandle 2312 -prefMapHandle 2308 -prefsLen 20926 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1ff61e7f-64e0-45d8-b211-3f4f77f9b919} 3436 "\\.\pipe\gecko-crash-server-pipe.3436" 2324 1bf03072e58 socket
C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3436.2.1864782028\1868584846" -childID 1 -isForBrowser -prefsHandle 3368 -prefMapHandle 3364 -prefsLen 21074 -prefMapSize 232675 -jsInitHandle 1496 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6904c02f-4e7e-4d2f-91bf-66b1f97a41c7} 3436 "\\.\pipe\gecko-crash-server-pipe.3436" 3284 1bf13d28e58 tab
C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3436.3.1898275732\1533649891" -childID 2 -isForBrowser -prefsHandle 2452 -prefMapHandle 2356 -prefsLen 26519 -prefMapSize 232675 -jsInitHandle 1496 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4f1fc50e-5b63-4d7a-8f24-91cad73aa5b4} 3436 "\\.\pipe\gecko-crash-server-pipe.3436" 3196 1bf0302db58 tab
C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3436.4.1667359747\829415848" -childID 3 -isForBrowser -prefsHandle 4060 -prefMapHandle 4056 -prefsLen 26519 -prefMapSize 232675 -jsInitHandle 1496 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dd01c1d3-13d7-49b8-817c-95402183de43} 3436 "\\.\pipe\gecko-crash-server-pipe.3436" 4068 1bf150e6258 tab
C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3436.5.485780686\490740409" -childID 4 -isForBrowser -prefsHandle 4992 -prefMapHandle 5008 -prefsLen 26578 -prefMapSize 232675 -jsInitHandle 1496 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c5b3b626-a18e-465e-a31d-89197157834b} 3436 "\\.\pipe\gecko-crash-server-pipe.3436" 1676 1bf0ff0ec58 tab
C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3436.7.622669863\1714446400" -childID 6 -isForBrowser -prefsHandle 5392 -prefMapHandle 5396 -prefsLen 26657 -prefMapSize 232675 -jsInitHandle 1496 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5de8820b-2cf6-41b7-9d62-5e4101bca9be} 3436 "\\.\pipe\gecko-crash-server-pipe.3436" 5384 1bf16463558 tab
C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3436.6.697108960\1654603099" -childID 5 -isForBrowser -prefsHandle 5176 -prefMapHandle 5084 -prefsLen 26657 -prefMapSize 232675 -jsInitHandle 1496 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c91d3c58-988e-410c-9a92-7e1ced4e8dc1} 3436 "\\.\pipe\gecko-crash-server-pipe.3436" 5164 1bf16463258 tab
C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3436.8.1958959904\1939284451" -childID 7 -isForBrowser -prefsHandle 5716 -prefMapHandle 5720 -prefsLen 26738 -prefMapSize 232675 -jsInitHandle 1496 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {89d216d1-0725-4b1b-88ae-9b4fa8ea24d9} 3436 "\\.\pipe\gecko-crash-server-pipe.3436" 5708 1bf16a6ab58 tab
C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3436.9.1980641880\324971199" -parentBuildID 20221007134813 -prefsHandle 1468 -prefMapHandle 6120 -prefsLen 26755 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {62edece8-a6ae-436f-8dd8-cb38e3efc7e0} 3436 "\\.\pipe\gecko-crash-server-pipe.3436" 6128 1bf15e35758 rdd
C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3436.10.1719035849\1458123726" -childID 8 -isForBrowser -prefsHandle 6212 -prefMapHandle 6208 -prefsLen 26755 -prefMapSize 232675 -jsInitHandle 1496 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {419f0d2e-2e83-4a6f-b150-6c01df9807fe} 3436 "\\.\pipe\gecko-crash-server-pipe.3436" 6236 1bf0ff36758 tab
Network
| Country | Destination | Domain | Proto |
| US | 93.184.221.240:80 | tcp | |
| US | 8.8.8.8:53 | 123.108.74.40.in-addr.arpa | udp |
| US | 117.18.237.29:80 | tcp | |
| US | 8.8.8.8:53 | 64.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 28.118.140.52.in-addr.arpa | udp |
| MD | 37.75.98.113:6666 | tcp | |
| N/A | 127.0.0.1:49753 | tcp | |
| N/A | 127.0.0.1:49759 | tcp | |
| US | 8.8.8.8:53 | contile.services.mozilla.com | udp |
| US | 8.8.8.8:53 | getpocket.cdn.mozilla.net | udp |
| US | 8.8.8.8:53 | firefox.settings.services.mozilla.com | udp |
| US | 34.117.237.239:443 | contile.services.mozilla.com | tcp |
| US | 8.8.8.8:53 | contile.services.mozilla.com | udp |
| US | 34.120.5.221:443 | getpocket.cdn.mozilla.net | tcp |
| US | 8.8.8.8:53 | contile.services.mozilla.com | udp |
| US | 8.8.8.8:53 | prod.pocket.prod.cloudops.mozgcp.net | udp |
| US | 8.8.8.8:53 | firefox.settings.services.mozilla.com | udp |
| US | 35.241.9.150:443 | firefox.settings.services.mozilla.com | tcp |
| US | 8.8.8.8:53 | firefox.settings.services.mozilla.com | udp |
| US | 8.8.8.8:53 | shavar.services.mozilla.com | udp |
| US | 8.8.8.8:53 | push.services.mozilla.com | udp |
| US | 8.8.8.8:53 | autopush.prod.mozaws.net | udp |
| US | 34.211.203.81:443 | shavar.services.mozilla.com | tcp |
| US | 8.8.8.8:53 | prod.pocket.prod.cloudops.mozgcp.net | udp |
| US | 8.8.8.8:53 | autopush.prod.mozaws.net | udp |
| US | 8.8.8.8:53 | shavar.prod.mozaws.net | udp |
| US | 34.117.65.55:443 | autopush.prod.mozaws.net | tcp |
| US | 8.8.8.8:53 | shavar.prod.mozaws.net | udp |
| US | 8.8.8.8:53 | 221.5.120.34.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 239.237.117.34.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 55.65.117.34.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 150.9.241.35.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 81.203.211.34.in-addr.arpa | udp |
| US | 8.8.8.8:53 | content-signature-2.cdn.mozilla.net | udp |
| US | 34.160.144.191:443 | content-signature-2.cdn.mozilla.net | tcp |
| US | 8.8.8.8:53 | prod.content-signature-chains.prod.webservices.mozgcp.net | udp |
| US | 35.241.9.150:443 | firefox.settings.services.mozilla.com | tcp |
| US | 8.8.8.8:53 | prod.content-signature-chains.prod.webservices.mozgcp.net | udp |
| US | 8.8.8.8:53 | 191.144.160.34.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 183.59.114.20.in-addr.arpa | udp |
| US | 40.77.2.164:443 | tcp | |
| US | 8.8.8.8:53 | app.any.run | udp |
| US | 172.67.20.89:80 | app.any.run | tcp |
| US | 172.67.20.89:80 | app.any.run | tcp |
| US | 8.8.8.8:53 | app.any.run | udp |
| US | 8.8.8.8:53 | app.any.run | udp |
| US | 172.67.20.89:443 | app.any.run | tcp |
| US | 8.8.8.8:53 | 89.20.67.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | counter.any.run | udp |
| US | 8.8.8.8:53 | owa.any.run | udp |
| US | 104.22.49.74:443 | counter.any.run | tcp |
| US | 8.8.8.8:53 | counter.any.run | udp |
| US | 8.8.8.8:53 | counter.any.run | udp |
| US | 8.8.8.8:53 | 196.168.217.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 106.208.58.216.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 8.36.251.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 195.179.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 74.49.22.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | googleads.g.doubleclick.net | udp |
| US | 8.8.8.8:53 | snap.licdn.com | udp |
| US | 8.8.8.8:53 | googleads.g.doubleclick.net | udp |
| US | 8.8.8.8:53 | a1916.dscg2.akamai.net | udp |
| US | 8.8.8.8:53 | static.ads-twitter.com | udp |
| US | 8.8.8.8:53 | googleads.g.doubleclick.net | udp |
| US | 8.8.8.8:53 | www.clarity.ms | udp |
| US | 8.8.8.8:53 | platform.twitter.map.fastly.net | udp |
| US | 8.8.8.8:53 | a1916.dscg2.akamai.net | udp |
| US | 8.8.8.8:53 | platform.twitter.map.fastly.net | udp |
| US | 8.8.8.8:53 | part-0040.t-0009.fdv2-t-msedge.net | udp |
| US | 8.8.8.8:53 | part-0040.t-0009.fdv2-t-msedge.net | udp |
| US | 8.8.8.8:53 | analytics.google.com | udp |
| US | 8.8.8.8:53 | stats.g.doubleclick.net | udp |
| US | 216.239.32.181:443 | analytics.google.com | tcp |
| US | 8.8.8.8:53 | analytics-alv.google.com | udp |
| US | 8.8.8.8:53 | stats.g.doubleclick.net | udp |
| US | 8.8.8.8:53 | analytics-alv.google.com | udp |
| US | 8.8.8.8:53 | stats.g.doubleclick.net | udp |
| US | 216.239.32.181:443 | analytics-alv.google.com | udp |
| US | 8.8.8.8:53 | 181.32.239.216.in-addr.arpa | udp |
| NL | 142.250.102.156:443 | stats.g.doubleclick.net | tcp |
| NL | 142.250.102.156:443 | stats.g.doubleclick.net | udp |
| US | 52.168.112.66:443 | tcp | |
| US | 8.8.8.8:53 | 156.102.250.142.in-addr.arpa | udp |
| NL | 142.250.179.194:443 | googleads.g.doubleclick.net | tcp |
| DE | 23.32.238.152:443 | a1916.dscg2.akamai.net | tcp |
| NL | 199.232.148.157:443 | platform.twitter.map.fastly.net | tcp |
| US | 13.107.237.68:443 | part-0040.t-0009.fdv2-t-msedge.net | tcp |
| US | 8.8.8.8:53 | cllctr.any.run | udp |
| NL | 142.250.179.194:443 | googleads.g.doubleclick.net | udp |
| US | 8.8.8.8:53 | cllctr.any.run | udp |
| US | 172.67.20.89:443 | cllctr.any.run | tcp |
| US | 8.8.8.8:53 | cllctr.any.run | udp |
| US | 8.8.8.8:53 | 131.179.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 206.23.217.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 194.179.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 157.148.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 68.237.107.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 152.238.32.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | cdn.linkedin.oribi.io | udp |
| US | 8.8.8.8:53 | px.ads.linkedin.com | udp |
| US | 8.8.8.8:53 | t.co | udp |
| US | 8.8.8.8:53 | analytics.twitter.com | udp |
| US | 104.244.42.69:443 | t.co | tcp |
| US | 8.8.8.8:53 | l-0005.l-msedge.net | udp |
| US | 8.8.8.8:53 | t.co | udp |
| NL | 52.222.139.9:443 | cdn.linkedin.oribi.io | tcp |
| US | 8.8.8.8:53 | l-0005.l-msedge.net | udp |
| US | 8.8.8.8:53 | s.twitter.com | udp |
| US | 8.8.8.8:53 | t.co | udp |
| US | 8.8.8.8:53 | d1ni990a184w7d.cloudfront.net | udp |
| US | 8.8.8.8:53 | d1ni990a184w7d.cloudfront.net | udp |
| US | 13.107.42.14:443 | l-0005.l-msedge.net | tcp |
| US | 104.244.42.195:443 | analytics.twitter.com | tcp |
| US | 172.67.20.89:443 | cllctr.any.run | tcp |
| US | 8.8.8.8:53 | w.clarity.ms | udp |
| US | 23.96.124.156:443 | w.clarity.ms | tcp |
| US | 8.8.8.8:53 | clarity-ingest-eus-e-sc.eastus.cloudapp.azure.com | udp |
| US | 8.8.8.8:53 | clarity-ingest-eus-e-sc.eastus.cloudapp.azure.com | udp |
| US | 8.8.8.8:53 | 69.42.244.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 9.139.222.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 14.42.107.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 195.42.244.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 156.124.96.23.in-addr.arpa | udp |
| US | 209.197.3.8:80 | tcp | |
| US | 209.197.3.8:80 | tcp | |
| MD | 37.75.98.113:6666 | tcp | |
| NL | 173.223.113.164:443 | tcp | |
| US | 8.8.8.8:53 | sentry.any.run | udp |
| US | 104.22.49.74:443 | sentry.any.run | tcp |
| US | 8.8.8.8:53 | sentry.any.run | udp |
| US | 8.8.8.8:53 | sentry.any.run | udp |
| US | 8.8.8.8:53 | owa.any.run | udp |
| US | 104.22.48.74:443 | owa.any.run | tcp |
| US | 8.8.8.8:53 | owa.any.run | udp |
| US | 8.8.8.8:53 | owa.any.run | udp |
| US | 8.8.8.8:53 | 74.48.22.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | w.clarity.ms | udp |
| US | 8.8.8.8:53 | clarity-ingest-eus-e-sc.eastus.cloudapp.azure.com | udp |
| US | 8.8.8.8:53 | clarity-ingest-eus-e-sc.eastus.cloudapp.azure.com | udp |
| US | 8.8.8.8:53 | 15.164.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 2.36.159.162.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 64.13.109.52.in-addr.arpa | udp |
| MD | 37.75.98.113:6666 | tcp | |
| US | 8.8.8.8:53 | aus5.mozilla.org | udp |
| US | 35.244.181.201:443 | aus5.mozilla.org | tcp |
| US | 8.8.8.8:53 | prod.balrog.prod.cloudops.mozgcp.net | udp |
| US | 8.8.8.8:53 | prod.balrog.prod.cloudops.mozgcp.net | udp |
| US | 8.8.8.8:53 | firefox.settings.services.mozilla.com | udp |
| US | 8.8.8.8:53 | ciscobinary.openh264.org | udp |
| US | 8.8.8.8:53 | firefox.settings.services.mozilla.com | udp |
| US | 8.8.8.8:53 | firefox.settings.services.mozilla.com | udp |
| GB | 88.221.134.155:80 | ciscobinary.openh264.org | tcp |
| US | 8.8.8.8:53 | a19.dscg10.akamai.net | udp |
| US | 8.8.8.8:53 | 201.181.244.35.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 155.134.221.88.in-addr.arpa | udp |
| US | 8.8.8.8:53 | redirector.gvt1.com | udp |
| GB | 216.58.208.110:443 | redirector.gvt1.com | tcp |
| US | 8.8.8.8:53 | redirector.gvt1.com | udp |
| US | 8.8.8.8:53 | redirector.gvt1.com | udp |
| GB | 216.58.208.110:443 | redirector.gvt1.com | udp |
| US | 8.8.8.8:53 | r3---sn-aigl6nzl.gvt1.com | udp |
| GB | 74.125.168.168:443 | r3---sn-aigl6nzl.gvt1.com | tcp |
| US | 8.8.8.8:53 | r3.sn-aigl6nzl.gvt1.com | udp |
| US | 8.8.8.8:53 | r3.sn-aigl6nzl.gvt1.com | udp |
| GB | 74.125.168.168:443 | r3.sn-aigl6nzl.gvt1.com | udp |
| US | 8.8.8.8:53 | 110.208.58.216.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 168.168.125.74.in-addr.arpa | udp |
| US | 93.184.221.240:80 | tcp | |
| US | 8.8.8.8:53 | firefox-settings-attachments.cdn.mozilla.net | udp |
| US | 34.111.73.144:443 | firefox-settings-attachments.cdn.mozilla.net | tcp |
| US | 34.111.73.144:443 | firefox-settings-attachments.cdn.mozilla.net | tcp |
| US | 8.8.8.8:53 | fennec-catalog-cdn.prod.mozaws.net | udp |
| US | 34.111.73.144:443 | fennec-catalog-cdn.prod.mozaws.net | tcp |
| US | 34.111.73.144:443 | fennec-catalog-cdn.prod.mozaws.net | tcp |
| US | 34.111.73.144:443 | fennec-catalog-cdn.prod.mozaws.net | tcp |
| US | 34.111.73.144:443 | fennec-catalog-cdn.prod.mozaws.net | tcp |
| US | 8.8.8.8:53 | fennec-catalog-cdn.prod.mozaws.net | udp |
| US | 8.8.8.8:53 | 144.73.111.34.in-addr.arpa | udp |
| US | 8.8.8.8:53 | w.clarity.ms | udp |
| US | 8.8.8.8:53 | clarity-ingest-eus-e-sc.eastus.cloudapp.azure.com | udp |
| US | 23.96.124.156:443 | clarity-ingest-eus-e-sc.eastus.cloudapp.azure.com | tcp |
| US | 8.8.8.8:53 | clarity-ingest-eus-e-sc.eastus.cloudapp.azure.com | udp |
| US | 8.8.8.8:53 | a19.dscg10.akamai.net | udp |
| US | 8.8.8.8:53 | clarity-ingest-eus-e-sc.eastus.cloudapp.azure.com | udp |
Files
memory/4076-133-0x0000000000300000-0x0000000000312000-memory.dmp
memory/4076-134-0x0000000004C80000-0x0000000004C90000-memory.dmp
memory/4076-135-0x0000000004D90000-0x0000000004DF6000-memory.dmp
memory/4076-136-0x00000000051E0000-0x000000000527C000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\tmp9C93.tmp.bat
| MD5 | ec47c4e1fd004096b9cdc2504c2f0480 |
| SHA1 | bff463192cee7a31bfbf240bc67593990a30a0b1 |
| SHA256 | 73505ce421058faefe0d86d1d85d1a80425462f87bb6b8eda7d7b7ddd413b2ae |
| SHA512 | 263375c9f6a3b2db2f830f7b94f637600c4c215f3339d4e63d81e718c35767944c8d597327976e54014c571dbc196204eb4bbf94b219cfa4866685df6dcbd3e0 |
C:\Users\Admin\AppData\Roaming\svhost.exe
| MD5 | cca9008a9ed95dba2d8c936c49a08a30 |
| SHA1 | 31286d0a6f43173be1b8e659616d4459080c4060 |
| SHA256 | 6ea0e93896ccb270f4e5d5cc733acb8bfff3babbcb8ad09573564bb4e5cac089 |
| SHA512 | 3e326b245c2ac068ec3c4c8382b4905bec7ccd8d36352bd31004cf4ad25d9ce8411bfd5000db15a015bb45032a9b13a7c93d4c65c2a34be531021280541417e8 |
C:\Users\Admin\AppData\Roaming\svhost.exe
| MD5 | cca9008a9ed95dba2d8c936c49a08a30 |
| SHA1 | 31286d0a6f43173be1b8e659616d4459080c4060 |
| SHA256 | 6ea0e93896ccb270f4e5d5cc733acb8bfff3babbcb8ad09573564bb4e5cac089 |
| SHA512 | 3e326b245c2ac068ec3c4c8382b4905bec7ccd8d36352bd31004cf4ad25d9ce8411bfd5000db15a015bb45032a9b13a7c93d4c65c2a34be531021280541417e8 |
memory/1988-145-0x0000000004AE0000-0x0000000004AF0000-memory.dmp
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bozzcyfh.default-release\activity-stream.discovery_stream.json.tmp
| MD5 | ba12b4b869e8fca6a5b548c7968343c7 |
| SHA1 | e858ea36d5e839e75e57175daeca5aa764362a1e |
| SHA256 | 148a3f7d04c3152672a128ea0a5067b414355792ab8dae527c07c4124c79f979 |
| SHA512 | 5cdb598497419d8a6caf44022ce42dc7e90ddc990de7ccf44768ab8c29e0a8c82c3a2d4512debd77b21deba6733a4f264e98d2b742492cd8735b07681028854f |
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bozzcyfh.default-release\prefs.js
| MD5 | fcd5f37e5e4066f7cffe8eb106b6ce19 |
| SHA1 | b0a1c4d3d5c96271429fb09cb71055d177c13402 |
| SHA256 | 38dbdb91f24f8e138803d71d0f7e4758fbb78e7f657208325fe30a501e225c67 |
| SHA512 | afdf7697bc784c3c85f30a8a1e4caa32459cf7f19c1ffacde04f62f089218ff1899ffe69fc465677d719546c8f91bea0d04807b13d58096f79aeba8eef0a0a15 |
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bozzcyfh.default-release\prefs-1.js
| MD5 | de9d89a225ab1cad6aad8649eb21dc96 |
| SHA1 | e35327444a2537929df3fb21ac4e4f88759a6684 |
| SHA256 | 4e0312b3aa79646805f42b36d7a66473523b76096f2a2cdada0c0ab395121662 |
| SHA512 | 23fcf95c0988e6167dc8cd149836a2afb4de0419de55863a9e8c2a5b7a417ce84e6eb2cd32ae97e0fa6dab805ed70eaadcd4ba4dfe58a716a8aee39e738c69b3 |
memory/1988-219-0x0000000004AE0000-0x0000000004AF0000-memory.dmp
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bozzcyfh.default-release\sessionstore-backups\recovery.jsonlz4
| MD5 | bcfb4b119611753c0a0a26e68e04a7d8 |
| SHA1 | 0286657fb5eb559f88aabe836ecfb529c172c072 |
| SHA256 | e13e47885ebaefdba539b2cb4ef12a2d6e63f5a739aa960532490bef955dc198 |
| SHA512 | 1142b89823b581ba32e28577e960af7ff031856621513d2b7b3f7f8affc89a9a8908d8e712c413ac915e144d52bb065b92023c43a7771c9fc6930e04e3fc73b6 |
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bozzcyfh.default-release\prefs-1.js
| MD5 | d6590d2fedda8024318bc174ad251274 |
| SHA1 | 1e0f94cfb02621d33fdf92c29c0fb3dcc5549789 |
| SHA256 | 2a57804b5d2b25e1cc671978a03e346c236f2ed14103f3df052a08a7178f27bb |
| SHA512 | 977ac51dfbf62a0e447040b21ae9044a0e1c024c6de91474c276353221fb0e96b75d41fb476261370ae48715ffc8383ef557f67b4dfc60e419c8bb3d5c104038 |
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bozzcyfh.default-release\prefs-1.js
| MD5 | e1496ce15ffdae1e7cdb2b1a2d5fc11c |
| SHA1 | 8e6d6b95aa40aeee6d6989d73ebb9ec5ecf12b54 |
| SHA256 | ecbdb4465c0ce96407854ea522c4c83d61128ce1a7708853ea32250756a7a749 |
| SHA512 | 4d211b0d33adf77493e4195eda2ce3766a502a24dd9c6dcdd449e28ba68c58821bf0b98a87a9c41cedd1596522103609519fd09ddbfd0992a8479b596fb2e8ec |
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bozzcyfh.default-release\sessionstore-backups\recovery.jsonlz4
| MD5 | 4823e8f394397a3fddd978bb5c96de5b |
| SHA1 | c718a75202b0abdd471da83cfa5200f34125b6aa |
| SHA256 | 20afbe6846c0c2d6370e03f06bd0a0c6560e92a40c2047faea7658f3070984f1 |
| SHA512 | 0f44adf07f6c3cfceebb96bf7972d105d7d33b4384111d82c9bf07142928094e852da6455e5965299e1b4e27ffc1068294f4bc96a08b1f87e87bb7f65c011c1d |
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bozzcyfh.default-release\cache2\doomed\23664
| MD5 | 5e3f3f851244e4fb0109f35033658309 |
| SHA1 | d81b77a811ffade20676a8b8e23c9bcb912f7c64 |
| SHA256 | c8b45dceab36b3d44834401040746aa010b3813da69b1ca39535ce3547687526 |
| SHA512 | 3699faa784963cb6e2c0dfc74f87fd45def9e5ced19ad14af101be71325c1a127809e0cae6f9f5915b90913422aed59a0eee3364b00ffc4ef42eee6046f94543 |
C:\Users\Admin\AppData\Local\Temp\tmpaddon
| MD5 | 85430baed3398695717b0263807cf97c |
| SHA1 | fffbee923cea216f50fce5d54219a188a5100f41 |
| SHA256 | a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e |
| SHA512 | 06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1 |
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bozzcyfh.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
| MD5 | fe3355639648c417e8307c6d051e3e37 |
| SHA1 | f54602d4b4778da21bc97c7238fc66aa68c8ee34 |
| SHA256 | 1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e |
| SHA512 | 8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c |
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bozzcyfh.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
| MD5 | 3d33cdc0b3d281e67dd52e14435dd04f |
| SHA1 | 4db88689282fd4f9e9e6ab95fcbb23df6e6485db |
| SHA256 | f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b |
| SHA512 | a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1 |
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bozzcyfh.default-release\prefs-1.js
| MD5 | b995ca944be9ba3a65ff957b3ae8552b |
| SHA1 | 6aff741770d806e9cc67fb6958bae910f513d42c |
| SHA256 | 76c288f4ff8eee365b2598a38a14dc93220e8f8f8f9a2299a4c8407dc23b8513 |
| SHA512 | 6a2944fe71837feb7d2c1c870e0ce7ed6988dadceba0e62f8602132bbd2dbb532a2c6dc4d8498d1b086b128e8db317ddb49853d43c5272bfc961fc05e1e69b1b |
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
| MD5 | a01c5ecd6108350ae23d2cddf0e77c17 |
| SHA1 | c6ac28a2cd979f1f9a75d56271821d5ff665e2b6 |
| SHA256 | 345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42 |
| SHA512 | b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72 |
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bozzcyfh.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
| MD5 | 8be33af717bb1b67fbd61c3f4b807e9e |
| SHA1 | 7cf17656d174d951957ff36810e874a134dd49e0 |
| SHA256 | e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd |
| SHA512 | 6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7 |
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bozzcyfh.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
| MD5 | 49ddb419d96dceb9069018535fb2e2fc |
| SHA1 | 62aa6fea895a8b68d468a015f6e6ab400d7a7ca6 |
| SHA256 | 2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539 |
| SHA512 | 48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2 |
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bozzcyfh.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
| MD5 | 33bf7b0439480effb9fb212efce87b13 |
| SHA1 | cee50f2745edc6dc291887b6075ca64d716f495a |
| SHA256 | 8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e |
| SHA512 | d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275 |
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bozzcyfh.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
| MD5 | 688bed3676d2104e7f17ae1cd2c59404 |
| SHA1 | 952b2cdf783ac72fcb98338723e9afd38d47ad8e |
| SHA256 | 33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237 |
| SHA512 | 7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776 |
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bozzcyfh.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
| MD5 | 937326fead5fd401f6cca9118bd9ade9 |
| SHA1 | 4526a57d4ae14ed29b37632c72aef3c408189d91 |
| SHA256 | 68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81 |
| SHA512 | b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2 |
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bozzcyfh.default-release\prefs-1.js
| MD5 | c5e3d34e98368c284b0a758b3ff7bc28 |
| SHA1 | 43e566a7ac31377c24b45304b0710fbdfeb7a964 |
| SHA256 | ca07d3893226bb3b92136d04496de8359d79b35fdb2508ea590eb113de36d6ca |
| SHA512 | f66afb22fa49485ef6b59a003b73676f71c12da08a2bdafa4ee03a73037c9d09721ab428de1e69b6d751986a34beda344865587c8726ad4ab761408b036d9762 |
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bozzcyfh.default-release\thumbnails\6c7580006806f7ab3bb5dfbea939832b.png
| MD5 | aa1ca8a5226323bb361e40c1383ffa1e |
| SHA1 | dbfdc14ede96c38059f025ed974cad60545d6e5c |
| SHA256 | 4ecfcfe1eabf380d3ce8abaaff80a5d1520a997d1c808d55aa9abe69b6d4b802 |
| SHA512 | ce5c571f067dce5498cd9611c5a0a5ec32d6c554496618f3492937c361c1e96b4bf0dff8fe54357ff0bbfd010b17f979933ec07efc26a28554bd422edc969665 |