Analysis

  • max time kernel
    149s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31-05-2024 15:34

General

  • Target

    nursultan nexgen fix.exe

  • Size

    1.5MB

  • MD5

    a3d07c747770c9a471a44446e46e33d5

  • SHA1

    8340534fb1770bae9660287ddb0496e243efcfe4

  • SHA256

    16015088c3352a8257f420555e7ce6245aa0e6682deeca79bf7e08c24e1ac3de

  • SHA512

    307cbdddaa9f426f8ceec060c2c0b1ab5ed3573e327dbcfdda7b1dfd22cf17559f017d835d71bdd15397fa95b0c7dfbfb4cd6b51cd5b2adc1d1cddc8ffe27f99

  • SSDEEP

    24576:U2G/nvxW3Ww0tpfnNGcvUCxt9groiK5Cg3ZRvm43TzvmF2cK07:UbA30pfnLRRgrheJROuTzvIR

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Process spawned unexpected child process 15 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • DCRat payload 2 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Disables Task Manager via registry modification
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 5 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 15 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies registry class 3 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\nursultan nexgen fix.exe
    "C:\Users\Admin\AppData\Local\Temp\nursultan nexgen fix.exe"
    1⤵
    • Checks computer location settings
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:1916
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\portagentbrowserweb\WRLLAAz5wgYRSh1EMNi6f5aM.vbe"
      2⤵
      • Checks computer location settings
      PID:4576
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\portagentbrowserweb\6X9rFgrS3wv5iM7PLkmLFP1j.bat" "
        3⤵
          PID:1580
          • C:\portagentbrowserweb\Containerruntime.exe
            "C:\portagentbrowserweb\Containerruntime.exe"
            4⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Drops file in Program Files directory
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4884
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\0uTMsHaN7R.bat"
              5⤵
                PID:5276
                • C:\Windows\system32\w32tm.exe
                  w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                  6⤵
                    PID:5536
                  • C:\portagentbrowserweb\firefox.exe
                    "C:\portagentbrowserweb\firefox.exe"
                    6⤵
                    • Executes dropped EXE
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:5972
              • C:\Windows\SysWOW64\reg.exe
                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
                4⤵
                • Modifies registry key
                PID:5548
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe"
          1⤵
          • Suspicious use of WriteProcessMemory
          PID:4484
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe"
            2⤵
            • Checks processor information in registry
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:4732
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4732.0.467297123\282353584" -parentBuildID 20221007134813 -prefsHandle 1852 -prefMapHandle 1844 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c021c2f1-738b-42d0-bb60-4ee2de7266f8} 4732 "\\.\pipe\gecko-crash-server-pipe.4732" 1940 2ba10fd8a58 gpu
              3⤵
                PID:500
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4732.1.1041255719\1944529304" -parentBuildID 20221007134813 -prefsHandle 2332 -prefMapHandle 2328 -prefsLen 20785 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {41b77e44-2988-4e66-ac95-fc127d3e8eda} 4732 "\\.\pipe\gecko-crash-server-pipe.4732" 2344 2ba10b43858 socket
                3⤵
                  PID:2304
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4732.2.629972554\565238691" -childID 1 -isForBrowser -prefsHandle 2948 -prefMapHandle 3036 -prefsLen 20888 -prefMapSize 233444 -jsInitHandle 1160 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {31999011-2259-44cf-82f7-397a1619a9ba} 4732 "\\.\pipe\gecko-crash-server-pipe.4732" 2944 2ba151a0958 tab
                  3⤵
                    PID:3892
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4732.3.426227820\269172717" -childID 2 -isForBrowser -prefsHandle 1128 -prefMapHandle 1080 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1160 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2814bcbb-f897-448f-a41b-7a5a882b51a1} 4732 "\\.\pipe\gecko-crash-server-pipe.4732" 2484 2ba13819b58 tab
                    3⤵
                      PID:3144
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4732.4.930403006\884762462" -childID 3 -isForBrowser -prefsHandle 3780 -prefMapHandle 3776 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1160 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {24918a2c-dfa8-4fca-98c9-d7089dc42fa4} 4732 "\\.\pipe\gecko-crash-server-pipe.4732" 3788 2ba15fa7858 tab
                      3⤵
                        PID:2520
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4732.5.1241025717\1877405409" -childID 4 -isForBrowser -prefsHandle 5084 -prefMapHandle 5112 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1160 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0655ae43-6d95-4bb5-98eb-dfeca5413586} 4732 "\\.\pipe\gecko-crash-server-pipe.4732" 5104 2ba157bc858 tab
                        3⤵
                          PID:5680
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4732.6.1027105980\1800386550" -childID 5 -isForBrowser -prefsHandle 5228 -prefMapHandle 5232 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1160 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ac414a86-2f1b-4997-b8d6-999f10e81f59} 4732 "\\.\pipe\gecko-crash-server-pipe.4732" 5220 2ba17643858 tab
                          3⤵
                            PID:5688
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4732.7.1634937210\432120574" -childID 6 -isForBrowser -prefsHandle 5432 -prefMapHandle 5436 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1160 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b7fef1c9-c6f9-43dd-bd4e-25f3835363fa} 4732 "\\.\pipe\gecko-crash-server-pipe.4732" 5020 2ba17643b58 tab
                            3⤵
                              PID:5696
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4732.8.1736242240\1448218935" -childID 7 -isForBrowser -prefsHandle 5972 -prefMapHandle 5968 -prefsLen 29694 -prefMapSize 233444 -jsInitHandle 1160 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4946dfce-85dc-4cb9-9bb3-dbbd76e80dc6} 4732 "\\.\pipe\gecko-crash-server-pipe.4732" 5964 2ba1cc14058 tab
                              3⤵
                                PID:6136
                          • C:\Windows\system32\schtasks.exe
                            schtasks.exe /create /tn "firefoxf" /sc MINUTE /mo 14 /tr "'C:\portagentbrowserweb\firefox.exe'" /f
                            1⤵
                            • Process spawned unexpected child process
                            • Creates scheduled task(s)
                            PID:6032
                          • C:\Windows\system32\schtasks.exe
                            schtasks.exe /create /tn "firefox" /sc ONLOGON /tr "'C:\portagentbrowserweb\firefox.exe'" /rl HIGHEST /f
                            1⤵
                            • Process spawned unexpected child process
                            • Creates scheduled task(s)
                            PID:6040
                          • C:\Windows\system32\schtasks.exe
                            schtasks.exe /create /tn "firefoxf" /sc MINUTE /mo 11 /tr "'C:\portagentbrowserweb\firefox.exe'" /rl HIGHEST /f
                            1⤵
                            • Process spawned unexpected child process
                            • Creates scheduled task(s)
                            PID:6060
                          • C:\Windows\system32\schtasks.exe
                            schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /f
                            1⤵
                            • Process spawned unexpected child process
                            • Creates scheduled task(s)
                            PID:6092
                          • C:\Windows\system32\schtasks.exe
                            schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
                            1⤵
                            • Process spawned unexpected child process
                            • Creates scheduled task(s)
                            PID:6108
                          • C:\Windows\system32\schtasks.exe
                            schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
                            1⤵
                            • Process spawned unexpected child process
                            • Creates scheduled task(s)
                            PID:6124
                          • C:\Windows\system32\schtasks.exe
                            schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Portable Devices\sysmon.exe'" /f
                            1⤵
                            • Process spawned unexpected child process
                            • Creates scheduled task(s)
                            PID:1808
                          • C:\Windows\system32\schtasks.exe
                            schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\sysmon.exe'" /rl HIGHEST /f
                            1⤵
                            • Process spawned unexpected child process
                            • Creates scheduled task(s)
                            PID:2984
                          • C:\Windows\system32\schtasks.exe
                            schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Portable Devices\sysmon.exe'" /rl HIGHEST /f
                            1⤵
                            • Process spawned unexpected child process
                            • Creates scheduled task(s)
                            PID:4568
                          • C:\Windows\system32\schtasks.exe
                            schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\portagentbrowserweb\RuntimeBroker.exe'" /f
                            1⤵
                            • Process spawned unexpected child process
                            • Creates scheduled task(s)
                            PID:756
                          • C:\Windows\system32\schtasks.exe
                            schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\portagentbrowserweb\RuntimeBroker.exe'" /rl HIGHEST /f
                            1⤵
                            • Process spawned unexpected child process
                            • Creates scheduled task(s)
                            PID:2076
                          • C:\Windows\system32\schtasks.exe
                            schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\portagentbrowserweb\RuntimeBroker.exe'" /rl HIGHEST /f
                            1⤵
                            • Process spawned unexpected child process
                            • Creates scheduled task(s)
                            PID:4064
                          • C:\Windows\system32\schtasks.exe
                            schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\odt\csrss.exe'" /f
                            1⤵
                            • Process spawned unexpected child process
                            • Creates scheduled task(s)
                            PID:4576
                          • C:\Windows\system32\schtasks.exe
                            schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\odt\csrss.exe'" /rl HIGHEST /f
                            1⤵
                            • Process spawned unexpected child process
                            • Creates scheduled task(s)
                            PID:1272
                          • C:\Windows\system32\schtasks.exe
                            schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\odt\csrss.exe'" /rl HIGHEST /f
                            1⤵
                            • Process spawned unexpected child process
                            • Creates scheduled task(s)
                            PID:2496
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4160 --field-trial-handle=2304,i,6987730730348465820,3913273227385401271,262144 --variations-seed-version /prefetch:8
                            1⤵
                              PID:6068

                            Network

                            MITRE ATT&CK Enterprise v15

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4s2odj76.default-release\cache2\entries\F4EFE37A30D0F14C6AC03FF7949A51CBC2EBC649
                              Filesize

                              13KB

                              MD5

                              216c37ddee09d5a8cfcd86fa1dca5c8d

                              SHA1

                              c57ec9ac7841432249a11873e355e3ca798bcb95

                              SHA256

                              6815423a5da27d52ee10d2a97047c16e0feeccf254622de64acfcd41bd0c7c2c

                              SHA512

                              7bf612a68061689c633ab453b5ce0cddf9431846439ce215ede6878db4b618a34cb1552c83cfa7acc531daaff8767ac305238995bbb102e83b0c4e2927a1d9d0

                            • C:\Users\Admin\AppData\Local\Temp\0uTMsHaN7R.bat
                              Filesize

                              199B

                              MD5

                              d5b5daf464e3f028415e8a7f36d366e9

                              SHA1

                              83b9f42734a80d36508a2ed876010e3fa59eae17

                              SHA256

                              e422cfb751c89f2bbc4b943521425ccc7b4b6ee85589c1d6578a6f8248356c57

                              SHA512

                              db3f2af31bc8284fc7e4a6502d271cc23e2501298fef2dfe32962a547f38bec8b4c4e97ac1d3b0ebec03958d0e7677576fd32172668e6552e625f27b6f108a26

                            • C:\Users\Admin\AppData\Local\Temp\tmpaddon
                              Filesize

                              442KB

                              MD5

                              85430baed3398695717b0263807cf97c

                              SHA1

                              fffbee923cea216f50fce5d54219a188a5100f41

                              SHA256

                              a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

                              SHA512

                              06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

                            • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
                              Filesize

                              8.0MB

                              MD5

                              a01c5ecd6108350ae23d2cddf0e77c17

                              SHA1

                              c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

                              SHA256

                              345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

                              SHA512

                              b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\datareporting\glean\db\data.safe.bin
                              Filesize

                              2KB

                              MD5

                              b15eac77d61b54f3e8d919c0a81b3ab6

                              SHA1

                              9f0421fd4f0469b1305693acb9010babd8a984e2

                              SHA256

                              1bc6eeee88d01780d0e4c0a55284943e5a14aa38da0da6a525e3885609a46d2d

                              SHA512

                              5b08698453271788e87ff38ab382b0069118b4cdb08ea9503cab5e911404b9df9d73f8e52a61c678f8e5dc408f05f8c7eef8890629ee0a9cb5c1c92be1847d62

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\datareporting\glean\pending_pings\49c35764-37d0-4261-90b6-8176666583e1
                              Filesize

                              746B

                              MD5

                              19a919a8511d5eecdc6fff1df2e9d358

                              SHA1

                              3d231e7e48629d40e6451ec900cb696815327528

                              SHA256

                              997decb4731cce5122d5bc6b05176621d3647a7e0b75db27124987fd629f2bd8

                              SHA512

                              69ddbf8ceafc0e520a56350fff83f73c2ef57c882fa1ca8845ad66945e5f8c9da99736221f82878622500093d8f6c1a9cdda73244cd04f1490445d3567e02d7e

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\datareporting\glean\pending_pings\cdf964b6-dac5-4253-a7f0-79e1eb9ed0a0
                              Filesize

                              11KB

                              MD5

                              d97c5e66381ced72cdc1f80b949f97ad

                              SHA1

                              6ea4fa1b781837ab5b0c593200acbd1010592f7c

                              SHA256

                              f483452168cf2406e0355beb46f1ab20c609b4a1b244f50c1ca6a7fe4c4bdc04

                              SHA512

                              046d06203bccd5caae978e3499e4c0aeb93d0cc7e9036288387a77429b205e8485671df0ac9065101166382bf195121259bd6e90c33d5e2683f2868217664b7b

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
                              Filesize

                              997KB

                              MD5

                              fe3355639648c417e8307c6d051e3e37

                              SHA1

                              f54602d4b4778da21bc97c7238fc66aa68c8ee34

                              SHA256

                              1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

                              SHA512

                              8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
                              Filesize

                              116B

                              MD5

                              3d33cdc0b3d281e67dd52e14435dd04f

                              SHA1

                              4db88689282fd4f9e9e6ab95fcbb23df6e6485db

                              SHA256

                              f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

                              SHA512

                              a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
                              Filesize

                              479B

                              MD5

                              49ddb419d96dceb9069018535fb2e2fc

                              SHA1

                              62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

                              SHA256

                              2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

                              SHA512

                              48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
                              Filesize

                              372B

                              MD5

                              8be33af717bb1b67fbd61c3f4b807e9e

                              SHA1

                              7cf17656d174d951957ff36810e874a134dd49e0

                              SHA256

                              e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

                              SHA512

                              6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
                              Filesize

                              11.8MB

                              MD5

                              33bf7b0439480effb9fb212efce87b13

                              SHA1

                              cee50f2745edc6dc291887b6075ca64d716f495a

                              SHA256

                              8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

                              SHA512

                              d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
                              Filesize

                              1KB

                              MD5

                              688bed3676d2104e7f17ae1cd2c59404

                              SHA1

                              952b2cdf783ac72fcb98338723e9afd38d47ad8e

                              SHA256

                              33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

                              SHA512

                              7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
                              Filesize

                              1KB

                              MD5

                              937326fead5fd401f6cca9118bd9ade9

                              SHA1

                              4526a57d4ae14ed29b37632c72aef3c408189d91

                              SHA256

                              68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

                              SHA512

                              b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\prefs-1.js
                              Filesize

                              6KB

                              MD5

                              97313ad9a17c787c1af07987f939b157

                              SHA1

                              8722e94cc6870c862b9b3f56c5ee4b0f1ba177f4

                              SHA256

                              f3e814d1ba883356fabd869b8258e0d5977e29f87c9f2440748c07f82894d9a8

                              SHA512

                              929fc2f8a71118b437656d4b72a5eaeae68906734ba950bc40a70d414e579ccc627ba38e52e9f2f71bdd28d1d68099cdbb4a2128622cf2055e99d116dc91f484

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4
                              Filesize

                              1KB

                              MD5

                              9e89df6174b42701c3ee7284d4c088de

                              SHA1

                              6c759d07d63c04371895dd753f39439abc7add24

                              SHA256

                              fe6bc81ec1e8814b92c54b7f7dbc23145b014a12ca69a7dbc3a0e05c8ed21b49

                              SHA512

                              ada07894e22d0fe056dfb474c1f404eff824d6645f80797d32b99e84125b25dc55d3a4f6e74b9b6f024fa3129c38a3edef4e8d9c8123d48c4b73dc4110d91a61

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4
                              Filesize

                              4KB

                              MD5

                              37115acdf33f217c9f200ac354d26b6b

                              SHA1

                              1829c68122ef1aaa13ef37945e44e72c4ea6e57d

                              SHA256

                              1cf1c2fd1f573edc21e84e5cb5d905fe96e4697fd7295bdaf85ef14cc8a28347

                              SHA512

                              89a50e2962f45dd7525588d2b781487a0881be204283e03bd3bac13a427ad205d840675cbb27f3ddfa614aa9051cd1696a0414e034b0010095727addaa9c69b5

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4
                              Filesize

                              1KB

                              MD5

                              7196e766440658999aeef1a0251171f0

                              SHA1

                              f422f46d9e73f7b805d49c83d85ebaaa35fcc7d7

                              SHA256

                              762dcfecb60aabf2ab21300a88a40f7b9f8f2fe2ee98fb395cd3f85a20f1dc28

                              SHA512

                              e259a72187644a89abd754c0d77086800c4401ff1c6b64a1b6c2c7adf1e24816f579b860808bb4c99c8d43f712768eced1f202afe5b7fbff86e636da13c64e2b

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4
                              Filesize

                              4KB

                              MD5

                              63480a735184a202af68c6318257fcf1

                              SHA1

                              53727788a6307a1a0c65e360f2a361eefe66e37b

                              SHA256

                              9c0fc35a36b33a2b5d04c7f66ab7d044aa0f387f1818090cc8418bfd520d695a

                              SHA512

                              4e0ea987e9040c1ecaa88cf6817aa4da9b70aa60c6256c539468825c10bd9a8d604ada684e9fdb7cdbc850f6d542f1e5b495b572342787352e15a50041b00433

                            • C:\portagentbrowserweb\6X9rFgrS3wv5iM7PLkmLFP1j.bat
                              Filesize

                              157B

                              MD5

                              c8f8a078dace2ff4cb106803c9199643

                              SHA1

                              a5029ff4c4f0f24b0fbe2951c9a8002501ebd3b5

                              SHA256

                              1b99d39fa273f33b072c67e0df7d33b1699fa17b7c7139467a658302a5ed0e0d

                              SHA512

                              efaea3b4653768bbd135a0ec55319df2464f1d440ad982f31a5eff05c5ba5032f4718683ff6419c668bf1f34a117b5a101f56d1efc1d74ad93e692c52686f999

                            • C:\portagentbrowserweb\Containerruntime.exe
                              Filesize

                              1.2MB

                              MD5

                              5887a563351ca99247b7e2c448bd9f2e

                              SHA1

                              b24695e88143863297535989900bb7521ea86d67

                              SHA256

                              e74cbd74c838db604926e27322342c02f803b95f98680d4089b5c01ed93fb390

                              SHA512

                              b7d82bd09ba64891b75bbb9356de74a1ed0835709a391698c1301825777418f57e4f2ae3c260d3f7b6ada05d0e7ddeb4a6b75901fdf53bdd82ffa2febb685107

                            • C:\portagentbrowserweb\WRLLAAz5wgYRSh1EMNi6f5aM.vbe
                              Filesize

                              220B

                              MD5

                              61a07f2f9e8e9b1f5175b2d60c3e3f18

                              SHA1

                              e695b0c2b43c786453bf3f6ae504f0626951d281

                              SHA256

                              5c75708ec9e4fe419a2fd1067bd5793bacb28140177cc6b36300fbf28e7c23d1

                              SHA512

                              8ef3529f6bf504224e7803019f1e162aead7961bc1a5115f50fb5f580570e8b04707da21a7aab4eb7f1554a3b5333597fb3335e5f6a74dabfdb0583eecb35b5d

                            • memory/4884-24-0x0000000000360000-0x0000000000492000-memory.dmp
                              Filesize

                              1.2MB

                            • memory/4884-23-0x00007FFC3C323000-0x00007FFC3C325000-memory.dmp
                              Filesize

                              8KB

                            • memory/4884-95-0x0000000000CA0000-0x0000000000CB6000-memory.dmp
                              Filesize

                              88KB

                            • memory/4884-96-0x0000000000CC0000-0x0000000000CCC000-memory.dmp
                              Filesize

                              48KB

                            • memory/4884-92-0x0000000000CF0000-0x0000000000D0C000-memory.dmp
                              Filesize

                              112KB

                            • memory/4884-94-0x0000000002730000-0x0000000002780000-memory.dmp
                              Filesize

                              320KB