Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240704-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-07-2024 13:05

General

  • Target

    149f34cc064bd94f468d0e3c2fcc176dcf3592b099b4cef85fb4d672cb0a5d6d.exe

  • Size

    1.8MB

  • MD5

    9a078876b23608ca0de594f4feb973fd

  • SHA1

    63355749469f7fabfe986fb3ae33bdc83834c061

  • SHA256

    149f34cc064bd94f468d0e3c2fcc176dcf3592b099b4cef85fb4d672cb0a5d6d

  • SHA512

    45ecc1a2bb87619656cb9204aa9eb2955e4d502adb84d528f004afe038e256a68de46224602ccf7cc81cdb3e62e6cbf5111ab2e33e72b3d8c10f6f81ac5615d6

  • SSDEEP

    49152:tPJA2u/IMoVMGYZa7FZ1rxkBMnEAIAC/mkaYOswu9OeRkKjFkDM:tRGCV/7Vxn8uBswwJ+K5k

Malware Config

Extracted

Family

amadey

Version

4.30

Botnet

4dd39d

C2

http://77.91.77.82

Attributes
  • install_dir

    ad40971b6b

  • install_file

    explorti.exe

  • strings_key

    a434973ad22def7137dbb5e059b7081e

  • url_paths

    /Hun4Ko/index.php

rc4.plain

Extracted

Family

stealc

Botnet

Nice

C2

http://85.28.47.30

Attributes
  • url_path

    /920475a59bac849d.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Stealc

    Stealc is an infostealer written in C++.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 12 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 6 IoCs
  • Identifies Wine through registry keys 2 TTPs 6 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 2 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 29 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 56 IoCs
  • Suspicious use of SendNotifyMessage 51 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\149f34cc064bd94f468d0e3c2fcc176dcf3592b099b4cef85fb4d672cb0a5d6d.exe
    "C:\Users\Admin\AppData\Local\Temp\149f34cc064bd94f468d0e3c2fcc176dcf3592b099b4cef85fb4d672cb0a5d6d.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:2516
    • C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
      "C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4660
      • C:\Users\Admin\AppData\Local\Temp\1000006001\5189481211.exe
        "C:\Users\Admin\AppData\Local\Temp\1000006001\5189481211.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:4872
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\KJDGIJECFI.exe"
          4⤵
            PID:5352
            • C:\Users\Admin\AppData\Local\Temp\KJDGIJECFI.exe
              "C:\Users\Admin\AppData\Local\Temp\KJDGIJECFI.exe"
              5⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • Suspicious behavior: EnumeratesProcesses
              PID:5344
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\EBFBKFBGII.exe"
            4⤵
            • Checks computer location settings
            • Suspicious use of SetWindowsHookEx
            PID:5720
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\1000008021\135016d09f.cmd" "
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1172
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.youtube.com/account"
            4⤵
            • Enumerates system info in registry
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of WriteProcessMemory
            PID:1628
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7fff0369ab58,0x7fff0369ab68,0x7fff0369ab78
              5⤵
                PID:2016
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1776 --field-trial-handle=1988,i,7788134946808019528,2257799460770922566,131072 /prefetch:2
                5⤵
                  PID:4536
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1960 --field-trial-handle=1988,i,7788134946808019528,2257799460770922566,131072 /prefetch:8
                  5⤵
                    PID:3972
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1360 --field-trial-handle=1988,i,7788134946808019528,2257799460770922566,131072 /prefetch:8
                    5⤵
                      PID:2912
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3040 --field-trial-handle=1988,i,7788134946808019528,2257799460770922566,131072 /prefetch:1
                      5⤵
                        PID:3064
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3060 --field-trial-handle=1988,i,7788134946808019528,2257799460770922566,131072 /prefetch:1
                        5⤵
                          PID:4692
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=1764 --field-trial-handle=1988,i,7788134946808019528,2257799460770922566,131072 /prefetch:1
                          5⤵
                            PID:6004
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4412 --field-trial-handle=1988,i,7788134946808019528,2257799460770922566,131072 /prefetch:8
                            5⤵
                              PID:6732
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4428 --field-trial-handle=1988,i,7788134946808019528,2257799460770922566,131072 /prefetch:8
                              5⤵
                                PID:6740
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1892 --field-trial-handle=1988,i,7788134946808019528,2257799460770922566,131072 /prefetch:2
                                5⤵
                                • Suspicious behavior: EnumeratesProcesses
                                PID:6152
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/account"
                              4⤵
                              • Enumerates system info in registry
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                              • Suspicious use of FindShellTrayWindow
                              • Suspicious use of SendNotifyMessage
                              • Suspicious use of WriteProcessMemory
                              PID:1344
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7fff035446f8,0x7fff03544708,0x7fff03544718
                                5⤵
                                  PID:4232
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,13529602371483321212,12909143515936426563,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
                                  5⤵
                                    PID:5032
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,13529602371483321212,12909143515936426563,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
                                    5⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:5068
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,13529602371483321212,12909143515936426563,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:8
                                    5⤵
                                      PID:4812
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13529602371483321212,12909143515936426563,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
                                      5⤵
                                        PID:1300
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13529602371483321212,12909143515936426563,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
                                        5⤵
                                          PID:640
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13529602371483321212,12909143515936426563,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4508 /prefetch:1
                                          5⤵
                                            PID:5888
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,13529602371483321212,12909143515936426563,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4828 /prefetch:2
                                            5⤵
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:6368
                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                          "C:\Program Files\Mozilla Firefox\firefox.exe" "https://www.youtube.com/account"
                                          4⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:4204
                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                            "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
                                            5⤵
                                            • Checks processor information in registry
                                            • Modifies registry class
                                            • Suspicious use of AdjustPrivilegeToken
                                            • Suspicious use of FindShellTrayWindow
                                            • Suspicious use of SendNotifyMessage
                                            • Suspicious use of SetWindowsHookEx
                                            • Suspicious use of WriteProcessMemory
                                            PID:1900
                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1900.0.1904468946\1023248259" -parentBuildID 20230214051806 -prefsHandle 1740 -prefMapHandle 1732 -prefsLen 22076 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e120f49f-a283-4b0c-9a0e-1941c72a80ac} 1900 "\\.\pipe\gecko-crash-server-pipe.1900" 1840 1fec9b0dd58 gpu
                                              6⤵
                                                PID:4616
                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1900.1.739466369\273141195" -parentBuildID 20230214051806 -prefsHandle 2476 -prefMapHandle 2464 -prefsLen 22927 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ba8fed86-442a-4dbe-aa36-6c6387a363dc} 1900 "\\.\pipe\gecko-crash-server-pipe.1900" 2488 1febcd87e58 socket
                                                6⤵
                                                  PID:4388
                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1900.2.1683540049\778854434" -childID 1 -isForBrowser -prefsHandle 3460 -prefMapHandle 3456 -prefsLen 22965 -prefMapSize 235121 -jsInitHandle 900 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {92be254f-5b4e-4710-b445-452508ab0954} 1900 "\\.\pipe\gecko-crash-server-pipe.1900" 3472 1fecc75ee58 tab
                                                  6⤵
                                                    PID:948
                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1900.3.2101383999\491147042" -childID 2 -isForBrowser -prefsHandle 3448 -prefMapHandle 3444 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 900 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {24ffaf10-d5d6-4c88-ad24-df5d3f97756f} 1900 "\\.\pipe\gecko-crash-server-pipe.1900" 3148 1febcd84d58 tab
                                                    6⤵
                                                      PID:5520
                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1900.4.106876412\1321219304" -childID 3 -isForBrowser -prefsHandle 5236 -prefMapHandle 5240 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 900 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bfbd4b80-0ffd-479d-80fb-c15b5d7c035b} 1900 "\\.\pipe\gecko-crash-server-pipe.1900" 5284 1fed06eb858 tab
                                                      6⤵
                                                        PID:5416
                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1900.5.1105132632\1145449681" -childID 4 -isForBrowser -prefsHandle 5456 -prefMapHandle 5452 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 900 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f490a2a6-f6a4-4d9d-b509-25114076ebe8} 1900 "\\.\pipe\gecko-crash-server-pipe.1900" 5464 1fed06eb558 tab
                                                        6⤵
                                                          PID:5996
                                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1900.6.176248164\1892384978" -childID 5 -isForBrowser -prefsHandle 5364 -prefMapHandle 5368 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 900 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7dde300c-5ca9-42a0-baa3-4fd78b1e9c9f} 1900 "\\.\pipe\gecko-crash-server-pipe.1900" 5352 1fed06ebb58 tab
                                                          6⤵
                                                            PID:5860
                                                • C:\Windows\System32\CompPkgSrv.exe
                                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                  1⤵
                                                    PID:5128
                                                  • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
                                                    "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
                                                    1⤵
                                                      PID:5136
                                                    • C:\Windows\System32\CompPkgSrv.exe
                                                      C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                      1⤵
                                                        PID:5720
                                                      • C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
                                                        C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
                                                        1⤵
                                                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                        • Checks BIOS information in registry
                                                        • Executes dropped EXE
                                                        • Identifies Wine through registry keys
                                                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        PID:5268
                                                      • C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
                                                        C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
                                                        1⤵
                                                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                        • Checks BIOS information in registry
                                                        • Executes dropped EXE
                                                        • Identifies Wine through registry keys
                                                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        PID:3848
                                                      • C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
                                                        C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
                                                        1⤵
                                                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                        • Checks BIOS information in registry
                                                        • Executes dropped EXE
                                                        • Identifies Wine through registry keys
                                                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        PID:4620

                                                      Network

                                                      MITRE ATT&CK Enterprise v15

                                                      Replay Monitor

                                                      Loading Replay Monitor...

                                                      Downloads

                                                      • C:\ProgramData\mozglue.dll

                                                        Filesize

                                                        593KB

                                                        MD5

                                                        c8fd9be83bc728cc04beffafc2907fe9

                                                        SHA1

                                                        95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                                                        SHA256

                                                        ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                                                        SHA512

                                                        fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                                                      • C:\ProgramData\nss3.dll

                                                        Filesize

                                                        2.0MB

                                                        MD5

                                                        1cc453cdf74f31e4d913ff9c10acdde2

                                                        SHA1

                                                        6e85eae544d6e965f15fa5c39700fa7202f3aafe

                                                        SHA256

                                                        ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                                                        SHA512

                                                        dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000001

                                                        Filesize

                                                        67KB

                                                        MD5

                                                        51c3c3d00a4a5a9d730c04c615f2639b

                                                        SHA1

                                                        3b92cce727fc1fb03e982eb611935218c821948f

                                                        SHA256

                                                        cb1e96afd2fec2b2b445be2f46c6b90db19c2ed2f0278f57f7490a299e88c19f

                                                        SHA512

                                                        7af8ec3160e4dbae2c3359146c0a82c32a02697d332138c391e4295d00f49ed1070857a0afe16222c5cea1cafffc4d26df525543f187be43a59967df1e919542

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000005

                                                        Filesize

                                                        36KB

                                                        MD5

                                                        103d7813f0ccc7445b4b9a4b34fc74bf

                                                        SHA1

                                                        ed862e8ebd885acde6115c340e59e50e74e3633b

                                                        SHA256

                                                        0ccaf58bb2aa430724873fa21515e5f3fbd875390288aade3823ec16962bc27b

                                                        SHA512

                                                        0723baca97705968a068676f74ac01bd492dac94a4fba391de578b6357b79c4aca5412f564dc0ea7ae5b6145256c7f8f22e8a4823f41e2baf50d201ec073be1f

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                        Filesize

                                                        240B

                                                        MD5

                                                        63df501a05562018dba4259d554372eb

                                                        SHA1

                                                        d90b92e69e73b2854f029a577a5e6287d63af43d

                                                        SHA256

                                                        23235cf1eac94ffb816cf250c2e09eb48550fd1093fc1d8a025939821a9689aa

                                                        SHA512

                                                        788ee640230f2a15abc223278fa3efa18971e40ad8d35f4ee0680c9f0fe41080e40eb297d854364370252da32413dd20739cda3753a9c890142f59ceb834d4df

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                                        Filesize

                                                        2KB

                                                        MD5

                                                        1e406863ccff21bdcafeacf6cd036296

                                                        SHA1

                                                        b765852ad04c5f0308d6a43104f88d3c95e125de

                                                        SHA256

                                                        bd6f16ddc8d7ea073c22dffa159dc6429a9288082703c9edea33db055fe56f2c

                                                        SHA512

                                                        7899b5937ee044073b5a95a1de4aa018890ee574f2c92ee978f33dcecf2f123979e9141c40025936a2039471bda5b26642f343d2759d75a736ebdc02cc70f9d9

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                                                        Filesize

                                                        2B

                                                        MD5

                                                        d751713988987e9331980363e24189ce

                                                        SHA1

                                                        97d170e1550eee4afc0af065b78cda302a97674c

                                                        SHA256

                                                        4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                                        SHA512

                                                        b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                        Filesize

                                                        524B

                                                        MD5

                                                        8d3d09f484d5cc30cf4dea933298c937

                                                        SHA1

                                                        b07a72d05f7ac170f15dd917bba4b2372f1f9bce

                                                        SHA256

                                                        3cab676813c7536568fadf2187e15e5cfd9e3a4d4a7de49d46db5c937bde5cfd

                                                        SHA512

                                                        20519d2d9d6ec7778e2dda1097a5d68eacf3c4cad11dec84f5c266ead6f397fc4e2aafb9393dd360661459c11f28d15ce7aff5a6c8b7951a76bf1bfd13482b67

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                        Filesize

                                                        7KB

                                                        MD5

                                                        a5ce07fac5551730069b79d7dad73b4e

                                                        SHA1

                                                        71c1e082b9fca2b6f8ba53fd4a4cd25947c8a024

                                                        SHA256

                                                        f8845f95d55f53a388124163c30a4fc58e0ae69850437236a5fb92a9757f2fa9

                                                        SHA512

                                                        53b65ef62ba1568540786b8256e4c84f50cb1576b1f33514ecfe7f7e366e998d61210cd7b6ef0208aa557d3103380cee82783e331684fc19a8d50775b37bf969

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                        Filesize

                                                        145KB

                                                        MD5

                                                        65e671e312b2f0081dc88b4ea529f6cd

                                                        SHA1

                                                        5ca45dc109650a7ada0b9ddb5bfd17fa8e02a1ef

                                                        SHA256

                                                        4b6dcb44e625671382704fab7dbe4c8e65c24079eb37905108849c70e60da830

                                                        SHA512

                                                        2368cb58e32febb76c33630c915c90da08d9b63ec88d10b72bea8f4e188ecf3a623eb1d967c14b900eedd9d8417a69a265874f0cb1abb250449aea1f131d7591

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                        Filesize

                                                        146KB

                                                        MD5

                                                        79cb3346e82c58a1032a36269b978f7e

                                                        SHA1

                                                        6058e3a4815ff65498b240160f98720cd8147d67

                                                        SHA256

                                                        af2e173490ea758ab5839a097f7a208051f99f84ba926ad89b4fc83d323b219a

                                                        SHA512

                                                        330e8a5f4b6313c4b0aa2094e3a0ecc0e79455123a14c415959e387d1fa8138957dfe6f9571163870b43c096f50f6926d8dc70e0292764ffcfeff3116af8250f

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                        Filesize

                                                        146KB

                                                        MD5

                                                        62a9e3aec641da649de6f7e0c5a24512

                                                        SHA1

                                                        eceee92e2f0dc0bafcaaa7d3f2912199f22fa63e

                                                        SHA256

                                                        fa00f5447a340152a120fe9b71c28e4cfdb7291a65e49280cc974609b8529b5f

                                                        SHA512

                                                        b3240592f82c189865b1f49f33ef0dc046ef7b2cfbadbd0b1687881a75a30754ba4f2cbf384240ae4890d89938af77f5cdfa1b46137303b423763e09789cea71

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                        Filesize

                                                        152B

                                                        MD5

                                                        0331fa75ac7846bafcf885ea76d47447

                                                        SHA1

                                                        5a141ffda430e091153fefc4aa36317422ba28ae

                                                        SHA256

                                                        64b4b2e791644fc04f164ecd13b8b9a3e62669896fb7907bf0a072bbeebaf74a

                                                        SHA512

                                                        f8b960d38d73cf29ce17ea409ef6830cae99d7deafaf2ff59f8347120d81925ff16e38faaa0f7f4c39936472d05d1d131df2a8a383351f138c38afb21c1a60e2

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                        Filesize

                                                        152B

                                                        MD5

                                                        f0f818d52a59eb6cf9c4dd2a1c844df9

                                                        SHA1

                                                        26afc4b28c0287274624690bd5bd4786cfe11d16

                                                        SHA256

                                                        58c0beea55fecbeded2d2c593473149214df818be1e4e4a28c97171dc8179d61

                                                        SHA512

                                                        7e8a1d3a6c8c9b0f1ac497e509e9edbe9e121df1df0147ce4421b8cf526ad238bd146868e177f9ce02e2d8f99cf7bb9ce7db4a582d487bbc921945211a977509

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                        Filesize

                                                        216B

                                                        MD5

                                                        d79b850771a554269588913e9e4f59a4

                                                        SHA1

                                                        621d311c27962f88726020632c8efc5fac347dff

                                                        SHA256

                                                        bac06632264aa10515e3b5f257c40b229312b418c0afab3cf87c402452bb15a9

                                                        SHA512

                                                        1e053aa03b58a1274d8e3137ece8780d1176af3fa231c945bdbe129f0193f1bd8544820aa2e27e6a56e9c576a5d70673dcf55290c24fee8f194380ecd8f49988

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                        Filesize

                                                        1KB

                                                        MD5

                                                        cd0c83b902cc047fb52d656af7a18c7d

                                                        SHA1

                                                        4d722262f95c745534d81c5ecaf8070aa5d9064a

                                                        SHA256

                                                        9ece23ded5cfc0640f64fa56aac968551494746527d03d8c3138f41194b2dd70

                                                        SHA512

                                                        60a6e664112bbc0cfcfba8cbb6ea3086e35d687d8ec4065c664b20fc19a868268cd9dd019b341eb47ccfb50caf685a119f3e34c053f9fc15a9c6d586c8dd1b62

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                        Filesize

                                                        6KB

                                                        MD5

                                                        d168fc9121d30a0c7249890509c3f7a7

                                                        SHA1

                                                        5688dcf87cb408ff93b75b56bb8d49b566b5f238

                                                        SHA256

                                                        22d48a2236910b27f03ca1956ae3652a83c580cc52587b82d0b66b8dcbffd2d7

                                                        SHA512

                                                        803c52529890ed09b522e77d88715feab4b8146dde8cb063c31e899399a3882f82d5004a34186093d0f029681d66113161f49b93cd5dfa3fb0c49468f262db96

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                        Filesize

                                                        6KB

                                                        MD5

                                                        6ece4a2d5f442540132aa1c23230c02a

                                                        SHA1

                                                        dcb5b2c169c0743cca386826ec55a7501041a922

                                                        SHA256

                                                        6ac02070b171cc4e98ebf05a4e4e61e80f64fd61bdf9ad9160533404bd5f586c

                                                        SHA512

                                                        7109a3edfcb8584c7fa07f7a131466e02a058b11024facaf891f1688e1d6de508324aacacece3033069ea8b8b4f4c618520a70e69a8d820ccec03666764ce2d3

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                        Filesize

                                                        11KB

                                                        MD5

                                                        1a8e72e8fc4ea522c163a4c5224cc1c0

                                                        SHA1

                                                        f3bb50d88c0321ffe08273c945f49cceb74258c2

                                                        SHA256

                                                        950baa8c29f3d220879c8c91a6e35e7a0d68157a0c66ccf3f8d1e611ad9aefeb

                                                        SHA512

                                                        6d7be71ccd4f7efa0a0e5ca6b5d095f4502241b3ba72f7e7cd9c9b976752e9c0cb09c43dda66fd81cc6d496d4e487c36c8c973dcb50f220fbd98fe006d451bcc

                                                      • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\vg8iw5f0.default-release\activity-stream.discovery_stream.json.tmp

                                                        Filesize

                                                        22KB

                                                        MD5

                                                        1779000332ae233c24d87047ca24b878

                                                        SHA1

                                                        139a0ae67ab9564d06ddfca9ed040c4562a63014

                                                        SHA256

                                                        21c09879dd3687fae1f63ae5e1083337baec70f312dcf2d4bf62b66b0c3c46f7

                                                        SHA512

                                                        eb98bce2b7f7625e65a9c05164f6ab4c072e6d635bba3c0b578d0b539fd2b9a32961fcf71432bc909873ee959517a301e8bc5defa46be368ed36de52458bc6b2

                                                      • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\vg8iw5f0.default-release\activity-stream.discovery_stream.json.tmp

                                                        Filesize

                                                        23KB

                                                        MD5

                                                        deeb5ee8876d62624b05e6a15bf04c30

                                                        SHA1

                                                        47db16d4dc2a16cce38ee83a4f3ce70903f669eb

                                                        SHA256

                                                        78559f6702845feb6578ba4e17ffe12d2948f4ad3b53729d614567406f16ae8c

                                                        SHA512

                                                        ae77398dbfaa82c015f095cab9611af455f7afab686d030e5a7145d576bdef66bee246c553f301131a9fb8d067e0d602761b139ac303e0f3a81b7fe62cfc07a3

                                                      • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\vg8iw5f0.default-release\cache2\entries\5CD1EBDF6B57F13C7E783CE5E6D8E9C44014FE1A

                                                        Filesize

                                                        13KB

                                                        MD5

                                                        61aca69304519286fa8c3bbd36707eb6

                                                        SHA1

                                                        41df6f1b8675b4293ad903a606d4e958a973c328

                                                        SHA256

                                                        dabe5dfea50144b4cc8f86360f6508edd6e6fa79d072d243afff3f3f36769b36

                                                        SHA512

                                                        2d895962ade3603f32f29b2642df4be95a36d27caa3cd8c6e1ffba72303dd045841249f361d101d1a6276bc63d910d87812bfbe465ab0b2994003195b66a5ecd

                                                      • C:\Users\Admin\AppData\Local\Temp\1000006001\5189481211.exe

                                                        Filesize

                                                        2.4MB

                                                        MD5

                                                        372c9047c2f9bc0241a64b506054fa0a

                                                        SHA1

                                                        a3dca1dc8b61381c1fca9f6951352aa5f6a2403f

                                                        SHA256

                                                        3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22

                                                        SHA512

                                                        1ddc4dcc4e77ec0c147afe1606f50a989ae8cc8ecae67cc5fb122cf985b2aec84c4968fc2075ffeb0f666d1ca0669acef855e8e647e681a31dd1d5d70a0f13fa

                                                      • C:\Users\Admin\AppData\Local\Temp\1000008021\135016d09f.cmd

                                                        Filesize

                                                        2KB

                                                        MD5

                                                        c1b73be75c9a5348a3e36e9ec2993f58

                                                        SHA1

                                                        84b8badeca9fa527ae6b79f3e5920e9fd0fbd906

                                                        SHA256

                                                        a75e65563e853c9fb8863bcf7c2103ec23893f31a42b9332042ea3f5f2d40ea0

                                                        SHA512

                                                        fe6d1df55358ba710c25e0e6b189beca8ce991d65a0fcecefdecacd2b96e0802ea549157c1449d2853f0ab37b8e865ec70e51772d2deefe8238d7581c81bc4a3

                                                      • C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe

                                                        Filesize

                                                        1.8MB

                                                        MD5

                                                        9a078876b23608ca0de594f4feb973fd

                                                        SHA1

                                                        63355749469f7fabfe986fb3ae33bdc83834c061

                                                        SHA256

                                                        149f34cc064bd94f468d0e3c2fcc176dcf3592b099b4cef85fb4d672cb0a5d6d

                                                        SHA512

                                                        45ecc1a2bb87619656cb9204aa9eb2955e4d502adb84d528f004afe038e256a68de46224602ccf7cc81cdb3e62e6cbf5111ab2e33e72b3d8c10f6f81ac5615d6

                                                      • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                                                        Filesize

                                                        442KB

                                                        MD5

                                                        85430baed3398695717b0263807cf97c

                                                        SHA1

                                                        fffbee923cea216f50fce5d54219a188a5100f41

                                                        SHA256

                                                        a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

                                                        SHA512

                                                        06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

                                                      • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                                                        Filesize

                                                        8.0MB

                                                        MD5

                                                        a01c5ecd6108350ae23d2cddf0e77c17

                                                        SHA1

                                                        c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

                                                        SHA256

                                                        345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

                                                        SHA512

                                                        b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vg8iw5f0.default-release\cookies.sqlite-wal

                                                        Filesize

                                                        256KB

                                                        MD5

                                                        cd8ec97ceb7e022022d2b511e2dcb277

                                                        SHA1

                                                        2755d904bec4af7121d5b9b43b523e888f3ac47c

                                                        SHA256

                                                        a48cec75e3a7cc2fb1fd2c16c6393d2ec682c8b1a420b85ffe8a6dcb11fbc3e4

                                                        SHA512

                                                        ab4973854d16707224503b21b843f47e8b696afc6056183d0ed0edce63b5bc9c23eba0eb577f2be5751b379f82039c1b466783e51781961a9d3c2f4d49206950

                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vg8iw5f0.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

                                                        Filesize

                                                        997KB

                                                        MD5

                                                        fe3355639648c417e8307c6d051e3e37

                                                        SHA1

                                                        f54602d4b4778da21bc97c7238fc66aa68c8ee34

                                                        SHA256

                                                        1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

                                                        SHA512

                                                        8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vg8iw5f0.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

                                                        Filesize

                                                        116B

                                                        MD5

                                                        3d33cdc0b3d281e67dd52e14435dd04f

                                                        SHA1

                                                        4db88689282fd4f9e9e6ab95fcbb23df6e6485db

                                                        SHA256

                                                        f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

                                                        SHA512

                                                        a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vg8iw5f0.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

                                                        Filesize

                                                        479B

                                                        MD5

                                                        49ddb419d96dceb9069018535fb2e2fc

                                                        SHA1

                                                        62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

                                                        SHA256

                                                        2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

                                                        SHA512

                                                        48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vg8iw5f0.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

                                                        Filesize

                                                        372B

                                                        MD5

                                                        8be33af717bb1b67fbd61c3f4b807e9e

                                                        SHA1

                                                        7cf17656d174d951957ff36810e874a134dd49e0

                                                        SHA256

                                                        e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

                                                        SHA512

                                                        6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vg8iw5f0.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

                                                        Filesize

                                                        11.8MB

                                                        MD5

                                                        33bf7b0439480effb9fb212efce87b13

                                                        SHA1

                                                        cee50f2745edc6dc291887b6075ca64d716f495a

                                                        SHA256

                                                        8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

                                                        SHA512

                                                        d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vg8iw5f0.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

                                                        Filesize

                                                        1KB

                                                        MD5

                                                        688bed3676d2104e7f17ae1cd2c59404

                                                        SHA1

                                                        952b2cdf783ac72fcb98338723e9afd38d47ad8e

                                                        SHA256

                                                        33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

                                                        SHA512

                                                        7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vg8iw5f0.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

                                                        Filesize

                                                        1KB

                                                        MD5

                                                        937326fead5fd401f6cca9118bd9ade9

                                                        SHA1

                                                        4526a57d4ae14ed29b37632c72aef3c408189d91

                                                        SHA256

                                                        68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

                                                        SHA512

                                                        b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vg8iw5f0.default-release\places.sqlite-wal

                                                        Filesize

                                                        992KB

                                                        MD5

                                                        de024e7a5941ed134515776026177725

                                                        SHA1

                                                        7795c75fdd3b01e82f609fbcc9748aa8af5bb85a

                                                        SHA256

                                                        d18f372f526e90fd8a1f26bd898b3a7a86dec79098965b77d1b99225b0dc0b34

                                                        SHA512

                                                        510abec1090a4e6183761f6fdce14456f7346cac73c5ef6b3f1a2d6be6d5200aedb2004dca536352a2bfcaf3fdf39f7ba46bfaf5c1ae9208714c6bca68ffe759

                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vg8iw5f0.default-release\prefs-1.js

                                                        Filesize

                                                        6KB

                                                        MD5

                                                        4ec52e29396819e12e2ab6561f639680

                                                        SHA1

                                                        a680c3092d3d0912f695fb32a92a6969fef8eea1

                                                        SHA256

                                                        9ca5f0d5fecaf112b74758f493dd53a7b0e9cef242ef49e8ebe795644121d214

                                                        SHA512

                                                        29f8805e6f415c7a8f558ecc0ead57af883654a61aa4ce2bacf43bc6e1abbc472e8ed78be69084cee96594254e232d4ace23fddaf46850a66aa0f463ad3b828d

                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vg8iw5f0.default-release\prefs-1.js

                                                        Filesize

                                                        8KB

                                                        MD5

                                                        3f49b796453fd9b1a48157123572c56d

                                                        SHA1

                                                        43179e6889e6fc4a7ad7a0c60280707151f632a9

                                                        SHA256

                                                        f77495dac16ceec9f9237246aaf0a77c5eb65f8456d148b128e87be373fbdd8b

                                                        SHA512

                                                        ef3d49bb7ca041cacb7e646105f1c2d645b2c3161b90400b7f34bdb3d08530f3e1bff60c514bc19710d820fcffcf896d5873c89ca9b10898e3f7f15dfa8056ea

                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vg8iw5f0.default-release\prefs.js

                                                        Filesize

                                                        6KB

                                                        MD5

                                                        36537c77a82a553daba7cf0dd40dd20d

                                                        SHA1

                                                        6877cb890cf0bd451fd379b621520642fe23d072

                                                        SHA256

                                                        1d2fe1ec5dd960b42b255f1fb5fb728754b3bd5958f8fab4e5a144db2bcac19b

                                                        SHA512

                                                        416f5a6b61717c61cc0dee8e2498118bf526dc78cc5081d45d679c5bb62389bb703c57ab86d985b1c9385bfe0acb3f9783ff340f40e0720cf18f51faa0f054c4

                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vg8iw5f0.default-release\sessionstore-backups\recovery.jsonlz4

                                                        Filesize

                                                        4KB

                                                        MD5

                                                        f35ab01afc91e196204b7054c158fbbe

                                                        SHA1

                                                        f92b6ec22c7370ae99918a9a8beb4418347b77f1

                                                        SHA256

                                                        5072e856c6c090e6512228fabc07b4e0842520345bf85d1c21610287d182dea0

                                                        SHA512

                                                        9bb91b5803c8abbaebaa13c63a5334b520a6404b5fc6126e9cc5c8323f9322c7e78869d7496e0cd7d1f25ec0fde9c79fd55b228e10b357448780d3a762a86dc8

                                                      • \??\pipe\crashpad_1628_QSUPCSGXJEZPVUNU

                                                        MD5

                                                        d41d8cd98f00b204e9800998ecf8427e

                                                        SHA1

                                                        da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                        SHA256

                                                        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                        SHA512

                                                        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                      • memory/2516-3-0x0000000000090000-0x0000000000550000-memory.dmp

                                                        Filesize

                                                        4.8MB

                                                      • memory/2516-2-0x0000000000091000-0x00000000000BF000-memory.dmp

                                                        Filesize

                                                        184KB

                                                      • memory/2516-1-0x0000000077E94000-0x0000000077E96000-memory.dmp

                                                        Filesize

                                                        8KB

                                                      • memory/2516-0-0x0000000000090000-0x0000000000550000-memory.dmp

                                                        Filesize

                                                        4.8MB

                                                      • memory/2516-5-0x0000000000090000-0x0000000000550000-memory.dmp

                                                        Filesize

                                                        4.8MB

                                                      • memory/2516-16-0x0000000000090000-0x0000000000550000-memory.dmp

                                                        Filesize

                                                        4.8MB

                                                      • memory/3848-2445-0x0000000000970000-0x0000000000E30000-memory.dmp

                                                        Filesize

                                                        4.8MB

                                                      • memory/3848-2446-0x0000000000970000-0x0000000000E30000-memory.dmp

                                                        Filesize

                                                        4.8MB

                                                      • memory/4620-2504-0x0000000000970000-0x0000000000E30000-memory.dmp

                                                        Filesize

                                                        4.8MB

                                                      • memory/4620-2503-0x0000000000970000-0x0000000000E30000-memory.dmp

                                                        Filesize

                                                        4.8MB

                                                      • memory/4660-1469-0x0000000000970000-0x0000000000E30000-memory.dmp

                                                        Filesize

                                                        4.8MB

                                                      • memory/4660-2484-0x0000000000970000-0x0000000000E30000-memory.dmp

                                                        Filesize

                                                        4.8MB

                                                      • memory/4660-18-0x0000000000971000-0x000000000099F000-memory.dmp

                                                        Filesize

                                                        184KB

                                                      • memory/4660-383-0x0000000000970000-0x0000000000E30000-memory.dmp

                                                        Filesize

                                                        4.8MB

                                                      • memory/4660-17-0x0000000000970000-0x0000000000E30000-memory.dmp

                                                        Filesize

                                                        4.8MB

                                                      • memory/4660-378-0x0000000000970000-0x0000000000E30000-memory.dmp

                                                        Filesize

                                                        4.8MB

                                                      • memory/4660-377-0x0000000000970000-0x0000000000E30000-memory.dmp

                                                        Filesize

                                                        4.8MB

                                                      • memory/4660-2505-0x0000000000970000-0x0000000000E30000-memory.dmp

                                                        Filesize

                                                        4.8MB

                                                      • memory/4660-20-0x0000000000970000-0x0000000000E30000-memory.dmp

                                                        Filesize

                                                        4.8MB

                                                      • memory/4660-263-0x0000000000970000-0x0000000000E30000-memory.dmp

                                                        Filesize

                                                        4.8MB

                                                      • memory/4660-630-0x0000000000970000-0x0000000000E30000-memory.dmp

                                                        Filesize

                                                        4.8MB

                                                      • memory/4660-390-0x0000000000970000-0x0000000000E30000-memory.dmp

                                                        Filesize

                                                        4.8MB

                                                      • memory/4660-2422-0x0000000000970000-0x0000000000E30000-memory.dmp

                                                        Filesize

                                                        4.8MB

                                                      • memory/4660-2440-0x0000000000970000-0x0000000000E30000-memory.dmp

                                                        Filesize

                                                        4.8MB

                                                      • memory/4660-2501-0x0000000000970000-0x0000000000E30000-memory.dmp

                                                        Filesize

                                                        4.8MB

                                                      • memory/4660-19-0x0000000000970000-0x0000000000E30000-memory.dmp

                                                        Filesize

                                                        4.8MB

                                                      • memory/4660-2488-0x0000000000970000-0x0000000000E30000-memory.dmp

                                                        Filesize

                                                        4.8MB

                                                      • memory/4660-2487-0x0000000000970000-0x0000000000E30000-memory.dmp

                                                        Filesize

                                                        4.8MB

                                                      • memory/4660-2486-0x0000000000970000-0x0000000000E30000-memory.dmp

                                                        Filesize

                                                        4.8MB

                                                      • memory/4660-389-0x0000000000970000-0x0000000000E30000-memory.dmp

                                                        Filesize

                                                        4.8MB

                                                      • memory/4660-2485-0x0000000000970000-0x0000000000E30000-memory.dmp

                                                        Filesize

                                                        4.8MB

                                                      • memory/4872-334-0x0000000000400000-0x0000000000FFD000-memory.dmp

                                                        Filesize

                                                        12.0MB

                                                      • memory/4872-36-0x0000000000400000-0x0000000000FFD000-memory.dmp

                                                        Filesize

                                                        12.0MB

                                                      • memory/4872-88-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                                                        Filesize

                                                        972KB

                                                      • memory/5268-332-0x0000000000970000-0x0000000000E30000-memory.dmp

                                                        Filesize

                                                        4.8MB

                                                      • memory/5268-328-0x0000000000970000-0x0000000000E30000-memory.dmp

                                                        Filesize

                                                        4.8MB

                                                      • memory/5344-338-0x00000000009B0000-0x0000000000E70000-memory.dmp

                                                        Filesize

                                                        4.8MB

                                                      • memory/5344-354-0x00000000009B0000-0x0000000000E70000-memory.dmp

                                                        Filesize

                                                        4.8MB