Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-07-2024 19:15

General

  • Target

    185ec222500924ff9b485f662fabc533dfc6be8d728412c751576355208499b0.exe

  • Size

    1.8MB

  • MD5

    ee8c22e6860d138e1da227f83a788e7e

  • SHA1

    c7f1ec27a961ab3aab2799544d00dea208ba60b4

  • SHA256

    185ec222500924ff9b485f662fabc533dfc6be8d728412c751576355208499b0

  • SHA512

    7d8e090daed5c9486991b97ef1b27174cc76a5b6e73e03c622da12f63d28548c2c2d952199a2855461621427b8be55d647d9c5570f4b46c7358a9c4d16657d2d

  • SSDEEP

    49152:ZWrDTFGICnAtlWKwbcOHtpkvpjx7twSgeRyC:ZYDTYIw4WnbcOHtpkvpNJwZC

Malware Config

Extracted

Family

amadey

Version

4.30

Botnet

4dd39d

C2

http://77.91.77.82

Attributes
  • install_dir

    ad40971b6b

  • install_file

    explorti.exe

  • strings_key

    a434973ad22def7137dbb5e059b7081e

  • url_paths

    /Hun4Ko/index.php

rc4.plain

Extracted

Family

stealc

Botnet

hate

C2

http://85.28.47.30

Attributes
  • url_path

    /920475a59bac849d.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Stealc

    Stealc is an infostealer written in C++.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 10 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 5 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 6 IoCs
  • Identifies Wine through registry keys 2 TTPs 5 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 2 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 10 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 28 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\185ec222500924ff9b485f662fabc533dfc6be8d728412c751576355208499b0.exe
    "C:\Users\Admin\AppData\Local\Temp\185ec222500924ff9b485f662fabc533dfc6be8d728412c751576355208499b0.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:2132
    • C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
      "C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:5040
      • C:\Users\Admin\AppData\Local\Temp\1000006001\2ddbbcd86c.exe
        "C:\Users\Admin\AppData\Local\Temp\1000006001\2ddbbcd86c.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:3448
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\IJKJJKFHIJ.exe"
          4⤵
            PID:5480
            • C:\Users\Admin\AppData\Local\Temp\IJKJJKFHIJ.exe
              "C:\Users\Admin\AppData\Local\Temp\IJKJJKFHIJ.exe"
              5⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • Suspicious behavior: EnumeratesProcesses
              PID:6096
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\BFHDHJKKJD.exe"
            4⤵
            • Checks computer location settings
            • Suspicious use of SetWindowsHookEx
            PID:2276
        • C:\Users\Admin\AppData\Local\Temp\1000010001\9d78c87577.exe
          "C:\Users\Admin\AppData\Local\Temp\1000010001\9d78c87577.exe"
          3⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:2532
          • C:\Windows\system32\cmd.exe
            "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\B4C9.tmp\B528.tmp\B529.bat C:\Users\Admin\AppData\Local\Temp\1000010001\9d78c87577.exe"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:2396
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.youtube.com/account"
              5⤵
              • Enumerates system info in registry
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              • Suspicious use of WriteProcessMemory
              PID:936
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.106 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7fff4a44cc40,0x7fff4a44cc4c,0x7fff4a44cc58
                6⤵
                  PID:4152
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1916,i,7567767149714821670,7284804360603771282,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=1912 /prefetch:2
                  6⤵
                    PID:4384
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2172,i,7567767149714821670,7284804360603771282,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=2164 /prefetch:3
                    6⤵
                      PID:3824
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2268,i,7567767149714821670,7284804360603771282,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=2216 /prefetch:8
                      6⤵
                        PID:3276
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3100,i,7567767149714821670,7284804360603771282,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=3136 /prefetch:1
                        6⤵
                          PID:5348
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3104,i,7567767149714821670,7284804360603771282,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=3180 /prefetch:1
                          6⤵
                            PID:5372
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4276,i,7567767149714821670,7284804360603771282,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=4288 /prefetch:8
                            6⤵
                            • Drops file in System32 directory
                            • Suspicious behavior: EnumeratesProcesses
                            PID:4844
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/account"
                          5⤵
                          • Enumerates system info in registry
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                          • Suspicious use of FindShellTrayWindow
                          • Suspicious use of SendNotifyMessage
                          • Suspicious use of WriteProcessMemory
                          PID:1736
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7fff4a3046f8,0x7fff4a304708,0x7fff4a304718
                            6⤵
                              PID:2212
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,4655333468406354621,8243719228235519782,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
                              6⤵
                                PID:4052
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,4655333468406354621,8243719228235519782,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
                                6⤵
                                • Suspicious behavior: EnumeratesProcesses
                                PID:452
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,4655333468406354621,8243719228235519782,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2708 /prefetch:8
                                6⤵
                                  PID:1228
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,4655333468406354621,8243719228235519782,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
                                  6⤵
                                    PID:4412
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,4655333468406354621,8243719228235519782,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
                                    6⤵
                                      PID:3676
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,4655333468406354621,8243719228235519782,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4312 /prefetch:1
                                      6⤵
                                        PID:1960
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,4655333468406354621,8243719228235519782,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2364 /prefetch:2
                                        6⤵
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:5872
                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                      "C:\Program Files\Mozilla Firefox\firefox.exe" "https://www.youtube.com/account"
                                      5⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:4156
                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                        "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
                                        6⤵
                                        • Checks processor information in registry
                                        • Modifies registry class
                                        • Suspicious use of AdjustPrivilegeToken
                                        • Suspicious use of FindShellTrayWindow
                                        • Suspicious use of SendNotifyMessage
                                        • Suspicious use of SetWindowsHookEx
                                        • Suspicious use of WriteProcessMemory
                                        PID:3128
                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1984 -parentBuildID 20240401114208 -prefsHandle 1900 -prefMapHandle 1892 -prefsLen 25755 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7cac7aa7-b9f1-4947-ac09-fd4dc5eaf5a2} 3128 "\\.\pipe\gecko-crash-server-pipe.3128" gpu
                                          7⤵
                                            PID:1548
                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2384 -parentBuildID 20240401114208 -prefsHandle 2452 -prefMapHandle 2448 -prefsLen 26675 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a7dcd3eb-c0dd-4eb2-902f-beff4e6e95b6} 3128 "\\.\pipe\gecko-crash-server-pipe.3128" socket
                                            7⤵
                                              PID:1160
                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3116 -childID 1 -isForBrowser -prefsHandle 3080 -prefMapHandle 3124 -prefsLen 22698 -prefMapSize 244658 -jsInitHandle 1192 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f5b39d2f-4476-4b9f-8a94-e7a11d5d876e} 3128 "\\.\pipe\gecko-crash-server-pipe.3128" tab
                                              7⤵
                                                PID:4500
                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3876 -childID 2 -isForBrowser -prefsHandle 3868 -prefMapHandle 3864 -prefsLen 31165 -prefMapSize 244658 -jsInitHandle 1192 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c5dc740e-4070-40a7-9846-d0d019746fb5} 3128 "\\.\pipe\gecko-crash-server-pipe.3128" tab
                                                7⤵
                                                  PID:5168
                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4588 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4564 -prefMapHandle 4424 -prefsLen 31165 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ee8a1e83-ce77-46d0-aa3a-aecc57e146aa} 3128 "\\.\pipe\gecko-crash-server-pipe.3128" utility
                                                  7⤵
                                                  • Checks processor information in registry
                                                  PID:5724
                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5416 -childID 3 -isForBrowser -prefsHandle 5428 -prefMapHandle 5396 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1192 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f529a120-d344-4f2e-bc0b-70667ea346f8} 3128 "\\.\pipe\gecko-crash-server-pipe.3128" tab
                                                  7⤵
                                                    PID:5908
                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5460 -childID 4 -isForBrowser -prefsHandle 5592 -prefMapHandle 5596 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1192 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {abb580d3-0f82-4d86-9dec-fd6e0497b6c7} 3128 "\\.\pipe\gecko-crash-server-pipe.3128" tab
                                                    7⤵
                                                      PID:5936
                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5844 -childID 5 -isForBrowser -prefsHandle 5744 -prefMapHandle 5752 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1192 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2b72aaaf-c784-4c2f-b1e7-f07c12ba9b71} 3128 "\\.\pipe\gecko-crash-server-pipe.3128" tab
                                                      7⤵
                                                        PID:5152
                                          • C:\Windows\System32\CompPkgSrv.exe
                                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                                            1⤵
                                              PID:808
                                            • C:\Windows\System32\CompPkgSrv.exe
                                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                                              1⤵
                                                PID:3508
                                              • C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe
                                                "C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"
                                                1⤵
                                                  PID:5520
                                                • C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
                                                  C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
                                                  1⤵
                                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                  • Checks BIOS information in registry
                                                  • Executes dropped EXE
                                                  • Identifies Wine through registry keys
                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:5444
                                                • C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
                                                  C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
                                                  1⤵
                                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                  • Checks BIOS information in registry
                                                  • Executes dropped EXE
                                                  • Identifies Wine through registry keys
                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:5096

                                                Network

                                                MITRE ATT&CK Enterprise v15

                                                Replay Monitor

                                                Loading Replay Monitor...

                                                Downloads

                                                • C:\ProgramData\mozglue.dll

                                                  Filesize

                                                  593KB

                                                  MD5

                                                  c8fd9be83bc728cc04beffafc2907fe9

                                                  SHA1

                                                  95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                                                  SHA256

                                                  ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                                                  SHA512

                                                  fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                                                • C:\ProgramData\nss3.dll

                                                  Filesize

                                                  2.0MB

                                                  MD5

                                                  1cc453cdf74f31e4d913ff9c10acdde2

                                                  SHA1

                                                  6e85eae544d6e965f15fa5c39700fa7202f3aafe

                                                  SHA256

                                                  ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                                                  SHA512

                                                  dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                  Filesize

                                                  264B

                                                  MD5

                                                  210fae483b6f6b05b1b5f852d69ddcac

                                                  SHA1

                                                  f052489aa7128a3d0fe8b664886d6285583bee6a

                                                  SHA256

                                                  afbf1da238d4fe60c185d783ea564216f6dccf3bc4bf15e3b8d72cd61f30c264

                                                  SHA512

                                                  362e215991da581b3c4f9978771bc88688055890b4c3ff364ad96251e42f4a3035934032dca5398adb122e992592af17f27e3d92668a77a76b0f02ae1cd1cad3

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                                  Filesize

                                                  3KB

                                                  MD5

                                                  e08252ac65a9995e5bbac32893631d0d

                                                  SHA1

                                                  5c183a7774d7d10619947cf126fbe4fa02aebc91

                                                  SHA256

                                                  4d2f3126540dab06a71b3622499c5cf4ae3b281d901e307b109d605c2ddef86a

                                                  SHA512

                                                  f534f32afb0a62c920af23253379139ac610b421722c04dc435fb04eea6b6d20c0bf7590f04b31ca61cfec4cd16f58dc554e3b843c5e6cfab990368b62d15675

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                                                  Filesize

                                                  2B

                                                  MD5

                                                  d751713988987e9331980363e24189ce

                                                  SHA1

                                                  97d170e1550eee4afc0af065b78cda302a97674c

                                                  SHA256

                                                  4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                                  SHA512

                                                  b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                  Filesize

                                                  354B

                                                  MD5

                                                  84aebe54ab9f062d508cf56e47dc8462

                                                  SHA1

                                                  a19643801e97664d81db7873593f32eb8631f675

                                                  SHA256

                                                  68c2d5717b84b8394bce9b0cd34722b2d17f1bdb429666472ecd5416104d3dd3

                                                  SHA512

                                                  72b7440c06f50a05cb990dd616a4612a5674f3f4e1be496b4bab8b69f0157fd930363e2a2e023522e940c07b5540734d5acbae39eb5fc54dfbbbf445e96d1893

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                  Filesize

                                                  8KB

                                                  MD5

                                                  74a0de564ae90e385f1f4b63f1f02c3a

                                                  SHA1

                                                  aec5eb245c1dbc8eb7df92752babc7a2e56a7f6e

                                                  SHA256

                                                  0638e31d0d049ba00f9ec344691acee63ddc49625e60f2367432d6902a041dd1

                                                  SHA512

                                                  639c07dc74a7a0f0bdf7855811a29dfbe04e08f7638c3d2fe32af7c859674836e762c340bb56c82c480283236fd20263c740d4b729c084cbad40fefb13e8c115

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                  Filesize

                                                  8KB

                                                  MD5

                                                  4bf360c9221deb0fe3ad88fa511e2638

                                                  SHA1

                                                  ae02764d35593b195de2803dc525302a9b84cd95

                                                  SHA256

                                                  19e5c6d560fe70a351ffa63f1d890a9517e6afbc700a1f27c76eae6bd2054413

                                                  SHA512

                                                  96aff13f65ea52dac6342e5803bc34b7ce3db0efb58e551cbce6d38f750055bad3164e8980e9b8a1f2ee36e9e570111c14f6642cae7e608c8bd7dc3181e16dd2

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                  Filesize

                                                  8KB

                                                  MD5

                                                  da2ea0be6cb0606fee7addb32f52d573

                                                  SHA1

                                                  b48cac736c003df0f64937c1d714fd2ca4b32b89

                                                  SHA256

                                                  7828b55c478331c79d480dccc5dcfa2dbd51440d8406e46d76da7759f99d887d

                                                  SHA512

                                                  4a6183334e7cd1e532e623dc0ff0e9c0479b61aca1e9ee33747563dd07d079496ec7e6ce287f775c28edc031656cff11c32e0f8de27b062fc6d0a7406ba8fbbb

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                  Filesize

                                                  8KB

                                                  MD5

                                                  ff9d75b28c62ea593d4de9430d3b964c

                                                  SHA1

                                                  7811649e3f9e0cd25d0d756c2250fd0f0aa24c55

                                                  SHA256

                                                  107535540410d96b6e4458b14c45c81d3abe44e7fa11af45282ec1d8aad03b0f

                                                  SHA512

                                                  30c219db026e67cc9ec7d4c33f7a971873d15a770a7370f240f2e58e765bdd15d9edfc54c0af4ace08b197d4fefb15daf97bb1efdfa71f0ddf6afc36c12288b0

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                  Filesize

                                                  8KB

                                                  MD5

                                                  8f3f8b9203688fe740cf3b3e7af02667

                                                  SHA1

                                                  23973c3d39525730172b25ddcf17c53cb77bca23

                                                  SHA256

                                                  f93163c8ec780daf714b49c732ad3730377cae7f9d759226fc585d0940f1b60a

                                                  SHA512

                                                  35d6d37b7bbffaf446e37fda8b97f883527eead535f5c3f89ae35d8599b77bdad0044bd7f99a62a0d5c97d897afa2bea76d07cd9477db2a0007bf1768741bfe8

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                  Filesize

                                                  8KB

                                                  MD5

                                                  49dd020e8e05bbf8e2c1586d4d499afd

                                                  SHA1

                                                  06001d2ee8e9ba367231f82c4dfe477daf7ae86b

                                                  SHA256

                                                  43e217f23169954e55afc408e23fe74015127c233f3fa9123fccc337dfabc777

                                                  SHA512

                                                  bd9016c0498594657ea7b7d9698aaed442e016ff661c53f0e4918c24686f434f5e620e2c85511e0bfd2853f596e62d49cd8cfb17dca4ded2320359598f288aa3

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                  Filesize

                                                  8KB

                                                  MD5

                                                  29c7bf5e1f9e33ccba4290aea925ab2a

                                                  SHA1

                                                  98770431e88de2096601da52218a8eabcc679b77

                                                  SHA256

                                                  4e8399b1013680fe48296070d37c914c11990469bc75b00f1e10e7743154ad40

                                                  SHA512

                                                  a78b18c54e3471757065f3ea685f099cbad866e9fcfd288ce78aabe87b9891606359cc3ff16fb997af3c5c41b8906c6be569abd99186173302481e42d63903fe

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                  Filesize

                                                  8KB

                                                  MD5

                                                  6da01dccd59285a3b1cd7ce4bc9c5e02

                                                  SHA1

                                                  81a46bc9e6a6f1b922be3490707ef072361e8524

                                                  SHA256

                                                  a30c60a7ab5021615e32532e4271785038c11bba387d2214427146580ded9f9a

                                                  SHA512

                                                  41766c2baf061be38fc2aad3e8772b9af316cecb29952bd60923f5ee8a2096c71289ae791bc35972787504a7c9c29f4f5c02cb3df6ec0eb4b2441d4ae9b337fd

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                  Filesize

                                                  181KB

                                                  MD5

                                                  04468938fbcb06739d9f7be87a651488

                                                  SHA1

                                                  f3e8ec2ba7746b8219321691b10e35606adce877

                                                  SHA256

                                                  e9913cb8d2b745c25050dbce9d614b4fd58d43217d967938211af4f825c7f2ba

                                                  SHA512

                                                  88ef459ce4467cda9ef5c8ede31a4002484598958fa4698c060b39150ba4af5258569a631d85b4ee48cf4a18f16885c65c0c04d2e084c9b16751ea21b88517b3

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                  Filesize

                                                  181KB

                                                  MD5

                                                  fa87b4c32f56ac4316d48ee23ecaf6de

                                                  SHA1

                                                  b39ba40d65fb0cbce33c0d30a621b255a271ba74

                                                  SHA256

                                                  ca0bae193277789f800ddc69f821e4c40140a0e048eb7c101ea022b532b49114

                                                  SHA512

                                                  df810e9097799c579e818c3aaf7c16776908403847312dc369a4336367cdc6fe505626df440a8000d7dd347918ece82ea88d3bca988e4a0fc70e8419bc09791e

                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                  Filesize

                                                  152B

                                                  MD5

                                                  7f37f119665df6beaa925337bbff0e84

                                                  SHA1

                                                  c2601d11f8aa77e12ab3508479cbf20c27cbd865

                                                  SHA256

                                                  1073dbff3ec315ac85361c35c8ba791cc4198149b097c7b287dda1d791925027

                                                  SHA512

                                                  8e180e41dd27c51e81788564b19b8ff411028890da506fbf767d394b1e73ec53e046c8d07235b2ec7c1c593c976bbf74ed9b7d442d68b526a0a77a9b5b0ab817

                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                  Filesize

                                                  152B

                                                  MD5

                                                  d406f3135e11b0a0829109c1090a41dc

                                                  SHA1

                                                  810f00e803c17274f9af074fc6c47849ad6e873e

                                                  SHA256

                                                  91f57909a10174b06c862089a9c1f3b3aeafea74a70ee1942ce11bb80d9eace4

                                                  SHA512

                                                  2b9f0f94b1e8a1b62ab38af8df2add0ec9e4c6dfa94d9c84cc24fe86d2d57d4fc0d9ec8a9775cf42a859ddfd130260128185a0e2588992bca8fd4ebf5ee6d409

                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

                                                  Filesize

                                                  38KB

                                                  MD5

                                                  c3aa6e31c125d83fb2eabcc9e33843dd

                                                  SHA1

                                                  ad91b78e1a9853ee876b77b82f75100ff5690d11

                                                  SHA256

                                                  c32b5cffb8ac92df9bd9340b75b8d0772a071af36df5b27879e45f6112f9b5b4

                                                  SHA512

                                                  897efddeb2d96e24aca43385cfb86a065034c4bb045c2e2b7391572e0ddd4a820b70fa83854de5048d7b7316fc9fa2f078924aab62206a7a135aaf91176a4c6b

                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                  Filesize

                                                  240B

                                                  MD5

                                                  ce66feb32432602f67fba481dfe1e5ca

                                                  SHA1

                                                  74d35f2aa9e85beecf87db36b1466576871c9cae

                                                  SHA256

                                                  6481845a8e56a573d19c05b2cf7f953df5a0f661be58d55a73635cd30efd857e

                                                  SHA512

                                                  3fdd3ea3e50d877eb2aca9fd7b4ec684856771ec0b9f1b91fa4f126fc0fc6bb877135621b94e76337fb4f9a59940b59b9a1102c5ff6b647a135a4b7ebc90e7ee

                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                  Filesize

                                                  1KB

                                                  MD5

                                                  0fb428212a8c3bb1fcc8af6b6e2e3254

                                                  SHA1

                                                  47e175dfc03c4b43394d6b645ac98acb34d6e2e6

                                                  SHA256

                                                  9a75bb277f395069ceb5f747e37a708676552ec264a5cdb69ff896237b194065

                                                  SHA512

                                                  b7a0151870f0dd5d460e384dc8df10efe8fc67ccf07993d1fe26ac0d9bd7e84e9d94e7d1919a78450009bafb12ce9e7d507b9a05fd23f5aac35798c88288df2b

                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                  Filesize

                                                  6KB

                                                  MD5

                                                  466d2f11085e22984b88384e3cdbb862

                                                  SHA1

                                                  923248591a8b69107bd983275d525a0a245f235f

                                                  SHA256

                                                  93a7d84fb81d79ec56087cda09ec636e8283ad6c2fac124f4351bd7dc925f0e5

                                                  SHA512

                                                  f8f60878019bed774e352e20a51ba1f67512b35ec6e175ac795cdaacb5e935762c09db03c65b03d61c62405d2a65de2168cb12c1b55cc0e6951443beb16134ae

                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                  Filesize

                                                  6KB

                                                  MD5

                                                  6ad9ff5df4a31f0f28b4a4756a7903a1

                                                  SHA1

                                                  737d1daebe67398a6a8ecd44f1a039299ce76544

                                                  SHA256

                                                  5487c337acc09cd4399209c49ff88f291055e46a196e875785ca4f216240669d

                                                  SHA512

                                                  fcb454c079d6d1d9828e5e44f57bc394920d4e6d3efa0cf7c998c79687713364e674dfb0fe23bdc641b3591f03f353a8f828b9b923873b4518bc7cf86b83e968

                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                  Filesize

                                                  11KB

                                                  MD5

                                                  294c05edba039ac23ce5ffecafa7ebd7

                                                  SHA1

                                                  e4e7800fa17f172996f716867f6c969b4eec49cb

                                                  SHA256

                                                  ef8bd5ba123471c4b16bfb0c9c0b56c7bf55c5312ceeabbef7d5473ea39aed82

                                                  SHA512

                                                  42a6753a202862ef0e988b35c2d1763a903131209701a4e1a93ce613d2706c53b3ef0d4a4c11fafbaca30b5308f1ef2b87d1a2d8d73709d3b4203d224d1dbd6d

                                                • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\onffaicf.default-release\activity-stream.discovery_stream.json.tmp

                                                  Filesize

                                                  18KB

                                                  MD5

                                                  2f96601568907c8ebd216a204e0c8878

                                                  SHA1

                                                  aef19684c0c1200bd7a04ae92067d68a4b949c3b

                                                  SHA256

                                                  ae821372c3e1293de8713fc0de99173f0f2fc799873f51095792a658cadd2320

                                                  SHA512

                                                  b2252b0bfce235016306c22af638e29726e3c72e1cad0f90641ac897174880a4fb18535038a22624f0d69ade869c2ddb157c3225f8104e9ca26b94508bdd8f2f

                                                • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\onffaicf.default-release\cache2\entries\5CD1EBDF6B57F13C7E783CE5E6D8E9C44014FE1A

                                                  Filesize

                                                  13KB

                                                  MD5

                                                  ab9786c313a6e4ee6610ef5071a21f71

                                                  SHA1

                                                  1a3958ac6bfcede0d2bb7e19ee9225688cd9b1bb

                                                  SHA256

                                                  14757d0fd06cb1f868e02a514a0ca6756d5a17ca283a822750799e1160e775a3

                                                  SHA512

                                                  ce8c2daabdfd907f07094a69aad108c67f0ef8c4db35d091c010e061e1e16d417eba445ffceae302970a4d009ef134ccc09c68c67b69fbac7ca1176d2a4a7b7b

                                                • C:\Users\Admin\AppData\Local\Temp\1000006001\2ddbbcd86c.exe

                                                  Filesize

                                                  2.4MB

                                                  MD5

                                                  b6bf96c3900b28a9970323938a1752bd

                                                  SHA1

                                                  fff9ac5ee2a9849759bf02538f8a431738a894c5

                                                  SHA256

                                                  1013ef0d12658680241090322d56cbfd6ad665fd922049180184c3fef077a506

                                                  SHA512

                                                  475848394c20823bf0c05f3d66ff27422b22670babde769f936791881d0da800cadf3ae08e0e99fe0a85abeafaa072672575d020de9267d87142047c1e1033ec

                                                • C:\Users\Admin\AppData\Local\Temp\1000010001\9d78c87577.exe

                                                  Filesize

                                                  89KB

                                                  MD5

                                                  bc08b445116ecc06852a929a5d302c4a

                                                  SHA1

                                                  a78aa42220b90d47b4cf63119e6082f06b295f57

                                                  SHA256

                                                  5b232254dd2d33eb576516116977c884fba81d5a8427f742a73655f9e076efc6

                                                  SHA512

                                                  657a21d453112fb909be4005e0cab1ebf467840e275a159eb535b486432ffa0bfcc60da92475b26f08a0ea481c927654520a43163e04e34324551cb3bfd69fdf

                                                • C:\Users\Admin\AppData\Local\Temp\B4C9.tmp\B528.tmp\B529.bat

                                                  Filesize

                                                  2KB

                                                  MD5

                                                  de9423d9c334ba3dba7dc874aa7dbc28

                                                  SHA1

                                                  bf38b137b8d780b3d6d62aee03c9d3f73770d638

                                                  SHA256

                                                  a1e1b422c40fb611a50d3f8bf34f9819f76ddb304aa2d105fb49f41f57752698

                                                  SHA512

                                                  63f13acd904378ad7de22053e1087d61a70341f1891ada3b671223fec8f841b42b6f1060a4b18c8bb865ee4cd071cadc7ff6bd6d549760945bf1645a1086f401

                                                • C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe

                                                  Filesize

                                                  1.8MB

                                                  MD5

                                                  ee8c22e6860d138e1da227f83a788e7e

                                                  SHA1

                                                  c7f1ec27a961ab3aab2799544d00dea208ba60b4

                                                  SHA256

                                                  185ec222500924ff9b485f662fabc533dfc6be8d728412c751576355208499b0

                                                  SHA512

                                                  7d8e090daed5c9486991b97ef1b27174cc76a5b6e73e03c622da12f63d28548c2c2d952199a2855461621427b8be55d647d9c5570f4b46c7358a9c4d16657d2d

                                                • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                                                  Filesize

                                                  479KB

                                                  MD5

                                                  09372174e83dbbf696ee732fd2e875bb

                                                  SHA1

                                                  ba360186ba650a769f9303f48b7200fb5eaccee1

                                                  SHA256

                                                  c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                                                  SHA512

                                                  b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                                                • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                                                  Filesize

                                                  13.8MB

                                                  MD5

                                                  0a8747a2ac9ac08ae9508f36c6d75692

                                                  SHA1

                                                  b287a96fd6cc12433adb42193dfe06111c38eaf0

                                                  SHA256

                                                  32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                                                  SHA512

                                                  59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\onffaicf.default-release\AlternateServices.bin

                                                  Filesize

                                                  12KB

                                                  MD5

                                                  416e3129fd5d43af0d23e11451c7fb7a

                                                  SHA1

                                                  a0c88b35532b89ca525cf9dad30b686a897d5e0c

                                                  SHA256

                                                  0a41ce263db42f740b94f3a3fc8ca93c6efa63eb48dea07fd5e518a2035bd8e1

                                                  SHA512

                                                  de7f532d51015ccfbad20e6f49daf33788c55e197dabac45078b52b9ab2fd1393c83e2db43d180d153aad2fd9eb8baaa29959a0a237fba9faaaebe43a1a04303

                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\onffaicf.default-release\cookies.sqlite-wal

                                                  Filesize

                                                  256KB

                                                  MD5

                                                  cde9ca242de39f05c0eff5b049581e2c

                                                  SHA1

                                                  282f1010de4c7ec555c18f4d8cf3a22749841ba5

                                                  SHA256

                                                  294e97f84c77e7502e61c6023305998b6195bccc1f2415f2bd6dcf253966c3e3

                                                  SHA512

                                                  007f62e186ab51926f7bac56d85f0c02f43591b3a127f1cb316a12ef199f40a6821a1f3f86f21c9cebfb3a1162a2f51005fef5b83d937a85c852bb9723a671de

                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\onffaicf.default-release\datareporting\glean\db\data.safe.tmp

                                                  Filesize

                                                  21KB

                                                  MD5

                                                  78c9a5319f4eb8fafce4ab3265b0e293

                                                  SHA1

                                                  921fa2b27e715e993b92e9d1560420154eb882e5

                                                  SHA256

                                                  984e491bc416f6b56d37e3b02e7889f0f47068e1eab1a52790807031482b126d

                                                  SHA512

                                                  8313f4f098b5e27b6705918c813e5605bec4b6cbb294b7b7f52174c6a4e2a52b06218e3f78bcdd3e064d0a011c2fd89908211861e9a8a35d9b241cec0150b760

                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\onffaicf.default-release\datareporting\glean\db\data.safe.tmp

                                                  Filesize

                                                  24KB

                                                  MD5

                                                  f808d300ac3e74780a32652399f4d9da

                                                  SHA1

                                                  e4fcee42881d8378465913a5df2b3000bc8ef244

                                                  SHA256

                                                  6bebcec152c240b089fcced00e70d1ec73984969237993449f6bbf253ee19b7a

                                                  SHA512

                                                  e8b8f17a323674c4160810dc512c894ba7877c2695b6c4ce3ca8104fdbbe9e2061e73e98aa6577c3841c87a7928cf82cb3284bd3fbc7aec3680c08174829756d

                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\onffaicf.default-release\datareporting\glean\pending_pings\729516dd-f579-41e1-b808-f2bd1188c456

                                                  Filesize

                                                  659B

                                                  MD5

                                                  b7041dbe6d01fbcc9e43c71e180a78c9

                                                  SHA1

                                                  e544cad8da62307b5ce7a1084b1531f300b34322

                                                  SHA256

                                                  33b3cf6f0b9844a32b76379b0258369633c00966576d36bad28a2a67fff8b30b

                                                  SHA512

                                                  697de7c1f551716a0c7851f6fef0a481cb3f311ad0bc55a599895d15e175e50db16fcfcf6987647991516e2ba19bfa7e6f23fcd7498aedff8a70e0b3507f3686

                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\onffaicf.default-release\datareporting\glean\pending_pings\7d8da4f4-e2b3-494b-a25c-f6dd4b206ea9

                                                  Filesize

                                                  982B

                                                  MD5

                                                  686aef48c7ad951e25f786c2328dd013

                                                  SHA1

                                                  7fb860601b3b623c19a311577c6e10629c83a8a0

                                                  SHA256

                                                  14de6dff02562e611e1e0106e3ac35c95f612ccfe067dce062ced7d83f7e7337

                                                  SHA512

                                                  d6c968669f0e7a78eccb2313008b60dd873fca38ebc05d7fadaf1dbba3c63041a193e07b5f2bae6438a2f0a2c88fd8ecf6e4f43dc24779a4cb1af26391fc587e

                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\onffaicf.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

                                                  Filesize

                                                  1.1MB

                                                  MD5

                                                  842039753bf41fa5e11b3a1383061a87

                                                  SHA1

                                                  3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                                                  SHA256

                                                  d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                                                  SHA512

                                                  d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\onffaicf.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

                                                  Filesize

                                                  116B

                                                  MD5

                                                  2a461e9eb87fd1955cea740a3444ee7a

                                                  SHA1

                                                  b10755914c713f5a4677494dbe8a686ed458c3c5

                                                  SHA256

                                                  4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                                                  SHA512

                                                  34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\onffaicf.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

                                                  Filesize

                                                  372B

                                                  MD5

                                                  bf957ad58b55f64219ab3f793e374316

                                                  SHA1

                                                  a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                                                  SHA256

                                                  bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                                                  SHA512

                                                  79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\onffaicf.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

                                                  Filesize

                                                  17.8MB

                                                  MD5

                                                  daf7ef3acccab478aaa7d6dc1c60f865

                                                  SHA1

                                                  f8246162b97ce4a945feced27b6ea114366ff2ad

                                                  SHA256

                                                  bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                                                  SHA512

                                                  5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\onffaicf.default-release\places.sqlite-wal

                                                  Filesize

                                                  992KB

                                                  MD5

                                                  f0356ee53b05256ba0ecd6d3430589d8

                                                  SHA1

                                                  bc4defc60894194c592233909570d11f0201543f

                                                  SHA256

                                                  1886d7de8e530de1d0738f506e7de09babde8cec96c664284e6b4519d46b2c51

                                                  SHA512

                                                  c88751d02f705692d4b497b8a757cf6139c09413bd466ec03facf05daf25e90608fd71ef1b3c9d1eefede1f298d251de855fdc8c68c2096f108c15cc7e089f2a

                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\onffaicf.default-release\prefs-1.js

                                                  Filesize

                                                  8KB

                                                  MD5

                                                  597c5aa46754141f4e7b0a6619ac2c73

                                                  SHA1

                                                  3febf22351a1e2b7da9a163f7d5299f11effe6f8

                                                  SHA256

                                                  368f49d0d9c31862a6127050d6f1831fe0f3903ebb2106c2a99c349ec8b33356

                                                  SHA512

                                                  48425c5afd86c21a5ef0dff3d9e10077aa69c3e31588c5cc59f51240d467529ee92d3173bb2419c2d3534510e84e7d50b8d5a66c0eb20e894bdb72c8d5f6eefa

                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\onffaicf.default-release\prefs-1.js

                                                  Filesize

                                                  10KB

                                                  MD5

                                                  b6e2269c5dca2549fce034fd5defd140

                                                  SHA1

                                                  26ef5a151c62e1f4df27a08a365ce7f6ebf6be57

                                                  SHA256

                                                  3f7ddf4ff7d41b0a870a221f4a29e4c341cdbb2126a4241b2265da9b9b1debe1

                                                  SHA512

                                                  2fcffee6f2cb6a1ea40c1e3181c292a7c0cd6b09b087fa504f69405006dda9114783f0d3a9a9f4743fbf02fdfc270c376a8b285e52eb025aeef05fc1c3639f1c

                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\onffaicf.default-release\prefs-1.js

                                                  Filesize

                                                  13KB

                                                  MD5

                                                  68bfdc118108863c717d254d2156bda0

                                                  SHA1

                                                  9fb7f09c974606f0c01b475087951afe47fc913b

                                                  SHA256

                                                  0f3ff73b49e096cfa9dad663643a758cc3e070d7760127ca6e2a75f1864ce130

                                                  SHA512

                                                  412f094302ecdfe1160dd702b4ab98b7f9ee949d2251de4c412379d66c8cbccb66f67c95aeeaa803e6f01484b07cb3df06f386558291dea7e3d413daa53e4687

                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\onffaicf.default-release\prefs.js

                                                  Filesize

                                                  8KB

                                                  MD5

                                                  a4a12a7572ede7e7fdb9f6595a38ab2b

                                                  SHA1

                                                  2b6267fb51e5f41c329d0944b8c4094d9157d686

                                                  SHA256

                                                  9481ce895fbe0a914dab685fb61a382a154a6321e8ec67e62655f9093eb08a34

                                                  SHA512

                                                  58eb84543b8534351bd2ecb1c28d1c2ffb6f8c6ace6a95fc6a3011614e94d26ee05ff83870f35dca3068a86a5f3a789ac830987a335079d3aa9a375e2dd89fbe

                                                • \??\pipe\crashpad_936_MMAKDZOSIKRNQBTB

                                                  MD5

                                                  d41d8cd98f00b204e9800998ecf8427e

                                                  SHA1

                                                  da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                  SHA256

                                                  e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                  SHA512

                                                  cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                • memory/2132-1-0x00000000776A4000-0x00000000776A6000-memory.dmp

                                                  Filesize

                                                  8KB

                                                • memory/2132-2-0x00000000003D1000-0x00000000003FF000-memory.dmp

                                                  Filesize

                                                  184KB

                                                • memory/2132-0-0x00000000003D0000-0x0000000000881000-memory.dmp

                                                  Filesize

                                                  4.7MB

                                                • memory/2132-3-0x00000000003D0000-0x0000000000881000-memory.dmp

                                                  Filesize

                                                  4.7MB

                                                • memory/2132-5-0x00000000003D0000-0x0000000000881000-memory.dmp

                                                  Filesize

                                                  4.7MB

                                                • memory/2132-18-0x00000000003D0000-0x0000000000881000-memory.dmp

                                                  Filesize

                                                  4.7MB

                                                • memory/3448-91-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                                                  Filesize

                                                  972KB

                                                • memory/3448-593-0x0000000000130000-0x0000000000D15000-memory.dmp

                                                  Filesize

                                                  11.9MB

                                                • memory/3448-37-0x0000000000130000-0x0000000000D15000-memory.dmp

                                                  Filesize

                                                  11.9MB

                                                • memory/3448-579-0x0000000000130000-0x0000000000D15000-memory.dmp

                                                  Filesize

                                                  11.9MB

                                                • memory/5040-2923-0x0000000000480000-0x0000000000931000-memory.dmp

                                                  Filesize

                                                  4.7MB

                                                • memory/5040-16-0x0000000000480000-0x0000000000931000-memory.dmp

                                                  Filesize

                                                  4.7MB

                                                • memory/5040-3023-0x0000000000480000-0x0000000000931000-memory.dmp

                                                  Filesize

                                                  4.7MB

                                                • memory/5040-618-0x0000000000480000-0x0000000000931000-memory.dmp

                                                  Filesize

                                                  4.7MB

                                                • memory/5040-1818-0x0000000000480000-0x0000000000931000-memory.dmp

                                                  Filesize

                                                  4.7MB

                                                • memory/5040-21-0x0000000000480000-0x0000000000931000-memory.dmp

                                                  Filesize

                                                  4.7MB

                                                • memory/5040-20-0x0000000000480000-0x0000000000931000-memory.dmp

                                                  Filesize

                                                  4.7MB

                                                • memory/5040-2574-0x0000000000480000-0x0000000000931000-memory.dmp

                                                  Filesize

                                                  4.7MB

                                                • memory/5040-3008-0x0000000000480000-0x0000000000931000-memory.dmp

                                                  Filesize

                                                  4.7MB

                                                • memory/5040-19-0x0000000000481000-0x00000000004AF000-memory.dmp

                                                  Filesize

                                                  184KB

                                                • memory/5040-2940-0x0000000000480000-0x0000000000931000-memory.dmp

                                                  Filesize

                                                  4.7MB

                                                • memory/5040-470-0x0000000000480000-0x0000000000931000-memory.dmp

                                                  Filesize

                                                  4.7MB

                                                • memory/5040-2960-0x0000000000480000-0x0000000000931000-memory.dmp

                                                  Filesize

                                                  4.7MB

                                                • memory/5040-813-0x0000000000480000-0x0000000000931000-memory.dmp

                                                  Filesize

                                                  4.7MB

                                                • memory/5040-613-0x0000000000480000-0x0000000000931000-memory.dmp

                                                  Filesize

                                                  4.7MB

                                                • memory/5040-2986-0x0000000000480000-0x0000000000931000-memory.dmp

                                                  Filesize

                                                  4.7MB

                                                • memory/5040-2985-0x0000000000480000-0x0000000000931000-memory.dmp

                                                  Filesize

                                                  4.7MB

                                                • memory/5040-2974-0x0000000000480000-0x0000000000931000-memory.dmp

                                                  Filesize

                                                  4.7MB

                                                • memory/5040-612-0x0000000000480000-0x0000000000931000-memory.dmp

                                                  Filesize

                                                  4.7MB

                                                • memory/5040-2984-0x0000000000480000-0x0000000000931000-memory.dmp

                                                  Filesize

                                                  4.7MB

                                                • memory/5096-2973-0x0000000000480000-0x0000000000931000-memory.dmp

                                                  Filesize

                                                  4.7MB

                                                • memory/5096-2972-0x0000000000480000-0x0000000000931000-memory.dmp

                                                  Filesize

                                                  4.7MB

                                                • memory/5444-733-0x0000000000480000-0x0000000000931000-memory.dmp

                                                  Filesize

                                                  4.7MB

                                                • memory/5444-648-0x0000000000480000-0x0000000000931000-memory.dmp

                                                  Filesize

                                                  4.7MB

                                                • memory/6096-606-0x0000000000760000-0x0000000000C11000-memory.dmp

                                                  Filesize

                                                  4.7MB

                                                • memory/6096-597-0x0000000000760000-0x0000000000C11000-memory.dmp

                                                  Filesize

                                                  4.7MB