Malware Analysis Report

2024-10-18 23:42

Sample ID 240815-sdenaaxfkg
Target 6dc00b02c91a51431b4d9bafbf70bf204de2152ae1391a4e374205939f81c5bf
SHA256 6dc00b02c91a51431b4d9bafbf70bf204de2152ae1391a4e374205939f81c5bf
Tags
amadey stealc 0657d1 kora nord credential_access discovery evasion persistence stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

6dc00b02c91a51431b4d9bafbf70bf204de2152ae1391a4e374205939f81c5bf

Threat Level: Known bad

The file 6dc00b02c91a51431b4d9bafbf70bf204de2152ae1391a4e374205939f81c5bf was found to be: Known bad.

Malicious Activity Summary

amadey stealc 0657d1 kora nord credential_access discovery evasion persistence stealer trojan

Amadey

Stealc

Credentials from Password Stores: Credentials from Web Browsers

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Downloads MZ/PE file

Loads dropped DLL

Checks BIOS information in registry

Executes dropped EXE

Checks computer location settings

Identifies Wine through registry keys

Adds Run key to start application

Suspicious use of SetThreadContext

Suspicious use of NtSetInformationThreadHideFromDebugger

AutoIT Executable

Drops file in Windows directory

Unsigned PE

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Browser Information Discovery

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Uses Task Scheduler COM API

Suspicious use of SendNotifyMessage

Suspicious use of FindShellTrayWindow

Checks processor information in registry

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-08-15 15:00

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-08-15 15:00

Reported

2024-08-15 15:02

Platform

win7-20240708-en

Max time kernel

149s

Max time network

141s

Command Line

"C:\Users\Admin\AppData\Local\Temp\6dc00b02c91a51431b4d9bafbf70bf204de2152ae1391a4e374205939f81c5bf.exe"

Signatures

Amadey

trojan amadey

Stealc

stealer stealc

Credentials from Password Stores: Credentials from Web Browsers

credential_access stealer

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\6dc00b02c91a51431b4d9bafbf70bf204de2152ae1391a4e374205939f81c5bf.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A

Downloads MZ/PE file

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\6dc00b02c91a51431b4d9bafbf70bf204de2152ae1391a4e374205939f81c5bf.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\6dc00b02c91a51431b4d9bafbf70bf204de2152ae1391a4e374205939f81c5bf.exe N/A

Identifies Wine through registry keys

evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\6dc00b02c91a51431b4d9bafbf70bf204de2152ae1391a4e374205939f81c5bf.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\07838ca960.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000036001\\07838ca960.exe" C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\6dc00b02c91a51431b4d9bafbf70bf204de2152ae1391a4e374205939f81c5bf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2928 set thread context of 2904 N/A C:\Users\Admin\AppData\Local\Temp\1000036001\07838ca960.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2004 set thread context of 2204 N/A C:\Users\Admin\1000037002\6a6c2648f4.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\explorti.job C:\Users\Admin\AppData\Local\Temp\6dc00b02c91a51431b4d9bafbf70bf204de2152ae1391a4e374205939f81c5bf.exe N/A

Browser Information Discovery

discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000036001\07838ca960.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\1000037002\6a6c2648f4.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000038001\48d02df88c.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\6dc00b02c91a51431b4d9bafbf70bf204de2152ae1391a4e374205939f81c5bf.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Program Files\Mozilla Firefox\firefox.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_Classes\Local Settings C:\Program Files\Mozilla Firefox\firefox.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\6dc00b02c91a51431b4d9bafbf70bf204de2152ae1391a4e374205939f81c5bf.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 900 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Local\Temp\6dc00b02c91a51431b4d9bafbf70bf204de2152ae1391a4e374205939f81c5bf.exe C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
PID 900 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Local\Temp\6dc00b02c91a51431b4d9bafbf70bf204de2152ae1391a4e374205939f81c5bf.exe C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
PID 900 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Local\Temp\6dc00b02c91a51431b4d9bafbf70bf204de2152ae1391a4e374205939f81c5bf.exe C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
PID 900 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Local\Temp\6dc00b02c91a51431b4d9bafbf70bf204de2152ae1391a4e374205939f81c5bf.exe C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
PID 3016 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe C:\Users\Admin\AppData\Local\Temp\1000036001\07838ca960.exe
PID 3016 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe C:\Users\Admin\AppData\Local\Temp\1000036001\07838ca960.exe
PID 3016 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe C:\Users\Admin\AppData\Local\Temp\1000036001\07838ca960.exe
PID 3016 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe C:\Users\Admin\AppData\Local\Temp\1000036001\07838ca960.exe
PID 2928 wrote to memory of 2904 N/A C:\Users\Admin\AppData\Local\Temp\1000036001\07838ca960.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2928 wrote to memory of 2904 N/A C:\Users\Admin\AppData\Local\Temp\1000036001\07838ca960.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2928 wrote to memory of 2904 N/A C:\Users\Admin\AppData\Local\Temp\1000036001\07838ca960.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2928 wrote to memory of 2904 N/A C:\Users\Admin\AppData\Local\Temp\1000036001\07838ca960.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2928 wrote to memory of 2904 N/A C:\Users\Admin\AppData\Local\Temp\1000036001\07838ca960.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2928 wrote to memory of 2904 N/A C:\Users\Admin\AppData\Local\Temp\1000036001\07838ca960.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2928 wrote to memory of 2904 N/A C:\Users\Admin\AppData\Local\Temp\1000036001\07838ca960.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2928 wrote to memory of 2904 N/A C:\Users\Admin\AppData\Local\Temp\1000036001\07838ca960.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2928 wrote to memory of 2904 N/A C:\Users\Admin\AppData\Local\Temp\1000036001\07838ca960.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2928 wrote to memory of 2904 N/A C:\Users\Admin\AppData\Local\Temp\1000036001\07838ca960.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2928 wrote to memory of 2904 N/A C:\Users\Admin\AppData\Local\Temp\1000036001\07838ca960.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2928 wrote to memory of 2904 N/A C:\Users\Admin\AppData\Local\Temp\1000036001\07838ca960.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2928 wrote to memory of 2904 N/A C:\Users\Admin\AppData\Local\Temp\1000036001\07838ca960.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2928 wrote to memory of 2904 N/A C:\Users\Admin\AppData\Local\Temp\1000036001\07838ca960.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3016 wrote to memory of 2004 N/A C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe C:\Users\Admin\1000037002\6a6c2648f4.exe
PID 3016 wrote to memory of 2004 N/A C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe C:\Users\Admin\1000037002\6a6c2648f4.exe
PID 3016 wrote to memory of 2004 N/A C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe C:\Users\Admin\1000037002\6a6c2648f4.exe
PID 3016 wrote to memory of 2004 N/A C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe C:\Users\Admin\1000037002\6a6c2648f4.exe
PID 2004 wrote to memory of 2204 N/A C:\Users\Admin\1000037002\6a6c2648f4.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2004 wrote to memory of 2204 N/A C:\Users\Admin\1000037002\6a6c2648f4.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2004 wrote to memory of 2204 N/A C:\Users\Admin\1000037002\6a6c2648f4.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2004 wrote to memory of 2204 N/A C:\Users\Admin\1000037002\6a6c2648f4.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2004 wrote to memory of 2204 N/A C:\Users\Admin\1000037002\6a6c2648f4.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2004 wrote to memory of 2204 N/A C:\Users\Admin\1000037002\6a6c2648f4.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2004 wrote to memory of 2204 N/A C:\Users\Admin\1000037002\6a6c2648f4.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2004 wrote to memory of 2204 N/A C:\Users\Admin\1000037002\6a6c2648f4.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2004 wrote to memory of 2204 N/A C:\Users\Admin\1000037002\6a6c2648f4.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2004 wrote to memory of 2204 N/A C:\Users\Admin\1000037002\6a6c2648f4.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2004 wrote to memory of 2204 N/A C:\Users\Admin\1000037002\6a6c2648f4.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2004 wrote to memory of 2204 N/A C:\Users\Admin\1000037002\6a6c2648f4.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2004 wrote to memory of 2204 N/A C:\Users\Admin\1000037002\6a6c2648f4.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3016 wrote to memory of 3036 N/A C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe C:\Users\Admin\AppData\Local\Temp\1000038001\48d02df88c.exe
PID 3016 wrote to memory of 3036 N/A C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe C:\Users\Admin\AppData\Local\Temp\1000038001\48d02df88c.exe
PID 3016 wrote to memory of 3036 N/A C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe C:\Users\Admin\AppData\Local\Temp\1000038001\48d02df88c.exe
PID 3016 wrote to memory of 3036 N/A C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe C:\Users\Admin\AppData\Local\Temp\1000038001\48d02df88c.exe
PID 2904 wrote to memory of 1792 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2904 wrote to memory of 1792 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2904 wrote to memory of 1792 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2904 wrote to memory of 1792 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1792 wrote to memory of 1452 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1792 wrote to memory of 1452 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1792 wrote to memory of 1452 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1792 wrote to memory of 1452 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1792 wrote to memory of 1452 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1792 wrote to memory of 1452 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1792 wrote to memory of 1452 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1792 wrote to memory of 1452 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1792 wrote to memory of 1452 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1792 wrote to memory of 1452 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1792 wrote to memory of 1452 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1792 wrote to memory of 1452 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1452 wrote to memory of 2484 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1452 wrote to memory of 2484 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1452 wrote to memory of 2484 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1452 wrote to memory of 2540 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1452 wrote to memory of 2540 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\6dc00b02c91a51431b4d9bafbf70bf204de2152ae1391a4e374205939f81c5bf.exe

"C:\Users\Admin\AppData\Local\Temp\6dc00b02c91a51431b4d9bafbf70bf204de2152ae1391a4e374205939f81c5bf.exe"

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

"C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"

C:\Users\Admin\AppData\Local\Temp\1000036001\07838ca960.exe

"C:\Users\Admin\AppData\Local\Temp\1000036001\07838ca960.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\1000037002\6a6c2648f4.exe

"C:\Users\Admin\1000037002\6a6c2648f4.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\1000038001\48d02df88c.exe

"C:\Users\Admin\AppData\Local\Temp\1000038001\48d02df88c.exe"

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1452.0.1120783150\1488075587" -parentBuildID 20221007134813 -prefsHandle 1216 -prefMapHandle 1208 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d27caa0a-63f2-4723-b123-540cd24e0e72} 1452 "\\.\pipe\gecko-crash-server-pipe.1452" 1280 5ff5158 gpu

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1452.1.22051271\1076633568" -parentBuildID 20221007134813 -prefsHandle 1484 -prefMapHandle 1480 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3c270e88-e22b-4883-8be3-88e066efc2ba} 1452 "\\.\pipe\gecko-crash-server-pipe.1452" 1496 e73c58 socket

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1452.2.641137293\762638411" -childID 1 -isForBrowser -prefsHandle 2088 -prefMapHandle 2084 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 836 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d67765e7-21b2-46ad-8819-165e9a15a99a} 1452 "\\.\pipe\gecko-crash-server-pipe.1452" 2100 e6e758 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1452.3.488024429\329680049" -childID 2 -isForBrowser -prefsHandle 2892 -prefMapHandle 2884 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 836 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0704b1b6-0267-49ae-817a-2c7bdc361f75} 1452 "\\.\pipe\gecko-crash-server-pipe.1452" 2904 e63f58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1452.4.1740922862\135843165" -childID 3 -isForBrowser -prefsHandle 3772 -prefMapHandle 3768 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 836 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2d85565f-b4cf-4efd-b791-0a570111a34d} 1452 "\\.\pipe\gecko-crash-server-pipe.1452" 3784 1ff9b258 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1452.5.971409299\1299843573" -childID 4 -isForBrowser -prefsHandle 3880 -prefMapHandle 3884 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 836 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9151a9d7-e14e-4d13-b6d4-2245dbc5de7a} 1452 "\\.\pipe\gecko-crash-server-pipe.1452" 3740 1ffaeb58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1452.6.1593925081\1296435869" -childID 5 -isForBrowser -prefsHandle 4056 -prefMapHandle 4060 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 836 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0549d7e9-0f12-40e6-bfbd-f6d85cb87862} 1452 "\\.\pipe\gecko-crash-server-pipe.1452" 4044 2063ee58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1452.7.670111648\1652674185" -childID 6 -isForBrowser -prefsHandle 4276 -prefMapHandle 4284 -prefsLen 26356 -prefMapSize 233444 -jsInitHandle 836 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {effc10ef-a789-481e-93d2-5391c5cf2179} 1452 "\\.\pipe\gecko-crash-server-pipe.1452" 4300 1ae62f58 tab

Network

Country Destination Domain Proto
RU 185.215.113.19:80 185.215.113.19 tcp
RU 185.215.113.16:80 185.215.113.16 tcp
RU 185.215.113.100:80 185.215.113.100 tcp
RU 185.215.113.100:80 185.215.113.100 tcp
N/A 127.0.0.1:49302 tcp
N/A 127.0.0.1:49308 tcp
US 8.8.8.8:53 accounts.google.com udp
US 8.8.8.8:53 getpocket.cdn.mozilla.net udp
US 8.8.8.8:53 spocs.getpocket.com udp
NL 108.177.127.84:443 accounts.google.com tcp
US 8.8.8.8:53 accounts.google.com udp
US 8.8.8.8:53 prod.ads.prod.webservices.mozgcp.net udp
US 34.120.5.221:443 getpocket.cdn.mozilla.net tcp
US 8.8.8.8:53 accounts.google.com udp
US 8.8.8.8:53 prod.ads.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 prod.pocket.prod.cloudops.mozgcp.net udp
US 8.8.8.8:53 prod.content-signature-chains.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 prod.content-signature-chains.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 prod.pocket.prod.cloudops.mozgcp.net udp
US 8.8.8.8:53 shavar.prod.mozaws.net udp
US 8.8.8.8:53 shavar.prod.mozaws.net udp
NL 108.177.127.84:443 accounts.google.com udp
US 8.8.8.8:53 prod.remote-settings.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 prod.remote-settings.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 accounts.youtube.com udp
US 8.8.8.8:53 accounts.google.com udp
FR 216.58.214.174:443 accounts.youtube.com tcp
US 8.8.8.8:53 www3.l.google.com udp
US 8.8.8.8:53 accounts.google.com udp
US 8.8.8.8:53 www3.l.google.com udp
US 8.8.8.8:53 www.google.com udp
FR 172.217.20.196:443 www.google.com tcp
US 8.8.8.8:53 www.google.com udp
US 8.8.8.8:53 www.google.com udp
FR 216.58.214.174:443 www3.l.google.com udp
FR 172.217.20.196:443 www.google.com udp
US 8.8.8.8:53 play.google.com udp
FR 142.250.201.174:443 play.google.com tcp
FR 142.250.201.174:443 play.google.com tcp
FR 142.250.201.174:443 play.google.com tcp
FR 142.250.201.174:443 play.google.com tcp
US 8.8.8.8:53 play.google.com udp
US 8.8.8.8:53 play.google.com udp
FR 142.250.201.174:443 play.google.com udp
US 8.8.8.8:53 accounts.google.com udp
US 8.8.8.8:53 accounts.google.com udp
US 8.8.8.8:53 prod.balrog.prod.cloudops.mozgcp.net udp
US 8.8.8.8:53 prod.balrog.prod.cloudops.mozgcp.net udp
US 8.8.8.8:53 prod.remote-settings.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 ciscobinary.openh264.org udp
NL 2.18.121.79:80 ciscobinary.openh264.org tcp
US 8.8.8.8:53 a19.dscg10.akamai.net udp
US 8.8.8.8:53 redirector.gvt1.com udp
FR 216.58.214.174:443 redirector.gvt1.com tcp
US 8.8.8.8:53 redirector.gvt1.com udp
US 8.8.8.8:53 redirector.gvt1.com udp
FR 216.58.214.174:443 redirector.gvt1.com udp
US 8.8.8.8:53 r1---sn-5hneknek.gvt1.com udp
NL 74.125.8.134:443 r1---sn-5hneknek.gvt1.com tcp
US 8.8.8.8:53 r1.sn-5hneknek.gvt1.com udp
US 8.8.8.8:53 r1.sn-5hneknek.gvt1.com udp
NL 74.125.8.134:443 r1.sn-5hneknek.gvt1.com udp
US 8.8.8.8:53 a19.dscg10.akamai.net udp
US 8.8.8.8:53 accounts.google.com udp
US 8.8.8.8:53 accounts.google.com udp
NL 108.177.127.84:443 accounts.google.com udp

Files

memory/900-0-0x00000000003E0000-0x000000000088C000-memory.dmp

memory/900-1-0x0000000077070000-0x0000000077072000-memory.dmp

memory/900-2-0x00000000003E1000-0x000000000040F000-memory.dmp

memory/900-3-0x00000000003E0000-0x000000000088C000-memory.dmp

memory/900-4-0x00000000003E0000-0x000000000088C000-memory.dmp

\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

MD5 6d0f73b4a2b84bef406470efcd79a990
SHA1 3e76cd04a8655c14330a7392bbeedb2e17f2e015
SHA256 6dc00b02c91a51431b4d9bafbf70bf204de2152ae1391a4e374205939f81c5bf
SHA512 54ba08bb0194c37dbbcf0f017ba9f7a87f370b9378e6191c6f4654c479c89de398e4b467d7506dc93f580d4cb773563eaa3c4da97c46e0b10feda0a82a9a627d

memory/900-14-0x0000000006C80000-0x000000000712C000-memory.dmp

memory/900-16-0x00000000003E0000-0x000000000088C000-memory.dmp

memory/3016-17-0x00000000012B0000-0x000000000175C000-memory.dmp

memory/3016-19-0x00000000012B0000-0x000000000175C000-memory.dmp

memory/3016-18-0x00000000012B1000-0x00000000012DF000-memory.dmp

memory/3016-20-0x00000000012B0000-0x000000000175C000-memory.dmp

memory/3016-22-0x00000000012B0000-0x000000000175C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000036001\07838ca960.exe

MD5 d1be0f6f034c55fc17558f2ae445f1b2
SHA1 6b7f7599af54f730451f8344906acc7d0a206af7
SHA256 21a8a20a3cf2e59afeea5b810da2fd7b132780a8167ab28b0bf8da4d7061478e
SHA512 3e96bbee8cb19b3dc7c45d302f5321122722562f2ad41ce9d61bb34d2fdd65c7eaf133bdb097445df327629b2fea78caa22041ca122884a9ec1758da0288f465

memory/2928-37-0x0000000000FF0000-0x0000000001120000-memory.dmp

memory/2904-48-0x0000000000400000-0x000000000052D000-memory.dmp

memory/2904-50-0x0000000000400000-0x000000000052D000-memory.dmp

memory/2904-55-0x0000000000400000-0x000000000052D000-memory.dmp

memory/2904-53-0x0000000000400000-0x000000000052D000-memory.dmp

memory/2904-52-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2904-46-0x0000000000400000-0x000000000052D000-memory.dmp

memory/2904-44-0x0000000000400000-0x000000000052D000-memory.dmp

memory/2904-42-0x0000000000400000-0x000000000052D000-memory.dmp

memory/2904-41-0x0000000000400000-0x000000000052D000-memory.dmp

memory/2904-57-0x0000000000400000-0x000000000052D000-memory.dmp

C:\Users\Admin\1000037002\6a6c2648f4.exe

MD5 6e9fc400fc9748327378354da7b3d022
SHA1 8bad09df89fc51f0cfb3209e1b39e15063f5c5e6
SHA256 7dd2c5bf200354ec22205f04d5eb6c3e336f49bf2d09809f68ba2ed7f9826f32
SHA512 daa0ed49c72b481f4bd898f048f8e9ba47285e845d3e43d8bd17e2801ade49e2d8c4c82bc797723deb8f2914aa9f6e4d0e7ff58bcc0b0195b4499bc5d9ac18a9

memory/2004-72-0x0000000000B10000-0x0000000000B48000-memory.dmp

memory/2204-88-0x0000000000400000-0x0000000000643000-memory.dmp

memory/2204-90-0x0000000000400000-0x0000000000643000-memory.dmp

memory/2204-83-0x0000000000400000-0x0000000000643000-memory.dmp

memory/2004-87-0x0000000002400000-0x0000000004400000-memory.dmp

memory/2204-81-0x0000000000400000-0x0000000000643000-memory.dmp

memory/2204-77-0x0000000000400000-0x0000000000643000-memory.dmp

memory/2204-86-0x0000000000400000-0x0000000000643000-memory.dmp

memory/2204-79-0x0000000000400000-0x0000000000643000-memory.dmp

memory/2204-75-0x0000000000400000-0x0000000000643000-memory.dmp

memory/3016-91-0x00000000012B0000-0x000000000175C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000038001\48d02df88c.exe

MD5 278ee1426274818874556aa18fd02e3a
SHA1 185a2761330024dec52134df2c8388c461451acb
SHA256 37257ddb1a6f309a6e9d147b5fc2551a9cae3a0e52b191b18d9465bfcb5c18eb
SHA512 07ec6759af5b9a00d8371b9fd9b723012dd0a1614cfcc7cd51975a004f69ffb90083735e9a871a2aa0e8d28799beac53a4748f55f4dd1e7495bc7388ebf4d6a0

memory/3016-108-0x00000000012B0000-0x000000000175C000-memory.dmp

memory/3016-110-0x00000000012B0000-0x000000000175C000-memory.dmp

memory/3036-111-0x0000000000220000-0x0000000000463000-memory.dmp

memory/3016-109-0x0000000006470000-0x00000000066B3000-memory.dmp

memory/3036-112-0x0000000000220000-0x0000000000463000-memory.dmp

memory/3016-113-0x00000000012B0000-0x000000000175C000-memory.dmp

memory/3016-120-0x00000000012B0000-0x000000000175C000-memory.dmp

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yrxx2hps.default-release\datareporting\glean\pending_pings\90fc4692-1317-4d64-b266-e9d51318f863

MD5 fefafee7bfe824e3b4f99f7b862db9bf
SHA1 3c22cda229e72e16c61853a320d083ca5790412c
SHA256 51101ec0456a6240e64e6ea9cedcec7de7ecba1a91f7891b61cdc411d63b9e9c
SHA512 76545e2b42f9bdae0817b587816b26ac68f4bb6f08d67053455c91d935ebca2918e41d861d2b519146d04add670c8eb52620cca4831997aef2993f586ac1f976

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yrxx2hps.default-release\datareporting\glean\pending_pings\23b1e166-fc25-43b4-8675-a7a642a57e1e

MD5 22045226b41d669cecbb3ba4debed770
SHA1 7ebd14aeb4f6f9d6dd5bfce6300f11736bb64ae3
SHA256 d58c5fa7eb98825babd1300d64e4322e6fadb5696a08865d39d290ec3833bea3
SHA512 5d6f424605b9e13203e61ada0e8e6fdc633cb6a585194c55ac911bee9a45d7888e00d0ce0d9d0cc633bab74120c3ca01c92b917a65ec42f84c01fbc9299f20db

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yrxx2hps.default-release\datareporting\glean\db\data.safe.bin

MD5 e90f2ac568d7cf806f6ddecadc4a358c
SHA1 afb9dd70acf6dac00a65fb1cdf8a5991b07240ad
SHA256 1498d97b5bed36c868fed3417a293660c20be0fbd8c097e62c08e85019831a45
SHA512 2fcf2db46a8ef0e7ad1e3875e529deef571f98afffb6b71c37cb847cb146b9c5a50f85e4494aa9b2574c2532f960e65037b97e701760986cec70116b7625b66e

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yrxx2hps.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

MD5 4ff720d6a1ac55c50603618933a49a53
SHA1 1bb8e1a0e531971ba205ff55e3bdecc0be2400bb
SHA256 70958305f33bf0cd885d41dbb03098e76ef6b9154785e666cfb5587ce53ae39b
SHA512 ebda769ff1ddb566adcfcd976b55f7fec46f5aec4312a6ab80b7c4fa397e46efefe82ff56a233ffdd6cb9a116b4ad556ecd15923465b1ff9dc65b44c577d7fdf

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yrxx2hps.default-release\activity-stream.discovery_stream.json.tmp

MD5 1b1142360e7cf0c180da00d385315ba0
SHA1 c97077295afff3d5a77a70d975e304b7875cede9
SHA256 871fd2e88cffea0613d0b3d0bc073fb9ce172067b72e37098b13148a53cd5a19
SHA512 a5b7e7f11842e5da1290bcbb4db9684f2135b7a1f1221775d44bdc9ebee0f9edfeb20bd08ec892451e546f990ee9536721e42f2d29327c9101a9500b21adb8bb

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yrxx2hps.default-release\prefs.js

MD5 ded766755057db6d5d203c45d9e82253
SHA1 394022c6992140b0cf2e4026f113f43295710ce5
SHA256 d4f5f973879a39a991d14f935056f3c6cfd0f01fe7974d53c0911f1bb0bc5de7
SHA512 38ff632ecb023081912dec4b090967cf8f9491ccae829990fb578ea2d69fb7835252857011797a3b4ee72eb2c19d1ccd7427bf8adefd460f93dedf0b91485fa1

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yrxx2hps.default-release\prefs.js

MD5 3a2737bee65f6708b0733626b16b6f9b
SHA1 e6296822cd38b47affe51d8e3f3129804eb4b087
SHA256 07cb9759c206c9b8dbfab677f6b831cbcf19ef914088403253ef40a4dab98ce8
SHA512 0407c445d94c2ad7839439e71f6aab88b61d86d123ab9e70e02fd11cf3b3910cb04705b8e0d03a0eba751d8258579df7bfc302064462577256b50cc8a68ed4bc

memory/3016-268-0x00000000012B0000-0x000000000175C000-memory.dmp

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yrxx2hps.default-release\sessionstore-backups\recovery.jsonlz4

MD5 8ea750da92ec1153d1b6a77e03fb72da
SHA1 645b45006f71bc462e7a81a59f54e02959ea5180
SHA256 a8435509881d9eec6e5d5bbfe438fca4d62f6c964f78dc78335d36b227221ceb
SHA512 133f15c6b7bc82829d08a7b8295fac8e625607d56f31f46a9f2be074c0f8ee94b9f5e109ed49d3d29338a196299cff0db4f2c43afae265ab26286209a31fcd12

memory/3016-281-0x00000000012B0000-0x000000000175C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpaddon

MD5 85430baed3398695717b0263807cf97c
SHA1 fffbee923cea216f50fce5d54219a188a5100f41
SHA256 a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
SHA512 06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yrxx2hps.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

MD5 fe3355639648c417e8307c6d051e3e37
SHA1 f54602d4b4778da21bc97c7238fc66aa68c8ee34
SHA256 1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
SHA512 8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yrxx2hps.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

MD5 3d33cdc0b3d281e67dd52e14435dd04f
SHA1 4db88689282fd4f9e9e6ab95fcbb23df6e6485db
SHA256 f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
SHA512 a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yrxx2hps.default-release\prefs-1.js

MD5 d5be98d62822b6a17beb1de74d296af7
SHA1 7edc7d0b5ed99d9df4e802843a0b0e48f1c55163
SHA256 537f7fc9dc806c4f6f023249eb2d1305a311634feb8dd0e6a9e2b676bd3a4a1a
SHA512 0e7a60b3e45546ea8f7ef9bd9203e7595147289a74f6f5f35b90f7020d63cb1ef74142aaab8b85a4bdd86bba7fc8099e1cbbd20f68d6e426e06c5dc261b022c4

C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

MD5 a01c5ecd6108350ae23d2cddf0e77c17
SHA1 c6ac28a2cd979f1f9a75d56271821d5ff665e2b6
SHA256 345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42
SHA512 b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yrxx2hps.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

MD5 49ddb419d96dceb9069018535fb2e2fc
SHA1 62aa6fea895a8b68d468a015f6e6ab400d7a7ca6
SHA256 2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
SHA512 48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yrxx2hps.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

MD5 8be33af717bb1b67fbd61c3f4b807e9e
SHA1 7cf17656d174d951957ff36810e874a134dd49e0
SHA256 e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
SHA512 6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yrxx2hps.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

MD5 33bf7b0439480effb9fb212efce87b13
SHA1 cee50f2745edc6dc291887b6075ca64d716f495a
SHA256 8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e
SHA512 d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yrxx2hps.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

MD5 688bed3676d2104e7f17ae1cd2c59404
SHA1 952b2cdf783ac72fcb98338723e9afd38d47ad8e
SHA256 33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
SHA512 7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yrxx2hps.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

MD5 937326fead5fd401f6cca9118bd9ade9
SHA1 4526a57d4ae14ed29b37632c72aef3c408189d91
SHA256 68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
SHA512 b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

memory/3016-352-0x00000000012B0000-0x000000000175C000-memory.dmp

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yrxx2hps.default-release\prefs-1.js

MD5 7951d9fcd8163361bb276654059639a2
SHA1 7a1f7d5c1cf11f236c58263fa9c89917628b2ab8
SHA256 abf88c7b294dadf8809fcf98f575377287bbf2c8e16e9ec4024cb38508279652
SHA512 5fd5a03e6292853c1b5243a2a6d4843261952b6405a45ded01df85a6b3ce8be2464f526865ace41de009f4ef559ed20461ae02f2d563971c68c6c7905ee16467

memory/3016-365-0x00000000012B0000-0x000000000175C000-memory.dmp

memory/3016-367-0x00000000012B0000-0x000000000175C000-memory.dmp

memory/3016-374-0x00000000012B0000-0x000000000175C000-memory.dmp

memory/3016-380-0x00000000012B0000-0x000000000175C000-memory.dmp

memory/3016-381-0x0000000006470000-0x00000000066B3000-memory.dmp

memory/3016-382-0x0000000006470000-0x00000000066B3000-memory.dmp

memory/3016-383-0x00000000012B0000-0x000000000175C000-memory.dmp

memory/3016-384-0x00000000012B0000-0x000000000175C000-memory.dmp

memory/3016-385-0x00000000012B0000-0x000000000175C000-memory.dmp

memory/3016-386-0x00000000012B0000-0x000000000175C000-memory.dmp

memory/3016-387-0x00000000012B0000-0x000000000175C000-memory.dmp

memory/3016-393-0x00000000012B0000-0x000000000175C000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-08-15 15:00

Reported

2024-08-15 15:02

Platform

win10v2004-20240802-en

Max time kernel

149s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\6dc00b02c91a51431b4d9bafbf70bf204de2152ae1391a4e374205939f81c5bf.exe"

Signatures

Amadey

trojan amadey

Stealc

stealer stealc

Credentials from Password Stores: Credentials from Web Browsers

credential_access stealer

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\6dc00b02c91a51431b4d9bafbf70bf204de2152ae1391a4e374205939f81c5bf.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A

Downloads MZ/PE file

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\6dc00b02c91a51431b4d9bafbf70bf204de2152ae1391a4e374205939f81c5bf.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\6dc00b02c91a51431b4d9bafbf70bf204de2152ae1391a4e374205939f81c5bf.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\6dc00b02c91a51431b4d9bafbf70bf204de2152ae1391a4e374205939f81c5bf.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A

Identifies Wine through registry keys

evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\6dc00b02c91a51431b4d9bafbf70bf204de2152ae1391a4e374205939f81c5bf.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\f54a68e4b7.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000036001\\f54a68e4b7.exe" C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2076 set thread context of 2352 N/A C:\Users\Admin\AppData\Local\Temp\1000036001\f54a68e4b7.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1804 set thread context of 964 N/A C:\Users\Admin\1000037002\83baa72830.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\explorti.job C:\Users\Admin\AppData\Local\Temp\6dc00b02c91a51431b4d9bafbf70bf204de2152ae1391a4e374205939f81c5bf.exe N/A

Browser Information Discovery

discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\6dc00b02c91a51431b4d9bafbf70bf204de2152ae1391a4e374205939f81c5bf.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000036001\f54a68e4b7.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\1000037002\83baa72830.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000038001\6a6c2648f4.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files\Mozilla Firefox\firefox.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings C:\Program Files\Mozilla Firefox\firefox.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\6dc00b02c91a51431b4d9bafbf70bf204de2152ae1391a4e374205939f81c5bf.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4032 wrote to memory of 2276 N/A C:\Users\Admin\AppData\Local\Temp\6dc00b02c91a51431b4d9bafbf70bf204de2152ae1391a4e374205939f81c5bf.exe C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
PID 4032 wrote to memory of 2276 N/A C:\Users\Admin\AppData\Local\Temp\6dc00b02c91a51431b4d9bafbf70bf204de2152ae1391a4e374205939f81c5bf.exe C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
PID 4032 wrote to memory of 2276 N/A C:\Users\Admin\AppData\Local\Temp\6dc00b02c91a51431b4d9bafbf70bf204de2152ae1391a4e374205939f81c5bf.exe C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
PID 2276 wrote to memory of 2076 N/A C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe C:\Users\Admin\AppData\Local\Temp\1000036001\f54a68e4b7.exe
PID 2276 wrote to memory of 2076 N/A C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe C:\Users\Admin\AppData\Local\Temp\1000036001\f54a68e4b7.exe
PID 2276 wrote to memory of 2076 N/A C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe C:\Users\Admin\AppData\Local\Temp\1000036001\f54a68e4b7.exe
PID 2076 wrote to memory of 2352 N/A C:\Users\Admin\AppData\Local\Temp\1000036001\f54a68e4b7.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2076 wrote to memory of 2352 N/A C:\Users\Admin\AppData\Local\Temp\1000036001\f54a68e4b7.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2076 wrote to memory of 2352 N/A C:\Users\Admin\AppData\Local\Temp\1000036001\f54a68e4b7.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2076 wrote to memory of 2352 N/A C:\Users\Admin\AppData\Local\Temp\1000036001\f54a68e4b7.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2076 wrote to memory of 2352 N/A C:\Users\Admin\AppData\Local\Temp\1000036001\f54a68e4b7.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2076 wrote to memory of 2352 N/A C:\Users\Admin\AppData\Local\Temp\1000036001\f54a68e4b7.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2076 wrote to memory of 2352 N/A C:\Users\Admin\AppData\Local\Temp\1000036001\f54a68e4b7.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2076 wrote to memory of 2352 N/A C:\Users\Admin\AppData\Local\Temp\1000036001\f54a68e4b7.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2076 wrote to memory of 2352 N/A C:\Users\Admin\AppData\Local\Temp\1000036001\f54a68e4b7.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2076 wrote to memory of 2352 N/A C:\Users\Admin\AppData\Local\Temp\1000036001\f54a68e4b7.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2276 wrote to memory of 1804 N/A C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe C:\Users\Admin\1000037002\83baa72830.exe
PID 2276 wrote to memory of 1804 N/A C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe C:\Users\Admin\1000037002\83baa72830.exe
PID 2276 wrote to memory of 1804 N/A C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe C:\Users\Admin\1000037002\83baa72830.exe
PID 1804 wrote to memory of 796 N/A C:\Users\Admin\1000037002\83baa72830.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1804 wrote to memory of 796 N/A C:\Users\Admin\1000037002\83baa72830.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1804 wrote to memory of 796 N/A C:\Users\Admin\1000037002\83baa72830.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1804 wrote to memory of 964 N/A C:\Users\Admin\1000037002\83baa72830.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1804 wrote to memory of 964 N/A C:\Users\Admin\1000037002\83baa72830.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1804 wrote to memory of 964 N/A C:\Users\Admin\1000037002\83baa72830.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1804 wrote to memory of 964 N/A C:\Users\Admin\1000037002\83baa72830.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1804 wrote to memory of 964 N/A C:\Users\Admin\1000037002\83baa72830.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1804 wrote to memory of 964 N/A C:\Users\Admin\1000037002\83baa72830.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1804 wrote to memory of 964 N/A C:\Users\Admin\1000037002\83baa72830.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1804 wrote to memory of 964 N/A C:\Users\Admin\1000037002\83baa72830.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1804 wrote to memory of 964 N/A C:\Users\Admin\1000037002\83baa72830.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2276 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe C:\Users\Admin\AppData\Local\Temp\1000038001\6a6c2648f4.exe
PID 2276 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe C:\Users\Admin\AppData\Local\Temp\1000038001\6a6c2648f4.exe
PID 2276 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe C:\Users\Admin\AppData\Local\Temp\1000038001\6a6c2648f4.exe
PID 2352 wrote to memory of 2636 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2352 wrote to memory of 2636 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2636 wrote to memory of 3200 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2636 wrote to memory of 3200 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2636 wrote to memory of 3200 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2636 wrote to memory of 3200 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2636 wrote to memory of 3200 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2636 wrote to memory of 3200 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2636 wrote to memory of 3200 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2636 wrote to memory of 3200 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2636 wrote to memory of 3200 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2636 wrote to memory of 3200 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2636 wrote to memory of 3200 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3200 wrote to memory of 1936 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3200 wrote to memory of 1936 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3200 wrote to memory of 1936 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3200 wrote to memory of 1936 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3200 wrote to memory of 1936 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3200 wrote to memory of 1936 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3200 wrote to memory of 1936 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3200 wrote to memory of 1936 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3200 wrote to memory of 1936 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3200 wrote to memory of 1936 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3200 wrote to memory of 1936 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3200 wrote to memory of 1936 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3200 wrote to memory of 1936 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3200 wrote to memory of 1936 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3200 wrote to memory of 1936 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3200 wrote to memory of 1936 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3200 wrote to memory of 1936 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\6dc00b02c91a51431b4d9bafbf70bf204de2152ae1391a4e374205939f81c5bf.exe

"C:\Users\Admin\AppData\Local\Temp\6dc00b02c91a51431b4d9bafbf70bf204de2152ae1391a4e374205939f81c5bf.exe"

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

"C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"

C:\Users\Admin\AppData\Local\Temp\1000036001\f54a68e4b7.exe

"C:\Users\Admin\AppData\Local\Temp\1000036001\f54a68e4b7.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\1000037002\83baa72830.exe

"C:\Users\Admin\1000037002\83baa72830.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\1000038001\6a6c2648f4.exe

"C:\Users\Admin\AppData\Local\Temp\1000038001\6a6c2648f4.exe"

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1972 -parentBuildID 20240401114208 -prefsHandle 1908 -prefMapHandle 1900 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5ff5a678-ce06-40c2-b75e-db90c2d18fcf} 3200 "\\.\pipe\gecko-crash-server-pipe.3200" gpu

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2416 -parentBuildID 20240401114208 -prefsHandle 2408 -prefMapHandle 2404 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {07b9caa3-7540-4b53-9a67-65899fe1abde} 3200 "\\.\pipe\gecko-crash-server-pipe.3200" socket

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1040 -childID 1 -isForBrowser -prefsHandle 952 -prefMapHandle 2812 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 948 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7eeb7850-069f-458d-bba6-eb4b3bd55603} 3200 "\\.\pipe\gecko-crash-server-pipe.3200" tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4000 -childID 2 -isForBrowser -prefsHandle 3992 -prefMapHandle 3984 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 948 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {99c8949a-f09d-40ff-903d-b7a7cf044761} 3200 "\\.\pipe\gecko-crash-server-pipe.3200" tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4736 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4764 -prefMapHandle 4760 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c20342c6-94ea-4bdd-b629-92ef6e499f46} 3200 "\\.\pipe\gecko-crash-server-pipe.3200" utility

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5216 -childID 3 -isForBrowser -prefsHandle 5208 -prefMapHandle 5152 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 948 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {40e7df2a-af41-42ff-af32-3ece76e1ace0} 3200 "\\.\pipe\gecko-crash-server-pipe.3200" tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5364 -childID 4 -isForBrowser -prefsHandle 5372 -prefMapHandle 5380 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 948 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {413f1909-8f93-4d1c-ac84-73e42eabfeb5} 3200 "\\.\pipe\gecko-crash-server-pipe.3200" tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5556 -childID 5 -isForBrowser -prefsHandle 5560 -prefMapHandle 5544 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 948 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b5d438dc-84f3-48d3-b510-59385fa41fcb} 3200 "\\.\pipe\gecko-crash-server-pipe.3200" tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6116 -childID 6 -isForBrowser -prefsHandle 5896 -prefMapHandle 6104 -prefsLen 27182 -prefMapSize 244658 -jsInitHandle 948 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1315c751-cb77-4289-bc90-b350ddbcdaa5} 3200 "\\.\pipe\gecko-crash-server-pipe.3200" tab

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 81.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
RU 185.215.113.19:80 185.215.113.19 tcp
RU 185.215.113.16:80 185.215.113.16 tcp
US 8.8.8.8:53 19.113.215.185.in-addr.arpa udp
US 8.8.8.8:53 16.113.215.185.in-addr.arpa udp
RU 185.215.113.100:80 185.215.113.100 tcp
RU 185.215.113.100:80 185.215.113.100 tcp
US 8.8.8.8:53 100.113.215.185.in-addr.arpa udp
US 8.8.8.8:53 accounts.google.com udp
US 8.8.8.8:53 spocs.getpocket.com udp
US 8.8.8.8:53 firefox-api-proxy.cdn.mozilla.net udp
NL 108.177.127.84:443 accounts.google.com tcp
NL 108.177.127.84:443 accounts.google.com tcp
US 8.8.8.8:53 accounts.google.com udp
US 34.117.188.166:443 spocs.getpocket.com udp
US 34.149.97.1:443 firefox-api-proxy.cdn.mozilla.net udp
US 34.117.188.166:443 spocs.getpocket.com udp
US 8.8.8.8:53 prod.ads.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 firefox-api-proxy-prod.pocket.prod.cloudops.mozgcp.net udp
US 8.8.8.8:53 accounts.google.com udp
US 8.8.8.8:53 prod.content-signature-chains.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 prod.ads.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 firefox-api-proxy-prod.pocket.prod.cloudops.mozgcp.net udp
US 8.8.8.8:53 prod.content-signature-chains.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 84.127.177.108.in-addr.arpa udp
NL 108.177.127.84:443 accounts.google.com udp
US 8.8.8.8:53 shavar.prod.mozaws.net udp
US 8.8.8.8:53 prod.remote-settings.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 shavar.prod.mozaws.net udp
US 8.8.8.8:53 prod.remote-settings.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 47.249.226.44.in-addr.arpa udp
US 8.8.8.8:53 67.214.58.216.in-addr.arpa udp
US 8.8.8.8:53 67.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 accounts.youtube.com udp
FR 216.58.214.174:443 accounts.youtube.com tcp
US 8.8.8.8:53 www3.l.google.com udp
US 8.8.8.8:53 www3.l.google.com udp
FR 216.58.214.174:443 www3.l.google.com udp
US 8.8.8.8:53 www.google.com udp
FR 172.217.20.196:443 www.google.com tcp
US 8.8.8.8:53 www.google.com udp
US 8.8.8.8:53 www.google.com udp
FR 172.217.20.196:443 www.google.com udp
US 8.8.8.8:53 174.214.58.216.in-addr.arpa udp
US 8.8.8.8:53 196.20.217.172.in-addr.arpa udp
N/A 127.0.0.1:58634 tcp
N/A 127.0.0.1:58642 tcp
US 8.8.8.8:53 play.google.com udp
FR 142.250.201.174:443 play.google.com tcp
FR 142.250.201.174:443 play.google.com tcp
US 8.8.8.8:53 play.google.com udp
US 8.8.8.8:53 play.google.com udp
FR 142.250.201.174:443 play.google.com tcp
FR 142.250.201.174:443 play.google.com udp
US 8.8.8.8:53 174.201.250.142.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 prod.balrog.prod.cloudops.mozgcp.net udp
US 8.8.8.8:53 prod.balrog.prod.cloudops.mozgcp.net udp
US 8.8.8.8:53 ciscobinary.openh264.org udp
NL 2.18.121.73:80 ciscobinary.openh264.org tcp
US 8.8.8.8:53 a19.dscg10.akamai.net udp
US 8.8.8.8:53 a19.dscg10.akamai.net udp
US 8.8.8.8:53 201.181.244.35.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 73.121.18.2.in-addr.arpa udp
US 8.8.8.8:53 redirector.gvt1.com udp
FR 216.58.214.174:443 redirector.gvt1.com tcp
US 8.8.8.8:53 redirector.gvt1.com udp
US 8.8.8.8:53 redirector.gvt1.com udp
FR 216.58.214.174:443 redirector.gvt1.com udp
US 8.8.8.8:53 r4---sn-5hnednss.gvt1.com udp
NL 172.217.132.201:443 r4---sn-5hnednss.gvt1.com tcp
US 8.8.8.8:53 r4.sn-5hnednss.gvt1.com udp
US 8.8.8.8:53 r4.sn-5hnednss.gvt1.com udp
NL 172.217.132.201:443 r4.sn-5hnednss.gvt1.com udp
US 8.8.8.8:53 201.132.217.172.in-addr.arpa udp
US 8.8.8.8:53 prod.balrog.prod.cloudops.mozgcp.net udp
US 8.8.8.8:53 location.services.mozilla.com udp
US 8.8.8.8:53 prod.classify-client.prod.webservices.mozgcp.net udp
US 35.190.72.216:443 prod.classify-client.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 prod.classify-client.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 216.72.190.35.in-addr.arpa udp
US 8.8.8.8:53 firefox-settings-attachments.cdn.mozilla.net udp
US 34.117.121.53:443 firefox-settings-attachments.cdn.mozilla.net tcp
US 34.117.121.53:443 firefox-settings-attachments.cdn.mozilla.net tcp
US 34.117.121.53:443 firefox-settings-attachments.cdn.mozilla.net tcp
US 34.117.121.53:443 firefox-settings-attachments.cdn.mozilla.net tcp
US 34.117.121.53:443 firefox-settings-attachments.cdn.mozilla.net tcp
US 34.117.121.53:443 firefox-settings-attachments.cdn.mozilla.net tcp
US 8.8.8.8:53 attachments.prod.remote-settings.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 attachments.prod.remote-settings.prod.webservices.mozgcp.net udp
FR 142.250.201.174:443 play.google.com udp
US 8.8.8.8:53 play.google.com udp
NL 108.177.127.84:443 accounts.google.com udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp

Files

memory/4032-0-0x0000000000320000-0x00000000007CC000-memory.dmp

memory/4032-1-0x00000000771F4000-0x00000000771F6000-memory.dmp

memory/4032-2-0x0000000000321000-0x000000000034F000-memory.dmp

memory/4032-3-0x0000000000320000-0x00000000007CC000-memory.dmp

memory/4032-4-0x0000000000320000-0x00000000007CC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

MD5 6d0f73b4a2b84bef406470efcd79a990
SHA1 3e76cd04a8655c14330a7392bbeedb2e17f2e015
SHA256 6dc00b02c91a51431b4d9bafbf70bf204de2152ae1391a4e374205939f81c5bf
SHA512 54ba08bb0194c37dbbcf0f017ba9f7a87f370b9378e6191c6f4654c479c89de398e4b467d7506dc93f580d4cb773563eaa3c4da97c46e0b10feda0a82a9a627d

memory/2276-17-0x0000000000ED0000-0x000000000137C000-memory.dmp

memory/4032-18-0x0000000000320000-0x00000000007CC000-memory.dmp

memory/2276-20-0x0000000000ED0000-0x000000000137C000-memory.dmp

memory/2276-19-0x0000000000ED1000-0x0000000000EFF000-memory.dmp

memory/2276-22-0x0000000000ED0000-0x000000000137C000-memory.dmp

memory/2276-21-0x0000000000ED0000-0x000000000137C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000036001\f54a68e4b7.exe

MD5 d1be0f6f034c55fc17558f2ae445f1b2
SHA1 6b7f7599af54f730451f8344906acc7d0a206af7
SHA256 21a8a20a3cf2e59afeea5b810da2fd7b132780a8167ab28b0bf8da4d7061478e
SHA512 3e96bbee8cb19b3dc7c45d302f5321122722562f2ad41ce9d61bb34d2fdd65c7eaf133bdb097445df327629b2fea78caa22041ca122884a9ec1758da0288f465

memory/2076-41-0x0000000072E0E000-0x0000000072E0F000-memory.dmp

memory/2076-42-0x00000000006B0000-0x00000000007E0000-memory.dmp

memory/2352-45-0x0000000000400000-0x000000000052D000-memory.dmp

memory/2352-50-0x0000000000400000-0x000000000052D000-memory.dmp

memory/2352-48-0x0000000000400000-0x000000000052D000-memory.dmp

C:\Users\Admin\1000037002\83baa72830.exe

MD5 6e9fc400fc9748327378354da7b3d022
SHA1 8bad09df89fc51f0cfb3209e1b39e15063f5c5e6
SHA256 7dd2c5bf200354ec22205f04d5eb6c3e336f49bf2d09809f68ba2ed7f9826f32
SHA512 daa0ed49c72b481f4bd898f048f8e9ba47285e845d3e43d8bd17e2801ade49e2d8c4c82bc797723deb8f2914aa9f6e4d0e7ff58bcc0b0195b4499bc5d9ac18a9

memory/1804-69-0x0000000000730000-0x0000000000768000-memory.dmp

memory/964-72-0x0000000000400000-0x0000000000643000-memory.dmp

memory/964-74-0x0000000000400000-0x0000000000643000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000038001\6a6c2648f4.exe

MD5 278ee1426274818874556aa18fd02e3a
SHA1 185a2761330024dec52134df2c8388c461451acb
SHA256 37257ddb1a6f309a6e9d147b5fc2551a9cae3a0e52b191b18d9465bfcb5c18eb
SHA512 07ec6759af5b9a00d8371b9fd9b723012dd0a1614cfcc7cd51975a004f69ffb90083735e9a871a2aa0e8d28799beac53a4748f55f4dd1e7495bc7388ebf4d6a0

memory/1636-92-0x0000000000D70000-0x0000000000FB3000-memory.dmp

memory/2276-91-0x0000000000ED0000-0x000000000137C000-memory.dmp

memory/1636-93-0x0000000000D70000-0x0000000000FB3000-memory.dmp

memory/2276-100-0x0000000000ED0000-0x000000000137C000-memory.dmp

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\datareporting\glean\pending_pings\97e3f38c-1ad6-4075-bf9b-6c0b021ae9df

MD5 f46833c6f9cacf3e9497830fa30b496c
SHA1 fef830d3bba846353fc58e92476021f4ca32b482
SHA256 be705ef9067f807618f3ff80bf14c564695c027d057596b1cec5a38a2dc50fe8
SHA512 a8dcffb58c4895605d23b3015be3a505c4212a2e213701dbb8661929b4581103a5a1603d68c3b1566b97c69800659b514cd2790381a98cd82c9d248ba1b27b9f

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\datareporting\glean\pending_pings\6e6cdc46-d4c9-4f9b-9c0e-16225760b8c5

MD5 5bf28932fb72dcc6c960d027a1b94463
SHA1 489096edcc46023bd2a0c4a00c2ed622c18eb171
SHA256 42d2e57fab89fbfa04dc489294a33e0efcfe7ccded22507f905dbc6e79c8ae99
SHA512 cd93274e7e2dbebfcc19fb3da9fa76ffab12f4b3b9766b43c82a435527addfd2260404b19a337bac4a585de722e87fa08ebba55dde5a7222efc993f39ed3ad41

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\datareporting\glean\pending_pings\6eb108bf-9950-45df-a8ca-d650e498d0e6

MD5 f58066910b76d14470635f7113dcb1a9
SHA1 821f123d04d0dfdb10a31275e89a4dcf453d7fa6
SHA256 c3fc4b37d28f58625e6c75bcc7a4fbf60952de366198dc4a1cbded3eca1e12d4
SHA512 929d89915e375a64c8589a8377a7022719d041e2fc42a16f44ea27c4d78a9a2ed8f32f153e36b92bfd566bc5855d7ae7a406e8cf4868f6bbf5655d33fc7b767a

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\datareporting\glean\db\data.safe.tmp

MD5 b977f336a1b2c8e20e621118c0f96c49
SHA1 db29e1e5d64d3af912a8338bd631a5b6bbe4b59a
SHA256 c944ffddfcc9dce88edd7f4179a710512d673662119c3deaeef01b3d25252572
SHA512 1b1c887a482956fae2123866c8384aafbd68b980d9871a4b0cbb1c4d29eafc322d17f6ed4e119430a013ac01b7e297664b618ad10dc8eb85c8cec4bc68096916

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\activity-stream.discovery_stream.json.tmp

MD5 1c436c5a2b11fee1cb52e9cda4d31f9b
SHA1 846cd4051211593985b6b64962810f6a3007a84a
SHA256 d3249b02bf42f33b917a65bde86de5c661e60867c1c13a85fda2e9aedd0be696
SHA512 c3b369d5d222253defc25aa4f775e0c894a70abfdb35f8d63b209d8b78fa2905d7b5201c0836621b74c4fba6ccf2ff6c5047c293f2dbe1092bc730a548e05878

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\datareporting\glean\db\data.safe.tmp

MD5 b8efbe03d9a2bb9ecde28c4777d2ee92
SHA1 3fa103abfe50330459bf1e31c00c5fa2693535cd
SHA256 8aa993bb4f84d2f25d577f25c0367f0f75414b47add7124d116b416995f5c547
SHA512 71659fd2800824ee7eeb7ceadbae258c5becdb3949ba113a655a0808ad28d7238249e3a81963a148f14e7c3d9c75c7b95dda87e647093edb488856f4d10bdafd

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\AlternateServices.bin

MD5 5cb156a069d3563ff9b577101e596d9f
SHA1 c97c0eefdb681843b42ae5593d69adc0260097c0
SHA256 f1bef5ce7948c68333ac21f725a1e814f5e7cd380c22f05dc9a5ba46de4fa837
SHA512 97c80a90cd08edfbb88b01a9dcd81d1141ca3edcaf23f5cfe2c471c6b99a2d13ac3d48c6ff6ab0113e9d373fe7335f53e58b19a530b51d683259aec5d9a982f7

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\prefs.js

MD5 5e65cf50ce669af1495ab893df20e38d
SHA1 7cd41ee92323632690f7365eea4e6200564c49e7
SHA256 02230f6ff7ad4247b5de8bd2339ad06008f737cafe4f41140c22821c37071b21
SHA512 48950122e16c20b3ddad244afb6ed26351882ee5fc7586ce35b61863e8153c9e9d7d9d5623f252254b5179768f936e6d1bc7f85e5838acdd83883fab127c101c

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\AlternateServices.bin

MD5 4603ea4a81cfa3d9f50c107cd63c5f55
SHA1 7dc03e1428f4bdd008286e7b3127136efdba3a97
SHA256 de3517491936adf55058a590add932feb02032a3f4d239c6fc90cf07b218cec8
SHA512 190d75f69d3eb7fbec54edccc54ff6396fe54bad16bd60704eb0a4a7b6f96836898cd36395cb882b0e8a2a3f965eb669d31b736f5d0be8c5fbd40070ad3b1ac1

memory/2276-418-0x0000000000ED0000-0x000000000137C000-memory.dmp

memory/2276-426-0x0000000000ED0000-0x000000000137C000-memory.dmp

memory/2276-453-0x0000000000ED0000-0x000000000137C000-memory.dmp

memory/2276-458-0x0000000000ED0000-0x000000000137C000-memory.dmp

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\datareporting\glean\db\data.safe.tmp

MD5 a3fac90a51044a3660cd63c1f727d8b8
SHA1 d4e271aac48d0341ec91185d252e85a5498643a9
SHA256 9942524c7aab23ea48987b6d88d51fba8c8947799e1361661f8fdc2702fdb76e
SHA512 76d9db811174cd65a82d52c7d369b13f667d8fff51b706cda4d84d634310d6c4cfe547b0e6e7d155cc5f253007c11cf9ab000ff9de50c8b7690fb21fc05db314

C:\Users\Admin\AppData\Local\Temp\tmpaddon

MD5 09372174e83dbbf696ee732fd2e875bb
SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

MD5 2a461e9eb87fd1955cea740a3444ee7a
SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

MD5 842039753bf41fa5e11b3a1383061a87
SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\cache2\entries\E449899591A9BC91DFBA673EC0589B51E541A88B

MD5 b2118ec98a1b3c34240d06cddac5b4a2
SHA1 8659a1477dead8108e6798a87779fa5d1bf2abde
SHA256 d446f246f41c3798dc9c44422e28bd7f84fc77d83e0a47cf32b4aaffcc4b556a
SHA512 b8daf61e0bd72e3a3d25264bec5d6d838b3473976f7e6ea7d04870204ce0847f59319af552882dd14edcd04877bb8ccedf757b894c86539ee759f965b2846377

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\prefs.js

MD5 59d81ffa22853345c39e64afc0a12b7d
SHA1 b4ea5629a6e754c86fc7eb5888c07884eaeaad43
SHA256 95a1e6bd28a3021e518192dc3075a1adeaa46e08e096d202b75e88799898096e
SHA512 0e3cc071c67e83da8e0ec612262f11e41655713aa7199f990a11784ac0aad2daa498c9f1c0c569ccc1340e7fde9bd665096c20683269997215d0fac105df14be

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\prefs-1.js

MD5 686ad9efb0425fad4a4a9ca43eedc36e
SHA1 4f3ac9a0066a25c4aec5c17e821ca75e204bf7c6
SHA256 12e23e9d18a7aeba4b600d444331a6d94a8767e5233cedc192774237bc13bf66
SHA512 3bdda6d194cdb90ce2316a82b7d55cde3566cd5cb35ce5b745695e6b44d3c93ac26f7525dde9346368954da0312fb1da840ac406af8477b13e1c3020931b2076

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

MD5 128700f20ce55acb234c140a8227ade1
SHA1 cdb4b1d3ba34154a62824d4d241d2bfb6d85371e
SHA256 7ac8591a4dad9f8b6258c69456fd0bd393c6d0eea780541c92634f76651d3f84
SHA512 affcae1177d9b71c8613bd0b6665ddf7c083fffa2b3279515847f551245545ea4b3f48dc2bbaa33ac0bb0f1c354d579c1cc2247df691a534827e6dd5a21a2fcb

C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

MD5 0a8747a2ac9ac08ae9508f36c6d75692
SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

MD5 bf957ad58b55f64219ab3f793e374316
SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

MD5 daf7ef3acccab478aaa7d6dc1c60f865
SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\prefs.js

MD5 a0e5ff0eba3076308a345f353a78a32f
SHA1 5290fc4629c2e01f637557ece575c5dc301db78e
SHA256 2c008ceb03c9937f1f392de370cca93907fd2e4fc4ac3c2ed609395c0db968ab
SHA512 80bf79cba107222f09129639456bd09ddacf6db133f17cd9d0154ea746d7ca2cd59ab96553f8ff73ee5fdf9fd73db2d657c0b1f1dc7ec622151b956004a5613f

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\prefs.js

MD5 10edd356df5e13d42883394d6e5bf141
SHA1 4253361dd3dc07adb6ad75be9e0405f33793f703
SHA256 0251e88a4d67ed432e8a41519eb4904a1aeae2c158213379392e7b4932f12d17
SHA512 c207345d5121e74eed94cd17637352a8e0cfe289559868ed25685fe7e420c899c881fd15084029a338e423324c8d2ba16da2ebaa5c7428e3e31b83d831cd924b

memory/5984-860-0x0000000000ED0000-0x000000000137C000-memory.dmp

memory/5984-897-0x0000000000ED0000-0x000000000137C000-memory.dmp

memory/2276-956-0x0000000000ED0000-0x000000000137C000-memory.dmp

memory/2276-2161-0x0000000000ED0000-0x000000000137C000-memory.dmp

memory/2276-2571-0x0000000000ED0000-0x000000000137C000-memory.dmp

memory/2276-2577-0x0000000000ED0000-0x000000000137C000-memory.dmp

memory/2276-2581-0x0000000000ED0000-0x000000000137C000-memory.dmp

memory/2276-2582-0x0000000000ED0000-0x000000000137C000-memory.dmp

memory/2380-2584-0x0000000000ED0000-0x000000000137C000-memory.dmp

memory/2380-2586-0x0000000000ED0000-0x000000000137C000-memory.dmp

memory/2276-2587-0x0000000000ED0000-0x000000000137C000-memory.dmp

memory/2276-2588-0x0000000000ED0000-0x000000000137C000-memory.dmp

memory/2276-2589-0x0000000000ED0000-0x000000000137C000-memory.dmp

memory/2276-2590-0x0000000000ED0000-0x000000000137C000-memory.dmp

memory/2276-2596-0x0000000000ED0000-0x000000000137C000-memory.dmp