Analysis

  • max time kernel
    150s
  • max time network
    147s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240704-en
  • resource tags

    arch:x64arch:x86image:win11-20240704-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    09-07-2024 02:33

General

  • Target

    c11e7133c481e34c3ac90d33416e85490b4e4b3b2af782fae22138298bb0e404.exe

  • Size

    2.4MB

  • MD5

    d342b0b1abfb52f8238f15947684c901

  • SHA1

    822148d3b2b2663c25b865a1f98516095c5e01b0

  • SHA256

    c11e7133c481e34c3ac90d33416e85490b4e4b3b2af782fae22138298bb0e404

  • SHA512

    e6558c4cc35d8b1784602695a7febec0aef5c9b6fba90fe4a90a8da27592678da6f61655770f35fc425c3de1d970576117982cffb12a9f9d1942daf7b32e4f75

  • SSDEEP

    49152:Y12qH4aaB9/JQGfQpUhQ2ZH0VH4QWcS56/DxIqzsWqPjuZ:Y8qYaaz/JQjUhQ2Sass6rTqbuZ

Malware Config

Extracted

Family

stealc

Botnet

hate

C2

http://85.28.47.30

Attributes
  • url_path

    /920475a59bac849d.php

Extracted

Family

amadey

Version

4.30

Botnet

4dd39d

C2

http://77.91.77.82

Attributes
  • install_dir

    ad40971b6b

  • install_file

    explorti.exe

  • strings_key

    a434973ad22def7137dbb5e059b7081e

  • url_paths

    /Hun4Ko/index.php

rc4.plain

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Stealc

    Stealc is an infostealer written in C++.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 8 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 5 IoCs
  • Identifies Wine through registry keys 2 TTPs 4 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 2 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 28 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 56 IoCs
  • Suspicious use of SendNotifyMessage 27 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\c11e7133c481e34c3ac90d33416e85490b4e4b3b2af782fae22138298bb0e404.exe
    "C:\Users\Admin\AppData\Local\Temp\c11e7133c481e34c3ac90d33416e85490b4e4b3b2af782fae22138298bb0e404.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3148
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\BKKKFCFIIJ.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1504
      • C:\Users\Admin\AppData\Local\Temp\BKKKFCFIIJ.exe
        "C:\Users\Admin\AppData\Local\Temp\BKKKFCFIIJ.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:4600
        • C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
          "C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe"
          4⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:3032
          • C:\Users\Admin\AppData\Local\Temp\1000006001\8b3434eaee.exe
            "C:\Users\Admin\AppData\Local\Temp\1000006001\8b3434eaee.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious use of SetWindowsHookEx
            PID:1572
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\1000008021\f939490aea.cmd" "
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:4280
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.youtube.com/account"
              6⤵
              • Enumerates system info in registry
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              • Suspicious use of WriteProcessMemory
              PID:2476
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x10c,0x110,0x114,0xe8,0x118,0x7ffda1a5ab58,0x7ffda1a5ab68,0x7ffda1a5ab78
                7⤵
                  PID:1816
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1536 --field-trial-handle=2392,i,13918741953325798702,2536063211323069619,131072 /prefetch:2
                  7⤵
                    PID:4552
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1880 --field-trial-handle=2392,i,13918741953325798702,2536063211323069619,131072 /prefetch:8
                    7⤵
                      PID:4820
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1896 --field-trial-handle=2392,i,13918741953325798702,2536063211323069619,131072 /prefetch:8
                      7⤵
                        PID:2568
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3032 --field-trial-handle=2392,i,13918741953325798702,2536063211323069619,131072 /prefetch:1
                        7⤵
                          PID:4316
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3044 --field-trial-handle=2392,i,13918741953325798702,2536063211323069619,131072 /prefetch:1
                          7⤵
                            PID:3520
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4060 --field-trial-handle=2392,i,13918741953325798702,2536063211323069619,131072 /prefetch:1
                            7⤵
                              PID:5812
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1756 --field-trial-handle=2392,i,13918741953325798702,2536063211323069619,131072 /prefetch:2
                              7⤵
                              • Suspicious behavior: EnumeratesProcesses
                              PID:6956
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/account"
                            6⤵
                            • Enumerates system info in registry
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                            • Suspicious use of FindShellTrayWindow
                            • Suspicious use of SendNotifyMessage
                            • Suspicious use of WriteProcessMemory
                            PID:2216
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x10c,0x110,0x114,0xe8,0x118,0x7ffda1043cb8,0x7ffda1043cc8,0x7ffda1043cd8
                              7⤵
                                PID:1916
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2004,5436315983071927440,13251746292790617004,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2016 /prefetch:2
                                7⤵
                                  PID:1788
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2004,5436315983071927440,13251746292790617004,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 /prefetch:3
                                  7⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:2700
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2004,5436315983071927440,13251746292790617004,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1404 /prefetch:8
                                  7⤵
                                    PID:1468
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,5436315983071927440,13251746292790617004,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
                                    7⤵
                                      PID:3720
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,5436315983071927440,13251746292790617004,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
                                      7⤵
                                        PID:3580
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,5436315983071927440,13251746292790617004,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4576 /prefetch:1
                                        7⤵
                                          PID:5656
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2004,5436315983071927440,13251746292790617004,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5248 /prefetch:8
                                          7⤵
                                          • Suspicious behavior: EnumeratesProcesses
                                          PID:6008
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,5436315983071927440,13251746292790617004,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
                                          7⤵
                                            PID:1612
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,5436315983071927440,13251746292790617004,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4748 /prefetch:1
                                            7⤵
                                              PID:4852
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,5436315983071927440,13251746292790617004,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3940 /prefetch:1
                                              7⤵
                                                PID:6364
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,5436315983071927440,13251746292790617004,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4648 /prefetch:1
                                                7⤵
                                                  PID:6372
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2004,5436315983071927440,13251746292790617004,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5464 /prefetch:8
                                                  7⤵
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:6568
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2004,5436315983071927440,13251746292790617004,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5420 /prefetch:2
                                                  7⤵
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:6968
                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                "C:\Program Files\Mozilla Firefox\firefox.exe" "https://www.youtube.com/account"
                                                6⤵
                                                • Suspicious use of WriteProcessMemory
                                                PID:2140
                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
                                                  7⤵
                                                  • Checks processor information in registry
                                                  • Modifies registry class
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  • Suspicious use of FindShellTrayWindow
                                                  • Suspicious use of SendNotifyMessage
                                                  • Suspicious use of SetWindowsHookEx
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:1096
                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1096.0.1291784094\1343650782" -parentBuildID 20230214051806 -prefsHandle 1740 -prefMapHandle 1732 -prefsLen 22074 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {abdecdb4-21b9-4b21-9a45-771b9c07a002} 1096 "\\.\pipe\gecko-crash-server-pipe.1096" 1852 1ad9810c158 gpu
                                                    8⤵
                                                      PID:1276
                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1096.1.1507786755\1839541025" -parentBuildID 20230214051806 -prefsHandle 2408 -prefMapHandle 2404 -prefsLen 22925 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5d4d9855-9b98-45e2-9e80-b5940101c22d} 1096 "\\.\pipe\gecko-crash-server-pipe.1096" 2436 1ad83c86258 socket
                                                      8⤵
                                                        PID:2240
                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1096.2.1822911198\1566389367" -childID 1 -isForBrowser -prefsHandle 2936 -prefMapHandle 2768 -prefsLen 22963 -prefMapSize 235121 -jsInitHandle 936 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c995bf2b-dcfc-4496-a232-327975afee73} 1096 "\\.\pipe\gecko-crash-server-pipe.1096" 2764 1ad96f93f58 tab
                                                        8⤵
                                                          PID:2312
                                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1096.3.1222824542\1539625665" -childID 2 -isForBrowser -prefsHandle 3424 -prefMapHandle 3440 -prefsLen 27614 -prefMapSize 235121 -jsInitHandle 936 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {05bfff0d-334e-4f23-9df6-6f3886bf46ba} 1096 "\\.\pipe\gecko-crash-server-pipe.1096" 3620 1ad9ce0f558 tab
                                                          8⤵
                                                            PID:1060
                                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1096.4.1956731906\709226502" -childID 3 -isForBrowser -prefsHandle 5192 -prefMapHandle 5196 -prefsLen 27695 -prefMapSize 235121 -jsInitHandle 936 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {39cfd575-879e-4608-a94b-7bda0b14126d} 1096 "\\.\pipe\gecko-crash-server-pipe.1096" 5204 1ad9ef29658 tab
                                                            8⤵
                                                              PID:5820
                                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1096.5.2058690826\1420876642" -childID 4 -isForBrowser -prefsHandle 5432 -prefMapHandle 5428 -prefsLen 27695 -prefMapSize 235121 -jsInitHandle 936 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7fa5294f-8376-4b59-9e5c-dab9e4789bd9} 1096 "\\.\pipe\gecko-crash-server-pipe.1096" 5348 1ad9ef27b58 tab
                                                              8⤵
                                                                PID:5900
                                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1096.6.601125262\1719672618" -childID 5 -isForBrowser -prefsHandle 5600 -prefMapHandle 5604 -prefsLen 27695 -prefMapSize 235121 -jsInitHandle 936 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1baaa7f3-55e8-4275-949e-ebf19b728ce8} 1096 "\\.\pipe\gecko-crash-server-pipe.1096" 5656 1ad9ef27858 tab
                                                                8⤵
                                                                  PID:5952
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\JJJJKEHCAK.exe"
                                                      2⤵
                                                      • Suspicious use of SetWindowsHookEx
                                                      PID:1996
                                                  • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
                                                    "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
                                                    1⤵
                                                      PID:4280
                                                    • C:\Windows\System32\CompPkgSrv.exe
                                                      C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                      1⤵
                                                        PID:2196
                                                      • C:\Windows\System32\CompPkgSrv.exe
                                                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                        1⤵
                                                          PID:5440
                                                        • C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
                                                          C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
                                                          1⤵
                                                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                          • Checks BIOS information in registry
                                                          • Executes dropped EXE
                                                          • Identifies Wine through registry keys
                                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          PID:2564
                                                        • C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
                                                          C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
                                                          1⤵
                                                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                          • Checks BIOS information in registry
                                                          • Executes dropped EXE
                                                          • Identifies Wine through registry keys
                                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          PID:6700

                                                        Network

                                                        MITRE ATT&CK Enterprise v15

                                                        Replay Monitor

                                                        Loading Replay Monitor...

                                                        Downloads

                                                        • C:\ProgramData\mozglue.dll

                                                          Filesize

                                                          593KB

                                                          MD5

                                                          c8fd9be83bc728cc04beffafc2907fe9

                                                          SHA1

                                                          95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                                                          SHA256

                                                          ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                                                          SHA512

                                                          fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                                                        • C:\ProgramData\nss3.dll

                                                          Filesize

                                                          2.0MB

                                                          MD5

                                                          1cc453cdf74f31e4d913ff9c10acdde2

                                                          SHA1

                                                          6e85eae544d6e965f15fa5c39700fa7202f3aafe

                                                          SHA256

                                                          ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                                                          SHA512

                                                          dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000001

                                                          Filesize

                                                          67KB

                                                          MD5

                                                          51c3c3d00a4a5a9d730c04c615f2639b

                                                          SHA1

                                                          3b92cce727fc1fb03e982eb611935218c821948f

                                                          SHA256

                                                          cb1e96afd2fec2b2b445be2f46c6b90db19c2ed2f0278f57f7490a299e88c19f

                                                          SHA512

                                                          7af8ec3160e4dbae2c3359146c0a82c32a02697d332138c391e4295d00f49ed1070857a0afe16222c5cea1cafffc4d26df525543f187be43a59967df1e919542

                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000005

                                                          Filesize

                                                          36KB

                                                          MD5

                                                          103d7813f0ccc7445b4b9a4b34fc74bf

                                                          SHA1

                                                          ed862e8ebd885acde6115c340e59e50e74e3633b

                                                          SHA256

                                                          0ccaf58bb2aa430724873fa21515e5f3fbd875390288aade3823ec16962bc27b

                                                          SHA512

                                                          0723baca97705968a068676f74ac01bd492dac94a4fba391de578b6357b79c4aca5412f564dc0ea7ae5b6145256c7f8f22e8a4823f41e2baf50d201ec073be1f

                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                          Filesize

                                                          216B

                                                          MD5

                                                          6e969135b89a9daf151997e9f6023391

                                                          SHA1

                                                          9b7f1f89fe248dbb3810abf6fa0e819eb73320ab

                                                          SHA256

                                                          687917c6b70477735ab99a5536840f92205055ff64716d9bd13e6a97063a5769

                                                          SHA512

                                                          af929884369620f57b8db6466480a6419d6f492c1dec80d8d7ca53de08fdf04583d9b77558c752a72e94c67efd5b0ddf98a6861a11674fe2af0f20621d4aeba0

                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                                          Filesize

                                                          2KB

                                                          MD5

                                                          4300c0753308224101dfe4d0ff18af86

                                                          SHA1

                                                          d53f39665c5d8a4302819a5ef664ce87dde70e57

                                                          SHA256

                                                          0fac2050d605205ff2fe504d612b0359f59b7e883a572a85d26993adbbbe34d9

                                                          SHA512

                                                          863ab49af2cfc948b17a1e7f99cf23bf035167d18dab89b566aaa95082b7124d6e3680a80eda15a6679e654470aebb31cd0b28c661a71208708d6aedd528fb69

                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                                                          Filesize

                                                          2B

                                                          MD5

                                                          d751713988987e9331980363e24189ce

                                                          SHA1

                                                          97d170e1550eee4afc0af065b78cda302a97674c

                                                          SHA256

                                                          4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                                          SHA512

                                                          b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                          Filesize

                                                          524B

                                                          MD5

                                                          0ddc6264fa45c323de9ae3d4189291d8

                                                          SHA1

                                                          a3117e08c8363003fb69edb2a79409e2a50377cf

                                                          SHA256

                                                          087b03e505462df86cedbd7687763427afbbabe82c352f0b37d6cd4b50f7e204

                                                          SHA512

                                                          52cddf2bb4ebf0ead8d8449a10cc563d8331234e309b3eb56d70407acb0332c8aa0da6c70e4104de693eb5df9dcc36dbf4c3ae85cce9f64b84e1cf1aa3d01a06

                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                          Filesize

                                                          7KB

                                                          MD5

                                                          82ee11def5232188f5f923ab65cff0ec

                                                          SHA1

                                                          00454802c4e94cd5b24a2a729dab7a707389ac68

                                                          SHA256

                                                          db3cb320e0b726f54cf5114214e0750b5d47d6e7ad394f91326e1382b6727fe5

                                                          SHA512

                                                          571dab1b1f30dc66e237727375507c797e6f5b3dd1b967dee90121ac0144c81587668be655bea6500bd010b57b450cb0d704373afb822e1924c96ee87299f422

                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                          Filesize

                                                          144KB

                                                          MD5

                                                          bfe99c7c9601b6857795ef6ee4aa78b5

                                                          SHA1

                                                          1c0dde74bc4f269487ae46b77a65835b4e62f5b1

                                                          SHA256

                                                          62597bee1d04da66532eb4b43831d368912a26f8f49c3e5478cf3a957677cb6c

                                                          SHA512

                                                          f4a12830fcbc2a8186b02a2f6a9bfb62e66ecb88e4a2c35bf609ed99752b7815ef1895b9b4270e6715cac5c97b69c9507b1fa3e09d2c79b9b93ff585fd75e835

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                          Filesize

                                                          152B

                                                          MD5

                                                          7ba8d5dce4a5e01e0f7e2bc69039b512

                                                          SHA1

                                                          94c46692b28fff7c45a5fe460c490f3fefb7c616

                                                          SHA256

                                                          8292f28cc308853788aeaea7c49e80f8f10f999718bc65baa4e9e13014a7618d

                                                          SHA512

                                                          b206368bd307c276b4d415bbe20ab1c8a31799a3af9cc76ae5e5d38d88144cc854f8cde46271e1e5865fe14383e17884942b4a6230ee20c8f1c46f0424fa0ca9

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                          Filesize

                                                          152B

                                                          MD5

                                                          491e074ffee79db3045798be635e2447

                                                          SHA1

                                                          f18b68fbeba3f27483ade74c2e6729d8461e0c02

                                                          SHA256

                                                          85c14a21ae9b76c5e941b5806374dbda37d5411123e906d48d510762c8d84ce7

                                                          SHA512

                                                          fd27b53d90a1999e98e4a56678b7ae098da3f800f3159b76a2b4caf7fdfd5767153f08e7325bba7e73b7c3c7f35386b01bea437711fbe31c5e602a468a8731a8

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

                                                          Filesize

                                                          33KB

                                                          MD5

                                                          1c0c8433626cac08202f23a1dae54325

                                                          SHA1

                                                          3a5700eeeacd9f9d6b17c2707f75f29308658cd3

                                                          SHA256

                                                          7aad4c7a174a145a4f9f11506145b521631ee2cb1ca2f7617b900ba515b31cd3

                                                          SHA512

                                                          da693d1d63c9971cb80792063f0e8d3335edb67ee1dcde4040d0dc8f44398f99d9f683eaab8cf44ebf5cdb78eae6672d43fd9ed9b45a526a80a311d8c77bcc8c

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                          Filesize

                                                          216B

                                                          MD5

                                                          5dfa9ad5ce45f52e8d320bd0786eee30

                                                          SHA1

                                                          5c80560ceff8a521f3e801291666d5f53ab4a461

                                                          SHA256

                                                          0f3d5f4aaf7a06f0567036a5aebcb03867989d3e837162e74cce5ff3532358fa

                                                          SHA512

                                                          13303969b89a6defc2673c9756a7132f55fe4725096fd4df56d059421127a94eee9b2e9346cfd355527aa4d15a7d7ee6f3c83e0366c8403096f770579a545890

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                          Filesize

                                                          1KB

                                                          MD5

                                                          4229b61a6c86cb0fc9fc9e406e403486

                                                          SHA1

                                                          67a9bf34d5b0962d7a96172f82bfeff12c6c7fe5

                                                          SHA256

                                                          ec376f69054951ef6cd00e88e5d3a311aa7133a72811d685dab1475192452734

                                                          SHA512

                                                          901424f675474f0821759d973deaa5184b36882f9a688717348427d74fcee540352a22c0ab1ad9069027b01120ab64bc6c4b84a6018afdb1dba82d6df0d5d329

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                          Filesize

                                                          5KB

                                                          MD5

                                                          a221c9b12a9d2a533bcee05d4051a3f1

                                                          SHA1

                                                          d0a837c2ded20063007b11ce61458a7813c508de

                                                          SHA256

                                                          0208fd1034f9944a573f3cce0817a01d3a75204dde3779b3e6c9326f648d5156

                                                          SHA512

                                                          6bd33a0369d5fb10e4e9880a0f6504ffa7352d5a0dd9cadadc613294b30dbb830eb653a37d08731065aca03c4246f535f439c9383d8c124c0b17d1126b36dd5a

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                          Filesize

                                                          6KB

                                                          MD5

                                                          18c2a45bb9fba33d047dc3e9cd03cafa

                                                          SHA1

                                                          77c00f0290e03689c78bc20bc857f60d184e054d

                                                          SHA256

                                                          b7af2a5a39c1388a04bb8c2dbef99a4b9e352aa3e4d77b6afe2443bc2857e293

                                                          SHA512

                                                          f5e6c07d32513e108a76895c9e630d3ab1b9339ef305ff9b420847b622ab0f1f804adb883ac3df1dd1d3c342cfafac90a5aeb22c2c1ccd1efd5f5ea75be8f45a

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                          Filesize

                                                          16B

                                                          MD5

                                                          46295cac801e5d4857d09837238a6394

                                                          SHA1

                                                          44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                          SHA256

                                                          0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                          SHA512

                                                          8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                          Filesize

                                                          16B

                                                          MD5

                                                          206702161f94c5cd39fadd03f4014d98

                                                          SHA1

                                                          bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                                          SHA256

                                                          1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                                          SHA512

                                                          0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                          Filesize

                                                          11KB

                                                          MD5

                                                          48fbb2fa77922cfcf5330aab25fa510d

                                                          SHA1

                                                          2efd221d6792b7bc085223bb0ab1abbf6f63af96

                                                          SHA256

                                                          07fb1ffdcafc18565237e9b3d1d9535c957f530c61d5cacb4b9a927b4462763f

                                                          SHA512

                                                          dbbe27b8bb90974f57c89955a101b0c9b5e2e7b55740adc1ce537b7a852864efc0e118c7ad05ac435d3bff662f14d104da4312d1d35e642b983c6e848aa5e384

                                                        • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4926s7ha.default-release\activity-stream.discovery_stream.json.tmp

                                                          Filesize

                                                          22KB

                                                          MD5

                                                          7e61188ef6f35aff00074ed965b6bb51

                                                          SHA1

                                                          2ed9e8eaf782c9338856c8ec2cd9c7ebdf6814ce

                                                          SHA256

                                                          abd1ba960dbc028527b5a25ca6fabb69e9f103d12d38b026bc61f397f31a7cfd

                                                          SHA512

                                                          4904520e6c0b92ba07d3b4f1cbc8a079d921282db4dba9a6c41863569c76d5ea4ba2381b70119f2d94480e1722ef13b6e27188a1e03dcf6074a831212566fdeb

                                                        • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4926s7ha.default-release\cache2\entries\5CD1EBDF6B57F13C7E783CE5E6D8E9C44014FE1A

                                                          Filesize

                                                          13KB

                                                          MD5

                                                          b5a5c1cd0a17e1d484e57dbdd3514126

                                                          SHA1

                                                          b73017855f981999aed294677dd4c9fcd0c31d6c

                                                          SHA256

                                                          04193aef70908ac7408b6564e398396b1ddcfdda04bf3f2cd2d3c4f1a813e53c

                                                          SHA512

                                                          b492380f7081ea489d4a335ddec8a16350a032da32ca5fe3caef4afb466349585bc94cfd076027eea0236b28464741d87db29e98742466c9faea1c9dde514e3d

                                                        • C:\Users\Admin\AppData\Local\Temp\1000006001\8b3434eaee.exe

                                                          Filesize

                                                          2.4MB

                                                          MD5

                                                          d342b0b1abfb52f8238f15947684c901

                                                          SHA1

                                                          822148d3b2b2663c25b865a1f98516095c5e01b0

                                                          SHA256

                                                          c11e7133c481e34c3ac90d33416e85490b4e4b3b2af782fae22138298bb0e404

                                                          SHA512

                                                          e6558c4cc35d8b1784602695a7febec0aef5c9b6fba90fe4a90a8da27592678da6f61655770f35fc425c3de1d970576117982cffb12a9f9d1942daf7b32e4f75

                                                        • C:\Users\Admin\AppData\Local\Temp\1000008021\f939490aea.cmd

                                                          Filesize

                                                          2KB

                                                          MD5

                                                          c1b73be75c9a5348a3e36e9ec2993f58

                                                          SHA1

                                                          84b8badeca9fa527ae6b79f3e5920e9fd0fbd906

                                                          SHA256

                                                          a75e65563e853c9fb8863bcf7c2103ec23893f31a42b9332042ea3f5f2d40ea0

                                                          SHA512

                                                          fe6d1df55358ba710c25e0e6b189beca8ce991d65a0fcecefdecacd2b96e0802ea549157c1449d2853f0ab37b8e865ec70e51772d2deefe8238d7581c81bc4a3

                                                        • C:\Users\Admin\AppData\Local\Temp\BKKKFCFIIJ.exe

                                                          Filesize

                                                          1.8MB

                                                          MD5

                                                          c21e9030716bbf545c1a6aed23780cb9

                                                          SHA1

                                                          7e870d396ba3c4e05a942f1d5834e8ef0e102ef1

                                                          SHA256

                                                          ad19679fc29e8a399dbb3d9f80d5cd9284d22140b05ac66e501b2e6c1596e4ee

                                                          SHA512

                                                          f40f08872ed7add791b3c8f5b5d09e670b131e64eaa837b77ceaa198c4fbd3b1ac843cd7744fd29eebc654c730560a07840ae5dd333d1ffd591d6524a96500bc

                                                        • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                                                          Filesize

                                                          442KB

                                                          MD5

                                                          85430baed3398695717b0263807cf97c

                                                          SHA1

                                                          fffbee923cea216f50fce5d54219a188a5100f41

                                                          SHA256

                                                          a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

                                                          SHA512

                                                          06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

                                                        • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                                                          Filesize

                                                          8.0MB

                                                          MD5

                                                          a01c5ecd6108350ae23d2cddf0e77c17

                                                          SHA1

                                                          c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

                                                          SHA256

                                                          345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

                                                          SHA512

                                                          b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4926s7ha.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

                                                          Filesize

                                                          997KB

                                                          MD5

                                                          fe3355639648c417e8307c6d051e3e37

                                                          SHA1

                                                          f54602d4b4778da21bc97c7238fc66aa68c8ee34

                                                          SHA256

                                                          1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

                                                          SHA512

                                                          8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4926s7ha.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

                                                          Filesize

                                                          116B

                                                          MD5

                                                          3d33cdc0b3d281e67dd52e14435dd04f

                                                          SHA1

                                                          4db88689282fd4f9e9e6ab95fcbb23df6e6485db

                                                          SHA256

                                                          f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

                                                          SHA512

                                                          a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4926s7ha.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

                                                          Filesize

                                                          479B

                                                          MD5

                                                          49ddb419d96dceb9069018535fb2e2fc

                                                          SHA1

                                                          62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

                                                          SHA256

                                                          2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

                                                          SHA512

                                                          48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4926s7ha.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

                                                          Filesize

                                                          372B

                                                          MD5

                                                          8be33af717bb1b67fbd61c3f4b807e9e

                                                          SHA1

                                                          7cf17656d174d951957ff36810e874a134dd49e0

                                                          SHA256

                                                          e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

                                                          SHA512

                                                          6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4926s7ha.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

                                                          Filesize

                                                          11.8MB

                                                          MD5

                                                          33bf7b0439480effb9fb212efce87b13

                                                          SHA1

                                                          cee50f2745edc6dc291887b6075ca64d716f495a

                                                          SHA256

                                                          8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

                                                          SHA512

                                                          d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4926s7ha.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

                                                          Filesize

                                                          1KB

                                                          MD5

                                                          688bed3676d2104e7f17ae1cd2c59404

                                                          SHA1

                                                          952b2cdf783ac72fcb98338723e9afd38d47ad8e

                                                          SHA256

                                                          33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

                                                          SHA512

                                                          7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4926s7ha.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

                                                          Filesize

                                                          1KB

                                                          MD5

                                                          937326fead5fd401f6cca9118bd9ade9

                                                          SHA1

                                                          4526a57d4ae14ed29b37632c72aef3c408189d91

                                                          SHA256

                                                          68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

                                                          SHA512

                                                          b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4926s7ha.default-release\prefs-1.js

                                                          Filesize

                                                          10KB

                                                          MD5

                                                          5eb395b47e5e1481273f96a980e53de4

                                                          SHA1

                                                          0b2880853f9224f33e16456aab986bed1ada9b10

                                                          SHA256

                                                          9bde436fad939df47cac58167620e2ee633217e76ab2c1fdb1f85112aaf5c658

                                                          SHA512

                                                          5572e0a2a8b37513e73c3da75d2429b16e0e46f9af3c9ae8b6e335fcfc6923e28d1e215540a2d9e1b61b430323500ec67e9650f086de960e403695c18c8ed0e4

                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4926s7ha.default-release\prefs-1.js

                                                          Filesize

                                                          6KB

                                                          MD5

                                                          12001d69d16f4a19504f9964c5f8c07f

                                                          SHA1

                                                          c16ce71a785bb39d45f41c0fb239a58599f8ee17

                                                          SHA256

                                                          e8df935e8613e1c445e73cb3d3ff76d9509d101e259ee5f97fe8d72071132723

                                                          SHA512

                                                          ff12f30c68b3e733e58e47de042a3c8039fc3c7f8d017b26615532186d227730292980f20640cca9d0cd77ea3b19265f9c168ff11c0c8d119f10dfd8d0947945

                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4926s7ha.default-release\prefs-1.js

                                                          Filesize

                                                          8KB

                                                          MD5

                                                          64973ec01b28689e8a69dea58b24d791

                                                          SHA1

                                                          606ab24a7e12e35498eea14ec2c2fb98b3a0e4e5

                                                          SHA256

                                                          143860692a0e73c3ef02bd3827948cc7bccabefc57d68b8ffd99e6461ebd0c66

                                                          SHA512

                                                          02ba1b37befc09001f994294b3fac59ba084d6b068ad54f730c71ac156cb88a4c6bf5cc9ac03f11e81a4f1e031c10af6f8cea08f4468ad46f67498f746256f49

                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4926s7ha.default-release\prefs.js

                                                          Filesize

                                                          7KB

                                                          MD5

                                                          306b4a4029fc588f6a7f360e81b421b8

                                                          SHA1

                                                          b2852aeca3c78f15d11834918d3bddc4e38a5beb

                                                          SHA256

                                                          91d7ffa4f0a81f8e066e2ade3dfc385e6aa1f5c318c94397356fbe21f09ae361

                                                          SHA512

                                                          bf8688f9605edbe3c32ea3f57fed25be715e8268a53adf715d6a22b379ff0237ab10a32c6137f034df82a66a76427ba062af76d37c3516b51e7130ccf326425c

                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4926s7ha.default-release\prefs.js

                                                          Filesize

                                                          6KB

                                                          MD5

                                                          6a84bb3df3ee01c4262cc5118956aa1b

                                                          SHA1

                                                          9935580da3a3d69a5b19f0b1fbc75ba35efe5d69

                                                          SHA256

                                                          1556fbd5e116b654726b0435600c61230384c2425b90a4c051e6f15fd94861ae

                                                          SHA512

                                                          b8a7265d18e66cceb2ed8d2139c125eb97487e25836038c2d058398081a5d899d032fc5a41d762038243f61cf0fcb29118d4f48413446e99c430e7d1231991a4

                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4926s7ha.default-release\sessionstore-backups\recovery.jsonlz4

                                                          Filesize

                                                          4KB

                                                          MD5

                                                          a18e559587609e0c6552296ef3620913

                                                          SHA1

                                                          97296ef54b41daa7da72507966d7edc073c653c8

                                                          SHA256

                                                          b49200b1dff4afa50b2580071bcaa308bbe00938e8696c21c74789f01961be1d

                                                          SHA512

                                                          e806037cdcde3db0bd20a603b8055dc7302a6e6d9ba0ba44cc5293f26e27004f42d13b4cd5bdaa5a6491d3033d7b5dfdd14f663ca54a41131f9f8fa0027f857e

                                                        • \??\pipe\crashpad_2476_ZJOEXZBHSFEXXIXP

                                                          MD5

                                                          d41d8cd98f00b204e9800998ecf8427e

                                                          SHA1

                                                          da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                          SHA256

                                                          e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                          SHA512

                                                          cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                        • memory/1572-120-0x0000000000E40000-0x0000000001A28000-memory.dmp

                                                          Filesize

                                                          11.9MB

                                                        • memory/1572-111-0x0000000000E40000-0x0000000001A28000-memory.dmp

                                                          Filesize

                                                          11.9MB

                                                        • memory/2564-2408-0x0000000000CB0000-0x0000000001166000-memory.dmp

                                                          Filesize

                                                          4.7MB

                                                        • memory/2564-2406-0x0000000000CB0000-0x0000000001166000-memory.dmp

                                                          Filesize

                                                          4.7MB

                                                        • memory/3032-2435-0x0000000000CB0000-0x0000000001166000-memory.dmp

                                                          Filesize

                                                          4.7MB

                                                        • memory/3032-2473-0x0000000000CB0000-0x0000000001166000-memory.dmp

                                                          Filesize

                                                          4.7MB

                                                        • memory/3032-2493-0x0000000000CB0000-0x0000000001166000-memory.dmp

                                                          Filesize

                                                          4.7MB

                                                        • memory/3032-2480-0x0000000000CB0000-0x0000000001166000-memory.dmp

                                                          Filesize

                                                          4.7MB

                                                        • memory/3032-2476-0x0000000000CB0000-0x0000000001166000-memory.dmp

                                                          Filesize

                                                          4.7MB

                                                        • memory/3032-2475-0x0000000000CB0000-0x0000000001166000-memory.dmp

                                                          Filesize

                                                          4.7MB

                                                        • memory/3032-2474-0x0000000000CB0000-0x0000000001166000-memory.dmp

                                                          Filesize

                                                          4.7MB

                                                        • memory/3032-503-0x0000000000CB0000-0x0000000001166000-memory.dmp

                                                          Filesize

                                                          4.7MB

                                                        • memory/3032-1582-0x0000000000CB0000-0x0000000001166000-memory.dmp

                                                          Filesize

                                                          4.7MB

                                                        • memory/3032-2392-0x0000000000CB0000-0x0000000001166000-memory.dmp

                                                          Filesize

                                                          4.7MB

                                                        • memory/3032-375-0x0000000000CB0000-0x0000000001166000-memory.dmp

                                                          Filesize

                                                          4.7MB

                                                        • memory/3032-369-0x0000000000CB0000-0x0000000001166000-memory.dmp

                                                          Filesize

                                                          4.7MB

                                                        • memory/3032-2412-0x0000000000CB0000-0x0000000001166000-memory.dmp

                                                          Filesize

                                                          4.7MB

                                                        • memory/3032-299-0x0000000000CB0000-0x0000000001166000-memory.dmp

                                                          Filesize

                                                          4.7MB

                                                        • memory/3032-93-0x0000000000CB0000-0x0000000001166000-memory.dmp

                                                          Filesize

                                                          4.7MB

                                                        • memory/3148-1-0x000000007EAE0000-0x000000007EEB1000-memory.dmp

                                                          Filesize

                                                          3.8MB

                                                        • memory/3148-3-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                                                          Filesize

                                                          972KB

                                                        • memory/3148-0-0x0000000000940000-0x0000000001528000-memory.dmp

                                                          Filesize

                                                          11.9MB

                                                        • memory/3148-77-0x000000007EAE0000-0x000000007EEB1000-memory.dmp

                                                          Filesize

                                                          3.8MB

                                                        • memory/3148-76-0x0000000000940000-0x0000000001528000-memory.dmp

                                                          Filesize

                                                          11.9MB

                                                        • memory/4600-81-0x0000000000880000-0x0000000000D36000-memory.dmp

                                                          Filesize

                                                          4.7MB

                                                        • memory/4600-94-0x0000000000880000-0x0000000000D36000-memory.dmp

                                                          Filesize

                                                          4.7MB

                                                        • memory/6700-2478-0x0000000000CB0000-0x0000000001166000-memory.dmp

                                                          Filesize

                                                          4.7MB

                                                        • memory/6700-2479-0x0000000000CB0000-0x0000000001166000-memory.dmp

                                                          Filesize

                                                          4.7MB