Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-07-2024 20:39

General

  • Target

    e369a08e4ef871f499a80b23c1c6e63fa98b4d3d0fc11536a9ee269b087816a5.exe

  • Size

    1.8MB

  • MD5

    70724f469bcf35c601b952b1f3b42318

  • SHA1

    7a1430987f4b4d60cd3ce1ad67a1454d773ecfa7

  • SHA256

    e369a08e4ef871f499a80b23c1c6e63fa98b4d3d0fc11536a9ee269b087816a5

  • SHA512

    75eb8ec34373138b6c205fafea37dea2bf8d9a377c5c8fffd8ebaa1b4ec6d77d08144e06786b36d937063479760f80af5e6fa8c6241f513c80ea7971538cf5ee

  • SSDEEP

    49152:W1+4+j+RZyaN85okf7Kfw+uERO4Hp4JBVYnJ:V7j+G5iwXIp4JBK

Malware Config

Extracted

Family

amadey

Version

4.30

Botnet

4dd39d

C2

http://77.91.77.82

Attributes
  • install_dir

    ad40971b6b

  • install_file

    explorti.exe

  • strings_key

    a434973ad22def7137dbb5e059b7081e

  • url_paths

    /Hun4Ko/index.php

rc4.plain

Extracted

Family

stealc

Botnet

hate

C2

http://85.28.47.30

Attributes
  • url_path

    /920475a59bac849d.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Stealc

    Stealc is an infostealer written in C++.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 10 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 5 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 6 IoCs
  • Identifies Wine through registry keys 2 TTPs 5 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 2 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies data under HKEY_USERS 1 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 28 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e369a08e4ef871f499a80b23c1c6e63fa98b4d3d0fc11536a9ee269b087816a5.exe
    "C:\Users\Admin\AppData\Local\Temp\e369a08e4ef871f499a80b23c1c6e63fa98b4d3d0fc11536a9ee269b087816a5.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:1736
    • C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
      "C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4592
      • C:\Users\Admin\AppData\Local\Temp\1000006001\e1a0298286.exe
        "C:\Users\Admin\AppData\Local\Temp\1000006001\e1a0298286.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:4268
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\BGIJDGCAEB.exe"
          4⤵
            PID:5536
            • C:\Users\Admin\AppData\Local\Temp\BGIJDGCAEB.exe
              "C:\Users\Admin\AppData\Local\Temp\BGIJDGCAEB.exe"
              5⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • Suspicious behavior: EnumeratesProcesses
              PID:4244
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\GDHCGDGIEB.exe"
            4⤵
            • Checks computer location settings
            • Suspicious use of SetWindowsHookEx
            PID:5572
        • C:\Users\Admin\AppData\Local\Temp\1000010001\55bd8dc034.exe
          "C:\Users\Admin\AppData\Local\Temp\1000010001\55bd8dc034.exe"
          3⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:4588
          • C:\Windows\system32\cmd.exe
            "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\B42D.tmp\B42E.tmp\B42F.bat C:\Users\Admin\AppData\Local\Temp\1000010001\55bd8dc034.exe"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:1012
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.youtube.com/account"
              5⤵
              • Enumerates system info in registry
              • Modifies data under HKEY_USERS
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              • Suspicious use of WriteProcessMemory
              PID:3040
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.106 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffcc99bcc40,0x7ffcc99bcc4c,0x7ffcc99bcc58
                6⤵
                  PID:2608
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1928,i,15630867718308392800,12090733490568937952,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=1924 /prefetch:2
                  6⤵
                    PID:4524
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2152,i,15630867718308392800,12090733490568937952,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=2176 /prefetch:3
                    6⤵
                      PID:4424
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2240,i,15630867718308392800,12090733490568937952,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=2252 /prefetch:8
                      6⤵
                        PID:1828
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3128,i,15630867718308392800,12090733490568937952,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=3156 /prefetch:1
                        6⤵
                          PID:436
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3132,i,15630867718308392800,12090733490568937952,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=3304 /prefetch:1
                          6⤵
                            PID:1120
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4608,i,15630867718308392800,12090733490568937952,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=4344 /prefetch:8
                            6⤵
                              PID:6120
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4788,i,15630867718308392800,12090733490568937952,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=4800 /prefetch:8
                              6⤵
                                PID:3568
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1044,i,15630867718308392800,12090733490568937952,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=4388 /prefetch:8
                                6⤵
                                • Drops file in System32 directory
                                • Suspicious behavior: EnumeratesProcesses
                                PID:2588
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/account"
                              5⤵
                              • Enumerates system info in registry
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                              • Suspicious use of FindShellTrayWindow
                              • Suspicious use of SendNotifyMessage
                              • Suspicious use of WriteProcessMemory
                              PID:1204
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ffcc98746f8,0x7ffcc9874708,0x7ffcc9874718
                                6⤵
                                  PID:2084
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2244,3863979235993900682,14866852161826297023,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2256 /prefetch:2
                                  6⤵
                                    PID:2716
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2244,3863979235993900682,14866852161826297023,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 /prefetch:3
                                    6⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:224
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2244,3863979235993900682,14866852161826297023,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2648 /prefetch:8
                                    6⤵
                                      PID:2952
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,3863979235993900682,14866852161826297023,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
                                      6⤵
                                        PID:4540
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,3863979235993900682,14866852161826297023,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
                                        6⤵
                                          PID:2464
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,3863979235993900682,14866852161826297023,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3736 /prefetch:1
                                          6⤵
                                            PID:5164
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2244,3863979235993900682,14866852161826297023,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4668 /prefetch:2
                                            6⤵
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:6124
                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                          "C:\Program Files\Mozilla Firefox\firefox.exe" "https://www.youtube.com/account"
                                          5⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:1584
                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                            "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
                                            6⤵
                                            • Checks processor information in registry
                                            • Modifies registry class
                                            • Suspicious use of FindShellTrayWindow
                                            • Suspicious use of SendNotifyMessage
                                            • Suspicious use of SetWindowsHookEx
                                            • Suspicious use of WriteProcessMemory
                                            PID:3448
                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1984 -parentBuildID 20240401114208 -prefsHandle 1900 -prefMapHandle 1892 -prefsLen 25753 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0d8288f1-7269-4640-9eff-765aba1e018f} 3448 "\\.\pipe\gecko-crash-server-pipe.3448" gpu
                                              7⤵
                                                PID:3256
                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2468 -parentBuildID 20240401114208 -prefsHandle 2444 -prefMapHandle 2440 -prefsLen 26673 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7b89e8bc-203d-494b-9b4d-8a764f982768} 3448 "\\.\pipe\gecko-crash-server-pipe.3448" socket
                                                7⤵
                                                  PID:1544
                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3048 -childID 1 -isForBrowser -prefsHandle 3264 -prefMapHandle 3136 -prefsLen 22698 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7ac46541-84a6-4290-ade9-16be0ad20548} 3448 "\\.\pipe\gecko-crash-server-pipe.3448" tab
                                                  7⤵
                                                    PID:4984
                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3028 -childID 2 -isForBrowser -prefsHandle 3388 -prefMapHandle 3320 -prefsLen 22739 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {06c4c8a8-3afc-41dd-8684-aaea9f22bb31} 3448 "\\.\pipe\gecko-crash-server-pipe.3448" tab
                                                    7⤵
                                                      PID:5756
                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3752 -childID 3 -isForBrowser -prefsHandle 3228 -prefMapHandle 3212 -prefsLen 22739 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {411828dc-e4c6-42cd-b61d-c378e87ca0a9} 3448 "\\.\pipe\gecko-crash-server-pipe.3448" tab
                                                      7⤵
                                                        PID:5768
                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3756 -childID 4 -isForBrowser -prefsHandle 3860 -prefMapHandle 3864 -prefsLen 22739 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fbb4395e-f1fc-45d3-b7e6-bdbcf653cec6} 3448 "\\.\pipe\gecko-crash-server-pipe.3448" tab
                                                        7⤵
                                                          PID:5780
                                            • C:\Windows\System32\CompPkgSrv.exe
                                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                                              1⤵
                                                PID:2932
                                              • C:\Windows\System32\CompPkgSrv.exe
                                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                1⤵
                                                  PID:5108
                                                • C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe
                                                  "C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"
                                                  1⤵
                                                    PID:5332
                                                  • C:\Windows\system32\svchost.exe
                                                    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                    1⤵
                                                      PID:5344
                                                    • C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
                                                      C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
                                                      1⤵
                                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                      • Checks BIOS information in registry
                                                      • Executes dropped EXE
                                                      • Identifies Wine through registry keys
                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:4436
                                                    • C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
                                                      C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
                                                      1⤵
                                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                      • Checks BIOS information in registry
                                                      • Executes dropped EXE
                                                      • Identifies Wine through registry keys
                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:6104

                                                    Network

                                                    MITRE ATT&CK Enterprise v15

                                                    Replay Monitor

                                                    Loading Replay Monitor...

                                                    Downloads

                                                    • C:\ProgramData\HIEHDHCFIJDBFHJJDBFH

                                                      Filesize

                                                      8KB

                                                      MD5

                                                      b759a48a1f709035e74528cc6f47c5fb

                                                      SHA1

                                                      9c2a1c8bc069157d72ea76daf944a9b0c81b85f7

                                                      SHA256

                                                      14101a450a352e958a953da6579fa139d1171ccaa4c03dd4274970519d3fd296

                                                      SHA512

                                                      4b1647a2a27ccc4202fdd54ca856be5e484fb8191ae8aea13b095a8b4efbffee556985b5f15b97ac9fa9a7e8ade41351e0328546c073ae4bf900de3a071f4246

                                                    • C:\ProgramData\mozglue.dll

                                                      Filesize

                                                      593KB

                                                      MD5

                                                      c8fd9be83bc728cc04beffafc2907fe9

                                                      SHA1

                                                      95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                                                      SHA256

                                                      ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                                                      SHA512

                                                      fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                                                    • C:\ProgramData\nss3.dll

                                                      Filesize

                                                      2.0MB

                                                      MD5

                                                      1cc453cdf74f31e4d913ff9c10acdde2

                                                      SHA1

                                                      6e85eae544d6e965f15fa5c39700fa7202f3aafe

                                                      SHA256

                                                      ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                                                      SHA512

                                                      dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\163adebd-1dea-4199-88f0-d3a6d0a38f4b.tmp

                                                      Filesize

                                                      8KB

                                                      MD5

                                                      b8984318ae27d69c19c3984a326b5e95

                                                      SHA1

                                                      981ede5b182096681fb2bf805ae789f1c4a9d452

                                                      SHA256

                                                      c31bfbc62e43c790be4dadc9bf65846ca1b963d6f462c73b6b1e0f6ad3734b4e

                                                      SHA512

                                                      fba4d89b6069beb6ee8ca8fca51866b1cfa43ce16ac373355c38a0084bd1053344095b43297a830dbdaf301c52a720e529d35c04010491c911ab62afbefa9dd6

                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\9f644d6d-d7ca-4be7-adfd-4edc7e34fe6e.tmp

                                                      Filesize

                                                      8KB

                                                      MD5

                                                      5a5a700de22de89aa036a16cf4f2678d

                                                      SHA1

                                                      9017efe71ac3fe5deb8ff2ec30caec32357cdf87

                                                      SHA256

                                                      203412a0177e9f12f3671980290f43b4136b9276c6f034d35e3345fcf81b40f1

                                                      SHA512

                                                      3fa1c2149439895ca8f6fb80bf5ef408933ab8228e951423365ece0aa7d634835ef3efb4b2a931151ff70ffe036bec773c68221f9b1c425570e66985feee5f96

                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index

                                                      Filesize

                                                      264B

                                                      MD5

                                                      35652b089823d79f66ee8997a85725b9

                                                      SHA1

                                                      cf4249af6b06482815d4dbb3934f4ea0abc35846

                                                      SHA256

                                                      226b8b92206b1f1a72de4f65582c951b73fb1e1c0d76da6c77df0a4f7b4c30cd

                                                      SHA512

                                                      3197623fb8678a50d319e9d92c25c5459be9001286a952028d2d551a5dfd80369c14962e4d4d3aca98be84d81fb2ff24ffece6c0ec676ac349ce80c1c2696980

                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                                      Filesize

                                                      3KB

                                                      MD5

                                                      b22f6c981b8c061294037e4563d97ac1

                                                      SHA1

                                                      63eef8be6a6bdc34f32115e6c320fa64545f09da

                                                      SHA256

                                                      6ca6d3dfd8a570f54ceb8f86be2fe4824213f17a7e3e97a33d202b21f4600007

                                                      SHA512

                                                      67be39b886281c6bf75b1f073dbf1aeb983b6445c4333f7c138a7ad2653c2f152eb4c389000c71f9d3e235038fa22211b3c1465138f8eac7665fb6b0c1249118

                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                                                      Filesize

                                                      2B

                                                      MD5

                                                      d751713988987e9331980363e24189ce

                                                      SHA1

                                                      97d170e1550eee4afc0af065b78cda302a97674c

                                                      SHA256

                                                      4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                                      SHA512

                                                      b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                      Filesize

                                                      524B

                                                      MD5

                                                      99e47322cf0850403cd724c64c196c8c

                                                      SHA1

                                                      d6b2030c718fc6d557397cf51a3e969d245dfe80

                                                      SHA256

                                                      6e470028e3d63f74320961f7f61eb1c1918c03a183016ae29674ebd1acf57aef

                                                      SHA512

                                                      404206a7e7f4b541957e0db443c9c5eff78e62f479aad90657c5f8bcb7b4fc0200efa2699382e56c5f7b048682c9f19ecbd9339cbdff8282b8f6f9b4e481995e

                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                      Filesize

                                                      8KB

                                                      MD5

                                                      ef4f09149cf6f2f916846378ee508604

                                                      SHA1

                                                      8090a2ed57a2ed4d5f9464d412fc7f18eec6a21b

                                                      SHA256

                                                      d4a9498a81ab4bf30d1bc425756eb286930ea19bae540a785de2303ed6616aec

                                                      SHA512

                                                      5650d91baf61de2dd3b9a2153e0ef0a5cc16956e204fe1fba3830b237e79b2ab2fec7168902d73a8748141fbfb893bdcda939a211c40c03c7193a06000820fa7

                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                      Filesize

                                                      8KB

                                                      MD5

                                                      c80139768a521919f245b2fdd6c3e085

                                                      SHA1

                                                      1e89f332c33f07c2a19cd01d8231e49d9e770b39

                                                      SHA256

                                                      acda14563150097e5037d466eeb45d6bb516bbbed1ac2d520d159be59e430cfc

                                                      SHA512

                                                      7e40a0c0cf2dde1613f701ddd99a08b3f9980c41eeaac47667af0f683a4400561d6e2dbda59b0a5a692f4455c7c0421d2eaf88caec4e32751f1f37b4ca448092

                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                      Filesize

                                                      8KB

                                                      MD5

                                                      b35db02b18e96c680e161e0d5f66bdbe

                                                      SHA1

                                                      fc2d545467857ec22098404f73078043d216636c

                                                      SHA256

                                                      182603dca99eb559a96fd1fba7e1660b2a7fe9b6f43c18e3b5c6d710a3a62318

                                                      SHA512

                                                      dca1b4229b5cb9de81ed3c2679fd98a14c80ada226fb817cc62c5eb973c7a7ac0b5e585269edc67c4da7dcbfaca93cfb53ad4fc5b3d19a3db835bac954b9da05

                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                      Filesize

                                                      8KB

                                                      MD5

                                                      29c03cb087bf83ee370b9fc6c6ed47e3

                                                      SHA1

                                                      286b1959988f44c36d36a085fea9604cdf5803a8

                                                      SHA256

                                                      6ffd39b87647752c901f96628e4380112e0d77fdfce2b6cdcee18f6ff04ff440

                                                      SHA512

                                                      2462f3d2785cb09f1d4e1c22f2958949689329856428b556808b4681ea173bf089201b4bb1be29e2798028f31406691bef32476dc056776bb0af1cbc50f22a93

                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                      Filesize

                                                      8KB

                                                      MD5

                                                      4dd88bf2da25a3a818c73a92bd967a85

                                                      SHA1

                                                      26e5940fcdbadc30611ef1064e3eb2d26f7d0191

                                                      SHA256

                                                      87e48fe16d58ca764fcc0f035685bd1390a5f40994ea0721ab1c5363f16fd4bf

                                                      SHA512

                                                      05e3072681d1db1cdb70734ebdaf8a8d2237d2a65583690775eec966885e2745bbcd76cba14c13db7fc6d1b2314bb8f4a4b45dfe2aff5d5afc8e47d9b7e070b3

                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                      Filesize

                                                      8KB

                                                      MD5

                                                      d75034b391deeec4afbcef962298b16c

                                                      SHA1

                                                      a006a32aae4f1e4721c1404e3092c100f65911b2

                                                      SHA256

                                                      7736aaffc84f51b404a4aec76fe5657e794c4cb4b5895cf907c08a14c81c1e8b

                                                      SHA512

                                                      615ba0474d8f2868dd7b3b260352b33ae6c220235d4b13c123b62d864b97b3de2dfd421e9d59619c57e8deaf9907026e39ccbe7012a1b810f6d9fb7eafe8fe93

                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                      Filesize

                                                      8KB

                                                      MD5

                                                      92700ce00db7e937aed4b2ea0a9f554b

                                                      SHA1

                                                      21f1c003ead70fe793d05595f06eb81231031cba

                                                      SHA256

                                                      235caebe5f7f0ac0bcab713f7895714ba8fc822c90c979b8da831571a1dd1a53

                                                      SHA512

                                                      aaf21789933fdda2a8ef353721ff9d40a203ef50ec5c4304e24c0a42bbc5357c3f4bd519a0330c0181ada6858c731c5b88aa2d4507698a570fcc452caa74c297

                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                      Filesize

                                                      181KB

                                                      MD5

                                                      5265e0306d85bc819c80191d5196a374

                                                      SHA1

                                                      7f6ef478a7bf56b6988ec92398e0671cb94d84a9

                                                      SHA256

                                                      6be910c9ecbcd7a24b68e035170806050166fec79c63d78a7c40831dbe48fc11

                                                      SHA512

                                                      6e6c99771c0abc56f543e9c7a026d55fe0343ce6e95c88c6c62fe0a89617390082644125445d41e25c8ba283101cb71e8cdc92deef99bdc97d3038a252a928eb

                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                      Filesize

                                                      181KB

                                                      MD5

                                                      32de21cd237c2a5be7970049716a5304

                                                      SHA1

                                                      cbc303fcea95ff0d00501c53908e823bdf378611

                                                      SHA256

                                                      9d896229b596150e88bbdb6370736188eb0f934d36b8a253bac5dd7bd40535ef

                                                      SHA512

                                                      b8b7dd571d95452d2ced3ee09c234670718f8bb8ba1d5892ec70d793d057ee5e5e5f6b11e43039675a04c69795a42dbef6173b3703435915b812d0aa325ccaaa

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                      Filesize

                                                      152B

                                                      MD5

                                                      3ee50fb26a9d3f096c47ff8696c24321

                                                      SHA1

                                                      a8c83e798d2a8b31fec0820560525e80dfa4fe66

                                                      SHA256

                                                      d80ec29cb17280af0c7522b30a80ffa19d1e786c0b09accfe3234b967d23eb6f

                                                      SHA512

                                                      479c0d2b76850aa79b58f9e0a8ba5773bd8909d915b98c2e9dc3a95c0ac18d7741b2ee571df695c0305598d89651c7aef2ff7c2fedb8b6a6aa30057ecfc872c5

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                      Filesize

                                                      152B

                                                      MD5

                                                      eaaad45aced1889a90a8aa4c39f92659

                                                      SHA1

                                                      5c0130d9e8d1a64c97924090d9a5258b8a31b83c

                                                      SHA256

                                                      5e3237f26b6047f64459cd5d3a6bc3563e2642b98d75b97011c93e0a9bd26f3b

                                                      SHA512

                                                      0db1c6bdb51f4e6ba5ef4dc12fc73886e599ab28f1eec5d943110bc3d856401ca31c05baa9026dd441b69f3de92307eb77d93f089ba6e2b84eea6e93982620e4

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                      Filesize

                                                      240B

                                                      MD5

                                                      913a93cf094a17279928d7c47e0c77dc

                                                      SHA1

                                                      35ca186fd41cda7148d4428ea1f9f551b6c3834d

                                                      SHA256

                                                      bee29398bd5bcdea921d533ba9b18ae9373975283cad04a93002a43c869d8d05

                                                      SHA512

                                                      d3e25ba8a36aed2bf0c10c1bfebd5c5aa392082b54794c8ae01dccf814e748591e42759a8559ab7da27fa648508c3e37bc873dfe90a4fa216c19918443da9e2b

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                      Filesize

                                                      1KB

                                                      MD5

                                                      6b7c416f3182574cf06a9cc4ef46127b

                                                      SHA1

                                                      6cd3ccd38a357c54368cb8207d28be0826ebf020

                                                      SHA256

                                                      c69091b48db6dbd9ff8069362dc29cb28d42cd168526327da138d80a6ecfe6a6

                                                      SHA512

                                                      e69d0e266db072c9b57ed79bc3fe1d4a65cc019e2e1939fcecbf4cc6f7e6ad75ba03e0b66eb61ba1503bef324845be61f89dcc51d51acca48993b9becf3f23a2

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                      Filesize

                                                      6KB

                                                      MD5

                                                      ba41bd4e3f53b717a1548d703d4bdb83

                                                      SHA1

                                                      607e18e5af3d8e3e3775006d1e451c59b368b71f

                                                      SHA256

                                                      4a1f5e6dd94aa4c57cd4ef058c95a31ab6025fae63cc145e3fae7b436a50cbbe

                                                      SHA512

                                                      ca1c9fac172d2d4ec3f09e5b39734a135f7c158f557eed9dfd71a7872c8884d97a959589c310a9031b87eb4b3c2f70289a0f66f8e207929a19045d5800245cc1

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                      Filesize

                                                      6KB

                                                      MD5

                                                      f86dc06dc6ea58ce97aa4f8870ddd6e0

                                                      SHA1

                                                      34d432ab08dc38b2ac63685e8ab48484551200e2

                                                      SHA256

                                                      54a062cf762679d28f7534567072bb884fc7b6154134dd82aa1abd05a13c1689

                                                      SHA512

                                                      03f82eade04064bb5913ddd68429cd3ae1943dff37156932b00044d96c774ed5a8bbeb2d0e787783369d562b1568f7cd18259e1ba81d58c26fc4c7472222337c

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                      Filesize

                                                      11KB

                                                      MD5

                                                      48112e95c60e31deddaec31432009bab

                                                      SHA1

                                                      0cb8e0e30fb14c978ef1a9ad81ed257a99157a19

                                                      SHA256

                                                      7625abc18d7f83a424d2a104e2050176668d0033d135a6d76bd418307df107ea

                                                      SHA512

                                                      754e718401dd7d22ffa9ca61add63e7d751e7a8c6e1a8b4f42d12d5f3da015aca03a4f51455f67ab3004d07fc9d7fb958a3037ffb29d4d40f1eabb9604e0a548

                                                    • C:\Users\Admin\AppData\Local\Temp\1000006001\e1a0298286.exe

                                                      Filesize

                                                      2.4MB

                                                      MD5

                                                      b6bf96c3900b28a9970323938a1752bd

                                                      SHA1

                                                      fff9ac5ee2a9849759bf02538f8a431738a894c5

                                                      SHA256

                                                      1013ef0d12658680241090322d56cbfd6ad665fd922049180184c3fef077a506

                                                      SHA512

                                                      475848394c20823bf0c05f3d66ff27422b22670babde769f936791881d0da800cadf3ae08e0e99fe0a85abeafaa072672575d020de9267d87142047c1e1033ec

                                                    • C:\Users\Admin\AppData\Local\Temp\1000010001\55bd8dc034.exe

                                                      Filesize

                                                      89KB

                                                      MD5

                                                      bc08b445116ecc06852a929a5d302c4a

                                                      SHA1

                                                      a78aa42220b90d47b4cf63119e6082f06b295f57

                                                      SHA256

                                                      5b232254dd2d33eb576516116977c884fba81d5a8427f742a73655f9e076efc6

                                                      SHA512

                                                      657a21d453112fb909be4005e0cab1ebf467840e275a159eb535b486432ffa0bfcc60da92475b26f08a0ea481c927654520a43163e04e34324551cb3bfd69fdf

                                                    • C:\Users\Admin\AppData\Local\Temp\B42D.tmp\B42E.tmp\B42F.bat

                                                      Filesize

                                                      2KB

                                                      MD5

                                                      de9423d9c334ba3dba7dc874aa7dbc28

                                                      SHA1

                                                      bf38b137b8d780b3d6d62aee03c9d3f73770d638

                                                      SHA256

                                                      a1e1b422c40fb611a50d3f8bf34f9819f76ddb304aa2d105fb49f41f57752698

                                                      SHA512

                                                      63f13acd904378ad7de22053e1087d61a70341f1891ada3b671223fec8f841b42b6f1060a4b18c8bb865ee4cd071cadc7ff6bd6d549760945bf1645a1086f401

                                                    • C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe

                                                      Filesize

                                                      1.8MB

                                                      MD5

                                                      70724f469bcf35c601b952b1f3b42318

                                                      SHA1

                                                      7a1430987f4b4d60cd3ce1ad67a1454d773ecfa7

                                                      SHA256

                                                      e369a08e4ef871f499a80b23c1c6e63fa98b4d3d0fc11536a9ee269b087816a5

                                                      SHA512

                                                      75eb8ec34373138b6c205fafea37dea2bf8d9a377c5c8fffd8ebaa1b4ec6d77d08144e06786b36d937063479760f80af5e6fa8c6241f513c80ea7971538cf5ee

                                                    • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                                                      Filesize

                                                      479KB

                                                      MD5

                                                      09372174e83dbbf696ee732fd2e875bb

                                                      SHA1

                                                      ba360186ba650a769f9303f48b7200fb5eaccee1

                                                      SHA256

                                                      c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                                                      SHA512

                                                      b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                                                    • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                                                      Filesize

                                                      13.8MB

                                                      MD5

                                                      0a8747a2ac9ac08ae9508f36c6d75692

                                                      SHA1

                                                      b287a96fd6cc12433adb42193dfe06111c38eaf0

                                                      SHA256

                                                      32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                                                      SHA512

                                                      59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vcc2x7ul.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

                                                      Filesize

                                                      1.1MB

                                                      MD5

                                                      842039753bf41fa5e11b3a1383061a87

                                                      SHA1

                                                      3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                                                      SHA256

                                                      d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                                                      SHA512

                                                      d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vcc2x7ul.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

                                                      Filesize

                                                      116B

                                                      MD5

                                                      2a461e9eb87fd1955cea740a3444ee7a

                                                      SHA1

                                                      b10755914c713f5a4677494dbe8a686ed458c3c5

                                                      SHA256

                                                      4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                                                      SHA512

                                                      34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vcc2x7ul.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

                                                      Filesize

                                                      372B

                                                      MD5

                                                      bf957ad58b55f64219ab3f793e374316

                                                      SHA1

                                                      a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                                                      SHA256

                                                      bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                                                      SHA512

                                                      79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vcc2x7ul.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

                                                      Filesize

                                                      17.8MB

                                                      MD5

                                                      daf7ef3acccab478aaa7d6dc1c60f865

                                                      SHA1

                                                      f8246162b97ce4a945feced27b6ea114366ff2ad

                                                      SHA256

                                                      bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                                                      SHA512

                                                      5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vcc2x7ul.default-release\prefs-1.js

                                                      Filesize

                                                      9KB

                                                      MD5

                                                      e316975d262910414bc6babe9035d6a7

                                                      SHA1

                                                      661887042a3abd64d57e4f84320a6b18728f1cda

                                                      SHA256

                                                      9c5d51aabaf2873f987959f85c5299ae51cddff5ad353505e0423c55967e0887

                                                      SHA512

                                                      c1bc5ba25bf47cd1cd0a1a49850537da96d97ef0d6a4aeb3f55393973ff5c698f4dc8244aaef57331bb3ae4ce8898a017cbfcb5c8c509b6eb5d066cea1263cde

                                                    • \??\pipe\crashpad_3040_UFGUUWXKWWSMPFWT

                                                      MD5

                                                      d41d8cd98f00b204e9800998ecf8427e

                                                      SHA1

                                                      da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                      SHA256

                                                      e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                      SHA512

                                                      cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                    • memory/1736-0-0x00000000008E0000-0x0000000000D9F000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/1736-2-0x00000000008E1000-0x000000000090F000-memory.dmp

                                                      Filesize

                                                      184KB

                                                    • memory/1736-1-0x0000000077054000-0x0000000077056000-memory.dmp

                                                      Filesize

                                                      8KB

                                                    • memory/1736-3-0x00000000008E0000-0x0000000000D9F000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/1736-17-0x00000000008E0000-0x0000000000D9F000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/1736-5-0x00000000008E0000-0x0000000000D9F000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4244-235-0x0000000000E60000-0x000000000131F000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4244-260-0x0000000000E60000-0x000000000131F000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4268-85-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                                                      Filesize

                                                      972KB

                                                    • memory/4268-38-0x00000000003E0000-0x0000000000FC5000-memory.dmp

                                                      Filesize

                                                      11.9MB

                                                    • memory/4268-231-0x00000000003E0000-0x0000000000FC5000-memory.dmp

                                                      Filesize

                                                      11.9MB

                                                    • memory/4268-226-0x00000000003E0000-0x0000000000FC5000-memory.dmp

                                                      Filesize

                                                      11.9MB

                                                    • memory/4436-394-0x0000000000A90000-0x0000000000F4F000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4436-392-0x0000000000A90000-0x0000000000F4F000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4592-37-0x0000000000A90000-0x0000000000F4F000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4592-273-0x0000000000A90000-0x0000000000F4F000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4592-21-0x0000000000A90000-0x0000000000F4F000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4592-395-0x0000000000A90000-0x0000000000F4F000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4592-268-0x0000000000A90000-0x0000000000F4F000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4592-405-0x0000000000A90000-0x0000000000F4F000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4592-411-0x0000000000A90000-0x0000000000F4F000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4592-227-0x0000000000A90000-0x0000000000F4F000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4592-450-0x0000000000A90000-0x0000000000F4F000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4592-372-0x0000000000A90000-0x0000000000F4F000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4592-18-0x0000000000A90000-0x0000000000F4F000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4592-302-0x0000000000A90000-0x0000000000F4F000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4592-225-0x0000000000A90000-0x0000000000F4F000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4592-452-0x0000000000A90000-0x0000000000F4F000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4592-20-0x0000000000A90000-0x0000000000F4F000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4592-440-0x0000000000A90000-0x0000000000F4F000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4592-488-0x0000000000A90000-0x0000000000F4F000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4592-465-0x0000000000A90000-0x0000000000F4F000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4592-19-0x0000000000A91000-0x0000000000ABF000-memory.dmp

                                                      Filesize

                                                      184KB

                                                    • memory/4592-475-0x0000000000A90000-0x0000000000F4F000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/6104-464-0x0000000000A90000-0x0000000000F4F000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/6104-463-0x0000000000A90000-0x0000000000F4F000-memory.dmp

                                                      Filesize

                                                      4.7MB