Analysis Overview
SHA256
16c4e552b6fc325bd01db07c4f1165883e13522c3832c494bea381006e737310
Threat Level: Known bad
The file 16c4e552b6fc325bd01db07c4f1165883e13522c3832c494bea381006e737310 was found to be: Known bad.
Malicious Activity Summary
Amadey
Stealc
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Downloads MZ/PE file
Executes dropped EXE
Checks BIOS information in registry
Identifies Wine through registry keys
Reads data files stored by FTP clients
Checks computer location settings
Loads dropped DLL
Reads user/profile data of web browsers
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Suspicious use of NtSetInformationThreadHideFromDebugger
Drops file in Windows directory
Enumerates physical storage devices
Unsigned PE
Suspicious behavior: EnumeratesProcesses
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Enumerates system info in registry
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Checks processor information in registry
Modifies registry class
Uses Task Scheduler COM API
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-07-09 13:03
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral2
Detonation Overview
Submitted
2024-07-09 13:03
Reported
2024-07-09 13:06
Platform
win11-20240704-en
Max time kernel
149s
Max time network
151s
Command Line
Signatures
Amadey
Stealc
Identifies VirtualBox via ACPI registry values (likely anti-VM)
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ | C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe | N/A |
| Key opened | \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ | C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe | N/A |
| Key opened | \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ | C:\Users\Admin\AppData\Local\Temp\16c4e552b6fc325bd01db07c4f1165883e13522c3832c494bea381006e737310.exe | N/A |
| Key opened | \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ | C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe | N/A |
| Key opened | \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ | C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe | N/A |
| Key opened | \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ | C:\Users\Admin\AppData\Local\Temp\KKFCFBKFCF.exe | N/A |
Downloads MZ/PE file
Checks BIOS information in registry
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion | C:\Users\Admin\AppData\Local\Temp\16c4e552b6fc325bd01db07c4f1165883e13522c3832c494bea381006e737310.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion | C:\Users\Admin\AppData\Local\Temp\16c4e552b6fc325bd01db07c4f1165883e13522c3832c494bea381006e737310.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion | C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion | C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion | C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion | C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion | C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion | C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion | C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion | C:\Users\Admin\AppData\Local\Temp\KKFCFBKFCF.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion | C:\Users\Admin\AppData\Local\Temp\KKFCFBKFCF.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion | C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\1000006001\f17a6016fc.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\1000010001\c130df19d4.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\KKFCFBKFCF.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe | N/A |
Identifies Wine through registry keys
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000\Software\Wine | C:\Users\Admin\AppData\Local\Temp\16c4e552b6fc325bd01db07c4f1165883e13522c3832c494bea381006e737310.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000\Software\Wine | C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000\Software\Wine | C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000\Software\Wine | C:\Users\Admin\AppData\Local\Temp\KKFCFBKFCF.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000\Software\Wine | C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000\Software\Wine | C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\1000006001\f17a6016fc.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\1000006001\f17a6016fc.exe | N/A |
Reads data files stored by FTP clients
Reads user/profile data of web browsers
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Suspicious use of NtSetInformationThreadHideFromDebugger
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\16c4e552b6fc325bd01db07c4f1165883e13522c3832c494bea381006e737310.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\1000006001\f17a6016fc.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\1000006001\f17a6016fc.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\KKFCFBKFCF.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe | N/A |
Drops file in Windows directory
| Description | Indicator | Process | Target |
| File created | C:\Windows\Tasks\explorti.job | C:\Users\Admin\AppData\Local\Temp\16c4e552b6fc325bd01db07c4f1165883e13522c3832c494bea381006e737310.exe | N/A |
Enumerates physical storage devices
Checks processor information in registry
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier | C:\Program Files\Mozilla Firefox\firefox.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz | C:\Program Files\Mozilla Firefox\firefox.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString | C:\Program Files\Mozilla Firefox\firefox.exe | N/A |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 | C:\Users\Admin\AppData\Local\Temp\1000006001\f17a6016fc.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString | C:\Users\Admin\AppData\Local\Temp\1000006001\f17a6016fc.exe | N/A |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 | C:\Program Files\Mozilla Firefox\firefox.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature | C:\Program Files\Mozilla Firefox\firefox.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision | C:\Program Files\Mozilla Firefox\firefox.exe | N/A |
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000_Classes\Local Settings | C:\Program Files\Mozilla Firefox\firefox.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\1000006001\f17a6016fc.exe | N/A |
| N/A | N/A | C:\Program Files\Mozilla Firefox\firefox.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\cmd.exe | N/A |
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Processes
C:\Users\Admin\AppData\Local\Temp\16c4e552b6fc325bd01db07c4f1165883e13522c3832c494bea381006e737310.exe
"C:\Users\Admin\AppData\Local\Temp\16c4e552b6fc325bd01db07c4f1165883e13522c3832c494bea381006e737310.exe"
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
"C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe"
C:\Users\Admin\AppData\Local\Temp\1000006001\f17a6016fc.exe
"C:\Users\Admin\AppData\Local\Temp\1000006001\f17a6016fc.exe"
C:\Users\Admin\AppData\Local\Temp\1000010001\c130df19d4.exe
"C:\Users\Admin\AppData\Local\Temp\1000010001\c130df19d4.exe"
C:\Windows\system32\cmd.exe
"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\D15A.tmp\D15B.tmp\D15C.bat C:\Users\Admin\AppData\Local\Temp\1000010001\c130df19d4.exe"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.youtube.com/account"
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/account"
C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" "https://www.youtube.com/account"
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffdef8c3cb8,0x7ffdef8c3cc8,0x7ffdef8c3cd8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x10c,0x110,0x114,0xe8,0x118,0x7ffdef57ab58,0x7ffdef57ab68,0x7ffdef57ab78
C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1344.0.683726636\1647244010" -parentBuildID 20230214051806 -prefsHandle 1720 -prefMapHandle 1712 -prefsLen 22074 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {beb27502-99a8-404e-8d49-a7616d7b548e} 1344 "\\.\pipe\gecko-crash-server-pipe.1344" 1812 29b7ce0c858 gpu
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1916,3998370460422177617,2826991108126813336,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1928 /prefetch:2
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1916,3998370460422177617,2826991108126813336,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2388 /prefetch:3
C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1344.1.1691917452\502499493" -parentBuildID 20230214051806 -prefsHandle 2388 -prefMapHandle 2384 -prefsLen 22925 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d62341bf-5364-48f5-99d5-6f78da65c291} 1344 "\\.\pipe\gecko-crash-server-pipe.1344" 2416 29b70086358 socket
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1916,3998370460422177617,2826991108126813336,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2692 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,3998370460422177617,2826991108126813336,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3180 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,3998370460422177617,2826991108126813336,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1344.2.213666548\1612405480" -childID 1 -isForBrowser -prefsHandle 3204 -prefMapHandle 3200 -prefsLen 22963 -prefMapSize 235121 -jsInitHandle 936 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d479ea94-7b98-492a-b8aa-c7e479e0397d} 1344 "\\.\pipe\gecko-crash-server-pipe.1344" 3216 29b7bc92d58 tab
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1520 --field-trial-handle=2300,i,17669750832763175606,6016258459190181467,131072 /prefetch:2
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1872 --field-trial-handle=2300,i,17669750832763175606,6016258459190181467,131072 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1888 --field-trial-handle=2300,i,17669750832763175606,6016258459190181467,131072 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2996 --field-trial-handle=2300,i,17669750832763175606,6016258459190181467,131072 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3004 --field-trial-handle=2300,i,17669750832763175606,6016258459190181467,131072 /prefetch:1
C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1344.3.80676112\668272798" -childID 2 -isForBrowser -prefsHandle 2804 -prefMapHandle 3056 -prefsLen 27614 -prefMapSize 235121 -jsInitHandle 936 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {182a5574-617b-4ab7-8220-e052538c59eb} 1344 "\\.\pipe\gecko-crash-server-pipe.1344" 3044 29b826ddb58 tab
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,3998370460422177617,2826991108126813336,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4424 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4136 --field-trial-handle=2300,i,17669750832763175606,6016258459190181467,131072 /prefetch:1
C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1344.4.1402530884\1422976075" -childID 3 -isForBrowser -prefsHandle 5236 -prefMapHandle 5136 -prefsLen 27695 -prefMapSize 235121 -jsInitHandle 936 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8db48eb1-e418-40b5-8e98-f74d671d0ce9} 1344 "\\.\pipe\gecko-crash-server-pipe.1344" 5220 29b84e6bc58 tab
C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1344.5.1187133323\1195491610" -childID 4 -isForBrowser -prefsHandle 5368 -prefMapHandle 5372 -prefsLen 27695 -prefMapSize 235121 -jsInitHandle 936 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {30f72513-02d0-4ed5-97eb-d20adc741352} 1344 "\\.\pipe\gecko-crash-server-pipe.1344" 5360 29b84ee0658 tab
C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1344.6.1643931491\687134149" -childID 5 -isForBrowser -prefsHandle 5436 -prefMapHandle 5380 -prefsLen 27695 -prefMapSize 235121 -jsInitHandle 936 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {18406631-13ec-4ab9-98d9-f89494d1c401} 1344 "\\.\pipe\gecko-crash-server-pipe.1344" 5424 29b84ee0f58 tab
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1916,3998370460422177617,2826991108126813336,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4956 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,3998370460422177617,2826991108126813336,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4616 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,3998370460422177617,2826991108126813336,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1984 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,3998370460422177617,2826991108126813336,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,3998370460422177617,2826991108126813336,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1916,3998370460422177617,2826991108126813336,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5000 /prefetch:8
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\KKFCFBKFCF.exe"
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\CGCFCFBKFC.exe"
C:\Users\Admin\AppData\Local\Temp\KKFCFBKFCF.exe
"C:\Users\Admin\AppData\Local\Temp\KKFCFBKFCF.exe"
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1916,3998370460422177617,2826991108126813336,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5664 /prefetch:2
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3984 --field-trial-handle=2300,i,17669750832763175606,6016258459190181467,131072 /prefetch:2
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
Network
| Country | Destination | Domain | Proto |
| RU | 77.91.77.82:80 | 77.91.77.82 | tcp |
| RU | 77.91.77.81:80 | 77.91.77.81 | tcp |
| US | 8.8.8.8:53 | 82.77.91.77.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 81.77.91.77.in-addr.arpa | udp |
| RU | 85.28.47.30:80 | 85.28.47.30 | tcp |
| GB | 142.250.180.14:443 | www.youtube.com | tcp |
| US | 8.8.8.8:53 | spocs.getpocket.com | udp |
| US | 8.8.8.8:53 | content-signature-2.cdn.mozilla.net | udp |
| US | 8.8.8.8:53 | shavar.services.mozilla.com | udp |
| US | 8.8.8.8:53 | push.services.mozilla.com | udp |
| GB | 142.250.179.238:443 | www.youtube.com | tcp |
| US | 8.8.8.8:53 | firefox.settings.services.mozilla.com | udp |
| US | 34.149.100.209:443 | firefox.settings.services.mozilla.com | tcp |
| GB | 216.58.201.110:443 | www.youtube.com | tcp |
| US | 34.117.188.166:443 | contile.services.mozilla.com | udp |
| US | 34.117.188.166:443 | contile.services.mozilla.com | udp |
| US | 52.33.222.107:443 | shavar.services.mozilla.com | tcp |
| US | 34.160.144.191:443 | prod.content-signature-chains.prod.webservices.mozgcp.net | tcp |
| US | 34.117.188.166:443 | contile.services.mozilla.com | tcp |
| US | 34.117.188.166:443 | contile.services.mozilla.com | tcp |
| GB | 142.250.179.238:443 | www.youtube.com | udp |
| GB | 216.58.201.110:443 | www.youtube.com | tcp |
| US | 34.107.243.93:443 | autopush.prod.mozaws.net | tcp |
| GB | 216.58.201.110:443 | www.youtube.com | udp |
| GB | 142.250.180.14:443 | www.youtube.com | tcp |
| US | 34.107.243.93:443 | autopush.prod.mozaws.net | tcp |
| US | 34.120.5.221:443 | prod.pocket.prod.cloudops.mozgcp.net | tcp |
| GB | 216.58.201.110:443 | www.youtube.com | tcp |
| US | 34.149.100.209:443 | firefox.settings.services.mozilla.com | tcp |
| GB | 142.250.180.4:443 | www.google.com | tcp |
| GB | 142.250.180.4:443 | www.google.com | udp |
| GB | 142.250.180.4:443 | www.google.com | udp |
| GB | 142.250.180.4:443 | www.google.com | tcp |
| N/A | 127.0.0.1:49789 | tcp | |
| GB | 142.250.180.4:443 | www.google.com | tcp |
| N/A | 224.0.0.251:5353 | udp | |
| N/A | 127.0.0.1:49829 | tcp | |
| RU | 77.91.77.81:80 | 77.91.77.81 | tcp |
| US | 35.244.181.201:443 | aus5.mozilla.org | tcp |
| US | 34.160.144.191:443 | prod.content-signature-chains.prod.webservices.mozgcp.net | tcp |
| GB | 88.221.134.209:80 | ciscobinary.openh264.org | tcp |
| GB | 142.250.200.14:443 | redirector.gvt1.com | tcp |
| GB | 142.250.200.14:443 | redirector.gvt1.com | udp |
| GB | 74.125.168.199:443 | r2---sn-aigzrnse.gvt1.com | tcp |
| GB | 74.125.168.199:443 | r2---sn-aigzrnse.gvt1.com | udp |
| GB | 142.250.200.46:443 | play.google.com | tcp |
| GB | 142.250.200.46:443 | play.google.com | udp |
| US | 34.117.121.53:443 | attachments.prod.remote-settings.prod.webservices.mozgcp.net | tcp |
| US | 34.117.121.53:443 | attachments.prod.remote-settings.prod.webservices.mozgcp.net | tcp |
| US | 34.117.121.53:443 | attachments.prod.remote-settings.prod.webservices.mozgcp.net | tcp |
| US | 34.117.121.53:443 | attachments.prod.remote-settings.prod.webservices.mozgcp.net | tcp |
| US | 34.117.121.53:443 | attachments.prod.remote-settings.prod.webservices.mozgcp.net | tcp |
| US | 34.117.121.53:443 | attachments.prod.remote-settings.prod.webservices.mozgcp.net | tcp |
| GB | 142.250.200.46:443 | play.google.com | tcp |
| GB | 142.250.200.46:443 | play.google.com | tcp |
| GB | 216.58.201.110:443 | www.youtube.com | udp |
| GB | 172.217.169.35:443 | beacons.gcp.gvt2.com | tcp |
| GB | 172.217.169.35:443 | beacons.gcp.gvt2.com | tcp |
| PL | 34.0.245.166:443 | e2c73.gcp.gvt2.com | tcp |
| US | 216.239.32.116:443 | beacons4.gvt2.com | tcp |
| US | 216.239.32.116:443 | beacons4.gvt2.com | udp |
Files
memory/3096-0-0x0000000000470000-0x000000000093B000-memory.dmp
memory/3096-1-0x00000000770F6000-0x00000000770F8000-memory.dmp
memory/3096-2-0x0000000000471000-0x000000000049F000-memory.dmp
memory/3096-3-0x0000000000470000-0x000000000093B000-memory.dmp
memory/3096-5-0x0000000000470000-0x000000000093B000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
| MD5 | c507b1fdfce35810fb9bffcbf4ae7a26 |
| SHA1 | e8e0c51cbabc34300a6ef97955c3694f01cb7756 |
| SHA256 | 16c4e552b6fc325bd01db07c4f1165883e13522c3832c494bea381006e737310 |
| SHA512 | cd7d0072b7392cba4854d1303bb1f33573ef371590fae7256d04b7e286e64fbf42c22466c9c8f6fc423c5965b1ae007e82b92a25038472964067c1d00d9b4ab1 |
memory/2884-16-0x00000000003E0000-0x00000000008AB000-memory.dmp
memory/3096-18-0x0000000000470000-0x000000000093B000-memory.dmp
memory/2884-19-0x00000000003E0000-0x00000000008AB000-memory.dmp
memory/2884-20-0x00000000003E0000-0x00000000008AB000-memory.dmp
memory/2884-21-0x00000000003E0000-0x00000000008AB000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\1000006001\f17a6016fc.exe
| MD5 | 3cf711041254d965f4d100dfd2af83b5 |
| SHA1 | 567f213eabaf61bf82e941631dbecd518b61d089 |
| SHA256 | 77e9b3740b0e2fd375cd1981ce2ad2ece335200794fa7eb92d4befee2094b9ce |
| SHA512 | 629f3136a6ebacf69800ed96000709c28ac096937c75cacb262394922779ab6cc613dd496e263ac02b41b998daa570771b68fd6a79b5d73fb3c4a45ef0bdb718 |
memory/4276-37-0x0000000000940000-0x000000000152B000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\1000010001\c130df19d4.exe
| MD5 | bc08b445116ecc06852a929a5d302c4a |
| SHA1 | a78aa42220b90d47b4cf63119e6082f06b295f57 |
| SHA256 | 5b232254dd2d33eb576516116977c884fba81d5a8427f742a73655f9e076efc6 |
| SHA512 | 657a21d453112fb909be4005e0cab1ebf467840e275a159eb535b486432ffa0bfcc60da92475b26f08a0ea481c927654520a43163e04e34324551cb3bfd69fdf |
C:\Users\Admin\AppData\Local\Temp\D15A.tmp\D15B.tmp\D15C.bat
| MD5 | de9423d9c334ba3dba7dc874aa7dbc28 |
| SHA1 | bf38b137b8d780b3d6d62aee03c9d3f73770d638 |
| SHA256 | a1e1b422c40fb611a50d3f8bf34f9819f76ddb304aa2d105fb49f41f57752698 |
| SHA512 | 63f13acd904378ad7de22053e1087d61a70341f1891ada3b671223fec8f841b42b6f1060a4b18c8bb865ee4cd071cadc7ff6bd6d549760945bf1645a1086f401 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | 6c1de55e8af0859bea07b6af77782896 |
| SHA1 | d5efde7bcf31d692d697ebbc54ccd13fb3624856 |
| SHA256 | 130afd8eb97d11640a28231e9314983eee9eff75964c93abd71e84e6412f710f |
| SHA512 | 9664d41b0b1767ddc4012318fca427edf9606c525f868a5ba98e5987bf5e71e4710dd19a0ed7223c706588b5803f3b118ee949c51d6fd99696049befff5fd510 |
memory/4276-63-0x0000000061E00000-0x0000000061EF3000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | 0176e968a02096540e4a096219a8fe34 |
| SHA1 | cd301ea619d7c92daf64446caea1f1293da48373 |
| SHA256 | f9319c68cc75bc8e334037d946cc89ad65605606c1bfd12a2fe2ebd711b14067 |
| SHA512 | b6aba8640823d43f8968ff31a2e5a48b6f6def43ea6f83cef801294ea1ca9eb1fa16cec516893485b650d7b4407e34536b380712fb72bc9da581cc2e1e0ae2d8 |
\??\pipe\LOCAL\crashpad_1056_MGFECQBOYTSYOHKN
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 7b881eee466f4b42486f39ba5ac6d9a8 |
| SHA1 | 33065d56c7cad225415ee578622adccd5bb73d93 |
| SHA256 | 711579e6e8b4a3e47bfa830568bceb87b19ae170949dcbdb5808fdbbc8edc6b4 |
| SHA512 | 98d0fc56ae7f967ead09b30f1284c0292584000dfc06e1d908d6dcdc44042e60fc1a5abb7280f9e6a9e7edf16c0399579d61d5dc7fe26ee30da92c0b749eb4ff |
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2nnjr4yd.default-release\activity-stream.discovery_stream.json.tmp
| MD5 | b2858471d3501b38ac24f0246d46a8fa |
| SHA1 | 456ed976c987d44383732b7b6504d64b16f21e1f |
| SHA256 | d72df6491dbd9f720c365ee9afb85cf65b858c3ecd78a2f80a8f76854d6b483c |
| SHA512 | 7c383c29fd503db2653b80d785315b926abace0f5e807b77f8bec7e8fbafb37e7af622de147dddec6fe231cc65082f5f8fb9ea194585fb6d537fca4970968267 |
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2nnjr4yd.default-release\prefs.js
| MD5 | a68c3d12651aadc10c00aff85f9dfa77 |
| SHA1 | 42c1b92cd415784c3935600da5d778d3091c74f3 |
| SHA256 | d8c1f5993ba445eb3c5c58897996a20ce0f3afaa403a0a8c3845377c48c2e012 |
| SHA512 | b2523fad0ed15c39a45564f14e22bac8ffe5a7177b8f9f3fa7a4ad9a11c30021e38831bae89cc1ad794d13b25a04fa4ccf224b0061f5d1eb4329b4c13ca94eac |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
| MD5 | d751713988987e9331980363e24189ce |
| SHA1 | 97d170e1550eee4afc0af065b78cda302a97674c |
| SHA256 | 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945 |
| SHA512 | b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001
| MD5 | 51c3c3d00a4a5a9d730c04c615f2639b |
| SHA1 | 3b92cce727fc1fb03e982eb611935218c821948f |
| SHA256 | cb1e96afd2fec2b2b445be2f46c6b90db19c2ed2f0278f57f7490a299e88c19f |
| SHA512 | 7af8ec3160e4dbae2c3359146c0a82c32a02697d332138c391e4295d00f49ed1070857a0afe16222c5cea1cafffc4d26df525543f187be43a59967df1e919542 |
memory/2884-255-0x00000000003E0000-0x00000000008AB000-memory.dmp
memory/5864-256-0x00000000003E0000-0x00000000008AB000-memory.dmp
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000005
| MD5 | 103d7813f0ccc7445b4b9a4b34fc74bf |
| SHA1 | ed862e8ebd885acde6115c340e59e50e74e3633b |
| SHA256 | 0ccaf58bb2aa430724873fa21515e5f3fbd875390288aade3823ec16962bc27b |
| SHA512 | 0723baca97705968a068676f74ac01bd492dac94a4fba391de578b6357b79c4aca5412f564dc0ea7ae5b6145256c7f8f22e8a4823f41e2baf50d201ec073be1f |
C:\ProgramData\nss3.dll
| MD5 | 1cc453cdf74f31e4d913ff9c10acdde2 |
| SHA1 | 6e85eae544d6e965f15fa5c39700fa7202f3aafe |
| SHA256 | ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5 |
| SHA512 | dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571 |
memory/5864-286-0x00000000003E0000-0x00000000008AB000-memory.dmp
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2nnjr4yd.default-release\cookies.sqlite-wal
| MD5 | 265b99e861626665356089e20371b616 |
| SHA1 | 09d037636b974ca044d56b7cc07a73748a3187e5 |
| SHA256 | 94a0b22445c28c6a05477bc9305e85434c975db9e75db2f0e9e45764fd818f83 |
| SHA512 | 41cc615b52f860c9d037ef24529460885a35efb46c8f67bd093ae73d7656deafdd11bf442d50420737fc265f6dfe5c169d40410ae3b9ca4ebc2690a9b9938292 |
C:\ProgramData\mozglue.dll
| MD5 | c8fd9be83bc728cc04beffafc2907fe9 |
| SHA1 | 95ab9f701e0024cedfbd312bcfe4e726744c4f2e |
| SHA256 | ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a |
| SHA512 | fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040 |
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2nnjr4yd.default-release\places.sqlite-wal
| MD5 | 47df025014909531485da6ffd28fa226 |
| SHA1 | b9e8beeb00d08f4d12c5b5e4463a94cfb6055085 |
| SHA256 | 4706801e35768f3d5abab11c1aa90bace5e53e3f7a402d10bc3e1c2eef30c2b9 |
| SHA512 | 950e17042121502c03e20a3ebb2595e451746925bf460a8ec63a0636ab5fc5e6c49ebf5da39476b28cf750d4c1e37715b12d9488cea2a214af4946bccf4e846c |
C:\ProgramData\IECGIEBAEBFIIECBGCBG
| MD5 | 476b748afe94a5055f4a4a232ce647ea |
| SHA1 | 3464d19f4b32db46dc657a323c7abd0bbbf54cf7 |
| SHA256 | a21d056282050c29ffbae8339bf7e58ac9aa34e5f95ffddd8d31fbbbdad21630 |
| SHA512 | 1f1af53b62b227b1e1c3e6ad7ceda191495f814886e0571b1343b9e914f381ecae16aba6b78889e5f0e2dd5543d5ea3c0e4601841ec742470bc932fda7e8fd5b |
memory/4276-310-0x0000000000940000-0x000000000152B000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
| MD5 | 206702161f94c5cd39fadd03f4014d98 |
| SHA1 | bd8bfc144fb5326d21bd1531523d9fb50e1b600a |
| SHA256 | 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167 |
| SHA512 | 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
| MD5 | 46295cac801e5d4857d09837238a6394 |
| SHA1 | 44e0fa1b517dbf802b18faf0785eeea6ac51594b |
| SHA256 | 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443 |
| SHA512 | 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | 54860eb1288b75bf9f295e4c07e6d39e |
| SHA1 | 6d1d7ab909307032ab77f10ec8dfa8af6cbd3e68 |
| SHA256 | 1413ba8d3f794bb4fcc4c0a3b9239ec4b534a35dbbb0a94ccf6a21c8a8d91453 |
| SHA512 | b115a01841d7917b486390fc4629aa38748080792b80b6b00ee507261a0e99b997ee619955d3f7f6406f20e04b0b86d1a3b3f0fd0c6064450ae7d82ea6052c74 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
| MD5 | b99b9fcb941eb005b202e8181c119d1c |
| SHA1 | c9e9b7b0060912bc9b2aa0b8a9be0509a10aa060 |
| SHA256 | a015114eef0daa7db8ff4860ae54473e569d49bfeebe3a85c5163672f93307f3 |
| SHA512 | 4c118fcce02d1ad4a47f53a067b89d8c50795e1b39ddedab5ce7b66643fd48911b38f152a49de683892d641ae95be2bb3b852a7e7fd7b18491f8566654970115 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | b20eb8f66aee25caeba570ecf5f6dd6f |
| SHA1 | b51cc8ac4f7c1c7791be1657bb05a9033d45fcad |
| SHA256 | fe328eceb610d33900b6c962a0ea464a9563d03f1a3795aeabbea81e3353c6cf |
| SHA512 | c9333a78a6d3790b4202125424c2cc981c78d1990e2bd395ea3cb5cd58ae6cd140b61b0abb50307bb47a65dff44016721d5c5bb9bb15b37d65dbea46db96302d |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | fe750ed7c0a0ff934809b3773561c66f |
| SHA1 | f751cbc76022fb7acd8dcd27e6a170b7a4d1d770 |
| SHA256 | 93321761be63afd09e21f3e614647dd906c1cf3b2cab5fd19a13cf53d2fae2dc |
| SHA512 | bd302ed5a530b2263df70e1596ff38efc6a3bfb24475dce4220f092009f0efe1ee66143e6e5658bcc6c12b9e5aa89a7d6e46d97359409402f29fd35903340f6a |
memory/4276-360-0x0000000000940000-0x000000000152B000-memory.dmp
memory/6536-364-0x0000000000F90000-0x000000000145B000-memory.dmp
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
| MD5 | 2a868e55d7d18e7414a9c7014f3e01ca |
| SHA1 | 622d220fc7930ede63e786e3f1700f6ed8ebfbe0 |
| SHA256 | fab688d000b10cf44ca84a7f5313c62f3321e3baab8d180753622dd5d04e4a7e |
| SHA512 | f8f72805f7237b3a951638918361755e7386f94ff4aa2bf323695e9ed8b5379b6488191559efcf644a26b9727e00c41320a22ad1470229b1a33ed68ef1a1d87e |
memory/6536-378-0x0000000000F90000-0x000000000145B000-memory.dmp
memory/2884-379-0x00000000003E0000-0x00000000008AB000-memory.dmp
memory/2884-383-0x00000000003E0000-0x00000000008AB000-memory.dmp
memory/2884-384-0x00000000003E0000-0x00000000008AB000-memory.dmp
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2nnjr4yd.default-release\sessionstore-backups\recovery.jsonlz4
| MD5 | 44ac31c20a0a4028ba4526c6de4cb1ec |
| SHA1 | 90fa2d9994ea83f11b211c5077677f30d1d62642 |
| SHA256 | c8c84def82a1bf56b07bef8b89338fc19bff0aa959754fa694724231bdd009ea |
| SHA512 | 37bbd97c5d1076ee278642548d800b78450883dd89646b1d9a2759e042e78911587e61498f596794074e4ccd194b70395a04cdd832c7bb2bb664e7ae2d371f8a |
memory/2884-391-0x00000000003E0000-0x00000000008AB000-memory.dmp
memory/2884-392-0x00000000003E0000-0x00000000008AB000-memory.dmp
memory/2884-402-0x00000000003E0000-0x00000000008AB000-memory.dmp
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
| MD5 | b4d536e92dbbd6c31ced41733bf7e44e |
| SHA1 | e72340f5711e8b42ba1feedddcfa3714764aa0fa |
| SHA256 | 4507c4c912c446712ad9c9a54347ae5417762e5a2f37d31062b37875215101c6 |
| SHA512 | fe2a1f2b65e11736b0147f5706ffb9854f14dfc94fae0e70424f54688e8e6a969f002a9dbc7c1b4f7ac550d077fc006baa80c7526398793e9bddc20a7cd403ec |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
| MD5 | 37ddf2d11201c820d22cffa4816a3296 |
| SHA1 | 7ff1a1500778d370e39aee3a274358faaed60989 |
| SHA256 | fcbbc2cabc521d4ffb5fd618bba053a02277e8f3e68687ec564ea3012ebe495b |
| SHA512 | 80cec6dfb105f732cd076cbca129d2b9784a1ceb37d471f358ba581e30bae8460f00da97068b4107081dabc15d255e82d023e353152b020d5059a35de8c37d72 |
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2nnjr4yd.default-release\prefs-1.js
| MD5 | f2b8d74320304f809ad3ef4db986ca4e |
| SHA1 | 09dab8bb5c1ae0f00e5c466121036c6cf5d74ef3 |
| SHA256 | 510d327ac935b175dce749ecc09b6d5aa90618b6f31acf88ec6a4761a291bc72 |
| SHA512 | 744f9ab2d56c36a7e939005e19980d445f0b196047818be0266b4d037e40a09a6dde6976377924425e27eaa8d1f0c05fadc69b2bf97bc83f7e02bca990b1e4fc |
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2nnjr4yd.default-release\cache2\entries\5CD1EBDF6B57F13C7E783CE5E6D8E9C44014FE1A
| MD5 | c29fd2fef6488c60ffa5c917b4f492c7 |
| SHA1 | ab9d50701ecadba2cdfd1b5c2eb205d0f2052b13 |
| SHA256 | 05c4d70462c08cb55555544c61624c8b51bddd4544b6a95c0ae77b77c5dca4e6 |
| SHA512 | 5a4c4a9a0540590fdff99454b683aa405b0970ed6ca1a35b06c12ace960ae92ab695ae3487dfd31735a8cfbf7be2cae7113304be506f47a42c4b4da54269f3e2 |
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2nnjr4yd.default-release\prefs-1.js
| MD5 | 195d695a375271382a70e83b317fb669 |
| SHA1 | 54c0c24eafb1a19fe6fb2475529c1e5d34420b6c |
| SHA256 | 195133dd02ffad1cbfc3eae285974c31ef59645dca0562191cb5c3bef1ba4a58 |
| SHA512 | bb8a35acab9ea791216665b130b0debb4b8c82bb2d617396c9bec2ded6a603ae14fe036b22b1d939897f75ee265c81bf74fd2777c4bb6895f2b4e1ca09b5e34b |
C:\Users\Admin\AppData\Local\Temp\tmpaddon
| MD5 | 85430baed3398695717b0263807cf97c |
| SHA1 | fffbee923cea216f50fce5d54219a188a5100f41 |
| SHA256 | a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e |
| SHA512 | 06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1 |
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2nnjr4yd.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
| MD5 | 3d33cdc0b3d281e67dd52e14435dd04f |
| SHA1 | 4db88689282fd4f9e9e6ab95fcbb23df6e6485db |
| SHA256 | f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b |
| SHA512 | a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1 |
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2nnjr4yd.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
| MD5 | fe3355639648c417e8307c6d051e3e37 |
| SHA1 | f54602d4b4778da21bc97c7238fc66aa68c8ee34 |
| SHA256 | 1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e |
| SHA512 | 8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c |
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2nnjr4yd.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
| MD5 | 006f039f6e05fa10ac98c3202defe29c |
| SHA1 | b7675b4389ff8a68e2d19fb054eca642f182cd3d |
| SHA256 | 9f8eec8b07a8dca4d5ee517ec7da9cf08226e8f29381ec5a228981ea9d7504d6 |
| SHA512 | a8f062ea2d412c92e2569dae8ae65f5a7f2849e2b599d961792c800fd01e2a5daf524b4953fc217d76c4afbfdbad88c38d44bb31a11fa79452178b1deccf95e7 |
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
| MD5 | a01c5ecd6108350ae23d2cddf0e77c17 |
| SHA1 | c6ac28a2cd979f1f9a75d56271821d5ff665e2b6 |
| SHA256 | 345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42 |
| SHA512 | b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72 |
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2nnjr4yd.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
| MD5 | 8be33af717bb1b67fbd61c3f4b807e9e |
| SHA1 | 7cf17656d174d951957ff36810e874a134dd49e0 |
| SHA256 | e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd |
| SHA512 | 6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7 |
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2nnjr4yd.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
| MD5 | 49ddb419d96dceb9069018535fb2e2fc |
| SHA1 | 62aa6fea895a8b68d468a015f6e6ab400d7a7ca6 |
| SHA256 | 2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539 |
| SHA512 | 48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2 |
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2nnjr4yd.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
| MD5 | 33bf7b0439480effb9fb212efce87b13 |
| SHA1 | cee50f2745edc6dc291887b6075ca64d716f495a |
| SHA256 | 8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e |
| SHA512 | d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275 |
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2nnjr4yd.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
| MD5 | 937326fead5fd401f6cca9118bd9ade9 |
| SHA1 | 4526a57d4ae14ed29b37632c72aef3c408189d91 |
| SHA256 | 68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81 |
| SHA512 | b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2 |
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2nnjr4yd.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
| MD5 | 688bed3676d2104e7f17ae1cd2c59404 |
| SHA1 | 952b2cdf783ac72fcb98338723e9afd38d47ad8e |
| SHA256 | 33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237 |
| SHA512 | 7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776 |
memory/2884-624-0x00000000003E0000-0x00000000008AB000-memory.dmp
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2nnjr4yd.default-release\cache2\entries\F8CBD54DDA10F4286A41EC6A537240712D6C2308
| MD5 | fe6f09b991a54091aa3496c481667dd5 |
| SHA1 | 2218fe479f1fb773838c41c0f6d637c24954c9b4 |
| SHA256 | 5a15a9dc27504cea6b89c3280a536b23e4b937502b449222e1504cfdccfba1f1 |
| SHA512 | 78d6789bf17232a5e7c1291218a20dc1d8267a2023e8aca39f41ebb7ab1f853fbe3a0eafa6f919e660205f8a12bc17c031ecd4ce309baed49e46dd4ff2605465 |
memory/2884-2386-0x00000000003E0000-0x00000000008AB000-memory.dmp
memory/2884-2419-0x00000000003E0000-0x00000000008AB000-memory.dmp
memory/2884-2445-0x00000000003E0000-0x00000000008AB000-memory.dmp
memory/544-2447-0x00000000003E0000-0x00000000008AB000-memory.dmp
memory/544-2448-0x00000000003E0000-0x00000000008AB000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
| MD5 | d72b8fbb16b99a46742f85dfc9f279bd |
| SHA1 | 5e9dc3278f81f14d93cfea323f75a7c8e3d60bee |
| SHA256 | 2a14294cb6ea1d284ce0da61ed8a9aae187ffbafb82d615b4bee209ac09c9e82 |
| SHA512 | 19964bb68f92089c2eeb0de76da62aeb1f5b55c5aea2430f1bdc43a3b2aee76c028c83210295c98caccc98be2a6e1245dc0479345b3fd4d7cb5004dd66a1d8aa |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
| MD5 | 3a6ae7948f08b0eae1cf94a39ff47326 |
| SHA1 | b0c0704cbed8ded90423bc9eeb0b5b68e1f1e256 |
| SHA256 | fa1035145b24a8e7ef590930196f39f42a4ccf3165b9be87674b1db9c0bfda48 |
| SHA512 | de8ae2cc3534e9095b8e9c9b3381149d51ba3dc151dca6b795b4973902b8552d25e8e3801bbff0420ea7b19275c554eb707a0a67eec55d98241b10960153d70b |
memory/2884-2486-0x00000000003E0000-0x00000000008AB000-memory.dmp
memory/2884-2487-0x00000000003E0000-0x00000000008AB000-memory.dmp
memory/2884-2488-0x00000000003E0000-0x00000000008AB000-memory.dmp
memory/2884-2489-0x00000000003E0000-0x00000000008AB000-memory.dmp
memory/2884-2490-0x00000000003E0000-0x00000000008AB000-memory.dmp
memory/2884-2503-0x00000000003E0000-0x00000000008AB000-memory.dmp
memory/6780-2505-0x00000000003E0000-0x00000000008AB000-memory.dmp
memory/6780-2506-0x00000000003E0000-0x00000000008AB000-memory.dmp
memory/2884-2507-0x00000000003E0000-0x00000000008AB000-memory.dmp
Analysis: behavioral1
Detonation Overview
Submitted
2024-07-09 13:03
Reported
2024-07-09 13:06
Platform
win10v2004-20240704-en
Max time kernel
150s
Max time network
152s
Command Line
Signatures
Amadey
Stealc
Identifies VirtualBox via ACPI registry values (likely anti-VM)
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ | C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe | N/A |
| Key opened | \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ | C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe | N/A |
| Key opened | \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ | C:\Users\Admin\AppData\Local\Temp\16c4e552b6fc325bd01db07c4f1165883e13522c3832c494bea381006e737310.exe | N/A |
| Key opened | \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ | C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe | N/A |
| Key opened | \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ | C:\Users\Admin\AppData\Local\Temp\FHIIEHJKKE.exe | N/A |
Downloads MZ/PE file
Checks BIOS information in registry
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion | C:\Users\Admin\AppData\Local\Temp\16c4e552b6fc325bd01db07c4f1165883e13522c3832c494bea381006e737310.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion | C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion | C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion | C:\Users\Admin\AppData\Local\Temp\FHIIEHJKKE.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion | C:\Users\Admin\AppData\Local\Temp\FHIIEHJKKE.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion | C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion | C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion | C:\Users\Admin\AppData\Local\Temp\16c4e552b6fc325bd01db07c4f1165883e13522c3832c494bea381006e737310.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion | C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion | C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe | N/A |
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-2547232018-1419253926-3356748848-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\16c4e552b6fc325bd01db07c4f1165883e13522c3832c494bea381006e737310.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-2547232018-1419253926-3356748848-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-2547232018-1419253926-3356748848-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\1000010001\7cdcc83c66.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-2547232018-1419253926-3356748848-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\1000006001\1ec8f29b8f.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-2547232018-1419253926-3356748848-1000\Control Panel\International\Geo\Nation | C:\Windows\SysWOW64\cmd.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\1000006001\1ec8f29b8f.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\1000010001\7cdcc83c66.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\FHIIEHJKKE.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe | N/A |
Identifies Wine through registry keys
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-2547232018-1419253926-3356748848-1000\Software\Wine | C:\Users\Admin\AppData\Local\Temp\16c4e552b6fc325bd01db07c4f1165883e13522c3832c494bea381006e737310.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-2547232018-1419253926-3356748848-1000\Software\Wine | C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-2547232018-1419253926-3356748848-1000\Software\Wine | C:\Users\Admin\AppData\Local\Temp\FHIIEHJKKE.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-2547232018-1419253926-3356748848-1000\Software\Wine | C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-2547232018-1419253926-3356748848-1000\Software\Wine | C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\1000006001\1ec8f29b8f.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\1000006001\1ec8f29b8f.exe | N/A |
Reads data files stored by FTP clients
Reads user/profile data of web browsers
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Suspicious use of NtSetInformationThreadHideFromDebugger
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\16c4e552b6fc325bd01db07c4f1165883e13522c3832c494bea381006e737310.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\1000006001\1ec8f29b8f.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\1000006001\1ec8f29b8f.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\1000006001\1ec8f29b8f.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\FHIIEHJKKE.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe | N/A |
Drops file in Windows directory
| Description | Indicator | Process | Target |
| File created | C:\Windows\Tasks\explorti.job | C:\Users\Admin\AppData\Local\Temp\16c4e552b6fc325bd01db07c4f1165883e13522c3832c494bea381006e737310.exe | N/A |
Enumerates physical storage devices
Checks processor information in registry
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz | C:\Program Files\Mozilla Firefox\firefox.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString | C:\Program Files\Mozilla Firefox\firefox.exe | N/A |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 | C:\Program Files\Mozilla Firefox\firefox.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature | C:\Program Files\Mozilla Firefox\firefox.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision | C:\Program Files\Mozilla Firefox\firefox.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier | C:\Program Files\Mozilla Firefox\firefox.exe | N/A |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 | C:\Users\Admin\AppData\Local\Temp\1000006001\1ec8f29b8f.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString | C:\Users\Admin\AppData\Local\Temp\1000006001\1ec8f29b8f.exe | N/A |
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-2547232018-1419253926-3356748848-1000_Classes\Local Settings | C:\Program Files\Mozilla Firefox\firefox.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\1000006001\1ec8f29b8f.exe | N/A |
| N/A | N/A | C:\Program Files\Mozilla Firefox\firefox.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\cmd.exe | N/A |
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Processes
C:\Users\Admin\AppData\Local\Temp\16c4e552b6fc325bd01db07c4f1165883e13522c3832c494bea381006e737310.exe
"C:\Users\Admin\AppData\Local\Temp\16c4e552b6fc325bd01db07c4f1165883e13522c3832c494bea381006e737310.exe"
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
"C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe"
C:\Users\Admin\AppData\Local\Temp\1000006001\1ec8f29b8f.exe
"C:\Users\Admin\AppData\Local\Temp\1000006001\1ec8f29b8f.exe"
C:\Users\Admin\AppData\Local\Temp\1000010001\7cdcc83c66.exe
"C:\Users\Admin\AppData\Local\Temp\1000010001\7cdcc83c66.exe"
C:\Windows\system32\cmd.exe
"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\D0FC.tmp\D0FD.tmp\D0FE.bat C:\Users\Admin\AppData\Local\Temp\1000010001\7cdcc83c66.exe"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.youtube.com/account"
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/account"
C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" "https://www.youtube.com/account"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7fff7a49ab58,0x7fff7a49ab68,0x7fff7a49ab78
C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7fff7a2446f8,0x7fff7a244708,0x7fff7a244718
C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2460.0.1620203540\1681860175" -parentBuildID 20230214051806 -prefsHandle 1756 -prefMapHandle 1748 -prefsLen 22076 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {37b22ca7-38ea-4926-a40b-6baa0a52514f} 2460 "\\.\pipe\gecko-crash-server-pipe.2460" 1856 1ec00d0e358 gpu
C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2460.1.1484849439\1460233506" -parentBuildID 20230214051806 -prefsHandle 2456 -prefMapHandle 2452 -prefsLen 22927 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {54051c0d-2cec-48d2-ad28-25b038ee3635} 2460 "\\.\pipe\gecko-crash-server-pipe.2460" 2468 1ec01290758 socket
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1756 --field-trial-handle=2348,i,3946852740641942384,8617300244396501962,131072 /prefetch:2
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1948 --field-trial-handle=2348,i,3946852740641942384,8617300244396501962,131072 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1968 --field-trial-handle=2348,i,3946852740641942384,8617300244396501962,131072 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,4477722238519126697,5354290870888649346,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,4477722238519126697,5354290870888649346,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,4477722238519126697,5354290870888649346,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3060 --field-trial-handle=2348,i,3946852740641942384,8617300244396501962,131072 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3064 --field-trial-handle=2348,i,3946852740641942384,8617300244396501962,131072 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,4477722238519126697,5354290870888649346,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,4477722238519126697,5354290870888649346,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2460.2.548903949\1607809102" -childID 1 -isForBrowser -prefsHandle 3100 -prefMapHandle 3096 -prefsLen 22965 -prefMapSize 235121 -jsInitHandle 896 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1e80a6bb-4313-4fa4-9d9e-171dc77335fe} 2460 "\\.\pipe\gecko-crash-server-pipe.2460" 3112 1ec03b3c158 tab
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2460.3.1356581293\1346345478" -childID 2 -isForBrowser -prefsHandle 3656 -prefMapHandle 3652 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 896 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {32f16df4-3667-498f-8613-8445123b2b0f} 2460 "\\.\pipe\gecko-crash-server-pipe.2460" 3668 1ec059f2458 tab
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3920 --field-trial-handle=2348,i,3946852740641942384,8617300244396501962,131072 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,4477722238519126697,5354290870888649346,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4416 /prefetch:1
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2460.4.777459112\1773147281" -childID 3 -isForBrowser -prefsHandle 5200 -prefMapHandle 5224 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 896 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7beabe39-e217-48ce-aeca-1d9769d33e4f} 2460 "\\.\pipe\gecko-crash-server-pipe.2460" 4892 1ec07e22358 tab
C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2460.5.597441369\790241849" -childID 4 -isForBrowser -prefsHandle 5452 -prefMapHandle 5448 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 896 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1a96bb64-1c0c-464f-b0c8-d5fce66fdfae} 2460 "\\.\pipe\gecko-crash-server-pipe.2460" 5460 1ec07e22958 tab
C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2460.6.1778400982\522431360" -childID 5 -isForBrowser -prefsHandle 5552 -prefMapHandle 5556 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 896 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9f9dd686-2d48-42bf-97d7-165d2871ba53} 2460 "\\.\pipe\gecko-crash-server-pipe.2460" 5632 1ec07e23258 tab
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\FHIIEHJKKE.exe"
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\CAAAFCAKKK.exe"
C:\Users\Admin\AppData\Local\Temp\FHIIEHJKKE.exe
"C:\Users\Admin\AppData\Local\Temp\FHIIEHJKKE.exe"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4816 --field-trial-handle=2348,i,3946852740641942384,8617300244396501962,131072 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4828 --field-trial-handle=2348,i,3946852740641942384,8617300244396501962,131072 /prefetch:8
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,4477722238519126697,5354290870888649346,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3776 /prefetch:2
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1064 --field-trial-handle=2348,i,3946852740641942384,8617300244396501962,131072 /prefetch:2
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 64.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 240.221.184.93.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 55.36.223.20.in-addr.arpa | udp |
| RU | 77.91.77.82:80 | 77.91.77.82 | tcp |
| RU | 77.91.77.81:80 | 77.91.77.81 | tcp |
| US | 8.8.8.8:53 | 82.77.91.77.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 81.77.91.77.in-addr.arpa | udp |
| RU | 85.28.47.30:80 | 85.28.47.30 | tcp |
| US | 8.8.8.8:53 | 30.47.28.85.in-addr.arpa | udp |
| US | 8.8.8.8:53 | www.youtube.com | udp |
| GB | 142.250.187.238:443 | www.youtube.com | tcp |
| GB | 142.250.187.238:443 | www.youtube.com | tcp |
| US | 8.8.8.8:53 | consent.youtube.com | udp |
| GB | 216.58.201.110:443 | consent.youtube.com | tcp |
| GB | 216.58.201.110:443 | consent.youtube.com | tcp |
| US | 8.8.8.8:53 | 3.178.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 238.187.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 234.212.58.216.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 110.201.58.216.in-addr.arpa | udp |
| US | 8.8.8.8:53 | www.youtube.com | udp |
| US | 8.8.8.8:53 | contile.services.mozilla.com | udp |
| US | 8.8.8.8:53 | spocs.getpocket.com | udp |
| US | 8.8.8.8:53 | content-signature-2.cdn.mozilla.net | udp |
| US | 8.8.8.8:53 | shavar.services.mozilla.com | udp |
| US | 8.8.8.8:53 | push.services.mozilla.com | udp |
| US | 8.8.8.8:53 | firefox.settings.services.mozilla.com | udp |
| GB | 142.250.180.14:443 | www.youtube.com | tcp |
| US | 8.8.8.8:53 | youtube-ui.l.google.com | udp |
| US | 34.149.100.209:443 | firefox.settings.services.mozilla.com | tcp |
| US | 8.8.8.8:53 | prod.remote-settings.prod.webservices.mozgcp.net | udp |
| US | 34.117.188.166:443 | spocs.getpocket.com | udp |
| US | 34.117.188.166:443 | spocs.getpocket.com | udp |
| US | 8.8.8.8:53 | contile.services.mozilla.com | udp |
| US | 44.242.121.21:443 | shavar.services.mozilla.com | tcp |
| US | 34.160.144.191:443 | content-signature-2.cdn.mozilla.net | tcp |
| US | 8.8.8.8:53 | youtube-ui.l.google.com | udp |
| US | 34.107.243.93:443 | push.services.mozilla.com | tcp |
| US | 34.117.188.166:443 | contile.services.mozilla.com | tcp |
| US | 34.117.188.166:443 | contile.services.mozilla.com | tcp |
| US | 8.8.8.8:53 | prod.remote-settings.prod.webservices.mozgcp.net | udp |
| US | 8.8.8.8:53 | contile.services.mozilla.com | udp |
| US | 8.8.8.8:53 | prod.ads.prod.webservices.mozgcp.net | udp |
| US | 8.8.8.8:53 | prod.ads.prod.webservices.mozgcp.net | udp |
| US | 8.8.8.8:53 | shavar.prod.mozaws.net | udp |
| US | 8.8.8.8:53 | prod.content-signature-chains.prod.webservices.mozgcp.net | udp |
| US | 8.8.8.8:53 | shavar.prod.mozaws.net | udp |
| GB | 142.250.180.14:443 | youtube-ui.l.google.com | udp |
| US | 34.107.243.93:443 | push.services.mozilla.com | tcp |
| US | 8.8.8.8:53 | prod.content-signature-chains.prod.webservices.mozgcp.net | udp |
| US | 8.8.8.8:53 | consent.youtube.com | udp |
| US | 8.8.8.8:53 | autopush.prod.mozaws.net | udp |
| US | 8.8.8.8:53 | getpocket.cdn.mozilla.net | udp |
| GB | 216.58.201.110:443 | consent.youtube.com | tcp |
| US | 8.8.8.8:53 | consent.youtube.com | udp |
| US | 8.8.8.8:53 | autopush.prod.mozaws.net | udp |
| US | 34.120.5.221:443 | getpocket.cdn.mozilla.net | tcp |
| US | 8.8.8.8:53 | prod.pocket.prod.cloudops.mozgcp.net | udp |
| GB | 216.58.201.110:443 | consent.youtube.com | udp |
| US | 8.8.8.8:53 | prod.pocket.prod.cloudops.mozgcp.net | udp |
| US | 34.149.100.209:443 | prod.remote-settings.prod.webservices.mozgcp.net | tcp |
| US | 8.8.8.8:53 | 234.16.217.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 99.201.58.216.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 227.187.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | www.google.com | udp |
| GB | 142.250.180.4:443 | www.google.com | tcp |
| US | 8.8.8.8:53 | www.google.com | udp |
| US | 8.8.8.8:53 | www.google.com | udp |
| GB | 142.250.180.4:443 | www.google.com | udp |
| US | 8.8.8.8:53 | 4.180.250.142.in-addr.arpa | udp |
| N/A | 224.0.0.251:5353 | udp | |
| GB | 142.250.180.4:443 | www.google.com | tcp |
| GB | 142.250.180.4:443 | www.google.com | udp |
| GB | 142.250.180.4:443 | www.google.com | tcp |
| N/A | 127.0.0.1:64082 | tcp | |
| RU | 77.91.77.81:80 | 77.91.77.81 | tcp |
| N/A | 127.0.0.1:64095 | tcp | |
| US | 8.8.8.8:53 | 103.169.127.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 206.23.85.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | aus5.mozilla.org | udp |
| US | 35.244.181.201:443 | aus5.mozilla.org | tcp |
| US | 8.8.8.8:53 | prod.balrog.prod.cloudops.mozgcp.net | udp |
| US | 8.8.8.8:53 | prod.balrog.prod.cloudops.mozgcp.net | udp |
| US | 34.160.144.191:443 | prod.content-signature-chains.prod.webservices.mozgcp.net | tcp |
| US | 8.8.8.8:53 | 201.181.244.35.in-addr.arpa | udp |
| US | 8.8.8.8:53 | ciscobinary.openh264.org | udp |
| GB | 88.221.134.209:80 | ciscobinary.openh264.org | tcp |
| US | 8.8.8.8:53 | a19.dscg10.akamai.net | udp |
| US | 8.8.8.8:53 | a19.dscg10.akamai.net | udp |
| US | 8.8.8.8:53 | redirector.gvt1.com | udp |
| GB | 142.250.200.14:443 | redirector.gvt1.com | tcp |
| US | 8.8.8.8:53 | redirector.gvt1.com | udp |
| US | 8.8.8.8:53 | redirector.gvt1.com | udp |
| GB | 142.250.200.14:443 | redirector.gvt1.com | udp |
| US | 8.8.8.8:53 | r2---sn-aigzrnse.gvt1.com | udp |
| GB | 74.125.168.199:443 | r2---sn-aigzrnse.gvt1.com | tcp |
| US | 8.8.8.8:53 | r2.sn-aigzrnse.gvt1.com | udp |
| US | 8.8.8.8:53 | r2.sn-aigzrnse.gvt1.com | udp |
| US | 8.8.8.8:53 | 209.134.221.88.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 14.200.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 199.168.125.74.in-addr.arpa | udp |
| GB | 74.125.168.199:443 | r2.sn-aigzrnse.gvt1.com | udp |
| US | 8.8.8.8:53 | play.google.com | udp |
| GB | 142.250.200.46:443 | play.google.com | tcp |
| US | 8.8.8.8:53 | play.google.com | udp |
| GB | 142.250.200.46:443 | play.google.com | udp |
| US | 8.8.8.8:53 | play.google.com | udp |
| US | 8.8.8.8:53 | 46.200.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | firefox-settings-attachments.cdn.mozilla.net | udp |
| US | 34.117.121.53:443 | firefox-settings-attachments.cdn.mozilla.net | tcp |
| US | 34.117.121.53:443 | firefox-settings-attachments.cdn.mozilla.net | tcp |
| US | 34.117.121.53:443 | firefox-settings-attachments.cdn.mozilla.net | tcp |
| US | 34.117.121.53:443 | firefox-settings-attachments.cdn.mozilla.net | tcp |
| US | 34.117.121.53:443 | firefox-settings-attachments.cdn.mozilla.net | tcp |
| US | 34.117.121.53:443 | firefox-settings-attachments.cdn.mozilla.net | tcp |
| US | 8.8.8.8:53 | attachments.prod.remote-settings.prod.webservices.mozgcp.net | udp |
| US | 8.8.8.8:53 | attachments.prod.remote-settings.prod.webservices.mozgcp.net | udp |
| US | 8.8.8.8:53 | 53.121.117.34.in-addr.arpa | udp |
| GB | 142.250.200.46:443 | play.google.com | tcp |
| GB | 142.250.200.46:443 | play.google.com | tcp |
| US | 8.8.8.8:53 | 73.144.22.2.in-addr.arpa | udp |
| GB | 216.58.201.110:443 | consent.youtube.com | udp |
| US | 8.8.8.8:53 | beacons.gcp.gvt2.com | udp |
| GB | 172.217.169.35:443 | beacons.gcp.gvt2.com | tcp |
| GB | 172.217.169.35:443 | beacons.gcp.gvt2.com | tcp |
| US | 8.8.8.8:53 | 35.169.217.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.214.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 122.10.44.20.in-addr.arpa | udp |
Files
memory/1284-0-0x0000000000890000-0x0000000000D5B000-memory.dmp
memory/1284-1-0x0000000077564000-0x0000000077566000-memory.dmp
memory/1284-2-0x0000000000891000-0x00000000008BF000-memory.dmp
memory/1284-3-0x0000000000890000-0x0000000000D5B000-memory.dmp
memory/1284-5-0x0000000000890000-0x0000000000D5B000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
| MD5 | c507b1fdfce35810fb9bffcbf4ae7a26 |
| SHA1 | e8e0c51cbabc34300a6ef97955c3694f01cb7756 |
| SHA256 | 16c4e552b6fc325bd01db07c4f1165883e13522c3832c494bea381006e737310 |
| SHA512 | cd7d0072b7392cba4854d1303bb1f33573ef371590fae7256d04b7e286e64fbf42c22466c9c8f6fc423c5965b1ae007e82b92a25038472964067c1d00d9b4ab1 |
memory/4640-18-0x0000000000490000-0x000000000095B000-memory.dmp
memory/1284-17-0x0000000000890000-0x0000000000D5B000-memory.dmp
memory/4640-19-0x0000000000490000-0x000000000095B000-memory.dmp
memory/4640-20-0x0000000000490000-0x000000000095B000-memory.dmp
memory/4640-21-0x0000000000490000-0x000000000095B000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\1000006001\1ec8f29b8f.exe
| MD5 | 3cf711041254d965f4d100dfd2af83b5 |
| SHA1 | 567f213eabaf61bf82e941631dbecd518b61d089 |
| SHA256 | 77e9b3740b0e2fd375cd1981ce2ad2ece335200794fa7eb92d4befee2094b9ce |
| SHA512 | 629f3136a6ebacf69800ed96000709c28ac096937c75cacb262394922779ab6cc613dd496e263ac02b41b998daa570771b68fd6a79b5d73fb3c4a45ef0bdb718 |
memory/3136-37-0x0000000000370000-0x0000000000F5B000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\1000010001\7cdcc83c66.exe
| MD5 | bc08b445116ecc06852a929a5d302c4a |
| SHA1 | a78aa42220b90d47b4cf63119e6082f06b295f57 |
| SHA256 | 5b232254dd2d33eb576516116977c884fba81d5a8427f742a73655f9e076efc6 |
| SHA512 | 657a21d453112fb909be4005e0cab1ebf467840e275a159eb535b486432ffa0bfcc60da92475b26f08a0ea481c927654520a43163e04e34324551cb3bfd69fdf |
C:\Users\Admin\AppData\Local\Temp\D0FC.tmp\D0FD.tmp\D0FE.bat
| MD5 | de9423d9c334ba3dba7dc874aa7dbc28 |
| SHA1 | bf38b137b8d780b3d6d62aee03c9d3f73770d638 |
| SHA256 | a1e1b422c40fb611a50d3f8bf34f9819f76ddb304aa2d105fb49f41f57752698 |
| SHA512 | 63f13acd904378ad7de22053e1087d61a70341f1891ada3b671223fec8f841b42b6f1060a4b18c8bb865ee4cd071cadc7ff6bd6d549760945bf1645a1086f401 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | 0331fa75ac7846bafcf885ea76d47447 |
| SHA1 | 5a141ffda430e091153fefc4aa36317422ba28ae |
| SHA256 | 64b4b2e791644fc04f164ecd13b8b9a3e62669896fb7907bf0a072bbeebaf74a |
| SHA512 | f8b960d38d73cf29ce17ea409ef6830cae99d7deafaf2ff59f8347120d81925ff16e38faaa0f7f4c39936472d05d1d131df2a8a383351f138c38afb21c1a60e2 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
| MD5 | d63d1e301f1aca59b65a96be5a9a33a0 |
| SHA1 | 7f56fb3b9015eca0d608ce322b0851ee2ba50d93 |
| SHA256 | f3f16bbc693e681bd669e6b3207f44c3a370365d5a3f3aa78ec54c7750f4299b |
| SHA512 | 531b5b5dcc07336737691e9ec6c7cc6e13b75d53461041ae5f9d741e19a18a96b021f60a6c41ec22835b63a67ad539e036a33bd243e9e2724478d864b3fde35c |
\??\pipe\crashpad_2288_UTXKVYZFHWPJUFAN
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | f0f818d52a59eb6cf9c4dd2a1c844df9 |
| SHA1 | 26afc4b28c0287274624690bd5bd4786cfe11d16 |
| SHA256 | 58c0beea55fecbeded2d2c593473149214df818be1e4e4a28c97171dc8179d61 |
| SHA512 | 7e8a1d3a6c8c9b0f1ac497e509e9edbe9e121df1df0147ce4421b8cf526ad238bd146868e177f9ce02e2d8f99cf7bb9ce7db4a582d487bbc921945211a977509 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 8b6f2c6c13de74a917f480308d418707 |
| SHA1 | 2bc83a70c5aaca356b7681aac81f6b656416a18c |
| SHA256 | e788501aa91c9e6a1d168a4b9f49da0fccf754414de900032dbdfe52b2b9147b |
| SHA512 | 8b714d7cc21196084df5d5aa76f27eec9142b4d80cc8cfad990e952dd8676c5011c4a2c95ef39a1ee65d2090b569c436b2ffa035e6dff5e5de00e2f0480fc209 |
memory/3136-112-0x0000000061E00000-0x0000000061EF3000-memory.dmp
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vg8iw5f0.default-release\prefs.js
| MD5 | 4058595e154151eb104046bad1523d52 |
| SHA1 | e07a92186f0ff92e21906248d61d0e4c637ca912 |
| SHA256 | 8b8a1f05ea783f189975ef0fc201dd43b46dc23223e2d0b2daf0da3a022c7ccb |
| SHA512 | e4cee940061ed611119d81c447171167e809434da9121a19c2e00e77e206584c680aa7418718d10b80eef35775b6c240c575372f03a8ee62e736a4dfefbb15be |
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\vg8iw5f0.default-release\activity-stream.discovery_stream.json.tmp
| MD5 | b8c93f3e8dfba88e28efd8509b9144b0 |
| SHA1 | a700dbb920640636d16a43088633acbdd74295ee |
| SHA256 | b804039b71b640a4f6d7de53342a046b5cfab75120b8960976893891755cfc0f |
| SHA512 | a6121179105bc9f0f602990dcc5f7238ade0fd14d34dd5a6e40f1e216a5351a18b51ebc5484d358ff7374bdbf1fc3955d0575e20aa8fd9b67ef0a0dd1d65323b |
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\vg8iw5f0.default-release\activity-stream.discovery_stream.json.tmp
| MD5 | 13ab084b2492d64e8b3adefca9e42445 |
| SHA1 | 23bf098abfc83f46d06bb630ab611d0eb4f24f8d |
| SHA256 | aa5a8ad6129edbe81952a460a160350c1b3f9325086ed3eb464a4e01d7db180a |
| SHA512 | 6681df172d200dead34f3e5ef6576bf45f50f1aef393b64a7848ae3046d11b6ece56df7b850c50e6cee855fd9edf8851acfa88942ad79443741b867371421e02 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
| MD5 | d751713988987e9331980363e24189ce |
| SHA1 | 97d170e1550eee4afc0af065b78cda302a97674c |
| SHA256 | 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945 |
| SHA512 | b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af |
memory/4640-240-0x0000000000490000-0x000000000095B000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001
| MD5 | 51c3c3d00a4a5a9d730c04c615f2639b |
| SHA1 | 3b92cce727fc1fb03e982eb611935218c821948f |
| SHA256 | cb1e96afd2fec2b2b445be2f46c6b90db19c2ed2f0278f57f7490a299e88c19f |
| SHA512 | 7af8ec3160e4dbae2c3359146c0a82c32a02697d332138c391e4295d00f49ed1070857a0afe16222c5cea1cafffc4d26df525543f187be43a59967df1e919542 |
C:\ProgramData\nss3.dll
| MD5 | 1cc453cdf74f31e4d913ff9c10acdde2 |
| SHA1 | 6e85eae544d6e965f15fa5c39700fa7202f3aafe |
| SHA256 | ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5 |
| SHA512 | dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571 |
C:\ProgramData\mozglue.dll
| MD5 | c8fd9be83bc728cc04beffafc2907fe9 |
| SHA1 | 95ab9f701e0024cedfbd312bcfe4e726744c4f2e |
| SHA256 | ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a |
| SHA512 | fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040 |
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vg8iw5f0.default-release\cookies.sqlite-wal
| MD5 | 27db6fe8291d113bf3e5545e19326bb0 |
| SHA1 | 06fbb0f155f235e7c66a6511427e6286e3dfed90 |
| SHA256 | 93a0e37728e44a76ccdecd122b58e342aafac5d22b9f2d17048b3ef4b4d6764e |
| SHA512 | a59c3136c5803f3de5b56bb36b91b52e409783f79407ade34cd96b158724ac8cbd2f25789994b5638b5a6acb8904d892f491faf09c3c59f87268a172daa36afb |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000005
| MD5 | 103d7813f0ccc7445b4b9a4b34fc74bf |
| SHA1 | ed862e8ebd885acde6115c340e59e50e74e3633b |
| SHA256 | 0ccaf58bb2aa430724873fa21515e5f3fbd875390288aade3823ec16962bc27b |
| SHA512 | 0723baca97705968a068676f74ac01bd492dac94a4fba391de578b6357b79c4aca5412f564dc0ea7ae5b6145256c7f8f22e8a4823f41e2baf50d201ec073be1f |
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vg8iw5f0.default-release\places.sqlite-wal
| MD5 | e23f1edb661839629750b1f84233c930 |
| SHA1 | a0f7eb8662186e45cf57fbe8ff5df0934920594c |
| SHA256 | e9cae7d3cfa9c90a85b70aa7b05960699c19eb79fed2c4dfc9533e86ac0335d1 |
| SHA512 | d175d71067bf486eb98cef06b3ae0ebd3921dcc3caf5b7e20fb5709df835f86101a66fde225fcb75565bec16e08df142a74fe9fc0b48550278fe8fd4f8a302fa |
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vg8iw5f0.default-release\prefs.js
| MD5 | 021f463c5e555b850e032ecdec53f2d2 |
| SHA1 | 706ef481fd3e236a952d5dc80a196a43b6e73f61 |
| SHA256 | b1e2611f21c62233dd712b641dc4c2fe93872f6e5ac887bfc237fc13a24c4e2f |
| SHA512 | e113152e8c843a8414e19685e4713697cbc0d0c03455c63c219abf85317ebc6c4831ddd7fa1767d8b22d12ea6712cc0159177bdd654834f211f66f144b009683 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
| MD5 | 53db6b4e0eafb34925a80811df17a6a7 |
| SHA1 | 056a2a6cd7bfea55e1bc9af78731e596964ea86f |
| SHA256 | 50dd770dfecaf1db2f5f39972793f3b314e4209251de7fc1a89f2cd1fcba2e0a |
| SHA512 | cd71a084ddab3e3641c68dab5dc6093c7e4434b4778ae4ac9b29ff3e992fa5636f37e4b02aa3aba000378a6e88706ba5a5f64a1d4ab9215678df463bec04da82 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | 46233fb7d492043fb42467c88ae1aefe |
| SHA1 | 7084029d28962884997ff22f1e133124c84c432f |
| SHA256 | 8decd61ccd34805d3eb88cb677e394bb397d7d44bef48516ed16e28c7e6cba7e |
| SHA512 | c0916a224cab1a49f6cc10552e7f0bc013c861c33a188578558a142fcf9a65d1a0ef6bb3b416e1325b277e58271236f03de87b0598a3893134be68aec07e0bca |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | 674b18cfc8ef7a5d46c7f69a830521dd |
| SHA1 | b72aea2e5f5617e8e2ec4a764d0637a00768150a |
| SHA256 | f7231f1463b474f706229cff806de2044a336639b8b97d053c0dc8d5fc1ccbe2 |
| SHA512 | 78b63b0578098a6f4f624d3ee1d2a5f2461477e6843c35f47f415dc74dbb01196529b8c788ca942a3ebf3caeb9ee6bf8d13c275b1e674ae50092140a256b2226 |
memory/3136-344-0x0000000000370000-0x0000000000F5B000-memory.dmp
memory/2204-348-0x0000000000050000-0x000000000051B000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | d4c8eac90ce4e6cf950a0c565f54411a |
| SHA1 | 9cd979115988a149a35c492c38f712b25813c4ea |
| SHA256 | 4b65b48b4f6f4f693537cabf0331afeb5208d6a17f9514418bb1dac1767d658a |
| SHA512 | 41b4980cc59d4699bbc8326909a42f293e55ed7a697708809e7c534ae13c972c03e6488957972e95583b1c268777c80fd88c43a5a25ce6c5c1ca6e85851c24e4 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
| MD5 | 83a961c428ac753795c1e741470a71ff |
| SHA1 | ee92643b72031583d8d672cde05e100ce361ce7e |
| SHA256 | 5f8dc7b79167df81eedf9bade04f4a833110c6c3022a41f8ebd85d231cea8374 |
| SHA512 | 9f7e10ed47e16c0de5f7d195b5cb6afa8b613f282fb163bd8173cee65ee8b5596afdf6b7eacfe649a528ea92e86b1751e6743725cf85125973aeb8f876a5282e |
memory/2204-365-0x0000000000050000-0x000000000051B000-memory.dmp
memory/4640-372-0x0000000000490000-0x000000000095B000-memory.dmp
memory/4640-377-0x0000000000490000-0x000000000095B000-memory.dmp
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vg8iw5f0.default-release\sessionstore-backups\recovery.jsonlz4
| MD5 | dedb382b28d35056f3e6f681e2456422 |
| SHA1 | 27ffdafadeaae4cf2215aad9b8c643c1c5053eef |
| SHA256 | 9d9d3c9174897093869719059e88bfc98499092dde12edf482545dc51a488755 |
| SHA512 | 19120e463fdd706838166eea20a7e0ca942f99b34b592e00be6ed4f6ae1a04f5e89f2ddadcfd8afd3148b242074ebbc2172809cc629860cdd105862e5d5ea20e |
memory/4640-383-0x0000000000490000-0x000000000095B000-memory.dmp
memory/4640-384-0x0000000000490000-0x000000000095B000-memory.dmp
memory/4640-385-0x0000000000490000-0x000000000095B000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
| MD5 | 3fc057a07986dd521bfc42f209325bfc |
| SHA1 | 60cea3f163d1c3ad4efd6df8b9bbe6f349ed4275 |
| SHA256 | 09ed17dd59856b5f9f89fdf0823c903ef82abbbf9e5b1ad6bb3a950c19da6cdc |
| SHA512 | c626ac666a7e9efe1106345552b36b1eaaeb4869995c214b596250d54a56153d04a07f04e2a448f88c70d7e33497540914c2fba5f51195abe8a2f8b4c403c9b0 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
| MD5 | 81f54070144585f48f78b8ee2d6263ac |
| SHA1 | b89cd2640ef21cfb95181a8533c7e5823acd6e94 |
| SHA256 | 0888dbea8830dcd8addcb1aa9968a92ea7187196decceadc75f7aac71d3d471f |
| SHA512 | 1fb58ab7a16eb75fc13e65bdda757b11e23346bb5ff6b8417694f69bfcc68b40e6ddde57f870b42050182cace81a2646190272454745b6e7fcb92eea8ecafc3a |
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\vg8iw5f0.default-release\cache2\entries\5CD1EBDF6B57F13C7E783CE5E6D8E9C44014FE1A
| MD5 | e5a78bc28287df43a7a47c5e1a7a17bf |
| SHA1 | c7c0f9b83109ea967be50dfc42b02e2ff6de9874 |
| SHA256 | 883b801b936c5ded0d651054e538280418567b0ad2851b905211798cf86694b8 |
| SHA512 | 862d3e1e2fc7bd2f28b882ed9242214cf058d741a6edd6251067ae7bba6d49bc63805e408c59061355961f425356b5572edd6a71c0aca197ee03604fdb301ffe |
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vg8iw5f0.default-release\prefs-1.js
| MD5 | 5a7f4058467e43e67a2b16ec2e8d9f0c |
| SHA1 | 76a4c74f26c4b76c820cd2eb8ee7add089a7e088 |
| SHA256 | 86acd0b5372718b0bc1f9abd4f1d58ab45cee9d5505acae5377f6e223b11f3d8 |
| SHA512 | a3ff4dd45700f9703a4a9053b80922247bd2b962377d0853dc6571ea30ef6491d3e168f7b487132576d418c27fab789bd32243e8e8f9a0cea2ad146b0908528f |
C:\Users\Admin\AppData\Local\Temp\tmpaddon
| MD5 | 85430baed3398695717b0263807cf97c |
| SHA1 | fffbee923cea216f50fce5d54219a188a5100f41 |
| SHA256 | a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e |
| SHA512 | 06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1 |
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vg8iw5f0.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
| MD5 | fe3355639648c417e8307c6d051e3e37 |
| SHA1 | f54602d4b4778da21bc97c7238fc66aa68c8ee34 |
| SHA256 | 1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e |
| SHA512 | 8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c |
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vg8iw5f0.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
| MD5 | 3d33cdc0b3d281e67dd52e14435dd04f |
| SHA1 | 4db88689282fd4f9e9e6ab95fcbb23df6e6485db |
| SHA256 | f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b |
| SHA512 | a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1 |
memory/4640-527-0x0000000000490000-0x000000000095B000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
| MD5 | a01c5ecd6108350ae23d2cddf0e77c17 |
| SHA1 | c6ac28a2cd979f1f9a75d56271821d5ff665e2b6 |
| SHA256 | 345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42 |
| SHA512 | b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72 |
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vg8iw5f0.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
| MD5 | 49ddb419d96dceb9069018535fb2e2fc |
| SHA1 | 62aa6fea895a8b68d468a015f6e6ab400d7a7ca6 |
| SHA256 | 2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539 |
| SHA512 | 48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2 |
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vg8iw5f0.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
| MD5 | 8be33af717bb1b67fbd61c3f4b807e9e |
| SHA1 | 7cf17656d174d951957ff36810e874a134dd49e0 |
| SHA256 | e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd |
| SHA512 | 6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7 |
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vg8iw5f0.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
| MD5 | 33bf7b0439480effb9fb212efce87b13 |
| SHA1 | cee50f2745edc6dc291887b6075ca64d716f495a |
| SHA256 | 8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e |
| SHA512 | d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275 |
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vg8iw5f0.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
| MD5 | 937326fead5fd401f6cca9118bd9ade9 |
| SHA1 | 4526a57d4ae14ed29b37632c72aef3c408189d91 |
| SHA256 | 68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81 |
| SHA512 | b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2 |
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vg8iw5f0.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
| MD5 | 688bed3676d2104e7f17ae1cd2c59404 |
| SHA1 | 952b2cdf783ac72fcb98338723e9afd38d47ad8e |
| SHA256 | 33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237 |
| SHA512 | 7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776 |
memory/4640-1389-0x0000000000490000-0x000000000095B000-memory.dmp
memory/6560-1728-0x0000000000490000-0x000000000095B000-memory.dmp
memory/6560-1784-0x0000000000490000-0x000000000095B000-memory.dmp
memory/4640-1813-0x0000000000490000-0x000000000095B000-memory.dmp
memory/4640-2458-0x0000000000490000-0x000000000095B000-memory.dmp
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
| MD5 | b36218042ba06163ab81f49720c2021a |
| SHA1 | 6b0c7925d998f766af6a57bfd5457b87e13032f9 |
| SHA256 | 68a9256783e744fdd5061c7b47680a8496a0785220137fbcea632112b7ce37cd |
| SHA512 | 8c6a287784999e7cdf81390e5a0ac40fffdd84df654085af53de9a423242cdc28df0446eb2a8a848915c4e6447d912d3638307528854edf4bc5d51e7fe42640b |
memory/4640-2490-0x0000000000490000-0x000000000095B000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
| MD5 | e39fc201b53a3137a8dc753bc6b9d622 |
| SHA1 | a51b31cfc22f8b0e60c1c97dddac6b8a11698874 |
| SHA256 | 3073dcf4942c20726db359aad8085ca13f3b93c011d81ae8b31b2f5fc5510749 |
| SHA512 | 4db7bdf3dc1a71f7e01a4ed2142594dc9f88ba605eb23b0f338369db3f3fbd1bc6cbf348da093100c91ce311f990bdd3eccda604e51e8e21f4d05719c6d13239 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
| MD5 | 973cb474755999006d8154c1446d0cb2 |
| SHA1 | f61ad2cf45644abe3e5ccb5d51d897a5de7f8156 |
| SHA256 | e5980d945ca494c22927f27339c681f994c632e1f664c7f7c10f3da25364ef61 |
| SHA512 | b008db179922060c408898f27c61044513b04babdbe4aa4e3387f35df7503969e31a82064482ffc8e0a2054672da5ba66c8c9fd7ed92ceff48b36d18651d6793 |
memory/4640-2501-0x0000000000490000-0x000000000095B000-memory.dmp
memory/4640-2502-0x0000000000490000-0x000000000095B000-memory.dmp
memory/4640-2503-0x0000000000490000-0x000000000095B000-memory.dmp
memory/4384-2505-0x0000000000490000-0x000000000095B000-memory.dmp
memory/4384-2507-0x0000000000490000-0x000000000095B000-memory.dmp
memory/4640-2508-0x0000000000490000-0x000000000095B000-memory.dmp
memory/4640-2521-0x0000000000490000-0x000000000095B000-memory.dmp
memory/4640-2522-0x0000000000490000-0x000000000095B000-memory.dmp
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
| MD5 | 50c58c26e6242d4e3133c081fa7bbc6c |
| SHA1 | 1891c8ac4fde9ad683b4341875088201dec49907 |
| SHA256 | e65925fcf765e3ee98d88a4c6b3ed4c37ecbcab5e8a9ff11f306597574e260e6 |
| SHA512 | 05a6bac59da251a24584da2a6b7775be09d67576c921fca518a02aae06023d9cc4338d86b298fb2e3a24c211dddb4456d2e87da1145a3795f37f7346e6db0685 |