Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-07-2024 17:06

General

  • Target

    538982ed425cfad7ee22aa81e0630a564a2a0628a1cae45a6c5ad47969c48a5e.exe

  • Size

    1.9MB

  • MD5

    f0ec9b272157493bffff098208f614d5

  • SHA1

    e78ea4ed8aace1b9ce8a4ffde1ae87c9cbe94df6

  • SHA256

    538982ed425cfad7ee22aa81e0630a564a2a0628a1cae45a6c5ad47969c48a5e

  • SHA512

    a72a92b028a626480e058b432d7a5ada270b60c073255f2385814084927a6727da139a0c39295f83946e269af0bb1eeb654713766c75d94d9e579efeda9f2d69

  • SSDEEP

    49152:nCLjB4MFD1H9WZ9yNJ0P1REZrPMtqFkFeIJp2:CvB4MFhQZ9yNJqRyrMtqFqJp

Malware Config

Extracted

Family

amadey

Version

4.30

Botnet

4dd39d

C2

http://77.91.77.82

Attributes
  • install_dir

    ad40971b6b

  • install_file

    explorti.exe

  • strings_key

    a434973ad22def7137dbb5e059b7081e

  • url_paths

    /Hun4Ko/index.php

rc4.plain

Extracted

Family

stealc

Botnet

hate

C2

http://85.28.47.30

Attributes
  • url_path

    /920475a59bac849d.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Stealc

    Stealc is an infostealer written in C++.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 10 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 5 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 6 IoCs
  • Identifies Wine through registry keys 2 TTPs 5 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 2 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 10 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies data under HKEY_USERS 1 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 28 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\538982ed425cfad7ee22aa81e0630a564a2a0628a1cae45a6c5ad47969c48a5e.exe
    "C:\Users\Admin\AppData\Local\Temp\538982ed425cfad7ee22aa81e0630a564a2a0628a1cae45a6c5ad47969c48a5e.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:4972
    • C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
      "C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3500
      • C:\Users\Admin\AppData\Local\Temp\1000006001\8e228009b7.exe
        "C:\Users\Admin\AppData\Local\Temp\1000006001\8e228009b7.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:4792
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\KJEHDHIEGI.exe"
          4⤵
            PID:3252
            • C:\Users\Admin\AppData\Local\Temp\KJEHDHIEGI.exe
              "C:\Users\Admin\AppData\Local\Temp\KJEHDHIEGI.exe"
              5⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • Suspicious behavior: EnumeratesProcesses
              PID:1304
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\BKFCBFCBFB.exe"
            4⤵
            • Checks computer location settings
            • Suspicious use of SetWindowsHookEx
            PID:5620
        • C:\Users\Admin\AppData\Local\Temp\1000010001\a931f70994.exe
          "C:\Users\Admin\AppData\Local\Temp\1000010001\a931f70994.exe"
          3⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:3112
          • C:\Windows\system32\cmd.exe
            "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\CC78.tmp\CC79.tmp\CC7A.bat C:\Users\Admin\AppData\Local\Temp\1000010001\a931f70994.exe"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:4952
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.youtube.com/account"
              5⤵
              • Enumerates system info in registry
              • Modifies data under HKEY_USERS
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              • Suspicious use of WriteProcessMemory
              PID:1740
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.106 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffb3c11cc40,0x7ffb3c11cc4c,0x7ffb3c11cc58
                6⤵
                  PID:3584
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1932,i,15935859227519118223,17863311464278837358,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=1928 /prefetch:2
                  6⤵
                    PID:904
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2172,i,15935859227519118223,17863311464278837358,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=2184 /prefetch:3
                    6⤵
                      PID:3300
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2260,i,15935859227519118223,17863311464278837358,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=2448 /prefetch:8
                      6⤵
                        PID:684
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3076,i,15935859227519118223,17863311464278837358,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=3096 /prefetch:1
                        6⤵
                          PID:5472
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3084,i,15935859227519118223,17863311464278837358,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=3148 /prefetch:1
                          6⤵
                            PID:5328
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4524,i,15935859227519118223,17863311464278837358,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=4712 /prefetch:8
                            6⤵
                              PID:5920
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4772,i,15935859227519118223,17863311464278837358,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=3692 /prefetch:8
                              6⤵
                                PID:412
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4692,i,15935859227519118223,17863311464278837358,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=4656 /prefetch:8
                                6⤵
                                • Drops file in System32 directory
                                • Suspicious behavior: EnumeratesProcesses
                                PID:5660
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/account"
                              5⤵
                              • Enumerates system info in registry
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                              • Suspicious use of FindShellTrayWindow
                              • Suspicious use of SendNotifyMessage
                              • Suspicious use of WriteProcessMemory
                              PID:4808
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ffb3bfd46f8,0x7ffb3bfd4708,0x7ffb3bfd4718
                                6⤵
                                  PID:3416
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,11504862448008802131,10321515186859765932,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
                                  6⤵
                                    PID:400
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,11504862448008802131,10321515186859765932,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
                                    6⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:2872
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,11504862448008802131,10321515186859765932,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:8
                                    6⤵
                                      PID:1612
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,11504862448008802131,10321515186859765932,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
                                      6⤵
                                        PID:1948
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,11504862448008802131,10321515186859765932,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3472 /prefetch:1
                                        6⤵
                                          PID:1532
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,11504862448008802131,10321515186859765932,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4664 /prefetch:1
                                          6⤵
                                            PID:5860
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,11504862448008802131,10321515186859765932,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2516 /prefetch:2
                                            6⤵
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:1692
                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                          "C:\Program Files\Mozilla Firefox\firefox.exe" "https://www.youtube.com/account"
                                          5⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:228
                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                            "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
                                            6⤵
                                            • Checks processor information in registry
                                            • Modifies registry class
                                            • Suspicious use of AdjustPrivilegeToken
                                            • Suspicious use of FindShellTrayWindow
                                            • Suspicious use of SendNotifyMessage
                                            • Suspicious use of SetWindowsHookEx
                                            • Suspicious use of WriteProcessMemory
                                            PID:2336
                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1972 -parentBuildID 20240401114208 -prefsHandle 1888 -prefMapHandle 1856 -prefsLen 25753 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3cbcf441-9f67-41eb-8532-fdb003e18c9a} 2336 "\\.\pipe\gecko-crash-server-pipe.2336" gpu
                                              7⤵
                                                PID:3608
                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2388 -parentBuildID 20240401114208 -prefsHandle 2436 -prefMapHandle 2432 -prefsLen 26673 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5a21518a-3768-4d0b-9a43-927af163ca85} 2336 "\\.\pipe\gecko-crash-server-pipe.2336" socket
                                                7⤵
                                                  PID:5032
                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3288 -childID 1 -isForBrowser -prefsHandle 3280 -prefMapHandle 3104 -prefsLen 22698 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {68a00047-073f-4820-90b8-ab1aadc084c6} 2336 "\\.\pipe\gecko-crash-server-pipe.2336" tab
                                                  7⤵
                                                    PID:3480
                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3284 -childID 2 -isForBrowser -prefsHandle 3192 -prefMapHandle 3764 -prefsLen 31163 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a5bd4ec5-922b-45f0-84ae-4456a25a6cdc} 2336 "\\.\pipe\gecko-crash-server-pipe.2336" tab
                                                    7⤵
                                                      PID:2440
                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4548 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 2812 -prefMapHandle 2808 -prefsLen 31163 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {85c777f1-5318-495e-a45f-7770c4743960} 2336 "\\.\pipe\gecko-crash-server-pipe.2336" utility
                                                      7⤵
                                                      • Checks processor information in registry
                                                      PID:5608
                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5392 -childID 3 -isForBrowser -prefsHandle 5384 -prefMapHandle 5380 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b3cdb41a-d565-4248-a0c9-516ac3f5b81b} 2336 "\\.\pipe\gecko-crash-server-pipe.2336" tab
                                                      7⤵
                                                        PID:5820
                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5624 -childID 4 -isForBrowser -prefsHandle 5544 -prefMapHandle 5548 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3a18d472-33bf-4a51-8ce9-167965e5f2e6} 2336 "\\.\pipe\gecko-crash-server-pipe.2336" tab
                                                        7⤵
                                                          PID:5952
                                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5760 -childID 5 -isForBrowser -prefsHandle 5528 -prefMapHandle 5532 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0c56b1fd-aebb-472d-93f3-63387a25c65c} 2336 "\\.\pipe\gecko-crash-server-pipe.2336" tab
                                                          7⤵
                                                            PID:5992
                                              • C:\Windows\System32\CompPkgSrv.exe
                                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                1⤵
                                                  PID:5092
                                                • C:\Windows\System32\CompPkgSrv.exe
                                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                  1⤵
                                                    PID:5812
                                                  • C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe
                                                    "C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"
                                                    1⤵
                                                      PID:5680
                                                    • C:\Windows\system32\svchost.exe
                                                      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                      1⤵
                                                        PID:5336
                                                      • C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
                                                        C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
                                                        1⤵
                                                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                        • Checks BIOS information in registry
                                                        • Executes dropped EXE
                                                        • Identifies Wine through registry keys
                                                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        PID:1684
                                                      • C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
                                                        C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
                                                        1⤵
                                                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                        • Checks BIOS information in registry
                                                        • Executes dropped EXE
                                                        • Identifies Wine through registry keys
                                                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        PID:728

                                                      Network

                                                      MITRE ATT&CK Enterprise v15

                                                      Replay Monitor

                                                      Loading Replay Monitor...

                                                      Downloads

                                                      • C:\ProgramData\mozglue.dll

                                                        Filesize

                                                        593KB

                                                        MD5

                                                        c8fd9be83bc728cc04beffafc2907fe9

                                                        SHA1

                                                        95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                                                        SHA256

                                                        ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                                                        SHA512

                                                        fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                                                      • C:\ProgramData\nss3.dll

                                                        Filesize

                                                        2.0MB

                                                        MD5

                                                        1cc453cdf74f31e4d913ff9c10acdde2

                                                        SHA1

                                                        6e85eae544d6e965f15fa5c39700fa7202f3aafe

                                                        SHA256

                                                        ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                                                        SHA512

                                                        dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                        Filesize

                                                        288B

                                                        MD5

                                                        6a78d7397ee244480b2911fec7f6a293

                                                        SHA1

                                                        27758b7525134d8d8e51ed126b00db6201f41c3a

                                                        SHA256

                                                        2eb081e605d1a683f3b895bf41b18a622821e2adac5455c4230b065cf22e41f7

                                                        SHA512

                                                        726e3e67b2dd0c84723f88e8620436dcab062af0ff998795c7a25f6c29f3a41944036f267f769520227caf998e7cf463c453febe940e306024a92ff5575075cb

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                                        Filesize

                                                        3KB

                                                        MD5

                                                        55b58383e6ed72af6b4775309fdef6d9

                                                        SHA1

                                                        9a229aeaca9e05265d86447be03b9b5b92221359

                                                        SHA256

                                                        ef3ad394cf03b6a6cbd27191d0771ef6f9fee7c4c7f5cedbbb4e09481f267009

                                                        SHA512

                                                        3af631c6390fb030f58f135ff117c4e13926625afe77f4b195cbca409685d92b96b0be4921c07e1b8fd0620dd4bf2f48e56f3119227c4e1e6db2c7358451f44c

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                                                        Filesize

                                                        2B

                                                        MD5

                                                        d751713988987e9331980363e24189ce

                                                        SHA1

                                                        97d170e1550eee4afc0af065b78cda302a97674c

                                                        SHA256

                                                        4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                                        SHA512

                                                        b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                        Filesize

                                                        356B

                                                        MD5

                                                        d801a7450f83cf83304050be6178645a

                                                        SHA1

                                                        f763d9ccc2bd8e49142b2a9b9f975e693b684fd1

                                                        SHA256

                                                        9d453e4369989ef4e70ac0fc0801f28278a15f3238b7c8f62e407df554ac0ed8

                                                        SHA512

                                                        98373aff5f55fbd57c27e0b0d9da5a96647a795892490dd05b6f9a4c51846a480bfc01239368c42345aede262a495beaba2ace6eba206cffd35ed4cd8c6fc60c

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                        Filesize

                                                        8KB

                                                        MD5

                                                        7f447edf19cf38fb153d309c5c459947

                                                        SHA1

                                                        7c20e9959f348d4a022be7cd011750fb6677e579

                                                        SHA256

                                                        b05b5e9fadf7d79418871453f522f56b3b2323f924ad8c9f9445b392f26e90b5

                                                        SHA512

                                                        cc417bf2a5a9b4fab03b696ab5c22b0ababb73d4f0042631aa0d7847143dbe8792bf2921947cd93fce23a75c4b7997101a18e6324984bf36c1cfa31c6bc8867c

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                        Filesize

                                                        8KB

                                                        MD5

                                                        c9f2843507a5348f7ef33cf7f21fa2fb

                                                        SHA1

                                                        51ec8a58ad9bb4daa20a8de496eda6045103311a

                                                        SHA256

                                                        c8c5ed466661f91e2f03ce8a6ced478ac3fffacec324c87056ec0e7df848e135

                                                        SHA512

                                                        f7f3af1cf8a6598cb321a591265f404fdb3b2c48d358975737a25a62a3db7ffad005906425cbbf32504f948dc9c03fac69a6d637c8e4f6d4d6cd40c6989faf08

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                        Filesize

                                                        8KB

                                                        MD5

                                                        fd48fa9b1454128b16b8dfdc325e3fb4

                                                        SHA1

                                                        2f00bbaa820f5262b2696615be8754c9b3cba371

                                                        SHA256

                                                        8a055a6fa91eb948194e00a2538794e8b17e3ee9e2806dcbf0eb87282a170b9c

                                                        SHA512

                                                        84c3c2d3568d2775200ce3103afef1ece4c9a842979f01ed140db27772d575db381693252985e87003881001616c4611eca4ab6fc697cdb1e0bed450ba347721

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                        Filesize

                                                        8KB

                                                        MD5

                                                        4bddb064efeb0878090b916c5b1168d7

                                                        SHA1

                                                        e599369576095d4e735818222662b8f8b07d343e

                                                        SHA256

                                                        bbc8e7152b4fab17875fb89f66cd6e8e4abcad7093b4e32ce814ad094cd847d4

                                                        SHA512

                                                        7b12e48151704a6391537df6751e11e0838e9ec63a75db17233c7fcbf51dc449db97ee3d97209202875fcd17e8a1669e21b01f280dec8a1a75de92609d262225

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                        Filesize

                                                        8KB

                                                        MD5

                                                        63b0acd92c4ab0ae74b406fb5a484368

                                                        SHA1

                                                        5b1aeabc6c4c9487fb02b422175e0c1e44a9f579

                                                        SHA256

                                                        2ed8851e000dc99a40cd24cc28d790153c1bc5ddcb8d2f7b5e8ae2f04c23b38e

                                                        SHA512

                                                        1992134534fab3ed5081be756ab7d690364e8a72b04ffb7b4d87b8b9756519a265055985125d1f5581a1e99dff1b1300a17c0b43fd3c6457e656870ceb1cbad9

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                        Filesize

                                                        8KB

                                                        MD5

                                                        0ecaedb7c05894a921a0674eea6be233

                                                        SHA1

                                                        c6f62331405b875dc6e9a9023e0a599d9a5a029f

                                                        SHA256

                                                        bdce629f30c5a3e9646d48eec1ed248c39262a6e2eff3503676faf089326e646

                                                        SHA512

                                                        f1966274f4e760c81dcc44bb95def96d0f1f54ab07ce12b77068d947830220acea9c4ea192e2a0d676243e674b5fdc67e602405b1bf9c02f0efc5fb10ba4ee66

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                        Filesize

                                                        8KB

                                                        MD5

                                                        d8b4917a5bd27c875dec7dee6444e7dd

                                                        SHA1

                                                        19e534da9c478951274a07f82e7c27d549358d2e

                                                        SHA256

                                                        f7db90bae86b64dfe768e70bbea6d370785947cecb048670f00e259194e38a48

                                                        SHA512

                                                        52a05949f4c0d8205a88125abef91a3af524537d9580c4b96f3bc27d533012e75046da53a18d869a27d77025d35f82b30f716ac79e87453ff869e6dab00788a7

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                        Filesize

                                                        181KB

                                                        MD5

                                                        8112149c0a8f97f6db207797ca176d3a

                                                        SHA1

                                                        57a978c39ab89556874cba4d7816553a87c60b13

                                                        SHA256

                                                        05351fe07d7b99a3fafa1442450efdae0716114db29aaf046b703a3c2a653198

                                                        SHA512

                                                        18ac1dc28173ad8253fdd5f4f4260eccefa71a1693598dcb2b7941aef2c86b2ec5690ff0f59153bc7007b5e95e004e0e8c1bdee1d1d427ed6c6ac659cf70a729

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                        Filesize

                                                        181KB

                                                        MD5

                                                        0d62c5e1f0fa83281cac3b56b4b86bf9

                                                        SHA1

                                                        099d9a41028ae7a0450de3ab9714126b14fc9550

                                                        SHA256

                                                        376f8edf59e199a4be72cf146031e5b67ac28d12fcbd22aa789b3bd4b78ca420

                                                        SHA512

                                                        4241778a6ba70f547b27a1bafa11240c88138a2cc5da6e77300844161b18334d7058a59a1607d976b88d0de884cbc0ad8d50dea26af4dfbbebee605044b9b402

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                        Filesize

                                                        152B

                                                        MD5

                                                        54aadd2d8ec66e446f1edb466b99ba8d

                                                        SHA1

                                                        a94f02b035dc918d8d9a46e6886413f15be5bff0

                                                        SHA256

                                                        1971045943002ef01930add9ba1a96a92ddc10d6c581ce29e33c38c2120b130e

                                                        SHA512

                                                        7e077f903463da60b5587aed4f5352060df400ebda713b602b88c15cb2f91076531ea07546a9352df772656065e0bf27bd285905a60f036a5c5951076d35e994

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                        Filesize

                                                        152B

                                                        MD5

                                                        2f842025e22e522658c640cfc7edc529

                                                        SHA1

                                                        4c2b24b02709acdd159f1b9bbeb396e52af27033

                                                        SHA256

                                                        1191573f2a7c12f0b9b8460e06dc36ca5386305eb8c883ebbbc8eb15f4d8e23e

                                                        SHA512

                                                        6e4393fd43984722229020ef662fc5981f253de31f13f30fadd6660bbc9ededcbfd163f132f6adaf42d435873322a5d0d3eea60060cf0e7f2e256262632c5d05

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

                                                        Filesize

                                                        38KB

                                                        MD5

                                                        c3aa6e31c125d83fb2eabcc9e33843dd

                                                        SHA1

                                                        ad91b78e1a9853ee876b77b82f75100ff5690d11

                                                        SHA256

                                                        c32b5cffb8ac92df9bd9340b75b8d0772a071af36df5b27879e45f6112f9b5b4

                                                        SHA512

                                                        897efddeb2d96e24aca43385cfb86a065034c4bb045c2e2b7391572e0ddd4a820b70fa83854de5048d7b7316fc9fa2f078924aab62206a7a135aaf91176a4c6b

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                        Filesize

                                                        240B

                                                        MD5

                                                        36da48d27d085c60e6f013ece42fee05

                                                        SHA1

                                                        f74501f1a147984ab4f45333e364f2482c4cfb7c

                                                        SHA256

                                                        99dc9e87fd9ef060be386c1c1fd79f6928b62afdbaafbfe732278cd833d3ebda

                                                        SHA512

                                                        950891946fb760f7687a975bfb8699fb091195a38887854cb1e4fbe699d65f8dfd21ff5c31cb12a6d22a4e45c1fbe19e359c356b25980e620f5a67e171d114a5

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                        Filesize

                                                        1KB

                                                        MD5

                                                        354ea0a1e6639cb350369878ce547208

                                                        SHA1

                                                        714b72c301070d9ccf9236217d99b11a24747039

                                                        SHA256

                                                        bf6eaa8fc3d7a141d5bd31a83f966fe3d3b13cca3a93fafcecaa336381c78e5e

                                                        SHA512

                                                        e83035ebc972ee61daddbf7948082536d89584e817d8875fc18fff3b7cfa0ff2c6bcaba00595bdc0d63b1e46d2c822fbe4c61376fa4cf73c59de72a17581740d

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                        Filesize

                                                        6KB

                                                        MD5

                                                        e0b30dbd52df0f2f70af7a10380b51ae

                                                        SHA1

                                                        cb392ab4f731cf46fb9f99c4a04f92d8b80da2ce

                                                        SHA256

                                                        0138c36f322b1d4fc45d291f9450546fd12ef2281f23299449608fd81157ee03

                                                        SHA512

                                                        09e126ea3ebd577cb91102b5c545f57045cc25c7120e0621a5797876debcba8894ff5e05e495d5b15c2e257a450bc170329a11b5f4a72dae3cdab0f08d6c8775

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                        Filesize

                                                        6KB

                                                        MD5

                                                        fa240707fddee70059cf71141101f7e5

                                                        SHA1

                                                        c4aaaa4bfb47962e773f404a56d3af90c2f38d9a

                                                        SHA256

                                                        758d754867397695e79c2123663ede8547f877735dc68c3878fb42debade5a47

                                                        SHA512

                                                        65d4df9ce7b7f9c224138d087b77a938f556476a211fcf55c9f58345e37f7eba0688fd7407b0b2319248c6fcab7996755a90ef105b8f623a9c3c412fe42ccdb7

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                        Filesize

                                                        11KB

                                                        MD5

                                                        c486affc6258e8bf035aef3311f75d72

                                                        SHA1

                                                        0300196d867f4f6e7a20f3da36b5ac8534ffc24f

                                                        SHA256

                                                        58a1fd589ac1692eda93b906326f394ce4cf123208981c9dbfa20b7888f96c3a

                                                        SHA512

                                                        d35e4027f4be3b0f77375d44570eb036576c5621bfc891ce3644a4068099cf3c927702e01b98f81924116fc4f1c866af35e33b8658cad2d8f52706eb41ff6829

                                                      • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zirruo9e.default-release\activity-stream.discovery_stream.json.tmp

                                                        Filesize

                                                        18KB

                                                        MD5

                                                        f479be209e043d1763839686c218a4d7

                                                        SHA1

                                                        d5bb56835dd6a85450a7390208a2c0ebf92d7380

                                                        SHA256

                                                        8be90fdb980766b80a95be8cb826a8b96b40268e33b4a3d6385c4f74bb40c1f8

                                                        SHA512

                                                        4ee73dd32b5a071f44d9c7d7c251da8a9ab6e002493cab6fe21d88d988e224972599d8d46dece08b5253083966f579600bf721de6688814f23d73f961b16ec30

                                                      • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zirruo9e.default-release\cache2\entries\5CD1EBDF6B57F13C7E783CE5E6D8E9C44014FE1A

                                                        Filesize

                                                        13KB

                                                        MD5

                                                        180d7d9ab85103fb8ca7a0427e2f3a40

                                                        SHA1

                                                        920c051e13ed628d09044668326af55ed3564fd1

                                                        SHA256

                                                        484ee34f5e8f328ac382d03388f96bf48ca4e99fe1f66abd230bef97a8e759a9

                                                        SHA512

                                                        e8f1611b512eb7b2a315cb69167cb1657b5522a76862591e2762260b087d8ca76c2ee179b8701c304d3a25b1fe52c74811d2abdca92a87f1e75dc978c865707d

                                                      • C:\Users\Admin\AppData\Local\Temp\1000006001\8e228009b7.exe

                                                        Filesize

                                                        2.4MB

                                                        MD5

                                                        c03d62f485ea79a178992f22c713c4a5

                                                        SHA1

                                                        aa16eb2b07a4b91b44c9e484923eb8bbcaf893d0

                                                        SHA256

                                                        546b5457cd26c9230fc49a456197aeeb761241adc2dd2774c37b1d3189968cb9

                                                        SHA512

                                                        3051d67889704c3adfe2748612d88b40acdde17b3fcf54ef8ae7466bd38b121db130300b53c9db9a981292507cf830d99bcd86ccacf320ec0198faa40af043fb

                                                      • C:\Users\Admin\AppData\Local\Temp\1000010001\a931f70994.exe

                                                        Filesize

                                                        89KB

                                                        MD5

                                                        bc08b445116ecc06852a929a5d302c4a

                                                        SHA1

                                                        a78aa42220b90d47b4cf63119e6082f06b295f57

                                                        SHA256

                                                        5b232254dd2d33eb576516116977c884fba81d5a8427f742a73655f9e076efc6

                                                        SHA512

                                                        657a21d453112fb909be4005e0cab1ebf467840e275a159eb535b486432ffa0bfcc60da92475b26f08a0ea481c927654520a43163e04e34324551cb3bfd69fdf

                                                      • C:\Users\Admin\AppData\Local\Temp\CC78.tmp\CC79.tmp\CC7A.bat

                                                        Filesize

                                                        2KB

                                                        MD5

                                                        de9423d9c334ba3dba7dc874aa7dbc28

                                                        SHA1

                                                        bf38b137b8d780b3d6d62aee03c9d3f73770d638

                                                        SHA256

                                                        a1e1b422c40fb611a50d3f8bf34f9819f76ddb304aa2d105fb49f41f57752698

                                                        SHA512

                                                        63f13acd904378ad7de22053e1087d61a70341f1891ada3b671223fec8f841b42b6f1060a4b18c8bb865ee4cd071cadc7ff6bd6d549760945bf1645a1086f401

                                                      • C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe

                                                        Filesize

                                                        1.9MB

                                                        MD5

                                                        f0ec9b272157493bffff098208f614d5

                                                        SHA1

                                                        e78ea4ed8aace1b9ce8a4ffde1ae87c9cbe94df6

                                                        SHA256

                                                        538982ed425cfad7ee22aa81e0630a564a2a0628a1cae45a6c5ad47969c48a5e

                                                        SHA512

                                                        a72a92b028a626480e058b432d7a5ada270b60c073255f2385814084927a6727da139a0c39295f83946e269af0bb1eeb654713766c75d94d9e579efeda9f2d69

                                                      • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                                                        Filesize

                                                        479KB

                                                        MD5

                                                        09372174e83dbbf696ee732fd2e875bb

                                                        SHA1

                                                        ba360186ba650a769f9303f48b7200fb5eaccee1

                                                        SHA256

                                                        c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                                                        SHA512

                                                        b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                                                      • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                                                        Filesize

                                                        13.8MB

                                                        MD5

                                                        0a8747a2ac9ac08ae9508f36c6d75692

                                                        SHA1

                                                        b287a96fd6cc12433adb42193dfe06111c38eaf0

                                                        SHA256

                                                        32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                                                        SHA512

                                                        59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zirruo9e.default-release\AlternateServices.bin

                                                        Filesize

                                                        10KB

                                                        MD5

                                                        4fef4e0409f2a758f1123650fb9727e5

                                                        SHA1

                                                        fb5ea32e89ad30588668bdd9d4e76fae53595861

                                                        SHA256

                                                        ed55800c8b82825492d0ffc8fce2d6388b5a9932d8447dc327d9e510288a434a

                                                        SHA512

                                                        84fd220288b35e23ae23b800d493af7f5a056ec0cca77ae527442bf9fdb270709c1f03adfc804c9eaec6b9d174d98e8bb8b336d160dbc14466b8c251b72578c1

                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zirruo9e.default-release\cookies.sqlite-wal

                                                        Filesize

                                                        192KB

                                                        MD5

                                                        8636fc1a5e2f28fe98e5457febeb7322

                                                        SHA1

                                                        5783caef1187cfb4f549d4e85742f02a1beb1107

                                                        SHA256

                                                        7421dc76fcda0b3f3cc738f4c8a435b74f595ed88c8f6e2159e20e2dfac15a57

                                                        SHA512

                                                        64293972c41552ff1746f86d3b4c217ecc768ab31df3b018a1a33f4d9e93d865a5c4d1a8fe0d6f8390bf995ee9f772961be25cb40eecc62f98ae0c8508a051fb

                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zirruo9e.default-release\datareporting\glean\db\data.safe.tmp

                                                        Filesize

                                                        24KB

                                                        MD5

                                                        dc92bd8c87e01d713580ac4a4485dea0

                                                        SHA1

                                                        ef50dc3cec2b65b1efea1044ee919042fdd2cf87

                                                        SHA256

                                                        64c05cabe0fb4659d9d6d9b8a39df80bb321f03146ad83464658d9fd4c8a27c2

                                                        SHA512

                                                        2b9bf3cc29e0bded83e6be1a4df8e5f7f74a989b422c59e27e60d0b6f155a5a5093eea426da5c8adf768363091cc8f784fc915348f6722c1ee37ab3fade6bffb

                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zirruo9e.default-release\datareporting\glean\db\data.safe.tmp

                                                        Filesize

                                                        21KB

                                                        MD5

                                                        7fc30e76ccea73745e9680aff113d320

                                                        SHA1

                                                        52acdf1a2ba08e89b8b4f253f14a1587f247d08f

                                                        SHA256

                                                        b699a96fe5e9cac41023c153ca3217f0de2d5c6a0c6b8df055dc883044194c31

                                                        SHA512

                                                        9476a21b96fcd66c676bd2d0d0dead94da27140e1d26635ca49eab2cb49cd5b4c91490f5be4fc3ab0e1c07bf6cdd141e695d9ca72fc7118871a81968507eaf3b

                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zirruo9e.default-release\datareporting\glean\db\data.safe.tmp

                                                        Filesize

                                                        22KB

                                                        MD5

                                                        fb20fd51ddeb9b2b176ed435ab9204ed

                                                        SHA1

                                                        0bc98081deb1e3d6219712ae4aaddb80c3bad7a3

                                                        SHA256

                                                        cf24aaf6099f95662b921ee36076a913175aa3de6b5a300d6cd37f9e85443ace

                                                        SHA512

                                                        ffd7081861d7b11f3804e333a848178bd7189ebe90bd7d39ed2d0cd400c07a7c53f4bdfe862a142ce74165b0f6715fc5c7b8752429c8f57666371e3543666cfe

                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zirruo9e.default-release\datareporting\glean\db\data.safe.tmp

                                                        Filesize

                                                        22KB

                                                        MD5

                                                        cfccc939b74fe5d507c7b6aac0866379

                                                        SHA1

                                                        aa1681d3f73bf3911df6745c819d17576f042e3c

                                                        SHA256

                                                        10c4e5a98cc38a652534b4d105e8d7feee1cc5909d69b3b14d9cc71eb77f59a4

                                                        SHA512

                                                        a2a0b364e391041a28bb2726a97373e4320ce0f72198a06184d4e4bcd3554a2b5b9504074d6875ae285c94902de88d0989ea311edc946a87d0199799070bf0be

                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zirruo9e.default-release\datareporting\glean\db\data.safe.tmp

                                                        Filesize

                                                        22KB

                                                        MD5

                                                        1c97f3192129edfcd5679eb40527098c

                                                        SHA1

                                                        7c5013e8db3d79cdfa1c373b52d5cf2083caf23e

                                                        SHA256

                                                        e9bd64bf2c129787d56c495cba48cfc6ae9125c5e7f5e1d0d79ab8b63d68baee

                                                        SHA512

                                                        035841792ca45b6f6df8c0459664ec5cffadffcb74696e601383a132c0da47c21570b90747f044c8d772655fd4167f2abac2d5401bfa5cd92ec4822839e527c9

                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zirruo9e.default-release\datareporting\glean\pending_pings\c802cb4e-e28f-46d5-83ce-67f4778db943

                                                        Filesize

                                                        659B

                                                        MD5

                                                        80d0c1028c830fa99adabbc000f1aaf5

                                                        SHA1

                                                        a63b2ffb7c54daf0af848737aa14216ac0589452

                                                        SHA256

                                                        04c73b19ba47692e639d294a911bac9661d634b62dbd2701f335ba0840d1bd6e

                                                        SHA512

                                                        cad13d1c0f4cfb5a0edcaf0c1a1f06025215083cbbb9ce335403c27f926123efd5e90cb8dc5a5d7305840c54e5b520083d58438f2a5c935110358026addb6ad2

                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zirruo9e.default-release\datareporting\glean\pending_pings\e609e4c8-0b3b-406a-9017-f4c6a596bbfd

                                                        Filesize

                                                        982B

                                                        MD5

                                                        0f031c32a5c5c67d8601a513b3f120f6

                                                        SHA1

                                                        8ed50c9aafecacda2d6af7623b75cf45c8e73966

                                                        SHA256

                                                        5f2c1bab4b867bdc2de114b62c60a9671a025c324664675c76c223a20ca56547

                                                        SHA512

                                                        b22df45c614d9c7326d078943982d86e5087fb769df09013e9c902edd527e76bc462dbd557f35c480b22a64e9436247aa250ac1fc41906113adfa42d64953723

                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zirruo9e.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

                                                        Filesize

                                                        1.1MB

                                                        MD5

                                                        842039753bf41fa5e11b3a1383061a87

                                                        SHA1

                                                        3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                                                        SHA256

                                                        d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                                                        SHA512

                                                        d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zirruo9e.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

                                                        Filesize

                                                        116B

                                                        MD5

                                                        2a461e9eb87fd1955cea740a3444ee7a

                                                        SHA1

                                                        b10755914c713f5a4677494dbe8a686ed458c3c5

                                                        SHA256

                                                        4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                                                        SHA512

                                                        34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zirruo9e.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

                                                        Filesize

                                                        372B

                                                        MD5

                                                        bf957ad58b55f64219ab3f793e374316

                                                        SHA1

                                                        a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                                                        SHA256

                                                        bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                                                        SHA512

                                                        79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zirruo9e.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

                                                        Filesize

                                                        17.8MB

                                                        MD5

                                                        daf7ef3acccab478aaa7d6dc1c60f865

                                                        SHA1

                                                        f8246162b97ce4a945feced27b6ea114366ff2ad

                                                        SHA256

                                                        bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                                                        SHA512

                                                        5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zirruo9e.default-release\places.sqlite-wal

                                                        Filesize

                                                        992KB

                                                        MD5

                                                        7dc0e8993484b4bfb616f05dc4f8a0f9

                                                        SHA1

                                                        6d87b1c13396852c6e03b97e65bbceee520daf99

                                                        SHA256

                                                        d816f84b29b42d443125f35812750052988c3943cb6c185aaaf41fe75456b3cd

                                                        SHA512

                                                        683935198daaa2205dcb4f8de4e1c7156d7ed51ed894f325ab2e7e80c6c0f4120a9856f6750361ecc110916cf3742e226fd532b210c71f046e72a3ac48fa96c8

                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zirruo9e.default-release\prefs-1.js

                                                        Filesize

                                                        8KB

                                                        MD5

                                                        9d12a8fb02df3dcf24d58a85bc1ee3fd

                                                        SHA1

                                                        0b6e16f271423ad5288eb0fbee60a55191d48696

                                                        SHA256

                                                        436514bc7d27437afebdf266af0a4e8b94caded3d1bdb1ed19a0382e397ddaf4

                                                        SHA512

                                                        b236708ebdea7831a1b0c984682c546dfc1dc2106c0c7b2be5061986f72b7c7055ad595a17a516f77ec809b60b24bd146d750e2d5e3bf0ce1b183058f2c59dde

                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zirruo9e.default-release\prefs-1.js

                                                        Filesize

                                                        10KB

                                                        MD5

                                                        f2a8b13ee9368f987abd3307c2b9fc43

                                                        SHA1

                                                        3a9d29492d57922c48908e88928b5d0f8138f010

                                                        SHA256

                                                        899587b943c02a84d46a0bc793e493044ae8096af0ebf60249e6d13f959ca9de

                                                        SHA512

                                                        fdbad924f82707fa3f5f774a373c7fc7389a4ed5007fd9911e3597ad911d4ab3e5d5625a26602d4d7949171bb5aa08cac7608ca066f273005eb8da9d73584b23

                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zirruo9e.default-release\prefs-1.js

                                                        Filesize

                                                        13KB

                                                        MD5

                                                        ce42a14bcd5b02b0a05a6b4f9213ce5b

                                                        SHA1

                                                        c501c9c7fa1d95c33ffe4494c0ee87e99fecc629

                                                        SHA256

                                                        c82117b1715d027ba9eb163ca399ab484e0b944889895b56734c537ea8979a92

                                                        SHA512

                                                        6fcb50b6a59359414a6355334f6602abb839977521ca01e9227306a674910d5e6884e0de0bd74aeea6739281db814f8be07e9d4b957d42b0771fe7cd3b6e4e61

                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zirruo9e.default-release\prefs.js

                                                        Filesize

                                                        8KB

                                                        MD5

                                                        cecdff8f3ab8e78a0526ca1fd6980202

                                                        SHA1

                                                        d4dc5e9e4c1d012fc918ef51025ca05505dfe484

                                                        SHA256

                                                        631e7d343c7cc2d89c7c147cadad4e2f5357d539498b2adcd46d99bcbb259f39

                                                        SHA512

                                                        80bd89e0d2d7dc3fa94125b338f10bdf5c8e961a4e1d1a9557076968c818cbb93337da418ac069150d248485de2dd2bdb6e7cf5d72e9d76237703ba9c2722628

                                                      • \??\pipe\crashpad_1740_OJQOGWRPIVWOCKOW

                                                        MD5

                                                        d41d8cd98f00b204e9800998ecf8427e

                                                        SHA1

                                                        da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                        SHA256

                                                        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                        SHA512

                                                        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                      • memory/728-2996-0x0000000000080000-0x0000000000558000-memory.dmp

                                                        Filesize

                                                        4.8MB

                                                      • memory/728-2995-0x0000000000080000-0x0000000000558000-memory.dmp

                                                        Filesize

                                                        4.8MB

                                                      • memory/1304-580-0x0000000000AB0000-0x0000000000F88000-memory.dmp

                                                        Filesize

                                                        4.8MB

                                                      • memory/1304-574-0x0000000000AB0000-0x0000000000F88000-memory.dmp

                                                        Filesize

                                                        4.8MB

                                                      • memory/1684-2922-0x0000000000080000-0x0000000000558000-memory.dmp

                                                        Filesize

                                                        4.8MB

                                                      • memory/1684-2924-0x0000000000080000-0x0000000000558000-memory.dmp

                                                        Filesize

                                                        4.8MB

                                                      • memory/3500-20-0x0000000000080000-0x0000000000558000-memory.dmp

                                                        Filesize

                                                        4.8MB

                                                      • memory/3500-2942-0x0000000000080000-0x0000000000558000-memory.dmp

                                                        Filesize

                                                        4.8MB

                                                      • memory/3500-3025-0x0000000000080000-0x0000000000558000-memory.dmp

                                                        Filesize

                                                        4.8MB

                                                      • memory/3500-713-0x0000000000080000-0x0000000000558000-memory.dmp

                                                        Filesize

                                                        4.8MB

                                                      • memory/3500-3015-0x0000000000080000-0x0000000000558000-memory.dmp

                                                        Filesize

                                                        4.8MB

                                                      • memory/3500-2997-0x0000000000080000-0x0000000000558000-memory.dmp

                                                        Filesize

                                                        4.8MB

                                                      • memory/3500-611-0x0000000000080000-0x0000000000558000-memory.dmp

                                                        Filesize

                                                        4.8MB

                                                      • memory/3500-1513-0x0000000000080000-0x0000000000558000-memory.dmp

                                                        Filesize

                                                        4.8MB

                                                      • memory/3500-19-0x0000000000080000-0x0000000000558000-memory.dmp

                                                        Filesize

                                                        4.8MB

                                                      • memory/3500-18-0x0000000000081000-0x00000000000AF000-memory.dmp

                                                        Filesize

                                                        184KB

                                                      • memory/3500-2918-0x0000000000080000-0x0000000000558000-memory.dmp

                                                        Filesize

                                                        4.8MB

                                                      • memory/3500-610-0x0000000000080000-0x0000000000558000-memory.dmp

                                                        Filesize

                                                        4.8MB

                                                      • memory/3500-605-0x0000000000080000-0x0000000000558000-memory.dmp

                                                        Filesize

                                                        4.8MB

                                                      • memory/3500-2925-0x0000000000080000-0x0000000000558000-memory.dmp

                                                        Filesize

                                                        4.8MB

                                                      • memory/3500-17-0x0000000000080000-0x0000000000558000-memory.dmp

                                                        Filesize

                                                        4.8MB

                                                      • memory/3500-467-0x0000000000080000-0x0000000000558000-memory.dmp

                                                        Filesize

                                                        4.8MB

                                                      • memory/3500-2962-0x0000000000080000-0x0000000000558000-memory.dmp

                                                        Filesize

                                                        4.8MB

                                                      • memory/3500-604-0x0000000000080000-0x0000000000558000-memory.dmp

                                                        Filesize

                                                        4.8MB

                                                      • memory/3500-2993-0x0000000000080000-0x0000000000558000-memory.dmp

                                                        Filesize

                                                        4.8MB

                                                      • memory/3500-2973-0x0000000000080000-0x0000000000558000-memory.dmp

                                                        Filesize

                                                        4.8MB

                                                      • memory/3500-2983-0x0000000000080000-0x0000000000558000-memory.dmp

                                                        Filesize

                                                        4.8MB

                                                      • memory/4792-81-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                                                        Filesize

                                                        972KB

                                                      • memory/4792-560-0x0000000000AF0000-0x00000000016E8000-memory.dmp

                                                        Filesize

                                                        12.0MB

                                                      • memory/4792-36-0x0000000000AF0000-0x00000000016E8000-memory.dmp

                                                        Filesize

                                                        12.0MB

                                                      • memory/4972-3-0x0000000000810000-0x0000000000CE8000-memory.dmp

                                                        Filesize

                                                        4.8MB

                                                      • memory/4972-2-0x0000000000811000-0x000000000083F000-memory.dmp

                                                        Filesize

                                                        184KB

                                                      • memory/4972-5-0x0000000000810000-0x0000000000CE8000-memory.dmp

                                                        Filesize

                                                        4.8MB

                                                      • memory/4972-16-0x0000000000810000-0x0000000000CE8000-memory.dmp

                                                        Filesize

                                                        4.8MB

                                                      • memory/4972-0-0x0000000000810000-0x0000000000CE8000-memory.dmp

                                                        Filesize

                                                        4.8MB

                                                      • memory/4972-1-0x0000000077204000-0x0000000077206000-memory.dmp

                                                        Filesize

                                                        8KB