Analysis

  • max time kernel
    110s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240704-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-07-2024 01:56

General

  • Target

    9e12b808314ab31153be5ca2472dde413e0f3d8c0fdb038261397d7a4881b739.exe

  • Size

    2.4MB

  • MD5

    286e26bd1701fc3054707a64e052edf3

  • SHA1

    0f655ee5b95b7325517892f6f08a6ace4766000d

  • SHA256

    9e12b808314ab31153be5ca2472dde413e0f3d8c0fdb038261397d7a4881b739

  • SHA512

    3e3854d2ba26fa1c83f23597d8c2d6856f333a05cfb9cb5def62c9cba7eeee8568acae472382d7b35d3ba8b4528e2bc6e9697ee2b90da7986eb9b5b2efd00ae1

  • SSDEEP

    49152:tDpIhkMDWttqvSka/ZutDupLNFFRB07VO4UyHKybP5kpTLqUQK0qW7IMZ6T:pCK3qqV49ubgO4mppnHi7ILT

Malware Config

Extracted

Family

stealc

Botnet

hate

C2

http://85.28.47.30

Attributes
  • url_path

    /920475a59bac849d.php

Extracted

Family

amadey

Version

4.30

Botnet

4dd39d

C2

http://77.91.77.82

Attributes
  • install_dir

    ad40971b6b

  • install_file

    explorti.exe

  • strings_key

    a434973ad22def7137dbb5e059b7081e

  • url_paths

    /Hun4Ko/index.php

rc4.plain

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Stealc

    Stealc is an infostealer written in C++.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 8 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Identifies Wine through registry keys 2 TTPs 4 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 2 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 28 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 39 IoCs
  • Suspicious use of SendNotifyMessage 35 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\9e12b808314ab31153be5ca2472dde413e0f3d8c0fdb038261397d7a4881b739.exe
    "C:\Users\Admin\AppData\Local\Temp\9e12b808314ab31153be5ca2472dde413e0f3d8c0fdb038261397d7a4881b739.exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3676
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\GCFBAKKJDB.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:644
      • C:\Users\Admin\AppData\Local\Temp\GCFBAKKJDB.exe
        "C:\Users\Admin\AppData\Local\Temp\GCFBAKKJDB.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Checks computer location settings
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:4064
        • C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
          "C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe"
          4⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Checks computer location settings
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:4200
          • C:\Users\Admin\AppData\Local\Temp\1000006001\14b1cafa71.exe
            "C:\Users\Admin\AppData\Local\Temp\1000006001\14b1cafa71.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious use of SetWindowsHookEx
            PID:4996
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\1000008021\8da7683bce.cmd" "
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:2552
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.youtube.com/account"
              6⤵
              • Enumerates system info in registry
              • Modifies data under HKEY_USERS
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              • Suspicious use of WriteProcessMemory
              PID:3048
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ffb280bab58,0x7ffb280bab68,0x7ffb280bab78
                7⤵
                  PID:3532
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1600 --field-trial-handle=1928,i,151686041148076215,15157109370027734528,131072 /prefetch:2
                  7⤵
                    PID:3192
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=1928,i,151686041148076215,15157109370027734528,131072 /prefetch:8
                    7⤵
                      PID:1132
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2252 --field-trial-handle=1928,i,151686041148076215,15157109370027734528,131072 /prefetch:8
                      7⤵
                        PID:4500
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3084 --field-trial-handle=1928,i,151686041148076215,15157109370027734528,131072 /prefetch:1
                        7⤵
                          PID:2836
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3116 --field-trial-handle=1928,i,151686041148076215,15157109370027734528,131072 /prefetch:1
                          7⤵
                            PID:4612
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3608 --field-trial-handle=1928,i,151686041148076215,15157109370027734528,131072 /prefetch:1
                            7⤵
                              PID:5932
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4172 --field-trial-handle=1928,i,151686041148076215,15157109370027734528,131072 /prefetch:8
                              7⤵
                                PID:5412
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4060 --field-trial-handle=1928,i,151686041148076215,15157109370027734528,131072 /prefetch:8
                                7⤵
                                  PID:6448
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4768 --field-trial-handle=1928,i,151686041148076215,15157109370027734528,131072 /prefetch:8
                                  7⤵
                                    PID:6616
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/account"
                                  6⤵
                                    PID:3188
                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                    "C:\Program Files\Mozilla Firefox\firefox.exe" "https://www.youtube.com/account"
                                    6⤵
                                    • Suspicious use of WriteProcessMemory
                                    PID:336
                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                      "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
                                      7⤵
                                      • Checks processor information in registry
                                      • Modifies registry class
                                      • Suspicious use of AdjustPrivilegeToken
                                      • Suspicious use of FindShellTrayWindow
                                      • Suspicious use of SendNotifyMessage
                                      • Suspicious use of SetWindowsHookEx
                                      PID:1360
                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1360.0.1657285040\1689669446" -parentBuildID 20230214051806 -prefsHandle 1708 -prefMapHandle 1700 -prefsLen 22076 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {16f88314-29db-4bc1-93d8-2887e9b1f07c} 1360 "\\.\pipe\gecko-crash-server-pipe.1360" 1800 17967e24958 gpu
                                        8⤵
                                          PID:1372
                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1360.1.530400764\418759449" -parentBuildID 20230214051806 -prefsHandle 2264 -prefMapHandle 2256 -prefsLen 22927 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0185e6d7-8e7d-45d4-8cca-674e7c584406} 1360 "\\.\pipe\gecko-crash-server-pipe.1360" 2408 1795b18a258 socket
                                          8⤵
                                            PID:4308
                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1360.2.44032436\579875868" -childID 1 -isForBrowser -prefsHandle 2892 -prefMapHandle 3088 -prefsLen 22965 -prefMapSize 235121 -jsInitHandle 1256 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {94074c44-c3dd-4b69-937f-3d66c60ffe0f} 1360 "\\.\pipe\gecko-crash-server-pipe.1360" 3172 17966d95358 tab
                                            8⤵
                                              PID:5496
                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1360.3.1950862715\1007176283" -childID 2 -isForBrowser -prefsHandle 3824 -prefMapHandle 3820 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1256 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0d1ced4e-26b3-401d-af74-5a1360f63880} 1360 "\\.\pipe\gecko-crash-server-pipe.1360" 3836 1795b13fa58 tab
                                              8⤵
                                                PID:6084
                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1360.4.901333548\427901254" -childID 3 -isForBrowser -prefsHandle 5212 -prefMapHandle 5228 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 1256 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b565c22e-6d79-4e5d-9bc1-b7f3b201ebf1} 1360 "\\.\pipe\gecko-crash-server-pipe.1360" 5244 179683add58 tab
                                                8⤵
                                                  PID:2856
                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1360.5.1099517516\538427646" -childID 4 -isForBrowser -prefsHandle 5384 -prefMapHandle 5388 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 1256 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fff6b2e1-8213-4668-a80d-3275d025a356} 1360 "\\.\pipe\gecko-crash-server-pipe.1360" 5376 1796c0fc158 tab
                                                  8⤵
                                                    PID:3496
                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1360.6.649804443\265773355" -childID 5 -isForBrowser -prefsHandle 5592 -prefMapHandle 5596 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 1256 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8b9eff4c-092e-4663-978e-ee625d589850} 1360 "\\.\pipe\gecko-crash-server-pipe.1360" 5464 1796c0fd058 tab
                                                    8⤵
                                                      PID:6108
                                        • C:\Windows\SysWOW64\cmd.exe
                                          "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\HCGCAAKJDH.exe"
                                          2⤵
                                          • Checks computer location settings
                                          • Suspicious use of SetWindowsHookEx
                                          PID:3948
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4152,i,13036770025638384416,811858527135662588,262144 --variations-seed-version --mojo-platform-channel-handle=2896 /prefetch:8
                                        1⤵
                                          PID:2212
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --field-trial-handle=3036,i,13036770025638384416,811858527135662588,262144 --variations-seed-version --mojo-platform-channel-handle=3052 /prefetch:3
                                          1⤵
                                            PID:3360
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --field-trial-handle=5016,i,13036770025638384416,811858527135662588,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:1
                                            1⤵
                                              PID:4548
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --field-trial-handle=5032,i,13036770025638384416,811858527135662588,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:1
                                              1⤵
                                                PID:804
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --field-trial-handle=5168,i,13036770025638384416,811858527135662588,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:1
                                                1⤵
                                                  PID:5040
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --field-trial-handle=5684,i,13036770025638384416,811858527135662588,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:8
                                                  1⤵
                                                    PID:672
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --field-trial-handle=6076,i,13036770025638384416,811858527135662588,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:1
                                                    1⤵
                                                      PID:3100
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=6260,i,13036770025638384416,811858527135662588,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:8
                                                      1⤵
                                                        PID:4328
                                                      • C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
                                                        C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
                                                        1⤵
                                                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                        • Checks BIOS information in registry
                                                        • Executes dropped EXE
                                                        • Identifies Wine through registry keys
                                                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        PID:5200
                                                      • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
                                                        "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
                                                        1⤵
                                                          PID:5352
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=6556,i,13036770025638384416,811858527135662588,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:8
                                                          1⤵
                                                            PID:6292
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --field-trial-handle=4036,i,13036770025638384416,811858527135662588,262144 --variations-seed-version --mojo-platform-channel-handle=1020 /prefetch:8
                                                            1⤵
                                                              PID:6164
                                                            • C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
                                                              C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
                                                              1⤵
                                                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                              • Checks BIOS information in registry
                                                              • Executes dropped EXE
                                                              • Identifies Wine through registry keys
                                                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              PID:6600
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4252,i,13036770025638384416,811858527135662588,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:8
                                                              1⤵
                                                                PID:7132

                                                              Network

                                                              MITRE ATT&CK Enterprise v15

                                                              Replay Monitor

                                                              Loading Replay Monitor...

                                                              Downloads

                                                              • C:\ProgramData\mozglue.dll

                                                                Filesize

                                                                593KB

                                                                MD5

                                                                c8fd9be83bc728cc04beffafc2907fe9

                                                                SHA1

                                                                95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                                                                SHA256

                                                                ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                                                                SHA512

                                                                fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                                                              • C:\ProgramData\nss3.dll

                                                                Filesize

                                                                2.0MB

                                                                MD5

                                                                1cc453cdf74f31e4d913ff9c10acdde2

                                                                SHA1

                                                                6e85eae544d6e965f15fa5c39700fa7202f3aafe

                                                                SHA256

                                                                ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                                                                SHA512

                                                                dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000004

                                                                Filesize

                                                                33KB

                                                                MD5

                                                                1c0c8433626cac08202f23a1dae54325

                                                                SHA1

                                                                3a5700eeeacd9f9d6b17c2707f75f29308658cd3

                                                                SHA256

                                                                7aad4c7a174a145a4f9f11506145b521631ee2cb1ca2f7617b900ba515b31cd3

                                                                SHA512

                                                                da693d1d63c9971cb80792063f0e8d3335edb67ee1dcde4040d0dc8f44398f99d9f683eaab8cf44ebf5cdb78eae6672d43fd9ed9b45a526a80a311d8c77bcc8c

                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000005

                                                                Filesize

                                                                36KB

                                                                MD5

                                                                103d7813f0ccc7445b4b9a4b34fc74bf

                                                                SHA1

                                                                ed862e8ebd885acde6115c340e59e50e74e3633b

                                                                SHA256

                                                                0ccaf58bb2aa430724873fa21515e5f3fbd875390288aade3823ec16962bc27b

                                                                SHA512

                                                                0723baca97705968a068676f74ac01bd492dac94a4fba391de578b6357b79c4aca5412f564dc0ea7ae5b6145256c7f8f22e8a4823f41e2baf50d201ec073be1f

                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                Filesize

                                                                216B

                                                                MD5

                                                                f54abad67c7068dbc82db8041e761fd7

                                                                SHA1

                                                                807b79794b51eea1bec4e6d1eda53f32e890fb9e

                                                                SHA256

                                                                d3724199b03f756ac0e6cb79a6a01ab6153ae77bb81959458d2bbae5b25b51ed

                                                                SHA512

                                                                475d7096e3b75f38047d2b5ed87b5cb27ca32d0ebbe206250b37064157c88cb1c72493d63969cf097ae7356052ae0265aeed31366f14e17be249a3b9b5f42915

                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                Filesize

                                                                72B

                                                                MD5

                                                                a774e9aa425e4e200a6852835feb5849

                                                                SHA1

                                                                44af7f7e69829238997b96fc4d1c6fd3ff09c576

                                                                SHA256

                                                                0b7b6cec933d93b2907bebb519ee36f2ad3448a0e680a92abe67db7fb7a5474e

                                                                SHA512

                                                                411e70712d6f58905b8aabfb168773ff4beb3174aff2d003583a67867f8e3daaca6c24eec0ac4f0f150cfe1b62e3d10a429baf7e5e93a0aab016cd8cd150726e

                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                                                Filesize

                                                                1KB

                                                                MD5

                                                                192f435622181b02e8b68f37019f9e62

                                                                SHA1

                                                                3fbc0c5717a7ca250e377423f3ed8f78199cf52e

                                                                SHA256

                                                                2fd7d238c707fae51e3a49f8ee26c936f8bc37e816cb5144ca76ae3370c233e7

                                                                SHA512

                                                                7d3b7f2057c12279eb161c293e00719d42509b3be922b7f02e71700637c8e2aed69d74ecb7aea2c20c6d7bd05adb5192ba7c67c774aa7a1df5ed934c3255a963

                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                                                Filesize

                                                                1KB

                                                                MD5

                                                                62451d0c1010b7fb9970848dbb748368

                                                                SHA1

                                                                0fda737c8b2a92d72d3359742bad7eb01b6bcb66

                                                                SHA256

                                                                1324349419be4d25053c9500ded44bdad4dc40b6bcabbb6bde95a549f238b836

                                                                SHA512

                                                                cecaf364939e40bdd02c65371c6f73ed11a3ff53608026f001a8565472dd3103d8487d85d52059973d1d8afac834245f1f5424eccc69ccb15cae9e560bfb6273

                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                                                Filesize

                                                                2KB

                                                                MD5

                                                                5da57d7701f27d451455116058266e8b

                                                                SHA1

                                                                32d185938295928e3634aeefeff16ce866043516

                                                                SHA256

                                                                23824a7e272736647181dada7f4021420c0cf0ae470052ca348f9fa61ae8cd1d

                                                                SHA512

                                                                cc41211b917377b4ab4d58b540f2771e1e4b605502c1e0e25874d5b0c673231e8f57cdac9fa322414a9b28fc4ab0a9751a5272e751991c6ca8bc83e89ce7fb7b

                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                Filesize

                                                                690B

                                                                MD5

                                                                ccee7107f6f2ad39b9bffaa05ed5c6fc

                                                                SHA1

                                                                46316f65670b1221dc5cca7a080c3908aae69d5b

                                                                SHA256

                                                                4dcc96f1db548c38f15623eb983d51415a0f67758e644d482172c707d8aa0820

                                                                SHA512

                                                                8790188d0ae65766643af3eee8e2d3ef44a4d2072e677915dc4b4c59dbe274d0be677313a320e6e4fd44b81c94e8b6d3077e4231a7b93159f5601f982d658afd

                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                Filesize

                                                                7KB

                                                                MD5

                                                                3c3bfe1686e03382a325502ef89ef954

                                                                SHA1

                                                                71d25b3aacd43041a852afd12c55128d81a696e1

                                                                SHA256

                                                                a2e1c068986a31561c569b0910d7cd7338eb2aebbb74820dc77dbd76443794be

                                                                SHA512

                                                                2ae1d494f3a315527565b665830d52b0460a1af8a4289d0a560bb42f90662932d825d6cee0395da22a679c0f963ac639a0f7baa6321b0fab46da63a6bf6c99db

                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                                                                Filesize

                                                                16KB

                                                                MD5

                                                                00cdca2857f111f4d13c35db9bfc5bb9

                                                                SHA1

                                                                1fd97a201b860eaeb202dd3dad466e41f105fdf8

                                                                SHA256

                                                                4379fe8fa1d76306fc6b52b4c598fc09d85da70861704a0a295be54db153e441

                                                                SHA512

                                                                eb70b741e864e8d7acd657e3d0bc10a347b3ecb660c31c3000f02aabfeebf06bbfeced676c52c17d802b20bd8442b2c6d59bc8569f0fc0f66a6cd6c648fa1387

                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                                Filesize

                                                                144KB

                                                                MD5

                                                                43610c7024af96417dd147d9de2f6500

                                                                SHA1

                                                                a7bd4d74f5543a5fe9cca996eae1420fd3829073

                                                                SHA256

                                                                e8f89fb6aca9561b2b526e8ab11d8fb2ef807f7de52c9c8d325ddcf2ac8b2c29

                                                                SHA512

                                                                23a401bafbe2d5449d4147207e56cadbf735f9ec306e3a38738c1520e7dd7047811717821bb7b9ddf6a1e5c8ef5d3ca43aca83f98d767f7b3073f26d1511a263

                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                                Filesize

                                                                285KB

                                                                MD5

                                                                564b87aded1b849d8a30586bdfbaef01

                                                                SHA1

                                                                8e0004a61182e767a18cba728684e10b64a43f3b

                                                                SHA256

                                                                e5a10d9ac95365d69d6d767b1bb164be45cc05c2ff8ac25a1abe6a3de1d4d56e

                                                                SHA512

                                                                3aef6f92ec97e77d831c5f59e7a65c173392140e1e9a2cd2a62e60c7ff35a8ccdcb7d69d5ad7f16f5c9b4cab39db7753fe301243347ad5d22fd3af9030051de7

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

                                                                Filesize

                                                                3KB

                                                                MD5

                                                                a14d77ec63f14443700e787729587b35

                                                                SHA1

                                                                827bf31a8947cfa2331f6107eba3952fe965e9ac

                                                                SHA256

                                                                75b5e30b57a5d11bc6addf5f8bfb1fde60093ad4f90a3fa5f43d43df6b34037e

                                                                SHA512

                                                                9494756d2f8addba5e14b643c1c39dcdb13930f998cc78a4b1c5a18f68c81c2c5c68ea7bd14fb8bc5efbc9899f31fbf1de4ac33f1b020eebb2bf1e5bbd172c7f

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

                                                                Filesize

                                                                2B

                                                                MD5

                                                                d751713988987e9331980363e24189ce

                                                                SHA1

                                                                97d170e1550eee4afc0af065b78cda302a97674c

                                                                SHA256

                                                                4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                                                SHA512

                                                                b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

                                                                Filesize

                                                                40B

                                                                MD5

                                                                20d4b8fa017a12a108c87f540836e250

                                                                SHA1

                                                                1ac617fac131262b6d3ce1f52f5907e31d5f6f00

                                                                SHA256

                                                                6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

                                                                SHA512

                                                                507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity

                                                                Filesize

                                                                1014B

                                                                MD5

                                                                ece4a2c2e5ffb0d8b00e79caa43e8222

                                                                SHA1

                                                                2da8d466d1e19616805d8732a809f693bdf6b939

                                                                SHA256

                                                                4f9c9520790047e4fb41acdf1c06b9b91bdb042db3d7bdaf75641f32adeae261

                                                                SHA512

                                                                f48ebe301de372cd3978a82452accc68705811e9d3004fc785e285ce2687f956be63cbcf8907701c6fc5bcdc0fe1395cef0a80dae8874d856ed76a49751db289

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity

                                                                Filesize

                                                                1014B

                                                                MD5

                                                                8568c9440db48cb03ced544406a529fd

                                                                SHA1

                                                                91ee9478d57b835fc45c63f2355d2423acc74d21

                                                                SHA256

                                                                f6d99ddb2254159be34f698f39c115778c0e12e63c73fe5f0f4ec31100daf732

                                                                SHA512

                                                                b0413d0f9598206338321a549a5f1468e8fe53f9b630f2ace459076f7bff575500cd42d1c048b27708d1bd5fc74ee88c10f99dd12c06fb7c20dab1c54d39d65f

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity

                                                                Filesize

                                                                1016B

                                                                MD5

                                                                f3fedd0f565e4c58e06f6de8332ce80f

                                                                SHA1

                                                                737256c7bc499d4689c310c9343cc34a435ca20d

                                                                SHA256

                                                                1bd37b905a90a50a7e7e974bc0cd6080b7ac244b3b7fdbef4ceb4aa8c5814551

                                                                SHA512

                                                                38eec2595983d40c98d290383b8447b60e28713f7b9ec0e328a420d0967c8b1869ad459570fb584c3ffbc7c4f2dc42d06abe9c1f9d1a46d5be1e7d68a8490678

                                                              • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bgt81dxj.default-release\activity-stream.discovery_stream.json.tmp

                                                                Filesize

                                                                26KB

                                                                MD5

                                                                5e9d19ee840d5dfda793ca342fff369e

                                                                SHA1

                                                                609dee9c30178a739177f3992009866127f9078c

                                                                SHA256

                                                                6082aa6b3fc205f72072fb8d607d31b1562a95dc1330eb28f3e1bafd5d2d4b96

                                                                SHA512

                                                                369d081a884b2322980838fd67eea51b6a8d5fd325fe2acb1bb373d11ca4bfc1a8b059a0659d60e54cfe4e5a40cce9de8f6e6fc768bcd98372174bf68ce757e4

                                                              • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bgt81dxj.default-release\cache2\doomed\30975

                                                                Filesize

                                                                9KB

                                                                MD5

                                                                98fb18a4feca6f39713bf69a193f6804

                                                                SHA1

                                                                45cfbfc84b71c1176bfa519113ced54a9d0539a9

                                                                SHA256

                                                                f3a2a36b178f9c4d277449fcb6c85a4d7fe95abc34e0336c5b376b55c3cb636f

                                                                SHA512

                                                                f14a755c5b996e008fd9fae0ad19b491654356e6069bd681f0e70f2018b14b35c9ee11539a81e7e53cd26eed5846760964a172052ddcf2e3738ad0ba2ef6aedb

                                                              • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bgt81dxj.default-release\cache2\entries\5CD1EBDF6B57F13C7E783CE5E6D8E9C44014FE1A

                                                                Filesize

                                                                13KB

                                                                MD5

                                                                4c50552e1856e1eea8a42acbea3dc64c

                                                                SHA1

                                                                1f7e43fcb21a438d85f5491a3db812579ee13aea

                                                                SHA256

                                                                894f18384f412e4ba0ad876f2a69be7c6099561656330fa0806819ceedef1217

                                                                SHA512

                                                                94ccffb7c4ce03ca5f23ab3e4ed9b2f44f1593dbad0eee08eb17cdd0987d0b93803bc2f0e00dd775be08bf447f155cbb62ecba23431ad98d0f8e467977c0a442

                                                              • C:\Users\Admin\AppData\Local\Temp\1000006001\14b1cafa71.exe

                                                                Filesize

                                                                2.4MB

                                                                MD5

                                                                e6a54ac6b35b2def5a7d9b9699388f26

                                                                SHA1

                                                                5f8a57b2e8902523bbafc50434f3692fe1d92b74

                                                                SHA256

                                                                25d515f52e58c10727895f1ee1a269998e37d3b4308e6ac6f1419186c30290a9

                                                                SHA512

                                                                8cdfb2da836614148507585645613432f7dd802ac8c80b89a4b302c9dfbbc9a96decd4a2df6468843ccfebd479968058d7f184e67026cf6b1d8dd474634c87c4

                                                              • C:\Users\Admin\AppData\Local\Temp\1000008021\8da7683bce.cmd

                                                                Filesize

                                                                2KB

                                                                MD5

                                                                c1b73be75c9a5348a3e36e9ec2993f58

                                                                SHA1

                                                                84b8badeca9fa527ae6b79f3e5920e9fd0fbd906

                                                                SHA256

                                                                a75e65563e853c9fb8863bcf7c2103ec23893f31a42b9332042ea3f5f2d40ea0

                                                                SHA512

                                                                fe6d1df55358ba710c25e0e6b189beca8ce991d65a0fcecefdecacd2b96e0802ea549157c1449d2853f0ab37b8e865ec70e51772d2deefe8238d7581c81bc4a3

                                                              • C:\Users\Admin\AppData\Local\Temp\GCFBAKKJDB.exe

                                                                Filesize

                                                                1.8MB

                                                                MD5

                                                                c21e9030716bbf545c1a6aed23780cb9

                                                                SHA1

                                                                7e870d396ba3c4e05a942f1d5834e8ef0e102ef1

                                                                SHA256

                                                                ad19679fc29e8a399dbb3d9f80d5cd9284d22140b05ac66e501b2e6c1596e4ee

                                                                SHA512

                                                                f40f08872ed7add791b3c8f5b5d09e670b131e64eaa837b77ceaa198c4fbd3b1ac843cd7744fd29eebc654c730560a07840ae5dd333d1ffd591d6524a96500bc

                                                              • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                                                                Filesize

                                                                442KB

                                                                MD5

                                                                85430baed3398695717b0263807cf97c

                                                                SHA1

                                                                fffbee923cea216f50fce5d54219a188a5100f41

                                                                SHA256

                                                                a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

                                                                SHA512

                                                                06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

                                                              • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                                                                Filesize

                                                                8.0MB

                                                                MD5

                                                                a01c5ecd6108350ae23d2cddf0e77c17

                                                                SHA1

                                                                c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

                                                                SHA256

                                                                345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

                                                                SHA512

                                                                b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bgt81dxj.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

                                                                Filesize

                                                                997KB

                                                                MD5

                                                                fe3355639648c417e8307c6d051e3e37

                                                                SHA1

                                                                f54602d4b4778da21bc97c7238fc66aa68c8ee34

                                                                SHA256

                                                                1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

                                                                SHA512

                                                                8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bgt81dxj.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

                                                                Filesize

                                                                116B

                                                                MD5

                                                                3d33cdc0b3d281e67dd52e14435dd04f

                                                                SHA1

                                                                4db88689282fd4f9e9e6ab95fcbb23df6e6485db

                                                                SHA256

                                                                f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

                                                                SHA512

                                                                a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bgt81dxj.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

                                                                Filesize

                                                                479B

                                                                MD5

                                                                49ddb419d96dceb9069018535fb2e2fc

                                                                SHA1

                                                                62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

                                                                SHA256

                                                                2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

                                                                SHA512

                                                                48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bgt81dxj.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

                                                                Filesize

                                                                372B

                                                                MD5

                                                                8be33af717bb1b67fbd61c3f4b807e9e

                                                                SHA1

                                                                7cf17656d174d951957ff36810e874a134dd49e0

                                                                SHA256

                                                                e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

                                                                SHA512

                                                                6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bgt81dxj.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

                                                                Filesize

                                                                11.8MB

                                                                MD5

                                                                33bf7b0439480effb9fb212efce87b13

                                                                SHA1

                                                                cee50f2745edc6dc291887b6075ca64d716f495a

                                                                SHA256

                                                                8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

                                                                SHA512

                                                                d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bgt81dxj.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

                                                                Filesize

                                                                1KB

                                                                MD5

                                                                688bed3676d2104e7f17ae1cd2c59404

                                                                SHA1

                                                                952b2cdf783ac72fcb98338723e9afd38d47ad8e

                                                                SHA256

                                                                33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

                                                                SHA512

                                                                7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bgt81dxj.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

                                                                Filesize

                                                                1KB

                                                                MD5

                                                                937326fead5fd401f6cca9118bd9ade9

                                                                SHA1

                                                                4526a57d4ae14ed29b37632c72aef3c408189d91

                                                                SHA256

                                                                68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

                                                                SHA512

                                                                b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bgt81dxj.default-release\prefs-1.js

                                                                Filesize

                                                                7KB

                                                                MD5

                                                                8c5ddcc06d14074f3a5be69ae80e90a8

                                                                SHA1

                                                                9df24edf3d65c31f403030838089e2aefd71ea80

                                                                SHA256

                                                                6ae3db14a076c5949b50384037593f7add6691e3970fec485e5a49ddeb951471

                                                                SHA512

                                                                ef0a36729056df7312a89bd3c8b80c493a8dbe448feba4422fb27903db546a160152266ed7878ae4921d8f926a7f50e8c666f6177d3245d4a776f66fb284e7a9

                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bgt81dxj.default-release\prefs.js

                                                                Filesize

                                                                6KB

                                                                MD5

                                                                0f0006b617aac2689f928cdb5c54c910

                                                                SHA1

                                                                b0f6afe121bdff001505fcd41b8c97ab8301d2f9

                                                                SHA256

                                                                d15b1e5e9621b1f6509b1338c9de4a8c1cc589c5b98b7fc5f028caffdf5be3b8

                                                                SHA512

                                                                4ef7fb274f3d3623de7516a57a67ebe4c329ecceb0dbc4052283de451a754bd0a50950680f8246e7f81773659c4392d349f655b07f613150174d306016fbb354

                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bgt81dxj.default-release\prefs.js

                                                                Filesize

                                                                6KB

                                                                MD5

                                                                7af20c9deb82e89c0145ba478e760925

                                                                SHA1

                                                                b31bb1d1781eb54d54a166f5683386414892c4f7

                                                                SHA256

                                                                1aff24aae431ae07a6283433b3e76a0506f0b8af7c0741dc670543c28420e99c

                                                                SHA512

                                                                74bbf006199e21af64ba10d3f37e1edb6150e7d7bf899349c3d0aada0fb2f939c0b7b00b8022fd8e07da554e5c662d81fc7df42311e52a9d78c8a3f89fc2cdf7

                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bgt81dxj.default-release\sessionstore-backups\recovery.jsonlz4

                                                                Filesize

                                                                4KB

                                                                MD5

                                                                49a7cf7eb90e69d46a7dbf2fdcec32a4

                                                                SHA1

                                                                79b290994a479dc18a627996421d0ddfc42366c9

                                                                SHA256

                                                                99af4401de3330daa28e4eb9290f9db0e6437a5a0869e3abb70eeaed34bbad9d

                                                                SHA512

                                                                021806234936e5256991f3b68eef196e3137b9e2a4678d19046354025d8f602d64a7b00684dd7bf7c722a37adcebdf7ebe09a45364ae7edc0c9b0e9e8b8e3369

                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bgt81dxj.default-release\sessionstore-backups\recovery.jsonlz4

                                                                Filesize

                                                                4KB

                                                                MD5

                                                                5a9b375704e971a2fd4c6f388ad9e7f6

                                                                SHA1

                                                                aa1669157dd88f5dea539bbaeb1d068492b90367

                                                                SHA256

                                                                0ee7acbb2eeaa00385bf257989655740d48ebee39c16b5825cc72cdb62ff4918

                                                                SHA512

                                                                b92bc2e7acd65093680aefcb305e7ea1ea2c9b21713a0dadd6ae9267e171584b36810c94aec675e93e493931559e3243c839bb4d87c33ac97f5d1a1ee924d2c4

                                                              • \??\pipe\crashpad_3048_GSJQXHOVZUGUMLAD

                                                                MD5

                                                                d41d8cd98f00b204e9800998ecf8427e

                                                                SHA1

                                                                da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                SHA256

                                                                e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                SHA512

                                                                cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                              • memory/3676-2-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                                                                Filesize

                                                                972KB

                                                              • memory/3676-1-0x000000007F810000-0x000000007FBE1000-memory.dmp

                                                                Filesize

                                                                3.8MB

                                                              • memory/3676-38-0x0000000000EE0000-0x0000000001AD5000-memory.dmp

                                                                Filesize

                                                                12.0MB

                                                              • memory/3676-83-0x0000000000EE0000-0x0000000001AD5000-memory.dmp

                                                                Filesize

                                                                12.0MB

                                                              • memory/3676-84-0x000000007F810000-0x000000007FBE1000-memory.dmp

                                                                Filesize

                                                                3.8MB

                                                              • memory/3676-0-0x0000000000EE0000-0x0000000001AD5000-memory.dmp

                                                                Filesize

                                                                12.0MB

                                                              • memory/4064-106-0x0000000000DD0000-0x0000000001286000-memory.dmp

                                                                Filesize

                                                                4.7MB

                                                              • memory/4064-88-0x0000000000DD0000-0x0000000001286000-memory.dmp

                                                                Filesize

                                                                4.7MB

                                                              • memory/4200-105-0x0000000000480000-0x0000000000936000-memory.dmp

                                                                Filesize

                                                                4.7MB

                                                              • memory/4200-2279-0x0000000000480000-0x0000000000936000-memory.dmp

                                                                Filesize

                                                                4.7MB

                                                              • memory/4200-1078-0x0000000000480000-0x0000000000936000-memory.dmp

                                                                Filesize

                                                                4.7MB

                                                              • memory/4200-367-0x0000000000480000-0x0000000000936000-memory.dmp

                                                                Filesize

                                                                4.7MB

                                                              • memory/4200-165-0x0000000000480000-0x0000000000936000-memory.dmp

                                                                Filesize

                                                                4.7MB

                                                              • memory/4200-681-0x0000000000480000-0x0000000000936000-memory.dmp

                                                                Filesize

                                                                4.7MB

                                                              • memory/4200-2592-0x0000000000480000-0x0000000000936000-memory.dmp

                                                                Filesize

                                                                4.7MB

                                                              • memory/4200-762-0x0000000000480000-0x0000000000936000-memory.dmp

                                                                Filesize

                                                                4.7MB

                                                              • memory/4200-2596-0x0000000000480000-0x0000000000936000-memory.dmp

                                                                Filesize

                                                                4.7MB

                                                              • memory/4200-1780-0x0000000000480000-0x0000000000936000-memory.dmp

                                                                Filesize

                                                                4.7MB

                                                              • memory/4200-449-0x0000000000480000-0x0000000000936000-memory.dmp

                                                                Filesize

                                                                4.7MB

                                                              • memory/4200-366-0x0000000000480000-0x0000000000936000-memory.dmp

                                                                Filesize

                                                                4.7MB

                                                              • memory/4996-148-0x00000000004B0000-0x00000000010AD000-memory.dmp

                                                                Filesize

                                                                12.0MB

                                                              • memory/4996-122-0x00000000004B0000-0x00000000010AD000-memory.dmp

                                                                Filesize

                                                                12.0MB

                                                              • memory/5200-166-0x0000000000480000-0x0000000000936000-memory.dmp

                                                                Filesize

                                                                4.7MB

                                                              • memory/5200-178-0x0000000000480000-0x0000000000936000-memory.dmp

                                                                Filesize

                                                                4.7MB

                                                              • memory/6600-956-0x0000000000480000-0x0000000000936000-memory.dmp

                                                                Filesize

                                                                4.7MB

                                                              • memory/6600-902-0x0000000000480000-0x0000000000936000-memory.dmp

                                                                Filesize

                                                                4.7MB