Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-07-2024 17:53

General

  • Target

    506ecb56dcf6b280d4f553a0fb009ba1760251e411916ab715701b53ae8fe943.exe

  • Size

    1.8MB

  • MD5

    8bc520e6b221e7998eb73c10c830fbd6

  • SHA1

    8a825403f8bff789c60e4dfb67ead847c957b0d4

  • SHA256

    506ecb56dcf6b280d4f553a0fb009ba1760251e411916ab715701b53ae8fe943

  • SHA512

    58d087c499275776e155cb38782f3eca9bdcb516a5707023eb60f31e99ace240076f59ce0c1fc8b7c7382583edfa0f29a68fde23c891a6f0d28de0d3703c94d6

  • SSDEEP

    24576:TRsfk8Fos8kPJBixYoH3z0w2qb3vHzwB+IS34ZNPIwvCpqJ56J1dag7cR7HI0LTZ:TIkxs8DxYY0w2kvsFtz6J2DM0L69Mt

Malware Config

Extracted

Family

amadey

Version

4.30

Botnet

4dd39d

C2

http://77.91.77.82

Attributes
  • install_dir

    ad40971b6b

  • install_file

    explorti.exe

  • strings_key

    a434973ad22def7137dbb5e059b7081e

  • url_paths

    /Hun4Ko/index.php

rc4.plain

Extracted

Family

stealc

Botnet

hate

C2

http://85.28.47.30

Attributes
  • url_path

    /920475a59bac849d.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Stealc

    Stealc is an infostealer written in C++.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 10 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 5 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 6 IoCs
  • Identifies Wine through registry keys 2 TTPs 5 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 2 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 10 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 28 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\506ecb56dcf6b280d4f553a0fb009ba1760251e411916ab715701b53ae8fe943.exe
    "C:\Users\Admin\AppData\Local\Temp\506ecb56dcf6b280d4f553a0fb009ba1760251e411916ab715701b53ae8fe943.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:3996
    • C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
      "C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4956
      • C:\Users\Admin\AppData\Local\Temp\1000006001\b76a3ced93.exe
        "C:\Users\Admin\AppData\Local\Temp\1000006001\b76a3ced93.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:2164
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\IEHIIIJDAA.exe"
          4⤵
            PID:2800
            • C:\Users\Admin\AppData\Local\Temp\IEHIIIJDAA.exe
              "C:\Users\Admin\AppData\Local\Temp\IEHIIIJDAA.exe"
              5⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • Suspicious behavior: EnumeratesProcesses
              PID:3516
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\KFIJJEGHDA.exe"
            4⤵
            • Checks computer location settings
            • Suspicious use of SetWindowsHookEx
            PID:3708
        • C:\Users\Admin\AppData\Local\Temp\1000010001\eea824c50c.exe
          "C:\Users\Admin\AppData\Local\Temp\1000010001\eea824c50c.exe"
          3⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:1588
          • C:\Windows\system32\cmd.exe
            "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\D476.tmp\D477.tmp\D478.bat C:\Users\Admin\AppData\Local\Temp\1000010001\eea824c50c.exe"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:3816
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.youtube.com/account"
              5⤵
              • Enumerates system info in registry
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              • Suspicious use of WriteProcessMemory
              PID:4484
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.106 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7fffbe8ecc40,0x7fffbe8ecc4c,0x7fffbe8ecc58
                6⤵
                  PID:4336
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1948,i,13830062955133599030,15702973093435428962,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=1944 /prefetch:2
                  6⤵
                    PID:3304
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2172,i,13830062955133599030,15702973093435428962,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=2184 /prefetch:3
                    6⤵
                      PID:3564
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2244,i,13830062955133599030,15702973093435428962,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=2580 /prefetch:8
                      6⤵
                        PID:3168
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3128,i,13830062955133599030,15702973093435428962,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=3172 /prefetch:1
                        6⤵
                          PID:5576
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3136,i,13830062955133599030,15702973093435428962,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=3340 /prefetch:1
                          6⤵
                            PID:5768
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4604,i,13830062955133599030,15702973093435428962,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=4612 /prefetch:8
                            6⤵
                            • Drops file in System32 directory
                            • Suspicious behavior: EnumeratesProcesses
                            PID:448
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/account"
                          5⤵
                          • Enumerates system info in registry
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                          • Suspicious use of FindShellTrayWindow
                          • Suspicious use of SendNotifyMessage
                          • Suspicious use of WriteProcessMemory
                          PID:1144
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7fffbe7a46f8,0x7fffbe7a4708,0x7fffbe7a4718
                            6⤵
                              PID:3064
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,1110957108464130198,9184783386533170581,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
                              6⤵
                                PID:4588
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,1110957108464130198,9184783386533170581,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
                                6⤵
                                • Suspicious behavior: EnumeratesProcesses
                                PID:2076
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,1110957108464130198,9184783386533170581,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2868 /prefetch:8
                                6⤵
                                  PID:4832
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1110957108464130198,9184783386533170581,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
                                  6⤵
                                    PID:2296
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1110957108464130198,9184783386533170581,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
                                    6⤵
                                      PID:2800
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1110957108464130198,9184783386533170581,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4672 /prefetch:1
                                      6⤵
                                        PID:1200
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,1110957108464130198,9184783386533170581,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1844 /prefetch:2
                                        6⤵
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:4344
                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                      "C:\Program Files\Mozilla Firefox\firefox.exe" "https://www.youtube.com/account"
                                      5⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:2828
                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                        "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
                                        6⤵
                                        • Checks processor information in registry
                                        • Modifies registry class
                                        • Suspicious use of AdjustPrivilegeToken
                                        • Suspicious use of FindShellTrayWindow
                                        • Suspicious use of SendNotifyMessage
                                        • Suspicious use of SetWindowsHookEx
                                        • Suspicious use of WriteProcessMemory
                                        PID:1924
                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2020 -parentBuildID 20240401114208 -prefsHandle 1920 -prefMapHandle 1912 -prefsLen 25753 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2a6e3240-f244-4b25-84cc-84cfd6dd8cae} 1924 "\\.\pipe\gecko-crash-server-pipe.1924" gpu
                                          7⤵
                                            PID:2500
                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2444 -parentBuildID 20240401114208 -prefsHandle 2400 -prefMapHandle 2380 -prefsLen 26673 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3669b907-7e82-4d7f-8ed2-453a117f9930} 1924 "\\.\pipe\gecko-crash-server-pipe.1924" socket
                                            7⤵
                                              PID:3140
                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3224 -childID 1 -isForBrowser -prefsHandle 1536 -prefMapHandle 2784 -prefsLen 22698 -prefMapSize 244658 -jsInitHandle 1140 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {da21042e-7f5d-415f-b71c-da388ee7dbf3} 1924 "\\.\pipe\gecko-crash-server-pipe.1924" tab
                                              7⤵
                                                PID:2828
                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3096 -childID 2 -isForBrowser -prefsHandle 3204 -prefMapHandle 2796 -prefsLen 31163 -prefMapSize 244658 -jsInitHandle 1140 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4e35c770-d787-4317-af69-8cbc4094e138} 1924 "\\.\pipe\gecko-crash-server-pipe.1924" tab
                                                7⤵
                                                  PID:5352
                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4216 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4204 -prefMapHandle 4176 -prefsLen 31163 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e7e3264f-6fb7-46fc-9b4c-d98d9bbf439d} 1924 "\\.\pipe\gecko-crash-server-pipe.1924" utility
                                                  7⤵
                                                  • Checks processor information in registry
                                                  PID:5588
                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5364 -childID 3 -isForBrowser -prefsHandle 5348 -prefMapHandle 5356 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1140 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2f031967-39c4-4d17-8eb0-642a8650ad90} 1924 "\\.\pipe\gecko-crash-server-pipe.1924" tab
                                                  7⤵
                                                    PID:5528
                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5508 -childID 4 -isForBrowser -prefsHandle 5588 -prefMapHandle 5584 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1140 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4cf4f8ce-bba2-489e-bf7c-7986bc82b6fe} 1924 "\\.\pipe\gecko-crash-server-pipe.1924" tab
                                                    7⤵
                                                      PID:5856
                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5700 -childID 5 -isForBrowser -prefsHandle 5780 -prefMapHandle 5776 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1140 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {48f5d66b-32a1-4c5e-83b6-c28bc52ab854} 1924 "\\.\pipe\gecko-crash-server-pipe.1924" tab
                                                      7⤵
                                                        PID:6000
                                          • C:\Windows\System32\CompPkgSrv.exe
                                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                                            1⤵
                                              PID:4932
                                            • C:\Windows\System32\CompPkgSrv.exe
                                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                                              1⤵
                                                PID:2528
                                              • C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe
                                                "C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"
                                                1⤵
                                                  PID:5264
                                                • C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
                                                  C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
                                                  1⤵
                                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                  • Checks BIOS information in registry
                                                  • Executes dropped EXE
                                                  • Identifies Wine through registry keys
                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:2052
                                                • C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
                                                  C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
                                                  1⤵
                                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                  • Checks BIOS information in registry
                                                  • Executes dropped EXE
                                                  • Identifies Wine through registry keys
                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:4136

                                                Network

                                                MITRE ATT&CK Enterprise v15

                                                Replay Monitor

                                                Loading Replay Monitor...

                                                Downloads

                                                • C:\ProgramData\mozglue.dll

                                                  Filesize

                                                  593KB

                                                  MD5

                                                  c8fd9be83bc728cc04beffafc2907fe9

                                                  SHA1

                                                  95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                                                  SHA256

                                                  ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                                                  SHA512

                                                  fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                                                • C:\ProgramData\nss3.dll

                                                  Filesize

                                                  2.0MB

                                                  MD5

                                                  1cc453cdf74f31e4d913ff9c10acdde2

                                                  SHA1

                                                  6e85eae544d6e965f15fa5c39700fa7202f3aafe

                                                  SHA256

                                                  ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                                                  SHA512

                                                  dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000005

                                                  Filesize

                                                  38KB

                                                  MD5

                                                  c3aa6e31c125d83fb2eabcc9e33843dd

                                                  SHA1

                                                  ad91b78e1a9853ee876b77b82f75100ff5690d11

                                                  SHA256

                                                  c32b5cffb8ac92df9bd9340b75b8d0772a071af36df5b27879e45f6112f9b5b4

                                                  SHA512

                                                  897efddeb2d96e24aca43385cfb86a065034c4bb045c2e2b7391572e0ddd4a820b70fa83854de5048d7b7316fc9fa2f078924aab62206a7a135aaf91176a4c6b

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                  Filesize

                                                  264B

                                                  MD5

                                                  d35f7792794a9d6bb36ad45de1e3038e

                                                  SHA1

                                                  e62494c420647728c70a9d4c12e08b6f7b44ba77

                                                  SHA256

                                                  de78a70f88f09058006e87a2682061c0c53c216622ed9be4998dfa862cc46fd8

                                                  SHA512

                                                  a523443bf3d8536d23b39766c56df6c23f3d87d948b1ff63fac07b4bb567ea0e6a69e97f3fb3eb7532d3ad0285a4377ef2660bde6cd23a66b11a56c5ef910e91

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                                  Filesize

                                                  3KB

                                                  MD5

                                                  a1097e161ccbb42dc92bd5de68762407

                                                  SHA1

                                                  0153b2cbec17e050407b76829b2e5da4711909c5

                                                  SHA256

                                                  fac2005c12a25b74a9af75a604eafdaea884b4518223c61d2af88262f29200d9

                                                  SHA512

                                                  5d817a871daede4c271858e89546e0508a3af7dcc647165c5e5b80e48221c7b3764d2e34bb27574021fca368057216ac85eb18547fc2802915aae1509804e0f4

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                                                  Filesize

                                                  2B

                                                  MD5

                                                  d751713988987e9331980363e24189ce

                                                  SHA1

                                                  97d170e1550eee4afc0af065b78cda302a97674c

                                                  SHA256

                                                  4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                                  SHA512

                                                  b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                  Filesize

                                                  524B

                                                  MD5

                                                  fd033545640c5b79a4990883dfe8b159

                                                  SHA1

                                                  84330d839cbdc2bbc6056f71f4345fd0a7461b00

                                                  SHA256

                                                  115bd51a702981ed5df14d43df23a3f57cf6c45c4844afe345aa695f0f0204a4

                                                  SHA512

                                                  78ead9848ac35739c6575c22c72871157504d445eb95685bff55db24988141f1e7766a113530e2b879f89fa6e38306d2304ed053c1c7a46420f17c7501f829bc

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                  Filesize

                                                  8KB

                                                  MD5

                                                  480d9d8fdc98799f950e082b0b7818bd

                                                  SHA1

                                                  2c339448c41340c01794493fe772b501809b5d56

                                                  SHA256

                                                  a2718d78f724a4280f9bf46df0a2c6bbb38a3c9461dc23f64c71537dcc1c200e

                                                  SHA512

                                                  9e34dec49f0fbf50d6b0ece921327f500368e3c29eceac766dc110cf4ffecf5b955ea36867b0522d0716f521957dfc1c584ee52c9ce0133c2fa69c8656829b38

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                  Filesize

                                                  8KB

                                                  MD5

                                                  7b3a4bd90c3e523d4586a41f6043d7b7

                                                  SHA1

                                                  029d080ea435ce6eacb44c1639bf306899bfa88c

                                                  SHA256

                                                  46ff386a9447b185fc6eb70acacce9a75f42e552aff69afef9c44644c3ab07af

                                                  SHA512

                                                  80b9a17c2082abe54760fdc90e12f3b86d1899be59e6e71e317132c5f3bb6e17647348208ac4be540eb63e67790a659677c86b905060551ef09e641cc663a8bb

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                  Filesize

                                                  8KB

                                                  MD5

                                                  5b70d1f08df01c9514f382f09578bdd0

                                                  SHA1

                                                  201e5c026b2b18ad242910b30f6b59cbca441913

                                                  SHA256

                                                  58396e83ffa8362712e3cb96d109f1d435608be2e3206c2cd6265863ac1cb136

                                                  SHA512

                                                  8f6dc8a07ea196bab26446ef0c36b3ff9f7f863601894d322cddb0c40d042a91a3dba012e0600c3065d31d169c4c87dfe57c2507f2ea65ec77f12a927afd16c3

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                  Filesize

                                                  8KB

                                                  MD5

                                                  4c77d5cc35f7fef125c268f5a21d77de

                                                  SHA1

                                                  ac3cc3dd959dea01276f724bc990b7e8c1ac3797

                                                  SHA256

                                                  967f333619c403d353e51511aea55b7edee391803df8ec381bd48eda2f69e975

                                                  SHA512

                                                  e356c36ccf702c1436678229116a9fa90878db7558755de89f7ba7f6502e67879fdb2592c654e0ae7c1e1e48ef179b38951e5c78e0ac75de9dc7f913ff29acfc

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                  Filesize

                                                  8KB

                                                  MD5

                                                  5e2e3201e61ad7b5847b392362a12f2a

                                                  SHA1

                                                  3544745a72725d7cd94efe7591ffdc33363088df

                                                  SHA256

                                                  fbe130f2dc7eaf5170e566aacfd9ca96ec7e4a4092ec311f469cce2ac75b13f3

                                                  SHA512

                                                  5e05088ecae1e34ba0d4470092f35a4b7d19d4e25f46c41a5e859b8afb993967cf3d6a61c7d9a95a39abeca0336f8f240990cb744897dbba539ab85763bc80a9

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                  Filesize

                                                  8KB

                                                  MD5

                                                  88fe3031b00caf70f8f888706f751e8f

                                                  SHA1

                                                  aed7e3dcbb64eba3a45323f99ab46a192c934f18

                                                  SHA256

                                                  cc9e9210c152b8378e98e3abf2c0235bba72dc7d5b69011cfcf018112017e14e

                                                  SHA512

                                                  1c2cbd8d0d26cc947ad6eedc09514dd2de8081f6b025f9753f192f0caba8b1a20a30a7ac9202e7008f51190d0011fe580e4416c62838c713b7f34134fa60eba6

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                  Filesize

                                                  8KB

                                                  MD5

                                                  b620aefcabd658875d46811a1c336c54

                                                  SHA1

                                                  087d8f09d716913a5f4204dd5026be9613500a8e

                                                  SHA256

                                                  00b456d481948fa1029018dc95a042ade6a4b871f4c4481f881dd91f555652d7

                                                  SHA512

                                                  48e0c2f7132dc389636773d39d7a100890997e456fbeb1a5eae0ecfcb3c66bd7869f5837b8eb4e484cd9bb57e73d8592230eab85a6596681ae54f17ce7d69e69

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                  Filesize

                                                  8KB

                                                  MD5

                                                  e9101fdf6dc10377feed46dc0462ebdb

                                                  SHA1

                                                  ddbbc68770c4c392c484b0dc83eb279d48d52a2d

                                                  SHA256

                                                  399c8e90c99882268df4b3d1eb446616af5680624a0bf54df251a2ac2d331ef4

                                                  SHA512

                                                  25ebff5fb2803c56a4da33ab2cb1a93f063054ac2791d82b45345fafe2da152fc36e7c5d44b8b09dc10a9b8b90a6cd01d4b25c03a426385a638fb2b5ad780019

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                  Filesize

                                                  92KB

                                                  MD5

                                                  dde95e677dec430754f383ee5f50f188

                                                  SHA1

                                                  6702abed9bc4dfcdc437d798936fcbadbe852e4e

                                                  SHA256

                                                  25b98ce6e8a5499b41ac9fd363c110662562160da747f3b61097185083f82165

                                                  SHA512

                                                  837acd3e79a18a2ee3f11fb4148ad37c797cbd804649ebbfac9c314edf6abdd36211182f029613aa8bce31b4b24c604b579e64c783bb12eda9eb18818f54ff96

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                  Filesize

                                                  92KB

                                                  MD5

                                                  9527792a145f606c6662ca65a1a56f29

                                                  SHA1

                                                  d4df748aca339d5367b3de3819aae7b99dec2895

                                                  SHA256

                                                  e26c595d8d1269603cca374a00e9f99eb688ccfc3b8b01d6932b2c44875c6dd7

                                                  SHA512

                                                  9c9b8ad9aaae3ac40269a9db7005b80b5265ceae75619b19f82555106ef6b91629f8cc9242a521e6a48bba89481476ac0df0a4285af3daec7a1a55564d01590c

                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                  Filesize

                                                  152B

                                                  MD5

                                                  1790c766c15938258a4f9b984cf68312

                                                  SHA1

                                                  15c9827d278d28b23a8ea0389d42fa87e404359f

                                                  SHA256

                                                  2e3978bb58c701f3c6b05de9349b7334a194591bec7bcf73f53527dc0991dc63

                                                  SHA512

                                                  2682d9c60c9d67608cf140b6ca4958d890bcbc3c8a8e95fcc639d2a11bb0ec348ca55ae99a5840e1f50e5c5bcf3e27c97fc877582d869d98cc4ea3448315aafb

                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                  Filesize

                                                  152B

                                                  MD5

                                                  8dc45b70cbe29a357e2c376a0c2b751b

                                                  SHA1

                                                  25d623cea817f86b8427db53b82340410c1489b2

                                                  SHA256

                                                  511cfb6bedbad2530b5cc5538b6ec2184fc4f85947ba4c8166d0bb9f5fe2703a

                                                  SHA512

                                                  3ce0f52675feb16d6e62aae1c50767da178b93bdae28bacf6df3a2f72b8cc75b09c5092d9065e0872e5d09fd9ffe0c6931d6ae1943ddb1927b85d60659ef866e

                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                  Filesize

                                                  240B

                                                  MD5

                                                  cc9448daaf280f0641084d2c5bbdd291

                                                  SHA1

                                                  28dbf15719da1fa803fe2cb3f911a7d248b76fd2

                                                  SHA256

                                                  7b640d18177fc7f3c0ca1db573666ca89cb4466e0e1ebb6b43d305ae1d73f14f

                                                  SHA512

                                                  ea8d00add6569e51dea2006231978f36779146c0ae2ee82b5fefe4312d7be31a2bce66f2b0095df45a9f0c2806717344b1e59895ecb367c07e87d87fd0ff4c5c

                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                  Filesize

                                                  1KB

                                                  MD5

                                                  6af00ca6247433a7d76b1ff0e5eb30c5

                                                  SHA1

                                                  ffaee9bc6b7d7447fe6f450775dcc993d87c289b

                                                  SHA256

                                                  de63105d2475139251856c3207c2515e0ce860852a258f39f77ff7d27d875d28

                                                  SHA512

                                                  d72262e7a2c967767f716ff9937ba9489f0ee4334e192e1b7494009ed88e39ee5bac35bd5c6f9481ea25f9e930c26d8c49898297ec582b68374c718975a0de11

                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                  Filesize

                                                  6KB

                                                  MD5

                                                  906d873d9823baae8a3d89db01711657

                                                  SHA1

                                                  5c9cc51928f1917874fa9d114f5d7049780c8371

                                                  SHA256

                                                  8e596973f21f5b34126c5ab0525356c58d853820db7df6a5b8177e181ee86913

                                                  SHA512

                                                  4b67ab632efec8ba94cd5e4a8627d5f0771a847722424fd17f9860a4aa5f456125f977a81b30c8641686ecbfe314d13d631e28835c2659df50e35a8acdb8b1e5

                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                  Filesize

                                                  6KB

                                                  MD5

                                                  b3adf5f10c3a795062f4398318d66215

                                                  SHA1

                                                  da133f125f34d8580f71e1096685e95199c43b71

                                                  SHA256

                                                  8d9e5a937929273d6f27998191d9d810f34190e2cd77d62a676c13f186c3e079

                                                  SHA512

                                                  304ff8c0c9c17dcb12e7f02b161398274dfcc9249e83d0150a85c2e9f5d9b6305662ad4227461bc8efbc3641ec70ed3bce329561c16c732f836269c8f9e58d93

                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                  Filesize

                                                  11KB

                                                  MD5

                                                  b74cc83a5b8fa45dab816780ce6648c0

                                                  SHA1

                                                  a058e4ca52467090cb4cb1cfcc3dc96d67816cc9

                                                  SHA256

                                                  fa68ccff2ed52b7efdb6ae4ec9483041cffebecc045d32231c7cb9dfb7762ccb

                                                  SHA512

                                                  ef7543b1187ee5b7f33e73fd2e04c53dcc2eb746cc9c9389f72ad8e22868b74ae36a99a795b3caf8a7f6094d47ad4b0419e3c04ff086eaf27e7ca330c194bcb1

                                                • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\vvc8bff9.default-release\activity-stream.discovery_stream.json.tmp

                                                  Filesize

                                                  21KB

                                                  MD5

                                                  5ef2eb045203a86aa49020ca0bcddb19

                                                  SHA1

                                                  482ee47d0ec51502d41286c32be1fa6b6c476bf1

                                                  SHA256

                                                  9f48bf0ee650a3cfcb3c116784959372c0a51bd3bb36bb0f75da87f0c8c6cd30

                                                  SHA512

                                                  d523a11808b2d7bae96172b8ba6318f31f89409b4f87dbf03312265800c3f81d5dac6df7f12b27960f68d53d807325e4ff6f60bd71b6807976179bf51478da8f

                                                • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\vvc8bff9.default-release\cache2\entries\5CD1EBDF6B57F13C7E783CE5E6D8E9C44014FE1A

                                                  Filesize

                                                  13KB

                                                  MD5

                                                  25f72d98226c5fb8cfd7f163c2a288f2

                                                  SHA1

                                                  0fbb993272b801b1c4fd4f5bfb391fb26a452da1

                                                  SHA256

                                                  3e92fe76a0719caf795c082edc0f629255277eb3f9e4b45a3a6b4ce28f9f1001

                                                  SHA512

                                                  319f2c569200b9bc59d028ecf7ab92d725841ca6b802a597ab760b628532631d9d0b7ee914c47258785fbf03da740cf7bed33116ad1706d7ac7e8bb758a4ab76

                                                • C:\Users\Admin\AppData\Local\Temp\1000006001\b76a3ced93.exe

                                                  Filesize

                                                  2.4MB

                                                  MD5

                                                  c03d62f485ea79a178992f22c713c4a5

                                                  SHA1

                                                  aa16eb2b07a4b91b44c9e484923eb8bbcaf893d0

                                                  SHA256

                                                  546b5457cd26c9230fc49a456197aeeb761241adc2dd2774c37b1d3189968cb9

                                                  SHA512

                                                  3051d67889704c3adfe2748612d88b40acdde17b3fcf54ef8ae7466bd38b121db130300b53c9db9a981292507cf830d99bcd86ccacf320ec0198faa40af043fb

                                                • C:\Users\Admin\AppData\Local\Temp\1000010001\eea824c50c.exe

                                                  Filesize

                                                  89KB

                                                  MD5

                                                  bc08b445116ecc06852a929a5d302c4a

                                                  SHA1

                                                  a78aa42220b90d47b4cf63119e6082f06b295f57

                                                  SHA256

                                                  5b232254dd2d33eb576516116977c884fba81d5a8427f742a73655f9e076efc6

                                                  SHA512

                                                  657a21d453112fb909be4005e0cab1ebf467840e275a159eb535b486432ffa0bfcc60da92475b26f08a0ea481c927654520a43163e04e34324551cb3bfd69fdf

                                                • C:\Users\Admin\AppData\Local\Temp\D476.tmp\D477.tmp\D478.bat

                                                  Filesize

                                                  2KB

                                                  MD5

                                                  de9423d9c334ba3dba7dc874aa7dbc28

                                                  SHA1

                                                  bf38b137b8d780b3d6d62aee03c9d3f73770d638

                                                  SHA256

                                                  a1e1b422c40fb611a50d3f8bf34f9819f76ddb304aa2d105fb49f41f57752698

                                                  SHA512

                                                  63f13acd904378ad7de22053e1087d61a70341f1891ada3b671223fec8f841b42b6f1060a4b18c8bb865ee4cd071cadc7ff6bd6d549760945bf1645a1086f401

                                                • C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe

                                                  Filesize

                                                  1.8MB

                                                  MD5

                                                  8bc520e6b221e7998eb73c10c830fbd6

                                                  SHA1

                                                  8a825403f8bff789c60e4dfb67ead847c957b0d4

                                                  SHA256

                                                  506ecb56dcf6b280d4f553a0fb009ba1760251e411916ab715701b53ae8fe943

                                                  SHA512

                                                  58d087c499275776e155cb38782f3eca9bdcb516a5707023eb60f31e99ace240076f59ce0c1fc8b7c7382583edfa0f29a68fde23c891a6f0d28de0d3703c94d6

                                                • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                                                  Filesize

                                                  479KB

                                                  MD5

                                                  09372174e83dbbf696ee732fd2e875bb

                                                  SHA1

                                                  ba360186ba650a769f9303f48b7200fb5eaccee1

                                                  SHA256

                                                  c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                                                  SHA512

                                                  b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                                                • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                                                  Filesize

                                                  13.8MB

                                                  MD5

                                                  0a8747a2ac9ac08ae9508f36c6d75692

                                                  SHA1

                                                  b287a96fd6cc12433adb42193dfe06111c38eaf0

                                                  SHA256

                                                  32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                                                  SHA512

                                                  59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vvc8bff9.default-release\AlternateServices.bin

                                                  Filesize

                                                  12KB

                                                  MD5

                                                  6f582a8f8daa29502a37bec0196fbdf3

                                                  SHA1

                                                  8b50a0ec1d90a23e32c2186eda20068602db790e

                                                  SHA256

                                                  652f350ebd91259bf891fde8ef565281b2455cc7a5b65a788a61708edee17b64

                                                  SHA512

                                                  fcbcee9745a8251bbf6c15138a093875cf0e133dbe9323fcfbfaf19a782b764788752802ec368b82062c5dffe4864479dc81f818f96d528606dc1d2d65ae788e

                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vvc8bff9.default-release\cookies.sqlite-wal

                                                  Filesize

                                                  256KB

                                                  MD5

                                                  07e09e5c00d1f5723e4b90e73d2a603a

                                                  SHA1

                                                  3e672d2e0eea8e1aaac5b0a17f0f416bc9b5634c

                                                  SHA256

                                                  4fd4a1e979d93f10f26eb2fb9c2c96c636a9c89c32065d51e87f8a2225cf8f35

                                                  SHA512

                                                  8d7cdc749916c3b3616e3689d2fc0f4072965dd8a9487273860abcea4f7ca4076f8280369bd93fa4668a53cbb8c1460d3be633792a831c9603bad330cdfa01e4

                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vvc8bff9.default-release\datareporting\glean\db\data.safe.tmp

                                                  Filesize

                                                  25KB

                                                  MD5

                                                  92e6ac8d12095308908eb2117d67a2c4

                                                  SHA1

                                                  28660296b64ec78e6a279c1d89d5b705969dd7d6

                                                  SHA256

                                                  65f31ee9832882dad8c197c747697850a5209e0cfc64f807d24bf095311b0fa0

                                                  SHA512

                                                  a8724087afaaf85cf18266d7cfeb597ca1a937a6ae4fbc556d528fffbc115050cf19cd639097be7b3bed7f5e2ebe9b427fb723833f62d19a9127068a1d598aa4

                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vvc8bff9.default-release\datareporting\glean\db\data.safe.tmp

                                                  Filesize

                                                  22KB

                                                  MD5

                                                  098bf1d0d1a9a00fed07f93cb753776d

                                                  SHA1

                                                  072ccc5dc3db92f1fdf0638d6e603f6fb5412101

                                                  SHA256

                                                  68da0ee94f944d950b1f4d814960ef2c3bac127aae5882d28d4d2565094c173c

                                                  SHA512

                                                  5e7d50356bab30c4e1aaeed043f35e3f6e86e0b2ccffaa2a92220b49c5a04af22129f5a09ea410dc6ff1d6d252e111c09301a10b663a925b3b4eb12c150a64fa

                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vvc8bff9.default-release\datareporting\glean\db\data.safe.tmp

                                                  Filesize

                                                  22KB

                                                  MD5

                                                  42ca31e3fa27668640b512e6cf07dcde

                                                  SHA1

                                                  dadfee9c9311c1d65f55f787468de167253f824b

                                                  SHA256

                                                  0fa59b211183256a5f2dad1b2d2868cef95746f9c27026bf6eecc3d3ef47f685

                                                  SHA512

                                                  9235106bb2549f507aecd1f5b870e3d3d9e04830f9aa128a04b62d37cbb89d7229bce82e988df982edb685228d1cb28025325400557e411da4adc09768f3e812

                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vvc8bff9.default-release\datareporting\glean\pending_pings\89a9a86e-9716-4ebd-8468-73b3ffad33d4

                                                  Filesize

                                                  982B

                                                  MD5

                                                  8c9612f721a8a582e3279b63c046e1d5

                                                  SHA1

                                                  abf15347a94dcb9ea794dfa1f012f5939055f09d

                                                  SHA256

                                                  d2a5994fe8fb6150c846446140a7c0c1b46927d80441791d08e62e0a88b0599d

                                                  SHA512

                                                  951b217b17a9add4a84321b318ab5ea594e9bab301c8ee3765f3b40dafbe4fdbf9eb2a97052d69096c1c26453987b81851371d58f378922cf41caf9ad7b08524

                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vvc8bff9.default-release\datareporting\glean\pending_pings\cdf567f3-4296-4448-b3c3-437be9cac530

                                                  Filesize

                                                  659B

                                                  MD5

                                                  725eba434b1920bccee9c3b65bd7e806

                                                  SHA1

                                                  fa4211dec79130152d962cdcab9a9edaa92903ea

                                                  SHA256

                                                  10e04854257f581e0ff8a2ca9464e9f4f95968fa0970c964fdf4c6b43a619c48

                                                  SHA512

                                                  5bbcaad29de3eaa05344a20d021782963e9b2c81df9a4deeb2b7a1fb7ab9482267e48e5d4f9626a0755b34739a18c4142584e0be25b3819fb5e1d83ad00cda42

                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vvc8bff9.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

                                                  Filesize

                                                  1.1MB

                                                  MD5

                                                  842039753bf41fa5e11b3a1383061a87

                                                  SHA1

                                                  3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                                                  SHA256

                                                  d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                                                  SHA512

                                                  d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vvc8bff9.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

                                                  Filesize

                                                  116B

                                                  MD5

                                                  2a461e9eb87fd1955cea740a3444ee7a

                                                  SHA1

                                                  b10755914c713f5a4677494dbe8a686ed458c3c5

                                                  SHA256

                                                  4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                                                  SHA512

                                                  34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vvc8bff9.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

                                                  Filesize

                                                  372B

                                                  MD5

                                                  bf957ad58b55f64219ab3f793e374316

                                                  SHA1

                                                  a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                                                  SHA256

                                                  bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                                                  SHA512

                                                  79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vvc8bff9.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

                                                  Filesize

                                                  17.8MB

                                                  MD5

                                                  daf7ef3acccab478aaa7d6dc1c60f865

                                                  SHA1

                                                  f8246162b97ce4a945feced27b6ea114366ff2ad

                                                  SHA256

                                                  bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                                                  SHA512

                                                  5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vvc8bff9.default-release\places.sqlite-wal

                                                  Filesize

                                                  992KB

                                                  MD5

                                                  ff1145248f9672247928ae723b80688f

                                                  SHA1

                                                  ab44bf927ab4d52d39064c496414a627d7b04c70

                                                  SHA256

                                                  95ce629f1fef05fa60bbec99f574ba7cd0e31e0e0f87b5220a773d4a96f47908

                                                  SHA512

                                                  1e55f63b79878782177013f934e51c2cf0fa6a88905719e97626c1561b7d2a17e3296c6e073d2770bb4e7c2da31da6164d5c41e2473a00469b0deab82b46292e

                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vvc8bff9.default-release\prefs-1.js

                                                  Filesize

                                                  8KB

                                                  MD5

                                                  e2343b63d5a6d6cab7c3a6d617fc0b76

                                                  SHA1

                                                  d5f051e8f28ae10883cd74cc09a74c519d6dcbeb

                                                  SHA256

                                                  3f65743767c3a9003f99c56e641ef712763c2081769099385636fc3c08a2bff0

                                                  SHA512

                                                  e6d3bc8531eb40165e3dd9d514125654d2cbd0e0180b7be039cc6ed67bbee7f9581e1da698b32eebf355d7b7e314a75d9ccbc54fb3d244921ba33989e9c48fa0

                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vvc8bff9.default-release\prefs-1.js

                                                  Filesize

                                                  10KB

                                                  MD5

                                                  913a8a31d13de59ffcc0d2ae104185a6

                                                  SHA1

                                                  613d75c8cac0f9cc635c836226b3065c535fd503

                                                  SHA256

                                                  de43bc3a0d229ddd52ce352c63a7318f1671977e5b4a083a4424823a83b06937

                                                  SHA512

                                                  710e4df15008a5533585a31d0550bc452080e74449816c98f26082db5508493856173e4dc00ef90477da7043726de709a8736e9d2264d65593a994d80ef2456f

                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vvc8bff9.default-release\prefs-1.js

                                                  Filesize

                                                  13KB

                                                  MD5

                                                  6859006686a70e5455a514cd342dceef

                                                  SHA1

                                                  ed9cc037f693da976a7c79abf29867a4c7a7f5eb

                                                  SHA256

                                                  e90b05dcc28a5aab9bb170979884dee8769d68f100be8da0e2ed54de684230f8

                                                  SHA512

                                                  7ec38762a646ac660b427f43721c7e7a86de403596e39f824aea1d4384501c2fe9d9b026037fefd2162f25a549b6321b2a10740c42324e16a6a821d3b3fd5dba

                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vvc8bff9.default-release\prefs.js

                                                  Filesize

                                                  8KB

                                                  MD5

                                                  ef0a0f5a3b168d44001be8c04f055c1d

                                                  SHA1

                                                  ec2be87709adf5cecf1ab76a5fbb45cdf863f5f1

                                                  SHA256

                                                  567abecdf664f120b84ce15ad167d1f79e0931f0077381023678668797f6ad5c

                                                  SHA512

                                                  ebdf97d6d788e8d940faa6a3e7c3df5b7a738934ff75bba3a66468dcb3f7d06deee76d3d42c68c8d23a8c24134a67d81e488b67e9c5ec60f27c8f57190d6ce78

                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vvc8bff9.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

                                                  Filesize

                                                  1.1MB

                                                  MD5

                                                  b429cd6c529bd560839e447ef295ba07

                                                  SHA1

                                                  e0e9c2322eaae67811b6079d6736aa8d0d8719a7

                                                  SHA256

                                                  57e832df35e40c351f6e0b6126bce8047fb51f525790526e3b9ff2c29e7bd236

                                                  SHA512

                                                  1424d346ce1769feef89cef99452b5ec4579f4aff9928ef06a7a6c66a63ba42a3e2669f92a5c1dbd0ff6a675c185738dfdb583cab80d197d31461cd2859c90d0

                                                • \??\pipe\crashpad_4484_QWIZNVHYHWSYCOZA

                                                  MD5

                                                  d41d8cd98f00b204e9800998ecf8427e

                                                  SHA1

                                                  da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                  SHA256

                                                  e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                  SHA512

                                                  cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                • memory/2052-3089-0x00000000009F0000-0x0000000000EAA000-memory.dmp

                                                  Filesize

                                                  4.7MB

                                                • memory/2052-3265-0x00000000009F0000-0x0000000000EAA000-memory.dmp

                                                  Filesize

                                                  4.7MB

                                                • memory/2164-92-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                                                  Filesize

                                                  972KB

                                                • memory/2164-566-0x0000000000E60000-0x0000000001A58000-memory.dmp

                                                  Filesize

                                                  12.0MB

                                                • memory/2164-36-0x0000000000E60000-0x0000000001A58000-memory.dmp

                                                  Filesize

                                                  12.0MB

                                                • memory/2164-613-0x0000000000E60000-0x0000000001A58000-memory.dmp

                                                  Filesize

                                                  12.0MB

                                                • memory/3516-618-0x0000000000F20000-0x00000000013DA000-memory.dmp

                                                  Filesize

                                                  4.7MB

                                                • memory/3516-617-0x0000000000F20000-0x00000000013DA000-memory.dmp

                                                  Filesize

                                                  4.7MB

                                                • memory/3996-2-0x0000000000A71000-0x0000000000A9F000-memory.dmp

                                                  Filesize

                                                  184KB

                                                • memory/3996-1-0x00000000779A4000-0x00000000779A6000-memory.dmp

                                                  Filesize

                                                  8KB

                                                • memory/3996-18-0x0000000000A70000-0x0000000000F2A000-memory.dmp

                                                  Filesize

                                                  4.7MB

                                                • memory/3996-0-0x0000000000A70000-0x0000000000F2A000-memory.dmp

                                                  Filesize

                                                  4.7MB

                                                • memory/3996-3-0x0000000000A70000-0x0000000000F2A000-memory.dmp

                                                  Filesize

                                                  4.7MB

                                                • memory/3996-5-0x0000000000A70000-0x0000000000F2A000-memory.dmp

                                                  Filesize

                                                  4.7MB

                                                • memory/4136-3715-0x00000000009F0000-0x0000000000EAA000-memory.dmp

                                                  Filesize

                                                  4.7MB

                                                • memory/4136-3716-0x00000000009F0000-0x0000000000EAA000-memory.dmp

                                                  Filesize

                                                  4.7MB

                                                • memory/4956-2625-0x00000000009F0000-0x0000000000EAA000-memory.dmp

                                                  Filesize

                                                  4.7MB

                                                • memory/4956-19-0x00000000009F0000-0x0000000000EAA000-memory.dmp

                                                  Filesize

                                                  4.7MB

                                                • memory/4956-3672-0x00000000009F0000-0x0000000000EAA000-memory.dmp

                                                  Filesize

                                                  4.7MB

                                                • memory/4956-3655-0x00000000009F0000-0x0000000000EAA000-memory.dmp

                                                  Filesize

                                                  4.7MB

                                                • memory/4956-3692-0x00000000009F0000-0x0000000000EAA000-memory.dmp

                                                  Filesize

                                                  4.7MB

                                                • memory/4956-17-0x00000000009F0000-0x0000000000EAA000-memory.dmp

                                                  Filesize

                                                  4.7MB

                                                • memory/4956-3654-0x00000000009F0000-0x0000000000EAA000-memory.dmp

                                                  Filesize

                                                  4.7MB

                                                • memory/4956-3703-0x00000000009F0000-0x0000000000EAA000-memory.dmp

                                                  Filesize

                                                  4.7MB

                                                • memory/4956-20-0x00000000009F0000-0x0000000000EAA000-memory.dmp

                                                  Filesize

                                                  4.7MB

                                                • memory/4956-3713-0x00000000009F0000-0x0000000000EAA000-memory.dmp

                                                  Filesize

                                                  4.7MB

                                                • memory/4956-848-0x00000000009F0000-0x0000000000EAA000-memory.dmp

                                                  Filesize

                                                  4.7MB

                                                • memory/4956-519-0x00000000009F0000-0x0000000000EAA000-memory.dmp

                                                  Filesize

                                                  4.7MB

                                                • memory/4956-620-0x00000000009F0000-0x0000000000EAA000-memory.dmp

                                                  Filesize

                                                  4.7MB

                                                • memory/4956-3726-0x00000000009F0000-0x0000000000EAA000-memory.dmp

                                                  Filesize

                                                  4.7MB

                                                • memory/4956-3727-0x00000000009F0000-0x0000000000EAA000-memory.dmp

                                                  Filesize

                                                  4.7MB

                                                • memory/4956-3740-0x00000000009F0000-0x0000000000EAA000-memory.dmp

                                                  Filesize

                                                  4.7MB

                                                • memory/4956-619-0x00000000009F0000-0x0000000000EAA000-memory.dmp

                                                  Filesize

                                                  4.7MB

                                                • memory/4956-3759-0x00000000009F0000-0x0000000000EAA000-memory.dmp

                                                  Filesize

                                                  4.7MB