Analysis

  • max time kernel
    149s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-07-2024 18:42

General

  • Target

    1013ef0d12658680241090322d56cbfd6ad665fd922049180184c3fef077a506.exe

  • Size

    2.4MB

  • MD5

    b6bf96c3900b28a9970323938a1752bd

  • SHA1

    fff9ac5ee2a9849759bf02538f8a431738a894c5

  • SHA256

    1013ef0d12658680241090322d56cbfd6ad665fd922049180184c3fef077a506

  • SHA512

    475848394c20823bf0c05f3d66ff27422b22670babde769f936791881d0da800cadf3ae08e0e99fe0a85abeafaa072672575d020de9267d87142047c1e1033ec

  • SSDEEP

    49152:vNXu+em7jvl9vusinK4BwNH+T7m4/OKp0Pu46RKebeb9kbXb8ddhhtQhCvOaY5dY:vNe+VZ9vusiK4BwNHi7m4mK7Webeb9k0

Malware Config

Extracted

Family

stealc

Botnet

hate

C2

http://85.28.47.30

Attributes
  • url_path

    /920475a59bac849d.php

Extracted

Family

amadey

Version

4.30

Botnet

4dd39d

C2

http://77.91.77.82

Attributes
  • install_dir

    ad40971b6b

  • install_file

    explorti.exe

  • strings_key

    a434973ad22def7137dbb5e059b7081e

  • url_paths

    /Hun4Ko/index.php

rc4.plain

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Stealc

    Stealc is an infostealer written in C++.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 10 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 5 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 7 IoCs
  • Identifies Wine through registry keys 2 TTPs 5 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 2 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 10 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 29 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\1013ef0d12658680241090322d56cbfd6ad665fd922049180184c3fef077a506.exe
    "C:\Users\Admin\AppData\Local\Temp\1013ef0d12658680241090322d56cbfd6ad665fd922049180184c3fef077a506.exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4988
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\HCAEBFBKKJ.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3504
      • C:\Users\Admin\AppData\Local\Temp\HCAEBFBKKJ.exe
        "C:\Users\Admin\AppData\Local\Temp\HCAEBFBKKJ.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Checks computer location settings
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:400
        • C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
          "C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe"
          4⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Checks computer location settings
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:996
          • C:\Users\Admin\AppData\Local\Temp\1000006001\e00762e369.exe
            "C:\Users\Admin\AppData\Local\Temp\1000006001\e00762e369.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious use of SetWindowsHookEx
            PID:2904
          • C:\Users\Admin\AppData\Local\Temp\1000010001\5dda12ecc2.exe
            "C:\Users\Admin\AppData\Local\Temp\1000010001\5dda12ecc2.exe"
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:1920
            • C:\Windows\system32\cmd.exe
              "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\D4E4.tmp\D4E5.tmp\D4E6.bat C:\Users\Admin\AppData\Local\Temp\1000010001\5dda12ecc2.exe"
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:2760
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.youtube.com/account"
                7⤵
                • Enumerates system info in registry
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                • Suspicious use of WriteProcessMemory
                PID:4688
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.106 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ff81045cc40,0x7ff81045cc4c,0x7ff81045cc58
                  8⤵
                    PID:3688
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1612,i,16318576986073009351,14046111307636611108,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=1608 /prefetch:2
                    8⤵
                      PID:3292
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2168,i,16318576986073009351,14046111307636611108,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=2172 /prefetch:3
                      8⤵
                        PID:4044
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2260,i,16318576986073009351,14046111307636611108,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=2464 /prefetch:8
                        8⤵
                          PID:4360
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3100,i,16318576986073009351,14046111307636611108,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=3136 /prefetch:1
                          8⤵
                            PID:5620
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3128,i,16318576986073009351,14046111307636611108,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=3168 /prefetch:1
                            8⤵
                              PID:5652
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4628,i,16318576986073009351,14046111307636611108,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=4356 /prefetch:8
                              8⤵
                              • Drops file in System32 directory
                              • Suspicious behavior: EnumeratesProcesses
                              PID:4528
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/account"
                            7⤵
                            • Enumerates system info in registry
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                            • Suspicious use of FindShellTrayWindow
                            • Suspicious use of SendNotifyMessage
                            • Suspicious use of WriteProcessMemory
                            PID:4372
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ff80d9246f8,0x7ff80d924708,0x7ff80d924718
                              8⤵
                                PID:1428
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,5813298789520994140,15902128619577755539,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
                                8⤵
                                  PID:3628
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,5813298789520994140,15902128619577755539,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
                                  8⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:2504
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,5813298789520994140,15902128619577755539,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2852 /prefetch:8
                                  8⤵
                                    PID:3220
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5813298789520994140,15902128619577755539,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
                                    8⤵
                                      PID:4164
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5813298789520994140,15902128619577755539,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
                                      8⤵
                                        PID:2224
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5813298789520994140,15902128619577755539,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4692 /prefetch:1
                                        8⤵
                                          PID:5204
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,5813298789520994140,15902128619577755539,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3756 /prefetch:2
                                          8⤵
                                          • Suspicious behavior: EnumeratesProcesses
                                          PID:2764
                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                        "C:\Program Files\Mozilla Firefox\firefox.exe" "https://www.youtube.com/account"
                                        7⤵
                                        • Suspicious use of WriteProcessMemory
                                        PID:4092
                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                          "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
                                          8⤵
                                          • Checks processor information in registry
                                          • Modifies registry class
                                          • Suspicious use of AdjustPrivilegeToken
                                          • Suspicious use of FindShellTrayWindow
                                          • Suspicious use of SendNotifyMessage
                                          • Suspicious use of SetWindowsHookEx
                                          • Suspicious use of WriteProcessMemory
                                          PID:3616
                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1984 -parentBuildID 20240401114208 -prefsHandle 1908 -prefMapHandle 1900 -prefsLen 25753 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2f7ae15e-7121-41f6-a5bc-3b2385cf806a} 3616 "\\.\pipe\gecko-crash-server-pipe.3616" gpu
                                            9⤵
                                              PID:1480
                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2468 -parentBuildID 20240401114208 -prefsHandle 2400 -prefMapHandle 2384 -prefsLen 26673 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {abdf4bca-bdce-4913-8794-fdf3c824c35a} 3616 "\\.\pipe\gecko-crash-server-pipe.3616" socket
                                              9⤵
                                                PID:5104
                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3104 -childID 1 -isForBrowser -prefsHandle 2848 -prefMapHandle 2948 -prefsLen 22698 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ae288492-f0b5-4ec3-9033-d4020932f4ab} 3616 "\\.\pipe\gecko-crash-server-pipe.3616" tab
                                                9⤵
                                                  PID:3336
                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3516 -childID 2 -isForBrowser -prefsHandle 3044 -prefMapHandle 3704 -prefsLen 31163 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {15c26210-e76a-4438-ad7d-0fc47d2782fe} 3616 "\\.\pipe\gecko-crash-server-pipe.3616" tab
                                                  9⤵
                                                    PID:5260
                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4260 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4276 -prefMapHandle 4300 -prefsLen 31163 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bcc5b414-f77a-45f3-bad2-4907f47150e8} 3616 "\\.\pipe\gecko-crash-server-pipe.3616" utility
                                                    9⤵
                                                    • Checks processor information in registry
                                                    PID:5604
                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5344 -childID 3 -isForBrowser -prefsHandle 5356 -prefMapHandle 5352 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {59eb57e9-0cab-489d-b4dc-2c8863c3e35b} 3616 "\\.\pipe\gecko-crash-server-pipe.3616" tab
                                                    9⤵
                                                      PID:5956
                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5476 -childID 4 -isForBrowser -prefsHandle 5484 -prefMapHandle 5488 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4ffc5d16-7b29-434a-95ad-09e028f6d5e1} 3616 "\\.\pipe\gecko-crash-server-pipe.3616" tab
                                                      9⤵
                                                        PID:5976
                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5828 -childID 5 -isForBrowser -prefsHandle 5748 -prefMapHandle 5752 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f9e16cf6-c5d3-4efb-9649-b935d408a698} 3616 "\\.\pipe\gecko-crash-server-pipe.3616" tab
                                                        9⤵
                                                          PID:5992
                                          • C:\Windows\SysWOW64\cmd.exe
                                            "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\CBAKJEHDBG.exe"
                                            2⤵
                                            • Checks computer location settings
                                            • Suspicious use of SetWindowsHookEx
                                            PID:1032
                                        • C:\Windows\System32\CompPkgSrv.exe
                                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                                          1⤵
                                            PID:2500
                                          • C:\Windows\System32\CompPkgSrv.exe
                                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                                            1⤵
                                              PID:6044
                                            • C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe
                                              "C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"
                                              1⤵
                                                PID:5920
                                              • C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
                                                C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
                                                1⤵
                                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                • Checks BIOS information in registry
                                                • Executes dropped EXE
                                                • Identifies Wine through registry keys
                                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:5240
                                              • C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
                                                C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
                                                1⤵
                                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                • Checks BIOS information in registry
                                                • Executes dropped EXE
                                                • Identifies Wine through registry keys
                                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:812
                                              • C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
                                                C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
                                                1⤵
                                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                • Checks BIOS information in registry
                                                • Executes dropped EXE
                                                • Identifies Wine through registry keys
                                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:1492

                                              Network

                                              MITRE ATT&CK Enterprise v15

                                              Replay Monitor

                                              Loading Replay Monitor...

                                              Downloads

                                              • C:\ProgramData\mozglue.dll

                                                Filesize

                                                593KB

                                                MD5

                                                c8fd9be83bc728cc04beffafc2907fe9

                                                SHA1

                                                95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                                                SHA256

                                                ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                                                SHA512

                                                fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                                              • C:\ProgramData\nss3.dll

                                                Filesize

                                                2.0MB

                                                MD5

                                                1cc453cdf74f31e4d913ff9c10acdde2

                                                SHA1

                                                6e85eae544d6e965f15fa5c39700fa7202f3aafe

                                                SHA256

                                                ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                                                SHA512

                                                dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                Filesize

                                                264B

                                                MD5

                                                042dbc3086b4700b512b634921b0d4da

                                                SHA1

                                                73551f72d2fc57cb14293c276d6b781fe7f619ad

                                                SHA256

                                                d41970d5d2e93651001ab301ea2241529e6d9cd845a959d07ac34a4f7730af55

                                                SHA512

                                                99b1b720be94d978825ad9404bd221ca5bd8be4b8ff8ac67546e56ceb22a0ebdaf25a18a4d55ff563a0e1e3d2cff08f86d20e9fd1f1d2e8a577f786d3936f004

                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                                Filesize

                                                3KB

                                                MD5

                                                9215a80bb7498bfba98776e78eefaa53

                                                SHA1

                                                aec3db7fa932c49b9ea1a266c109d12a579b7b3c

                                                SHA256

                                                4aedfea82e761e55ed7ef15f709de36a480eb052b4b3b48b5819e70d5738b066

                                                SHA512

                                                8000d350d15be928c1a98293eefee74153015b44a6d9b05c1974de475c5384a7edc8fc47a58a963427eeed855f8a341bbb97b6513491fa57364db3f51a25ed77

                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                                                Filesize

                                                2B

                                                MD5

                                                d751713988987e9331980363e24189ce

                                                SHA1

                                                97d170e1550eee4afc0af065b78cda302a97674c

                                                SHA256

                                                4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                                SHA512

                                                b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                Filesize

                                                356B

                                                MD5

                                                4d6ba5314247dd4b54e607fa2e98267d

                                                SHA1

                                                ed3b8db52c2051c88eed0118b0f82f6625dcb8f2

                                                SHA256

                                                1691e6c1609a603939dd6297da77ab4c322d232bfcd4ae973eb2c618cc2582e9

                                                SHA512

                                                a78a2968a89ced10af6cfb43b54b9f83dd9f4173179ddb355b6be1ee5011dd3c0be1e4e45e0354b1f2c22f2e207f61d7535beb7ce668db838bd77e67b440af90

                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                Filesize

                                                8KB

                                                MD5

                                                07eb6ed88340759ca0354e8ec9ecfc93

                                                SHA1

                                                a97514da40a656a2834ecba9a1f3bc7cae531731

                                                SHA256

                                                e40166b9928d79cb22435ca1228ab1a6185329982e2d067bf94039c83e9ac560

                                                SHA512

                                                693829eec11b66626b6419efc713c0bfd5ec955100211c27ed4eeb59281f792776f63a8dee151235e706569eb2477b867e9ee3459e96b1462d451d5b99c4a899

                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                Filesize

                                                8KB

                                                MD5

                                                0d00910cf9271a3904ee528795e85b42

                                                SHA1

                                                7f5d970e97b71fb7a63a6e191cdfe42eb318b822

                                                SHA256

                                                e95095ea7e770f7bb30a84594a06ad9fd5785a978d8fdecfdfd205af8fc2c1cb

                                                SHA512

                                                16df5fb3652fc779a3ba17d76a44f55212ce35b69b533d5e1492e35a34c8e52d4a16acb4a93482b9c168b843a88a19d9690f4ebff4c366f2d8e2a2b387e824b5

                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                Filesize

                                                8KB

                                                MD5

                                                b19ccd255ac0314cc9f26d4e63248eb7

                                                SHA1

                                                fc2abfb884168ec9ad2b0229e587c2274fd5ff4f

                                                SHA256

                                                002800d495b8c8450dc2bc51735e96b93d7ca0d2c9f6dc091f055bc6b5406ef2

                                                SHA512

                                                04dafbf7a37f1ad77afbd38c5c2cc77487424ef9d45cb6bfef0a806d662380b399820835fee5883184806814b48d08fcc81ce98d5f7e2c500335a7026e977a04

                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                Filesize

                                                8KB

                                                MD5

                                                3038783851395a9a5273f62bb4337b50

                                                SHA1

                                                e18ab7a488b405b1b6d1612e178f08d28afdf3dd

                                                SHA256

                                                a82103efc99c3ead20bbedae8fe265828e96713c093440433b311d059b43062e

                                                SHA512

                                                905ccfb3a914ec1295a5da3e80c6109fa18dac056634195a5a78ed747788609489745d7ac254e1e658cc55add689ecb1da7975a46e5434ece7b00e1abc8d5af6

                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                Filesize

                                                8KB

                                                MD5

                                                210df58605a0adc83349a7c77bd1e684

                                                SHA1

                                                ddde51cdedcaf3e97e1c0ad3f49c19d786f6b662

                                                SHA256

                                                b7fe66a042db2bd1add5cd902e6f00512d5439ceb907c283805eb6cd6cf5cc01

                                                SHA512

                                                be447c5e502a4a82aa6f3962934ab0c3000886b7472203b44df29516d77f4c8d99baa72b7247fa42ff73abbb3dc14d38cbcf3128563c01534bb866953e25064f

                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                Filesize

                                                8KB

                                                MD5

                                                a8cacf5affca957c60c00842d3270ec2

                                                SHA1

                                                02e4d2cc468247ba7548cb2620b02de79f13abe5

                                                SHA256

                                                7007cc98e902352108d8ddc339a097d5edcb951085e127d5a665ff3953a1a0bb

                                                SHA512

                                                73f6d93784bad6e2daaa9d024b63d3b974a06d302a2974cff8859f5c37027ecef425726d3c51266754ad9a64549c040108376602cca1a6aab0ad692608cc4e8c

                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                Filesize

                                                8KB

                                                MD5

                                                5892a270f00ebcc3ccc16d10154fdfd2

                                                SHA1

                                                fb4ad5d06145d3f5020d632dc4bd9ecba647e726

                                                SHA256

                                                5b6c702b01117ff47cb6b85134cdc1749747979b230139ad8eab594555c5d747

                                                SHA512

                                                76ae120c24ef7f5572e820c37c6bae09123f35da0a1921e1e8dedf0ddd8bd3a5e4370a1f83ad2c56ecae41c2f85a274d10c0fae426005ddb1fa5aaf1d7c92343

                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                Filesize

                                                8KB

                                                MD5

                                                1115c61c1535cd2beb6f516a43053a93

                                                SHA1

                                                b0073f3b21b8d4a63cd54918fe1bdd2644c4ccd8

                                                SHA256

                                                4bed16a3e9934c5efb3a99a75139647964f97fc98ebad50b1859d351788aac11

                                                SHA512

                                                61b744d77689419f047c7b71f7449410c7a3a83e25cdaa0c9e2058a2ab379497a591bac3a256b1f1b6e26457a35201e3aafafe102e01d4313e32e4096e4940b4

                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                Filesize

                                                92KB

                                                MD5

                                                e2f344b2007088f7e6aeaff48c14e035

                                                SHA1

                                                64bf2e25c49d41bbcfb661dcbe427c04cab5f559

                                                SHA256

                                                22fe121e3eee7725b0e5f881688a374bcc008cd007e43fe284f855645c5642fa

                                                SHA512

                                                cc2937ad3b8377716f40409e2ddda8202959b202b8ef6817f28f30e42f35211e10c3c2b8e4460d5ecc2e5f2802e87a7a5b4b8bace570125db4f10f1c5c7f2509

                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                Filesize

                                                92KB

                                                MD5

                                                7cf0b10c05339123b442a580834ef231

                                                SHA1

                                                406f95c12dbacd2709eb8bb2156d90accc8f8a2d

                                                SHA256

                                                36d32960d5fa6ccf51c9d20357da95c41dd76a18553e8bbc86ecea27d4c3da3b

                                                SHA512

                                                18bd4bda510f4826b32661146fcf72701ce21b1268b7d33c40116bb10d813e88c042e31bcb86837b3f5916ab9b17f7352c31d6a5f1b12bc884d1c5975d87248d

                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                Filesize

                                                152B

                                                MD5

                                                10fa19df148444a77ceec60cabd2ce21

                                                SHA1

                                                685b599c497668166ede4945d8885d204fd8d70f

                                                SHA256

                                                c3b5deb970d0f06a05c8111da90330ffe25da195aafa4e182211669484d1964b

                                                SHA512

                                                3518ce16fef66c59e0bdb772db51aeaa9042c44ca399be61ca3d9979351f93655393236711cf2b1988d5f90a5b9318a7569a8cef3374fc745a8f9aa8323691ef

                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                Filesize

                                                152B

                                                MD5

                                                75c9f57baeefeecd6c184627de951c1e

                                                SHA1

                                                52e0468e13cbfc9f15fc62cc27ce14367a996cff

                                                SHA256

                                                648ba270261690bb792f95d017e134d81a612ef4fc76dc41921c9e5b8f46d98f

                                                SHA512

                                                c4570cc4bb4894de3ecc8eee6cd8bfa5809ea401ceef683557fb170175ff4294cc21cdc6834db4e79e5e82d3bf16105894fff83290d26343423324bc486d4a15

                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

                                                Filesize

                                                38KB

                                                MD5

                                                c3aa6e31c125d83fb2eabcc9e33843dd

                                                SHA1

                                                ad91b78e1a9853ee876b77b82f75100ff5690d11

                                                SHA256

                                                c32b5cffb8ac92df9bd9340b75b8d0772a071af36df5b27879e45f6112f9b5b4

                                                SHA512

                                                897efddeb2d96e24aca43385cfb86a065034c4bb045c2e2b7391572e0ddd4a820b70fa83854de5048d7b7316fc9fa2f078924aab62206a7a135aaf91176a4c6b

                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                Filesize

                                                216B

                                                MD5

                                                24bca0fb5d69252cf5a02732e7856c46

                                                SHA1

                                                5701c48dd562f4ea886f4c20364b1e376bd8ccb8

                                                SHA256

                                                5d5409492e637c0c0881f72f8b6654463647927129e50b1de3e06597b460bbd4

                                                SHA512

                                                396b21a90fe5b537b58a51053c79d11c0706a1656de98789cc3ad7f770103878e5041bcc199ec535ae398c4f4beef7124fe8e329c38b2c45caa332ff5bd12edd

                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                Filesize

                                                1KB

                                                MD5

                                                d00e57d77d0f9a82661d5da5955f3254

                                                SHA1

                                                bad386e6037059eb37918a9689788ca738d1af71

                                                SHA256

                                                e1dbc4702002b7a32d72eae5ad3b293f96ca59b3290d58f107508e543eb5f602

                                                SHA512

                                                80fc44dc76cf0c81614633f73948210496c3a92d554c32508042dc421baceee0b10d17e685b9717d01e8d6adaabdbe820a68b2dbc45c2c5b67c1067d06768051

                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                Filesize

                                                6KB

                                                MD5

                                                af364317b6e104d2f77545d233b0e3b8

                                                SHA1

                                                80dc21039537c7fcff36fbb90bc3e17acfa317fb

                                                SHA256

                                                690201aa0464bce92f476d61b504bad2453ee12bcad178750ae90372a8333c44

                                                SHA512

                                                2d7473edae36247bb622c4d2f466464e3e793cbefce1c3d5d36f943b29e6b809e307778cfa14effce832113591a3718d0a9e1119626b8bc2c4a237dccf753943

                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                Filesize

                                                6KB

                                                MD5

                                                550da5d08f20416bffd1f1af1d8eec49

                                                SHA1

                                                08ebb3960972d1cbfd22a9e28335ddda820361ad

                                                SHA256

                                                8ce94dd6f9f0b379f08b08b40566988e447a00b2762c941fd3247c3dfe5c0ec8

                                                SHA512

                                                7ddea71d7ccbff056ffc06cba69f8d102cfe5da87280deee1d2c5f2af69e58e8320ce2384573966217a41f6c10e0217cb9062ae6d96c1f6fd345d0972f3e3a1c

                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                Filesize

                                                11KB

                                                MD5

                                                2c148bd0de3122e8d03764c5d334349c

                                                SHA1

                                                62539cb61eae9319a8d7d005c45ffb64202f1ed6

                                                SHA256

                                                ba9d27350c9e6564c3520c52e8e76fb836b1c63eecce494a2b1b5192ebd50064

                                                SHA512

                                                4a5b2de7da7c4af1ac795ef3715f468214d76072284ffdb4a993a6a42a1993e114f8f6ab60ec243fcb935b381a7f23133cb0e9f257a6a8bc81ebdf209d4061f2

                                              • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yol9faaa.default-release\activity-stream.discovery_stream.json.tmp

                                                Filesize

                                                18KB

                                                MD5

                                                d503f9a7e370491f25f26f25f326e7c0

                                                SHA1

                                                8be7f1650779a5d2cd4288dacad75498239a5f8e

                                                SHA256

                                                4b1b431b2ef840e9702fd06d8afb47b51eaa352f329b8bc4657c3e432fc78242

                                                SHA512

                                                65e16f1e9d36fc6ef0fe6f2c80cc812064d58716a201777ceb37a3696ac5b7201c74969e3500c5ce2da19d59f23c18d1e3a0819c2465472269c4d0b20468ba16

                                              • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yol9faaa.default-release\cache2\entries\5CD1EBDF6B57F13C7E783CE5E6D8E9C44014FE1A

                                                Filesize

                                                13KB

                                                MD5

                                                75e15c350300b512df55d5e35966f3fb

                                                SHA1

                                                519876e91f714e338a75d674e30804647b90d17d

                                                SHA256

                                                2acd16e711c8671e46e3f61696cf5c5d54cc488a285f4630a0b21f3578374b49

                                                SHA512

                                                79fa33aeb67ce7d450149acf4a32c18938283d7ef9b2f5372a8a447bb463522a17da093fe22b95b87845cfe97e8f6b0ce634ec8abbb0931804b5227c3c50467a

                                              • C:\Users\Admin\AppData\Local\Temp\1000006001\e00762e369.exe

                                                Filesize

                                                2.4MB

                                                MD5

                                                b6bf96c3900b28a9970323938a1752bd

                                                SHA1

                                                fff9ac5ee2a9849759bf02538f8a431738a894c5

                                                SHA256

                                                1013ef0d12658680241090322d56cbfd6ad665fd922049180184c3fef077a506

                                                SHA512

                                                475848394c20823bf0c05f3d66ff27422b22670babde769f936791881d0da800cadf3ae08e0e99fe0a85abeafaa072672575d020de9267d87142047c1e1033ec

                                              • C:\Users\Admin\AppData\Local\Temp\1000010001\5dda12ecc2.exe

                                                Filesize

                                                89KB

                                                MD5

                                                bc08b445116ecc06852a929a5d302c4a

                                                SHA1

                                                a78aa42220b90d47b4cf63119e6082f06b295f57

                                                SHA256

                                                5b232254dd2d33eb576516116977c884fba81d5a8427f742a73655f9e076efc6

                                                SHA512

                                                657a21d453112fb909be4005e0cab1ebf467840e275a159eb535b486432ffa0bfcc60da92475b26f08a0ea481c927654520a43163e04e34324551cb3bfd69fdf

                                              • C:\Users\Admin\AppData\Local\Temp\D4E4.tmp\D4E5.tmp\D4E6.bat

                                                Filesize

                                                2KB

                                                MD5

                                                de9423d9c334ba3dba7dc874aa7dbc28

                                                SHA1

                                                bf38b137b8d780b3d6d62aee03c9d3f73770d638

                                                SHA256

                                                a1e1b422c40fb611a50d3f8bf34f9819f76ddb304aa2d105fb49f41f57752698

                                                SHA512

                                                63f13acd904378ad7de22053e1087d61a70341f1891ada3b671223fec8f841b42b6f1060a4b18c8bb865ee4cd071cadc7ff6bd6d549760945bf1645a1086f401

                                              • C:\Users\Admin\AppData\Local\Temp\HCAEBFBKKJ.exe

                                                Filesize

                                                1.8MB

                                                MD5

                                                8bc520e6b221e7998eb73c10c830fbd6

                                                SHA1

                                                8a825403f8bff789c60e4dfb67ead847c957b0d4

                                                SHA256

                                                506ecb56dcf6b280d4f553a0fb009ba1760251e411916ab715701b53ae8fe943

                                                SHA512

                                                58d087c499275776e155cb38782f3eca9bdcb516a5707023eb60f31e99ace240076f59ce0c1fc8b7c7382583edfa0f29a68fde23c891a6f0d28de0d3703c94d6

                                              • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                                                Filesize

                                                479KB

                                                MD5

                                                09372174e83dbbf696ee732fd2e875bb

                                                SHA1

                                                ba360186ba650a769f9303f48b7200fb5eaccee1

                                                SHA256

                                                c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                                                SHA512

                                                b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                                              • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                                                Filesize

                                                13.8MB

                                                MD5

                                                0a8747a2ac9ac08ae9508f36c6d75692

                                                SHA1

                                                b287a96fd6cc12433adb42193dfe06111c38eaf0

                                                SHA256

                                                32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                                                SHA512

                                                59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yol9faaa.default-release\AlternateServices.bin

                                                Filesize

                                                11KB

                                                MD5

                                                f3ce800fce6d376467cce97b37624157

                                                SHA1

                                                4ca87a726a156bdec5982730c2c6ec919d1e98c1

                                                SHA256

                                                6ba7f2ead92e4f1d82f6093a3d2390f4f35626320ea5b4a713d968f4927b25a6

                                                SHA512

                                                ecc020d0c0fba0182b3f346a3ca02b2e03c6830389de7297f0a7739eefdd352a37daf4e42eca2a671a370d1a28159ba02f89c25aaf5f25e83bfd0d0c2c7e0c12

                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yol9faaa.default-release\AlternateServices.bin

                                                Filesize

                                                12KB

                                                MD5

                                                4a0870cc19525c69219d3ff1fb5b1d41

                                                SHA1

                                                50d25f4be5241dd071f47797849f273078a66091

                                                SHA256

                                                018673058b2ea2793f7d2bde04c6dd63ee23cb84095d3b3ab1d1159b01145ce6

                                                SHA512

                                                5d67d26b28ad1bde8344d17e2541f641d456fcfa42b9818c9c02c9bfb0769da3b60ee44e860b23106a9ba99b130f20b179ea65070be0fcfcc47f459e7e2278a0

                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yol9faaa.default-release\datareporting\glean\db\data.safe.tmp

                                                Filesize

                                                25KB

                                                MD5

                                                ed41a9e5a6ed75fe1daa2dc48ea78007

                                                SHA1

                                                b877f7e5323bb3b72349e2476960e355971e99fb

                                                SHA256

                                                6cc6dbbf1d276dd7cdc068bbd45dbb16f493bd0dc16f7bed8d33216ff156a012

                                                SHA512

                                                cbe0ca1ff31292aa2f193f3e13db100c5c4811bc13b71a9ee3ac9196cb699d4b9a0ce0b61175932e47fbc66bc1323334481bf34882d11ad20f0bbc4d69b79dd8

                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yol9faaa.default-release\datareporting\glean\db\data.safe.tmp

                                                Filesize

                                                24KB

                                                MD5

                                                16d6aa0d285dbf388429a02fcb28caf6

                                                SHA1

                                                6bedfde1d68f87cbf8650e87afa8e2cc59eb425f

                                                SHA256

                                                5679089e1aaf0bede9e0713714749c8866d75a49a7e7642bd399a77eab19c2db

                                                SHA512

                                                edf9e5d95359c4d350bc4ef43d3654debb374785881976bf3564ceb33bc3a20076013a97ff4697030e3cebbe1e4a9355a63bd04eabb21a039fe6d6a3c9eb3be8

                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yol9faaa.default-release\datareporting\glean\db\data.safe.tmp

                                                Filesize

                                                21KB

                                                MD5

                                                db3f1455941c43e7f2b3d37d58e87c7f

                                                SHA1

                                                7d2e9be888fd3db625893b67ec6ccbbe44df0df4

                                                SHA256

                                                b4dfaae1c300ead883e188a1e3b559e72c6930cd3dd353ead9803830435731a6

                                                SHA512

                                                8dd3346bcb4c9790e8b38e8822a68aa0b0a567d491e0285e1e6917cd6c0bd242cb18d29c5f041de735f85bcbb9ea5a5be9ef3bea6443d05d210c0dd190381e77

                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yol9faaa.default-release\datareporting\glean\db\data.safe.tmp

                                                Filesize

                                                22KB

                                                MD5

                                                83b1d2c983f19c5f2dc884ea3464458d

                                                SHA1

                                                423b152086b56a8e7a35a0ce14261928456aa422

                                                SHA256

                                                7f10dd32a5008c8082542955393c7962228ae92f8101ac6db81289775985b480

                                                SHA512

                                                d949dc440479619fcba20747b2a505a532b0c2534b4cc03291d479f52903cbcebc46a98487728cb2e9d73c96303de5ce9b119bc4873575c60d7b854b9c9ac34e

                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yol9faaa.default-release\datareporting\glean\db\data.safe.tmp

                                                Filesize

                                                22KB

                                                MD5

                                                e1ed6c15f1ad9d6e45e610a862fa11a2

                                                SHA1

                                                2cdbbe33c34184138a1b451dc51e049d4014e3f8

                                                SHA256

                                                107521cad7c61afd195df4ef15d742bf89923f8748ab74be1e7719802a8b5bfd

                                                SHA512

                                                aa7dde9557b99b0aaed7a170b8344f1f8bf65a9e4d7234ff39ed1d643fdccaa302074820a2b8700086d22f76b01fc2f27775afc5217bcbcac2927eef62bf3980

                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yol9faaa.default-release\datareporting\glean\pending_pings\3e5e03ec-759a-46fa-a8e6-a734b4c99729

                                                Filesize

                                                659B

                                                MD5

                                                98fd9217b48fa708f600d73564e69009

                                                SHA1

                                                6e898be19a9c2386a354e36ba779878476349e2c

                                                SHA256

                                                a54640948684f40e730b5cd505d100e0064edec1ffeac585b6e2039422c4dda0

                                                SHA512

                                                aa5a8eaae9aec251e5d8d5a33360631136ed77b09a0c6742df09b6d6b9f6da0bc6818074f85ccd78f28284573e4641f5bd7f286b60640e087baaedd6d0ad9e91

                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yol9faaa.default-release\datareporting\glean\pending_pings\ee5c07dc-fe2d-41ff-979e-1130c9d7adfe

                                                Filesize

                                                982B

                                                MD5

                                                d2ba83cb2840132a19bd8686c52bf5e7

                                                SHA1

                                                e8f5670fda3c38c856033458af5596c719af1b85

                                                SHA256

                                                678cf189b4adec9badae41a7f6ea236485754346e5587ccb50a6b1c54ed1c05b

                                                SHA512

                                                a944d4fb80e50580cd41af3c0bfc1c7c54259e6e8b9889ca12f61308683f8852b214dd7065624ba4a4cdfbf6d870b5fd4d5360ee4f6d332fff4f750745c6f915

                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yol9faaa.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

                                                Filesize

                                                1.1MB

                                                MD5

                                                842039753bf41fa5e11b3a1383061a87

                                                SHA1

                                                3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                                                SHA256

                                                d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                                                SHA512

                                                d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yol9faaa.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

                                                Filesize

                                                116B

                                                MD5

                                                2a461e9eb87fd1955cea740a3444ee7a

                                                SHA1

                                                b10755914c713f5a4677494dbe8a686ed458c3c5

                                                SHA256

                                                4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                                                SHA512

                                                34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yol9faaa.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

                                                Filesize

                                                372B

                                                MD5

                                                bf957ad58b55f64219ab3f793e374316

                                                SHA1

                                                a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                                                SHA256

                                                bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                                                SHA512

                                                79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yol9faaa.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

                                                Filesize

                                                17.8MB

                                                MD5

                                                daf7ef3acccab478aaa7d6dc1c60f865

                                                SHA1

                                                f8246162b97ce4a945feced27b6ea114366ff2ad

                                                SHA256

                                                bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                                                SHA512

                                                5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yol9faaa.default-release\prefs-1.js

                                                Filesize

                                                8KB

                                                MD5

                                                ba3c13b09f24d23c5ba76a45f1c57567

                                                SHA1

                                                9aebc7af4efbd8ba1777c3d5209b501b936ae30a

                                                SHA256

                                                cb2a9f24fd4d50c95909905e69ecc4f1d1fa58aa066118d2bb2fe88c6223caf9

                                                SHA512

                                                03af78b9111bbf9758851728c279536212a765ee47d9c6818b9b2be4f29dbf6088dcb42a9da8f8ad0e7b1474d7ff26d5cf7dc7bd485caf2bb45a0014799b1fb9

                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yol9faaa.default-release\prefs-1.js

                                                Filesize

                                                10KB

                                                MD5

                                                e7d2d5e5a53027cf6fe6e602772c376d

                                                SHA1

                                                38c0d58322c712202fb39ff9ba49d4b9b53850b9

                                                SHA256

                                                f4cc85c2df891f53cc698caacb4a92b6290a3b319fc8456c4fbac3dff2f4cb18

                                                SHA512

                                                a90798d72ff05526cd934fb6904c4b681801f641a6c96f45c4ea1f401154dd36aa079273721152f0d9f178317b5de34ebbbca2c3b0f98c71f3a17e35e70d8d8e

                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yol9faaa.default-release\prefs-1.js

                                                Filesize

                                                13KB

                                                MD5

                                                76bff253ddaabc098a7534216294ad5f

                                                SHA1

                                                adc8ab682125ee827378f55d826e8ac95d39777e

                                                SHA256

                                                bfeb395ed0bd0ecc4290610fdd39c85bef5a09d07d400aedfab7db5db73acb37

                                                SHA512

                                                6792ebc3841c08d4be082641d35bb9e2da861ef0f923ad62794fb8ee276427ab7c071cc3dc842343141d9fad3fcac89ca9f6af87e3407ce5544b6e0db2f7511d

                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yol9faaa.default-release\prefs.js

                                                Filesize

                                                8KB

                                                MD5

                                                a9cec187d2c5ad25ca8ffed106a488cb

                                                SHA1

                                                a3220ef64a5996e5f82c657950502ebebcdafb72

                                                SHA256

                                                eaa6094b803b75b78a262853affd1f96e43408724c791f5245945e4e24939543

                                                SHA512

                                                4d375e95d53b46dcbc1ac48e870dc5a9379ac23a888e7a23bdd4e116194ab67a4dd60fe3fec0b78603087f830631d442425276bd84c69eab1ce2ddd5ec1812a2

                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yol9faaa.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

                                                Filesize

                                                1.1MB

                                                MD5

                                                7e5af55d9a4fedd59905b93781ba9ca9

                                                SHA1

                                                e48b7d5d1232c437607de57e22d2331a60aead7f

                                                SHA256

                                                52451c0de95bcec420892be4d6e035fbbe197baf2956d381eaa203742ba47a4f

                                                SHA512

                                                f808b483f0242e0930b4aacef38e419c17f1a9991ddb7a9da0c88ee9779d63288b8358dab193d506a0faecd906fe599539b1a7e0a40f8faf83f8a527c06ac41b

                                              • \??\pipe\crashpad_4688_SGLZWXWBJNQMZYWR

                                                MD5

                                                d41d8cd98f00b204e9800998ecf8427e

                                                SHA1

                                                da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                SHA256

                                                e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                SHA512

                                                cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                              • memory/400-95-0x0000000000DF0000-0x00000000012AA000-memory.dmp

                                                Filesize

                                                4.7MB

                                              • memory/400-81-0x0000000000DF0000-0x00000000012AA000-memory.dmp

                                                Filesize

                                                4.7MB

                                              • memory/812-3655-0x00000000008F0000-0x0000000000DAA000-memory.dmp

                                                Filesize

                                                4.7MB

                                              • memory/812-3654-0x00000000008F0000-0x0000000000DAA000-memory.dmp

                                                Filesize

                                                4.7MB

                                              • memory/996-3695-0x00000000008F0000-0x0000000000DAA000-memory.dmp

                                                Filesize

                                                4.7MB

                                              • memory/996-486-0x00000000008F0000-0x0000000000DAA000-memory.dmp

                                                Filesize

                                                4.7MB

                                              • memory/996-3733-0x00000000008F0000-0x0000000000DAA000-memory.dmp

                                                Filesize

                                                4.7MB

                                              • memory/996-2816-0x00000000008F0000-0x0000000000DAA000-memory.dmp

                                                Filesize

                                                4.7MB

                                              • memory/996-3706-0x00000000008F0000-0x0000000000DAA000-memory.dmp

                                                Filesize

                                                4.7MB

                                              • memory/996-3705-0x00000000008F0000-0x0000000000DAA000-memory.dmp

                                                Filesize

                                                4.7MB

                                              • memory/996-3633-0x00000000008F0000-0x0000000000DAA000-memory.dmp

                                                Filesize

                                                4.7MB

                                              • memory/996-3636-0x00000000008F0000-0x0000000000DAA000-memory.dmp

                                                Filesize

                                                4.7MB

                                              • memory/996-94-0x00000000008F0000-0x0000000000DAA000-memory.dmp

                                                Filesize

                                                4.7MB

                                              • memory/996-3651-0x00000000008F0000-0x0000000000DAA000-memory.dmp

                                                Filesize

                                                4.7MB

                                              • memory/996-606-0x00000000008F0000-0x0000000000DAA000-memory.dmp

                                                Filesize

                                                4.7MB

                                              • memory/996-601-0x00000000008F0000-0x0000000000DAA000-memory.dmp

                                                Filesize

                                                4.7MB

                                              • memory/996-770-0x00000000008F0000-0x0000000000DAA000-memory.dmp

                                                Filesize

                                                4.7MB

                                              • memory/996-3685-0x00000000008F0000-0x0000000000DAA000-memory.dmp

                                                Filesize

                                                4.7MB

                                              • memory/996-3684-0x00000000008F0000-0x0000000000DAA000-memory.dmp

                                                Filesize

                                                4.7MB

                                              • memory/1492-3735-0x00000000008F0000-0x0000000000DAA000-memory.dmp

                                                Filesize

                                                4.7MB

                                              • memory/1492-3736-0x00000000008F0000-0x0000000000DAA000-memory.dmp

                                                Filesize

                                                4.7MB

                                              • memory/2904-111-0x0000000000BB0000-0x0000000001795000-memory.dmp

                                                Filesize

                                                11.9MB

                                              • memory/2904-122-0x0000000000BB0000-0x0000000001795000-memory.dmp

                                                Filesize

                                                11.9MB

                                              • memory/4988-77-0x000000007F840000-0x000000007FC11000-memory.dmp

                                                Filesize

                                                3.8MB

                                              • memory/4988-76-0x0000000000CB0000-0x0000000001895000-memory.dmp

                                                Filesize

                                                11.9MB

                                              • memory/4988-2-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                                                Filesize

                                                972KB

                                              • memory/4988-0-0x0000000000CB0000-0x0000000001895000-memory.dmp

                                                Filesize

                                                11.9MB

                                              • memory/4988-1-0x000000007F840000-0x000000007FC11000-memory.dmp

                                                Filesize

                                                3.8MB

                                              • memory/5240-563-0x00000000008F0000-0x0000000000DAA000-memory.dmp

                                                Filesize

                                                4.7MB

                                              • memory/5240-556-0x00000000008F0000-0x0000000000DAA000-memory.dmp

                                                Filesize

                                                4.7MB