Malware Analysis Report

2025-03-15 06:25

Sample ID 240127-q1va5sdch4
Target Keygen Xdecoder.exe
SHA256 567c4101aa7ad812b7bd42d87a5ba7d9c4f82dd7096daa7b079cfa70649dec2e
Tags
njrat hacked persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

567c4101aa7ad812b7bd42d87a5ba7d9c4f82dd7096daa7b079cfa70649dec2e

Threat Level: Known bad

The file Keygen Xdecoder.exe was found to be: Known bad.

Malicious Activity Summary

njrat hacked persistence trojan

njRAT/Bladabindi

Drops startup file

Executes dropped EXE

Adds Run key to start application

Suspicious use of NtSetInformationThreadHideFromDebugger

Drops file in Windows directory

Enumerates physical storage devices

Unsigned PE

Suspicious use of SetWindowsHookEx

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SendNotifyMessage

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of FindShellTrayWindow

Uses Task Scheduler COM API

Checks processor information in registry

Views/modifies file attributes

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-01-27 13:44

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-01-27 13:44

Reported

2024-01-27 13:49

Platform

win11-20231222-en

Max time kernel

300s

Max time network

301s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Keygen Xdecoder.exe"

Signatures

njRAT/Bladabindi

trojan njrat

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe C:\Windows\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe C:\Windows\svchost.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.lnk C:\Users\Admin\AppData\Local\Temp\paylod.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.lnk C:\Windows\svchost.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\paylod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Keygen (2).exe N/A
N/A N/A C:\Windows\svchost.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-4286256601-2211319207-2237621277-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Windows.URL" C:\Windows\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Windows.URL" C:\Windows\svchost.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4286256601-2211319207-2237621277-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows2 = "C:\\Windows\\svchost.exe" C:\Users\Admin\AppData\Local\Temp\paylod.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4286256601-2211319207-2237621277-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows2 = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Windows.URL" C:\Windows\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows2 = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Windows.URL" C:\Windows\svchost.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Keygen Xdecoder.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Keygen Xdecoder.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\svchost.exe C:\Users\Admin\AppData\Local\Temp\paylod.exe N/A
File opened for modification C:\Windows\svchost.exe C:\Windows\SysWOW64\attrib.exe N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Program Files\Mozilla Firefox\firefox.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-4286256601-2211319207-2237621277-1000_Classes\Local Settings C:\Program Files\Mozilla Firefox\firefox.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Keygen Xdecoder.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Keygen Xdecoder.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\svchost.exe N/A
Token: 33 N/A C:\Windows\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\svchost.exe N/A
Token: 33 N/A C:\Windows\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\svchost.exe N/A
Token: 33 N/A C:\Windows\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\svchost.exe N/A
Token: 33 N/A C:\Windows\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\svchost.exe N/A
Token: 33 N/A C:\Windows\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\svchost.exe N/A
Token: 33 N/A C:\Windows\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\svchost.exe N/A
Token: 33 N/A C:\Windows\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\svchost.exe N/A
Token: 33 N/A C:\Windows\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\svchost.exe N/A
Token: 33 N/A C:\Windows\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\svchost.exe N/A
Token: 33 N/A C:\Windows\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\svchost.exe N/A
Token: 33 N/A C:\Windows\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: 33 N/A C:\Windows\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\svchost.exe N/A
Token: 33 N/A C:\Windows\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\svchost.exe N/A
Token: 33 N/A C:\Windows\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\svchost.exe N/A
Token: 33 N/A C:\Windows\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\svchost.exe N/A
Token: 33 N/A C:\Windows\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\svchost.exe N/A
Token: 33 N/A C:\Windows\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\svchost.exe N/A
Token: 33 N/A C:\Windows\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\svchost.exe N/A
Token: 33 N/A C:\Windows\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\svchost.exe N/A
Token: 33 N/A C:\Windows\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\svchost.exe N/A
Token: 33 N/A C:\Windows\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\svchost.exe N/A
Token: 33 N/A C:\Windows\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\svchost.exe N/A
Token: 33 N/A C:\Windows\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\svchost.exe N/A
Token: 33 N/A C:\Windows\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\svchost.exe N/A
Token: 33 N/A C:\Windows\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: 33 N/A C:\Windows\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\svchost.exe N/A
Token: 33 N/A C:\Windows\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\svchost.exe N/A
Token: 33 N/A C:\Windows\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\svchost.exe N/A
Token: 33 N/A C:\Windows\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\svchost.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2604 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\Keygen Xdecoder.exe C:\Users\Admin\AppData\Local\Temp\paylod.exe
PID 2604 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\Keygen Xdecoder.exe C:\Users\Admin\AppData\Local\Temp\paylod.exe
PID 2604 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\Keygen Xdecoder.exe C:\Users\Admin\AppData\Local\Temp\paylod.exe
PID 2604 wrote to memory of 3540 N/A C:\Users\Admin\AppData\Local\Temp\Keygen Xdecoder.exe C:\Users\Admin\AppData\Local\Temp\Keygen (2).exe
PID 2604 wrote to memory of 3540 N/A C:\Users\Admin\AppData\Local\Temp\Keygen Xdecoder.exe C:\Users\Admin\AppData\Local\Temp\Keygen (2).exe
PID 2604 wrote to memory of 3540 N/A C:\Users\Admin\AppData\Local\Temp\Keygen Xdecoder.exe C:\Users\Admin\AppData\Local\Temp\Keygen (2).exe
PID 3516 wrote to memory of 4404 N/A C:\Users\Admin\AppData\Local\Temp\paylod.exe C:\Windows\svchost.exe
PID 3516 wrote to memory of 4404 N/A C:\Users\Admin\AppData\Local\Temp\paylod.exe C:\Windows\svchost.exe
PID 3516 wrote to memory of 4404 N/A C:\Users\Admin\AppData\Local\Temp\paylod.exe C:\Windows\svchost.exe
PID 3516 wrote to memory of 2992 N/A C:\Users\Admin\AppData\Local\Temp\paylod.exe C:\Windows\SysWOW64\attrib.exe
PID 3516 wrote to memory of 2992 N/A C:\Users\Admin\AppData\Local\Temp\paylod.exe C:\Windows\SysWOW64\attrib.exe
PID 3516 wrote to memory of 2992 N/A C:\Users\Admin\AppData\Local\Temp\paylod.exe C:\Windows\SysWOW64\attrib.exe
PID 1372 wrote to memory of 3512 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1372 wrote to memory of 3512 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1372 wrote to memory of 3512 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1372 wrote to memory of 3512 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1372 wrote to memory of 3512 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1372 wrote to memory of 3512 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1372 wrote to memory of 3512 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1372 wrote to memory of 3512 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1372 wrote to memory of 3512 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1372 wrote to memory of 3512 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1372 wrote to memory of 3512 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3512 wrote to memory of 3140 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3512 wrote to memory of 3140 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3512 wrote to memory of 4576 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3512 wrote to memory of 4576 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3512 wrote to memory of 4576 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3512 wrote to memory of 4576 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3512 wrote to memory of 4576 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3512 wrote to memory of 4576 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3512 wrote to memory of 4576 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3512 wrote to memory of 4576 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3512 wrote to memory of 4576 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3512 wrote to memory of 4576 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3512 wrote to memory of 4576 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3512 wrote to memory of 4576 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3512 wrote to memory of 4576 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3512 wrote to memory of 4576 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3512 wrote to memory of 4576 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3512 wrote to memory of 4576 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3512 wrote to memory of 4576 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3512 wrote to memory of 4576 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3512 wrote to memory of 4576 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3512 wrote to memory of 4576 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3512 wrote to memory of 4576 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3512 wrote to memory of 4576 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3512 wrote to memory of 4576 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3512 wrote to memory of 4576 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3512 wrote to memory of 4576 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3512 wrote to memory of 4576 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3512 wrote to memory of 4576 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3512 wrote to memory of 4576 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3512 wrote to memory of 4576 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3512 wrote to memory of 4576 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3512 wrote to memory of 4576 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3512 wrote to memory of 4576 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3512 wrote to memory of 4576 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3512 wrote to memory of 4576 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3512 wrote to memory of 4576 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3512 wrote to memory of 4576 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3512 wrote to memory of 4576 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3512 wrote to memory of 4576 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3512 wrote to memory of 4576 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe

Uses Task Scheduler COM API

persistence

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Keygen Xdecoder.exe

"C:\Users\Admin\AppData\Local\Temp\Keygen Xdecoder.exe"

C:\Users\Admin\AppData\Local\Temp\paylod.exe

"C:\Users\Admin\AppData\Local\Temp\paylod.exe"

C:\Users\Admin\AppData\Local\Temp\Keygen (2).exe

"C:\Users\Admin\AppData\Local\Temp\Keygen (2).exe"

C:\Windows\SysWOW64\attrib.exe

attrib +h +r +s "C:\Windows\svchost.exe"

C:\Windows\svchost.exe

"C:\Windows\svchost.exe"

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe"

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe"

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3512.0.1507553285\119548449" -parentBuildID 20221007134813 -prefsHandle 1776 -prefMapHandle 1768 -prefsLen 20669 -prefMapSize 233414 -appDir "C:\Program Files\Mozilla Firefox\browser" - {eabff379-9efa-4e9d-b8b0-775b1d0780e8} 3512 "\\.\pipe\gecko-crash-server-pipe.3512" 1856 223ee6d3b58 gpu

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3512.1.1961360801\1918804042" -parentBuildID 20221007134813 -prefsHandle 2228 -prefMapHandle 2224 -prefsLen 20705 -prefMapSize 233414 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f402ab77-9401-4196-beb8-30589cd59fc3} 3512 "\\.\pipe\gecko-crash-server-pipe.3512" 2232 223ee030b58 socket

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3512.2.434233520\1996204875" -childID 1 -isForBrowser -prefsHandle 3096 -prefMapHandle 2964 -prefsLen 20808 -prefMapSize 233414 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7ce2ac7e-84e6-40d5-9b5e-b55a4f859da6} 3512 "\\.\pipe\gecko-crash-server-pipe.3512" 3060 223f369d258 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3512.3.761862167\171983053" -childID 2 -isForBrowser -prefsHandle 3580 -prefMapHandle 3576 -prefsLen 25986 -prefMapSize 233414 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a8569579-a12c-4b51-b7f3-23b9d88928e2} 3512 "\\.\pipe\gecko-crash-server-pipe.3512" 3592 223f45a3658 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3512.4.166625011\1122598330" -childID 3 -isForBrowser -prefsHandle 4176 -prefMapHandle 4172 -prefsLen 26045 -prefMapSize 233414 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {24d7fe4a-3e46-4157-8485-76697b4bab61} 3512 "\\.\pipe\gecko-crash-server-pipe.3512" 4196 223f4bf3e58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3512.7.1374156205\1632389990" -childID 6 -isForBrowser -prefsHandle 5452 -prefMapHandle 5456 -prefsLen 26045 -prefMapSize 233414 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {eff5c60a-f46e-4b76-8640-ae55f8e63413} 3512 "\\.\pipe\gecko-crash-server-pipe.3512" 5124 223f5784d58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3512.6.190865286\1974581194" -childID 5 -isForBrowser -prefsHandle 5260 -prefMapHandle 5264 -prefsLen 26045 -prefMapSize 233414 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6fd92026-e924-4519-b499-910a084ad5de} 3512 "\\.\pipe\gecko-crash-server-pipe.3512" 5252 223f50f9258 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3512.5.192838908\22517493" -childID 4 -isForBrowser -prefsHandle 5100 -prefMapHandle 5088 -prefsLen 26045 -prefMapSize 233414 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {23882d5a-2028-417e-b3f5-239983b7a6f7} 3512 "\\.\pipe\gecko-crash-server-pipe.3512" 5124 223e242ea58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3512.8.554928629\1633318652" -childID 7 -isForBrowser -prefsHandle 4512 -prefMapHandle 2848 -prefsLen 26644 -prefMapSize 233414 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d52a7d1e-7dd9-4182-a958-c6dd217a4a31} 3512 "\\.\pipe\gecko-crash-server-pipe.3512" 5832 223f2871958 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3512.9.375113896\706211477" -childID 8 -isForBrowser -prefsHandle 6008 -prefMapHandle 6016 -prefsLen 26723 -prefMapSize 233414 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {81172eea-e864-4c5e-be99-eae5934f8dde} 3512 "\\.\pipe\gecko-crash-server-pipe.3512" 5996 223ee958258 tab

Network

Country Destination Domain Proto
US 8.8.8.8:53 ecutuning.ddns.net udp
DZ 105.105.91.157:11560 ecutuning.ddns.net tcp
DZ 105.105.91.157:11560 ecutuning.ddns.net tcp
DZ 105.105.91.157:11560 ecutuning.ddns.net tcp
DZ 105.105.91.157:11560 ecutuning.ddns.net tcp
DZ 105.105.91.157:11560 ecutuning.ddns.net tcp
DZ 105.105.91.157:11560 ecutuning.ddns.net tcp
DZ 105.105.91.157:11560 ecutuning.ddns.net tcp
DZ 105.105.91.157:11560 ecutuning.ddns.net tcp
DZ 105.105.91.157:11560 ecutuning.ddns.net tcp
DZ 105.105.91.157:11560 ecutuning.ddns.net tcp
DZ 105.105.91.157:11560 ecutuning.ddns.net tcp
DZ 105.105.91.157:11560 ecutuning.ddns.net tcp
US 52.111.229.48:443 tcp
DZ 105.105.91.157:11560 ecutuning.ddns.net tcp
DZ 105.105.91.157:11560 ecutuning.ddns.net tcp
DZ 105.105.91.157:11560 ecutuning.ddns.net tcp
DZ 105.105.91.157:11560 ecutuning.ddns.net tcp
DZ 105.105.91.157:11560 ecutuning.ddns.net tcp
DZ 105.105.91.157:11560 ecutuning.ddns.net tcp
DZ 105.105.91.157:11560 ecutuning.ddns.net tcp
N/A 127.0.0.1:49827 tcp
US 8.8.8.8:53 content-signature-2.cdn.mozilla.net udp
US 8.8.8.8:53 shavar.services.mozilla.com udp
US 8.8.8.8:53 firefox.settings.services.mozilla.com udp
US 34.160.144.191:443 prod.content-signature-chains.prod.webservices.mozgcp.net tcp
US 50.112.167.115:443 shavar.services.mozilla.com tcp
US 34.117.237.239:443 contile.services.mozilla.com tcp
US 34.107.243.93:443 autopush.prod.mozaws.net tcp
US 34.149.100.209:443 firefox.settings.services.mozilla.com tcp
US 34.120.158.37:443 tracking-protection.cdn.mozilla.net tcp
US 34.120.158.37:443 tracking-protection.cdn.mozilla.net tcp
US 34.120.158.37:443 tracking-protection.cdn.mozilla.net tcp
US 34.120.158.37:443 tracking-protection.cdn.mozilla.net tcp
US 34.120.158.37:443 tracking-protection.cdn.mozilla.net tcp
US 34.120.158.37:443 tracking-protection.cdn.mozilla.net tcp
N/A 127.0.0.1:49833 tcp
US 34.120.158.37:443 tracking-protection.cdn.mozilla.net tcp
US 34.120.158.37:443 tracking-protection.cdn.mozilla.net tcp
US 34.120.158.37:443 tracking-protection.cdn.mozilla.net tcp
US 34.120.158.37:443 tracking-protection.cdn.mozilla.net tcp
DZ 105.105.91.157:11560 ecutuning.ddns.net tcp
US 34.120.158.37:443 tracking-protection.cdn.mozilla.net tcp
DZ 105.105.91.157:11560 ecutuning.ddns.net tcp
DZ 105.105.91.157:11560 ecutuning.ddns.net tcp
DZ 105.105.91.157:11560 ecutuning.ddns.net tcp
DZ 105.105.91.157:11560 ecutuning.ddns.net tcp
US 34.120.158.37:443 tcp
US 34.120.158.37:443 tcp
DZ 105.105.91.157:11560 ecutuning.ddns.net tcp
DZ 105.105.91.157:11560 ecutuning.ddns.net tcp
DZ 105.105.91.157:11560 ecutuning.ddns.net tcp
DZ 105.105.91.157:11560 ecutuning.ddns.net tcp
FR 82.64.70.102:80 plexstation.fr tcp
FR 82.64.70.102:80 plexstation.fr tcp
US 34.149.100.209:443 firefox.settings.services.mozilla.com tcp
US 104.17.24.14:80 cdnjs.cloudflare.com tcp
US 104.18.11.207:80 maxcdn.bootstrapcdn.com tcp
US 104.18.11.207:80 maxcdn.bootstrapcdn.com tcp
US 104.18.11.207:80 maxcdn.bootstrapcdn.com tcp
DZ 105.105.91.157:11560 ecutuning.ddns.net tcp
FR 82.64.70.102:80 plexstation.fr tcp
FR 82.64.70.102:80 plexstation.fr tcp
FR 82.64.70.102:443 plexstation.fr tcp
US 172.64.141.13:443 use.fontawesome.com.cdn.cloudflare.net tcp
US 172.64.141.13:443 use.fontawesome.com.cdn.cloudflare.net udp
US 172.64.141.13:443 use.fontawesome.com.cdn.cloudflare.net tcp
US 172.64.141.13:443 use.fontawesome.com.cdn.cloudflare.net tcp
DZ 105.105.91.157:11560 ecutuning.ddns.net tcp
DZ 105.105.91.157:11560 ecutuning.ddns.net tcp
DZ 105.105.91.157:11560 ecutuning.ddns.net tcp
DZ 105.105.91.157:11560 ecutuning.ddns.net tcp
DZ 105.105.91.157:11560 ecutuning.ddns.net tcp
DZ 105.105.91.157:11560 ecutuning.ddns.net tcp
DZ 105.105.91.157:11560 ecutuning.ddns.net tcp
US 35.244.181.201:443 aus5.mozilla.org tcp
GB 88.221.134.155:80 a19.dscg10.akamai.net tcp
FR 142.250.179.78:443 redirector.gvt1.com tcp
FR 142.250.179.78:443 redirector.gvt1.com udp
DE 74.125.11.102:443 r1.sn-4g5e6nzl.gvt1.com tcp
DE 74.125.11.102:443 r1.sn-4g5e6nzl.gvt1.com udp
DZ 105.105.91.157:11560 ecutuning.ddns.net tcp
DZ 105.105.91.157:11560 ecutuning.ddns.net tcp
DZ 105.105.91.157:11560 ecutuning.ddns.net tcp
DZ 105.105.91.157:11560 ecutuning.ddns.net tcp
DZ 105.105.91.157:11560 ecutuning.ddns.net tcp
DZ 105.105.91.157:11560 ecutuning.ddns.net tcp
DZ 105.105.91.157:11560 ecutuning.ddns.net tcp
DZ 105.105.91.157:11560 ecutuning.ddns.net tcp
DZ 105.105.91.157:11560 ecutuning.ddns.net tcp
DZ 105.105.91.157:11560 ecutuning.ddns.net tcp
DZ 105.105.91.157:11560 ecutuning.ddns.net tcp
DZ 105.105.91.157:11560 ecutuning.ddns.net tcp
DZ 105.105.91.157:11560 ecutuning.ddns.net tcp
DZ 105.105.91.157:11560 ecutuning.ddns.net tcp
DZ 105.105.91.157:11560 ecutuning.ddns.net tcp
DZ 105.105.91.157:11560 ecutuning.ddns.net tcp
DZ 105.105.91.157:11560 ecutuning.ddns.net tcp
DZ 105.105.91.157:11560 ecutuning.ddns.net tcp
DZ 105.105.91.157:11560 ecutuning.ddns.net tcp
DZ 105.105.91.157:11560 ecutuning.ddns.net tcp
DZ 105.105.91.157:11560 ecutuning.ddns.net tcp
DZ 105.105.91.157:11560 ecutuning.ddns.net tcp
DZ 105.105.91.157:11560 ecutuning.ddns.net tcp
DZ 105.105.91.157:11560 ecutuning.ddns.net tcp

Files

memory/2604-0-0x0000000000710000-0x000000000104A000-memory.dmp

memory/2604-1-0x000000007EF50000-0x000000007F321000-memory.dmp

memory/2604-2-0x0000000077264000-0x0000000077265000-memory.dmp

memory/2604-3-0x0000000073CE0000-0x0000000074291000-memory.dmp

memory/2604-4-0x00000000054B0000-0x00000000054C0000-memory.dmp

memory/2604-5-0x0000000073CE0000-0x0000000074291000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\paylod.exe

MD5 e6149ed0cdf7e22aaa3c79dfc7150900
SHA1 d9e1b9e3feff75897030366ba28d2c460374afa2
SHA256 b107529ccc4a4ad32ab1bd60ef6ae6b1cebc5e5252c0a6cd53a0cf6028e346d2
SHA512 f086c90a52981143e79066482b73c5e673c0e72332f204fa8f33b2ff180dbe52f1ee93bb44a1852d513569c3091ce81ba1185e511e00abdbbe1f2182a853f67e

C:\Users\Admin\AppData\Local\Temp\Keygen (2).exe

MD5 bdd092955a9bd216e7e86d0841281bb7
SHA1 94b8d9d6503767521d15ba346532fe8abcbbd72d
SHA256 9cb7ecfc83197b9ccae78765b9fdf48f501282b62baf631f13440dd6657049c8
SHA512 0a108ebbbf344cc639dcd221fe10023ade8fd0a2b28b7659b7ebad332147646d450d62757a1a1a4bbac53d52be75ede9f09d6a1baa70d713a43fb1373ee08508

C:\Users\Admin\AppData\Local\Temp\Keygen (2).exe

MD5 6de43bee67421456e15cf648303537e9
SHA1 de0c0c49bcbde1b466b353a6d5746a087a18a081
SHA256 9f4b211c0dcd552f4379e3f3bed59f454bb395fa087dbf713666440b042badab
SHA512 d59ff89bd8ed3bed72e3a5908c9ab07e98feb28e7926c37c7a22af242d1e4812f66143387f7892d9e374edbc9a5e5b5a7307a6a413ca08ce8f820570e9c7ec5c

C:\Users\Admin\AppData\Local\Temp\Keygen (2).exe

MD5 b0a53d6885628e2abf384abdc13bd114
SHA1 95f35186e10b4243eee63ca5a5f6774862ecca34
SHA256 20f4e903c7480d98b3d5c7fc42000a1133fe70bed19426b470851269c107351d
SHA512 fbf5749586556decec440c27e0742f95496d19888d1134edd7b5dd6f105c71029cbeffc31357b1b93f8b9aea011826aceefbf255cd14cb748ce079634575666b

memory/3516-24-0x00000000008C0000-0x00000000008CC000-memory.dmp

memory/2604-23-0x0000000000710000-0x000000000104A000-memory.dmp

memory/3516-26-0x0000000071750000-0x0000000071F01000-memory.dmp

memory/3516-25-0x0000000005330000-0x00000000053CC000-memory.dmp

memory/2604-27-0x000000007EF50000-0x000000007F321000-memory.dmp

memory/2604-29-0x0000000073CE0000-0x0000000074291000-memory.dmp

memory/3540-28-0x0000000002430000-0x0000000002431000-memory.dmp

memory/3516-32-0x0000000006170000-0x0000000006716000-memory.dmp

memory/3516-47-0x0000000071750000-0x0000000071F01000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Windows.lnk

MD5 3c7f20dc02ea235561742a5ff2af9bd1
SHA1 66015a77688beefbf41afdb842270f51963e6e72
SHA256 9b0ead1e17d54b2c8fb9cf7b3adafd56e0867e20d867cf500ac7f9d48798795f
SHA512 1a5c3aa536dca799a022b78dcdf8a31a16fe3282ed7921b08700e7d39eaa621f5ee5457c4f3b5386aae65af53d42e4612d83aba3862f3be2a5f01108dc25cb56

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.lnk

MD5 fee395f5894b15d0dca013f0f143166e
SHA1 957859786324770b2b7f3a2aaa9f29ae2812ce68
SHA256 91a4f8736ee03615f54b66210b23f7e41b0726d7fe3d56b615431c90ebb85979
SHA512 09d5b73079fcb7a89c01adfbe0b235c773b20c5ed9f19d80791916092bef194f7890e3c2a59bab0930f564f3024c6be5a9421d6b5b5b029d9d99f3f209c1006f

memory/4404-42-0x0000000071750000-0x0000000071F01000-memory.dmp

memory/3540-48-0x0000000000400000-0x00000000005B5000-memory.dmp

memory/4404-50-0x0000000006100000-0x0000000006192000-memory.dmp

memory/4404-51-0x00000000060D0000-0x00000000060DA000-memory.dmp

memory/3540-52-0x0000000000400000-0x00000000005B5000-memory.dmp

memory/3540-53-0x0000000002430000-0x0000000002431000-memory.dmp

memory/4404-55-0x0000000071750000-0x0000000071F01000-memory.dmp

memory/3540-56-0x0000000000400000-0x00000000005B5000-memory.dmp

memory/3540-62-0x0000000000400000-0x00000000005B5000-memory.dmp

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4uf7yb.default-release\datareporting\glean\pending_pings\de961c04-f085-4f18-829e-0d4221e85853

MD5 14a02b085cfff30327a2d29022a34979
SHA1 76452219786bc08dc4c1eaa763409a642579cc97
SHA256 d0252e6f2595283d8dedd2902d52d8ec76fc1c3d835e6404c328b86fa4646bea
SHA512 d1b700a020a240f66976b5a0024f583cf35b70483cb084462893d5f54a87c48aa4c0478389d5ab6cda199dacebcd7fe651a15111e977cf2915049e618e8746c6

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4uf7yb.default-release\datareporting\glean\pending_pings\71afe486-b325-44e2-8281-c0529e45d3b4

MD5 131325d083122c19b0eb9dca1cde3a23
SHA1 4677e8b3fe8f00a58c4f0f58ec0145e8ba9f773b
SHA256 6af9cae70d0292a8d367c0a0fcb3ee2df65e53449b4f593bf314c3a47ca3f2d5
SHA512 31031d219295520555fc002899150a296d0876dfb6c9012ab555c3e351845cffb3084f14e6489855d8389f5ffa160f0c9f272290ceb6947892537a1fee5ecc53

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4uf7yb.default-release\datareporting\glean\db\data.safe.bin

MD5 881b66215c99aedc361796b3c04a65da
SHA1 73a7016d7b8f2ed63b70022484b55935cfe450b9
SHA256 ffa5a74af1e394be3582f300708ac515c7c243dbded7518c9b7938d5f5b07c1b
SHA512 ef81608e01c98d5fc868c289df8a9af1726f52d8887644775dac10005b721b23480325376f312f8afec31a3231c302f4408537f68912bf8d698f98ea152b6c17

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4uf7yb.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

MD5 1a72b4cd078b73443029dfd93f07330b
SHA1 200c5ed539def048c03097988aa48fba6a9a73b4
SHA256 5f457751416a1bd370c8c87e59a02c59d1e39c05a252a73eb81162233ad1d642
SHA512 0648ff97d55aa0e66b3ea4274fda374f0a73e96a0ff4d22601a863c61a3fcc0611a22d4e9760b7909c2617f552492a566c1637d8762206b7ccf85a7d4258c444

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4uf7yb.default-release\sessionstore-backups\recovery.jsonlz4

MD5 e348d855960a8295806829709152a91d
SHA1 b0593abdda64c166a3fe2478f08fcd16919f058c
SHA256 8a72d65e1c532a136ccbd72e1017ee6b72ae06ad08b7bb8135d7d5ea08d0b5e6
SHA512 f691c84e9e11d67e0b7ab4f0d34fa143e029c9c05a33454df217fd06e5a769cd423e2459abcdd9558af89d626c5280a40edd8f217f43c9c2f894539efb240783

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4uf7yb.default-release\prefs-1.js

MD5 7db5abda62c0212c0e4e918576e11106
SHA1 b4bc4bf2014e32a2d52c283ef2710af6a26b5ad5
SHA256 2229e0bad8e079bfe2182de55245a6010cc618968d51905839baafba56164686
SHA512 9f59fcc22046ad38e969ff47d1c35e3832d56f3ee47947470d7232b6a948d55757197022c23c9738811a3016ae724b969d3c9e69fa7e43bc31ce0b5a2ee7c3ac

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4uf7yb.default-release\sessionstore-backups\recovery.jsonlz4

MD5 f9300272ecbca56d24a4df23c113bb47
SHA1 59ce27597ec79e559d34368763bbc931dac22854
SHA256 3dbbbc4badee7e5bf566617aa09344338eeeb1508ee8531f6d3fd035b167f6d6
SHA512 e0188c4c20a19ae56caf5dc1ff48c37ab8d76f106e9dc338ed7b7f7e559d2115eda041f98f09dbceffeb6aecfd5efe0f3197079e8f6e61ce0741d810bcdfdb67

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4uf7yb.default-release\sessionstore-backups\recovery.jsonlz4

MD5 149628a55020b6deafcc7d67ca83b6d2
SHA1 9e587c81aca31864598bedecce8e2f7bcf011b19
SHA256 7626655a9a43a7a27c32236007b613813b0048f1a51380b9931b59d6f65714d1
SHA512 587eddd8a8f28039467229f99c5cf1706b06bf22ba40229af0c4af411eadeb84adb409159f0f7beeb3513f55b133a477933588a82aa0ff138510093d20b7e6a6

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4uf7yb.default-release\sessionstore-backups\recovery.jsonlz4

MD5 7901daf28ae70619c9aef9a3acd76385
SHA1 78bd1be4c9ada4d6b1c5084b4d7fb4d19843b2b2
SHA256 75488bb8117314b48967a0aca15e658538f69e240823db7d69abb28d6de9950e
SHA512 5627d468aa952e45f1391dbec1aa7b1bc77adb3530d31c612abffa5d5937fa12e7e65065e6b3be9bcab46f85cee20c1e59497c7a881fb15c48d177eaf120ef52

C:\Users\Admin\AppData\Local\Temp\tmpaddon

MD5 85430baed3398695717b0263807cf97c
SHA1 fffbee923cea216f50fce5d54219a188a5100f41
SHA256 a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
SHA512 06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4uf7yb.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

MD5 fe3355639648c417e8307c6d051e3e37
SHA1 f54602d4b4778da21bc97c7238fc66aa68c8ee34
SHA256 1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
SHA512 8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4uf7yb.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

MD5 3d33cdc0b3d281e67dd52e14435dd04f
SHA1 4db88689282fd4f9e9e6ab95fcbb23df6e6485db
SHA256 f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
SHA512 a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4uf7yb.default-release\prefs-1.js

MD5 7271e91a7b3982d1734460603b6821af
SHA1 03f3a4d90766567d3e3281e2baeaa34b3131b185
SHA256 b227c4ce5914b4ca8c0a92e622b2cda8668c7f36da31c3ccbb19047c3acc5429
SHA512 fd6f34ab59c9fa4c01390d179eeb4216cb9dc690f8d7c5ae32a1f8c47ff64e6bae937f89a32633a5b0f58b1cfd4f8b8050b292b832b0d66adf1db032bf6ab1d4

C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

MD5 f4ae2a18172e4d53c3ea086bc7673be8
SHA1 53818a849bd6e330f3be64d040c12e8217349aaf
SHA256 5a177e3f893b89b9c8f21be62340d78106dad923df366e30936dec364b1aa7ae
SHA512 51f0e0d0c978ec77eab7fecf608f6fcb27a4dfa505c6a77ae0df07ed2f002826a0f939dbbba3164a00bd721a389d624066b6f287a6c06ddccc5ddf0d4538749e

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4uf7yb.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

MD5 49ddb419d96dceb9069018535fb2e2fc
SHA1 62aa6fea895a8b68d468a015f6e6ab400d7a7ca6
SHA256 2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
SHA512 48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4uf7yb.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

MD5 8be33af717bb1b67fbd61c3f4b807e9e
SHA1 7cf17656d174d951957ff36810e874a134dd49e0
SHA256 e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
SHA512 6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4uf7yb.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

MD5 937326fead5fd401f6cca9118bd9ade9
SHA1 4526a57d4ae14ed29b37632c72aef3c408189d91
SHA256 68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
SHA512 b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4uf7yb.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

MD5 688bed3676d2104e7f17ae1cd2c59404
SHA1 952b2cdf783ac72fcb98338723e9afd38d47ad8e
SHA256 33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
SHA512 7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4uf7yb.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

MD5 6b3ba398db2369e7e0324f3b8d3b4362
SHA1 f156cc51c7eca32aa35d7e29d02ac67bcf49ebc5
SHA256 addc957defea5cf072aa0c6e424fb56861103e3930f6c38709fac127158a3323
SHA512 78ff1fbd298c030c6e81d0c6a9ee0f9a3855bcd73e32e497f3bcbc0d4e6309334514063174f64e022ed2a9937d3fa0fae3b68fc3e07de07af928f44b2016fe59