Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-09-2024 10:56

General

  • Target

    7107c368b936ca16f29354c81d66c753f3dd2cb67285d11bae7472f04d2a2eb3.exe

  • Size

    1.8MB

  • MD5

    a3bc9da8a3ba9ca5053f49ab20ee44ea

  • SHA1

    fc31c189c50723350f68335779aa184fb011a627

  • SHA256

    7107c368b936ca16f29354c81d66c753f3dd2cb67285d11bae7472f04d2a2eb3

  • SHA512

    cd55155fc40730731302cb328ae4c7b1a5988242e993460be40e9ddcb3cddea6dfe60ed5b55f9c410fba5062982350524e9a817423639ed7b6f16a9628b9c45c

  • SSDEEP

    49152:Husv++yaV6Mbvy2ly0YGZ4NdX3/tbHan:HufNMfYS8V3/tD

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

c7817d

C2

http://31.41.244.10

Attributes
  • install_dir

    0e8d0864aa

  • install_file

    svoutse.exe

  • strings_key

    5481b88a6ef75bcf21333988a4e47048

  • url_paths

    /Dem7kTu/index.php

rc4.plain

Extracted

Family

stealc

Botnet

rave

C2

http://185.215.113.103

Attributes
  • url_path

    /e2b1563c6670f193.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Stealc

    Stealc is an infostealer written in C++.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 12 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Identifies Wine through registry keys 2 TTPs 6 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 29 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\7107c368b936ca16f29354c81d66c753f3dd2cb67285d11bae7472f04d2a2eb3.exe
    "C:\Users\Admin\AppData\Local\Temp\7107c368b936ca16f29354c81d66c753f3dd2cb67285d11bae7472f04d2a2eb3.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4336
    • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
      "C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1840
      • C:\Users\Admin\AppData\Roaming\1000026000\e1af17cd20.exe
        "C:\Users\Admin\AppData\Roaming\1000026000\e1af17cd20.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:4700
      • C:\Users\Admin\AppData\Local\Temp\1000030001\009ffb3e7d.exe
        "C:\Users\Admin\AppData\Local\Temp\1000030001\009ffb3e7d.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:4632
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\Admin\AppData\Local\Temp\1000037041\no.ps1"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3180
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account
          4⤵
          • Enumerates system info in registry
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:1508
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff8dcafcc40,0x7ff8dcafcc4c,0x7ff8dcafcc58
            5⤵
              PID:1996
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1924,i,11926226540857086783,6398432771984952660,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1916 /prefetch:2
              5⤵
                PID:3332
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2020,i,11926226540857086783,6398432771984952660,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2172 /prefetch:3
                5⤵
                  PID:1424
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2240,i,11926226540857086783,6398432771984952660,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2432 /prefetch:8
                  5⤵
                    PID:3100
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3076,i,11926226540857086783,6398432771984952660,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3148 /prefetch:1
                    5⤵
                      PID:4408
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3084,i,11926226540857086783,6398432771984952660,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3156 /prefetch:1
                      5⤵
                        PID:4664
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4604,i,11926226540857086783,6398432771984952660,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=836 /prefetch:8
                        5⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:2320
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.youtube.com/account
                      4⤵
                      • Enumerates system info in registry
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of SendNotifyMessage
                      • Suspicious use of WriteProcessMemory
                      PID:3996
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8dc9b46f8,0x7ff8dc9b4708,0x7ff8dc9b4718
                        5⤵
                          PID:848
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,13934848796091926189,11951546191924150435,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
                          5⤵
                            PID:2292
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,13934848796091926189,11951546191924150435,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 /prefetch:3
                            5⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:1336
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,13934848796091926189,11951546191924150435,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3048 /prefetch:1
                            5⤵
                              PID:4660
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,13934848796091926189,11951546191924150435,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3056 /prefetch:1
                              5⤵
                                PID:948
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,13934848796091926189,11951546191924150435,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3264 /prefetch:8
                                5⤵
                                  PID:2136
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,13934848796091926189,11951546191924150435,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4448 /prefetch:1
                                  5⤵
                                    PID:6568
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,13934848796091926189,11951546191924150435,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4852 /prefetch:2
                                    5⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:5600
                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                  "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
                                  4⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:668
                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                    "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
                                    5⤵
                                    • Checks processor information in registry
                                    • Modifies registry class
                                    • Suspicious use of AdjustPrivilegeToken
                                    • Suspicious use of FindShellTrayWindow
                                    • Suspicious use of SendNotifyMessage
                                    • Suspicious use of SetWindowsHookEx
                                    PID:4352
                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1972 -parentBuildID 20240401114208 -prefsHandle 1888 -prefMapHandle 1864 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {aea210d9-8480-40e8-b151-53c713255a2e} 4352 "\\.\pipe\gecko-crash-server-pipe.4352" gpu
                                      6⤵
                                        PID:4304
                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2448 -parentBuildID 20240401114208 -prefsHandle 2432 -prefMapHandle 2428 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {64cc3174-8414-4766-959c-4416d6371c81} 4352 "\\.\pipe\gecko-crash-server-pipe.4352" socket
                                        6⤵
                                          PID:2488
                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2756 -childID 1 -isForBrowser -prefsHandle 2960 -prefMapHandle 2956 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {abe39e9b-7a73-4a6d-8584-21ee0d225f55} 4352 "\\.\pipe\gecko-crash-server-pipe.4352" tab
                                          6⤵
                                            PID:5764
                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3076 -childID 2 -isForBrowser -prefsHandle 3500 -prefMapHandle 3276 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {88f94e8b-2bfb-4d4d-a041-02298bf82ef5} 4352 "\\.\pipe\gecko-crash-server-pipe.4352" tab
                                            6⤵
                                              PID:6128
                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4268 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4124 -prefMapHandle 4188 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {68daa33d-5e79-498b-91bb-932031bcb37a} 4352 "\\.\pipe\gecko-crash-server-pipe.4352" utility
                                              6⤵
                                              • Checks processor information in registry
                                              PID:6548
                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5376 -childID 3 -isForBrowser -prefsHandle 5404 -prefMapHandle 5316 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f62a7b2a-0f78-4f17-bba3-c6967b07b9db} 4352 "\\.\pipe\gecko-crash-server-pipe.4352" tab
                                              6⤵
                                                PID:6188
                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5548 -childID 4 -isForBrowser -prefsHandle 5556 -prefMapHandle 5560 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c440cf14-c955-473c-96ed-75c02ad4da6a} 4352 "\\.\pipe\gecko-crash-server-pipe.4352" tab
                                                6⤵
                                                  PID:6204
                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5748 -childID 5 -isForBrowser -prefsHandle 5760 -prefMapHandle 5764 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d66b284a-af52-45dd-81c1-53c369fc4a3f} 4352 "\\.\pipe\gecko-crash-server-pipe.4352" tab
                                                  6⤵
                                                    PID:6232
                                        • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                                          "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                                          1⤵
                                            PID:5688
                                          • C:\Windows\System32\CompPkgSrv.exe
                                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                                            1⤵
                                              PID:5700
                                            • C:\Windows\System32\CompPkgSrv.exe
                                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                                              1⤵
                                                PID:6952
                                              • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                                                C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                                                1⤵
                                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                • Checks BIOS information in registry
                                                • Executes dropped EXE
                                                • Identifies Wine through registry keys
                                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:1704
                                              • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                                                C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                                                1⤵
                                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                • Checks BIOS information in registry
                                                • Executes dropped EXE
                                                • Identifies Wine through registry keys
                                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:3628

                                              Network

                                              MITRE ATT&CK Enterprise v15

                                              Replay Monitor

                                              Loading Replay Monitor...

                                              Downloads

                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                Filesize

                                                264B

                                                MD5

                                                e8afe6e4463e256042776f15ea528d2a

                                                SHA1

                                                c5695f1e29b8a988d4c12856a72e9d1f1323ccf5

                                                SHA256

                                                9f0cde0150ed3ab889ebc9269173e4d186e9fa0229c1b20c0fc17000525996b2

                                                SHA512

                                                2b688092c14f141b5f1c67dab29245cadda8a4fb7a5f4d62b019ad36712a449aea8636d7c5d1ad78c4fd55554ff2549fe8443d62569cf8bae79402a80637960c

                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                                Filesize

                                                2KB

                                                MD5

                                                1a664163e3416232bbb679cafd41e0eb

                                                SHA1

                                                d940ba45c3797914ab35d8df64febf11279bd028

                                                SHA256

                                                178ad6b9bf63291617d7cdd03c8a9a7f1a5bfb069df57482c77a1deb65022d9a

                                                SHA512

                                                aa4dc8feb5f7c13c0a98f540f0a55f51474936a7989132cfff91ce152c24a9a1260faf01156407d4ddecaf24d1137c2e92e08f32b0580b5e1fd7e7903526b1ba

                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                                                Filesize

                                                2B

                                                MD5

                                                d751713988987e9331980363e24189ce

                                                SHA1

                                                97d170e1550eee4afc0af065b78cda302a97674c

                                                SHA256

                                                4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                                SHA512

                                                b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                Filesize

                                                356B

                                                MD5

                                                dac0c245e4eb0f02be8d0785e28cf460

                                                SHA1

                                                8d062c98f9b2f995e1d111027830dcef7600ecc7

                                                SHA256

                                                952eeb17e7665f441d0756fe06c837f470544322ad7d0bdd3a0b9f3eccfdb6e2

                                                SHA512

                                                17de8a8fa31aefae9e4ec5601e48ba28f3dab22f4774caff445a053224a6ad6d4eda4dc4d6419860f19cd47b8bddea23666b67705b0ddd26a5a4ec7fdf5dcaed

                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                Filesize

                                                9KB

                                                MD5

                                                c80cbddcb4e2d9abd7087bf3347bf265

                                                SHA1

                                                78b0ac0d43f473ab62f243b3f2bf898c58a3cc07

                                                SHA256

                                                e51b100651be49e6beb447ce522dabddece9927a206a68eb5edfc9700ec66737

                                                SHA512

                                                9b39896f815bfcf48f2d91a03e7a866ecaff9817ee1eefe4f2db6153fd4a2da51008f1487d1bf51fca612b8170c92059317beb964dd2b926a613ff0e7c6613a2

                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                Filesize

                                                9KB

                                                MD5

                                                4de03825b06376a9dc7dfaba25b37a81

                                                SHA1

                                                21fdb8278967e5571f9932b6803daaf4f5cfd366

                                                SHA256

                                                fd7106fe96f7e112c6f3aa0264cb9b90d5731dc602a0dac2c5ed06e6b90a4e25

                                                SHA512

                                                a8e3041a40299e5070855a64ea6d5030d02bc7598f85fac011eebc45a9f6e550fa15860b0e2fd48a1cc78ffd29277044ed60ef9362d58fa4bbc5c857825961af

                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                Filesize

                                                9KB

                                                MD5

                                                a04cf0fbfe69708748e73e289b476ba3

                                                SHA1

                                                eb2ecb2a0d9c62c3838fb015731164730c092f29

                                                SHA256

                                                51a7ff0beac5c6404a2422b2a68c43a107456541ef4e9d934cbd85c6a6733c2f

                                                SHA512

                                                365942dca62c60a0bfc75755e0f1c1455f4e90e89559fb28d4179901a6509c8fd9e6983a7b64a3043028c37ae14d3e2f7aaaf738f136dee674e9e1805158b84e

                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                Filesize

                                                9KB

                                                MD5

                                                d3e538ec0f326d62eb0290c8310dc65b

                                                SHA1

                                                846bb8167e4bd2bc12b78e8b6d47eb5efbc7487a

                                                SHA256

                                                1c5b1e9ec273f234d253ee432929bd721bafe7f3c838ab8d9399d6a89d986c9b

                                                SHA512

                                                ad6786a3ba48141710f1a20d46bce760b8ae27b78b36f9d3c22e9a7a93459e5d8fa4472d9055e0c4a315075c8ae4bb1372e09ce7226d9edc183249e990daec49

                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                Filesize

                                                9KB

                                                MD5

                                                807d7b73bc08b2ca7a701d3c42562089

                                                SHA1

                                                d86f4b1801d3e15e275cc95b04ff29dc81b6e2df

                                                SHA256

                                                b6e132ea312fd6a7aaa5949c39aca14f1458b0698d228b82b6b6366aace67428

                                                SHA512

                                                7306b704330175b416c1275968bb4a332cbfc5d9e68fd40b3e03377ee2bb267295c01d683087c2f1f8a47effb1929e9c435ea225e2a8cec29221f6ac8ddd9ae4

                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                Filesize

                                                9KB

                                                MD5

                                                a6d51d05f292e9fd3ea2658b55a6e5b0

                                                SHA1

                                                5ec3eeea7e703fef5cdb249f1b1e8feb31fc76c1

                                                SHA256

                                                d002850edb534846da325782a6cef7e66fcb0106d18b0e9e53f985569c347171

                                                SHA512

                                                621961719d4cad1eb3d41f392de5c7f73fd3e892d19f9a9bdd00d5e26439cd79c9d5e09134582edabb5818aeca93d48ca1beddee8d7e36951c5e1091ae0c2fc0

                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                Filesize

                                                9KB

                                                MD5

                                                41377af4d9ac25402254233d922c6713

                                                SHA1

                                                aa6f9fc759de31d03d023b426fc3b39980f4005f

                                                SHA256

                                                92359465e0ceb2478db8f458747a40df0301089200c07bb6c7d385fb82f48313

                                                SHA512

                                                e9369b187fa2790e70056310bc32a6d355bd1ed2ba2e2d866158da928dfe7bd915343993b41b02a11b26af57fa3f071f348c5a1e51eff9cf74eebf4b8ea4b39d

                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                Filesize

                                                9KB

                                                MD5

                                                dab6b908d356d30d0fa942a5aef20a4f

                                                SHA1

                                                f6fc8b4371d2e1e55831e0a65975179f6f704c70

                                                SHA256

                                                bb832453b3924976e9566e2f420ef182f61673164a35c438f1c4f72339a6f298

                                                SHA512

                                                7356a69f945df0a24911afadee9e1845bdbdd1e6d8729388ccc04761e1b5769c7948da751cb3df3694816de5a6f3b62c2f5dbbf1c8182225bb1100d434779da1

                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                Filesize

                                                9KB

                                                MD5

                                                c24624a013b7e928120458ff302ad708

                                                SHA1

                                                67418e4e00392889c654539db3a2201409277030

                                                SHA256

                                                f15f950d9c41166fb73d34cf481987af776a91cf63bd8f9ae424076f1126620f

                                                SHA512

                                                4854f594c235ab5d896f87bb6ca138b5c08f9b7d92c57c70c78f9478d001bad0e1f3d2fc32dea972fed44c2d42ec544bdba23745d87da356378ca987d3a45506

                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                Filesize

                                                99KB

                                                MD5

                                                d232489203d0101274d570478d442711

                                                SHA1

                                                34dbabd1cd5c0b4fb697537a18c94663f0f17064

                                                SHA256

                                                413551f2b8219d5d8e6ff88202448451e2accb012f84631df424c86782d333ba

                                                SHA512

                                                f745147c17c0441cf1aa49812268ed096494c0da0f8911051d1c119148f482555f9d801af258e5f534276c006705b093171e093e81d3e82c4d15fb50f354025f

                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                Filesize

                                                99KB

                                                MD5

                                                8c2237a5110554fcd63a5ccd0dbbbf06

                                                SHA1

                                                e556231d392dfa725a00efdde2b66f5ad2772cd5

                                                SHA256

                                                95f76ccf36689acf22f84f7482fbdfe1073c855f17708199344c766f4e05e764

                                                SHA512

                                                db117dc06360ce1158aeafe08f7d1c2b8cdda559bc0bc606b792a763ffdeab472303988ac055a826fdab1932f3740f13d0265d4484ba464e8b3b1b1686f2c7b8

                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                Filesize

                                                152B

                                                MD5

                                                719923124ee00fb57378e0ebcbe894f7

                                                SHA1

                                                cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

                                                SHA256

                                                aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

                                                SHA512

                                                a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                Filesize

                                                152B

                                                MD5

                                                d7114a6cd851f9bf56cf771c37d664a2

                                                SHA1

                                                769c5d04fd83e583f15ab1ef659de8f883ecab8a

                                                SHA256

                                                d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

                                                SHA512

                                                33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

                                                Filesize

                                                32KB

                                                MD5

                                                e6fd019802e4caf75cc550b3df828db0

                                                SHA1

                                                f8a85e905b071c3b4309c345e52ebd60f31778b9

                                                SHA256

                                                9a4d03b9c6e9951eb4b28e4d1137d395ffe902e82a5713c9e5179463d5351f25

                                                SHA512

                                                3439e2be3a5146362cc0ac40e9a5c1c55887be0177d7fe5c6b4cafdc3a17c52c72055247dd8bf7d6d0423f816fb2ec4df1b69d222a3ade8fe023fb8b3eaa5b79

                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

                                                Filesize

                                                38KB

                                                MD5

                                                d2d2809abccb934fdaeb28495aad6cc0

                                                SHA1

                                                bb45cdb313bef33258c77fe2bc7a355b091bae61

                                                SHA256

                                                1140160bac9d000fe420508a039047da882dd4e754d87969ccae9226677ff312

                                                SHA512

                                                bc117aa72314a6cba24625b3ebfd8966aac7e70c026007130721b01321cf5b3b1a89884d713b7985f79602fdf3a8c11dd8190813df44b87914834be4cb95dc86

                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                Filesize

                                                216B

                                                MD5

                                                44c4ea87ff3c775e767ac4a97a23cc38

                                                SHA1

                                                a20fb9d6ef78d2a5182a3e267b9b4e17f9d6764b

                                                SHA256

                                                4643ab1dafcf29ad4a1af4a2d9f92a31b34c3d60ef195389e126235394aed66e

                                                SHA512

                                                6bf481e9eef8404721162e50aec5e8a6d5d4975dd48a0ce027fe95acd174ccf9be0aee3e0041583f5e6f0e868587ffbbb6c20c9cb6cdd2c111011c1335059202

                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                Filesize

                                                1KB

                                                MD5

                                                44804756ab71ef8b1917e3f3de855bb7

                                                SHA1

                                                1f796d3a8ee5e79c8288ebcdc155eca5dc385458

                                                SHA256

                                                dfa5fedb0617fbd5e2cae9a2bfd337869081a56240a7357268e360cb4ae2db3d

                                                SHA512

                                                3523010edad3ef7197a4c6bd04b17675a6dc1a67c19cab706b9df6d7626d7984bff5324cf3fba4840a3677aa7971d73f0c34c8740b0db92cbd9eb157b0538cdf

                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                Filesize

                                                5KB

                                                MD5

                                                3021193291ae3772d8fea2863ea36707

                                                SHA1

                                                1987a2d751fc76135c64cad4145fdd9211df481c

                                                SHA256

                                                34efa7b826f9e2bfdfee857cd383d6822759a1dd2e5cd901f35b25edf51a5d09

                                                SHA512

                                                dc445e00632aebd3d688fe867b0555eb723aa0ee591d2b3fa2e3ee1c3b53f0597a023ee3766907294758cddbff2059f08eaa2a99afd8dd8931c0160ab1c7a657

                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                Filesize

                                                6KB

                                                MD5

                                                4954584291284bf273aa9707818e60a8

                                                SHA1

                                                c006b1a2969b98aab678084da994d9de7d343cbd

                                                SHA256

                                                d417429ec9940c7d05da63f95f5ab5773fabfa3cd6ae86d28411d31123555516

                                                SHA512

                                                d341e9bc6572fa0662adfa8079bf0e67134e963b463d3e692d716a9b5b943c687259c862574a8d14f7ec835b72d93500329ae4feec013beda04871c22043897a

                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                Filesize

                                                10KB

                                                MD5

                                                cc9b7adff21b4f7726ee731456572b5d

                                                SHA1

                                                7091c570abc4877666bcd5d08c84c57e0cb9aa1c

                                                SHA256

                                                450e5daeea989e37939ca9c63ab10730f570fc802a6bdbfa6f7e56a4ad91873b

                                                SHA512

                                                640965f52e4e5b219216d99dfe834dd23bc0475517d2de9c77da08092310553c950cb460cbae2452fc24d1f7da10315b564ee451a1812cbd62bb6b7265d3bfaa

                                              • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\activity-stream.discovery_stream.json.tmp

                                                Filesize

                                                27KB

                                                MD5

                                                c49201ca8599166607acb2fad361f09d

                                                SHA1

                                                7dbd8cecf550a7d893a95df08d07b1de481a6956

                                                SHA256

                                                b3f98c85ad5582f0fb6eada16b10dd521cd42dcca7d6d08767910dcbf6f86878

                                                SHA512

                                                dc257b8b616c8b90c1a7c230616cc03bc8658bc20a19ad5abee83f56b8d5e95e9600e9ee500dc4fd1114c92550e4d8cfaa7ed265d9556bd25e9b92211f32cd80

                                              • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\cache2\entries\58EFA56DB4BFFECB0EDA547894BC9A057159E22F

                                                Filesize

                                                13KB

                                                MD5

                                                82be1f81871cb9317f06b1a1eb318d5e

                                                SHA1

                                                e5fd9a9f3093364af9ac57a43db8730d7eda9100

                                                SHA256

                                                5e096d120b28cb43bc4ad1526261be9862fe0b45be056f53bb3ba17a61c25b8c

                                                SHA512

                                                39d017fcdb06abeb5c8166d2447890aea416f73267bc1a7fc245c6823ee876948db34490933a8c36159c6daedb2ec14a513e3d46d3edd77ede6432286b5a4549

                                              • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe

                                                Filesize

                                                1.8MB

                                                MD5

                                                a3bc9da8a3ba9ca5053f49ab20ee44ea

                                                SHA1

                                                fc31c189c50723350f68335779aa184fb011a627

                                                SHA256

                                                7107c368b936ca16f29354c81d66c753f3dd2cb67285d11bae7472f04d2a2eb3

                                                SHA512

                                                cd55155fc40730731302cb328ae4c7b1a5988242e993460be40e9ddcb3cddea6dfe60ed5b55f9c410fba5062982350524e9a817423639ed7b6f16a9628b9c45c

                                              • C:\Users\Admin\AppData\Local\Temp\1000037041\no.ps1

                                                Filesize

                                                132B

                                                MD5

                                                27b9f35dd5e29794e0f254d4006f6fa4

                                                SHA1

                                                95496ffd85e8e55f57832b24c90a900d3cc96b26

                                                SHA256

                                                ca3bd2725a493554e081ea2c5528c7f134edad6374e2747e27230f112cec7f1d

                                                SHA512

                                                44dbb780e4e25e3eccc2de8c3edc7b0a4bb18e1f7f9cbbdd046ae74dc4daee526fdc5339864a66eb9d14b48b0871f474fdbe22eb1766eb4e94b0b6460fd5841d

                                              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jkqcry1o.isw.ps1

                                                Filesize

                                                60B

                                                MD5

                                                d17fe0a3f47be24a6453e9ef58c94641

                                                SHA1

                                                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                SHA256

                                                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                SHA512

                                                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                              • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                                                Filesize

                                                479KB

                                                MD5

                                                09372174e83dbbf696ee732fd2e875bb

                                                SHA1

                                                ba360186ba650a769f9303f48b7200fb5eaccee1

                                                SHA256

                                                c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                                                SHA512

                                                b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                                              • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                                                Filesize

                                                13.8MB

                                                MD5

                                                0a8747a2ac9ac08ae9508f36c6d75692

                                                SHA1

                                                b287a96fd6cc12433adb42193dfe06111c38eaf0

                                                SHA256

                                                32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                                                SHA512

                                                59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                                              • C:\Users\Admin\AppData\Roaming\1000026000\e1af17cd20.exe

                                                Filesize

                                                1.7MB

                                                MD5

                                                9f2ea8da04f80eb3da5aa70a8b0dec4f

                                                SHA1

                                                512b90952420f05ba4e9bbc373ca739e62a09d39

                                                SHA256

                                                f5117e607da6f40b945427386ad04ced62b3473351008eed049c3e9653222826

                                                SHA512

                                                c05467a56476014fe6a4866e74ab0a716bde6213ce2bcf6c0eddc9b4702e5dc83d797722f4fe2adfe5bff1eee1eaae435c89113ab53935fbacb9fc760795d497

                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\AlternateServices.bin

                                                Filesize

                                                17KB

                                                MD5

                                                b65f47c398a5031b962d90186b9b3d0f

                                                SHA1

                                                c785ed2fd989ac7d79701ddf93c4897c5843e955

                                                SHA256

                                                476725503f8c38539bbe103e3cc26e010c1baa505cef458815ef0acced0c5afe

                                                SHA512

                                                2de3f7378df2df515bb151481cf212567a8553ac6f1fe0379aa332edcfbe6f2711407fc183930853106ba30070e4e721ef3a0b214de2071817319dd6e93e3f3f

                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\AlternateServices.bin

                                                Filesize

                                                6KB

                                                MD5

                                                dc35862d4ac34ba5f4fde56cdc45f661

                                                SHA1

                                                0cc4676429c2aad9083e2aefd6c7fd21e9896319

                                                SHA256

                                                3360ce7e2dd9128e04169aa81ad2b54e0aca2d0411e584e55d38717d654ece35

                                                SHA512

                                                d3e65dd7195acddb03f138e9ca3580be25e92af48815f210aa8cf808a72996cacc7c2e4b65934139c53188efdc64405c9ce9ab327295ca1bd75a96e27d1d573c

                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\AlternateServices.bin

                                                Filesize

                                                7KB

                                                MD5

                                                bec42771fecff7b43f00de11b0bb3800

                                                SHA1

                                                b939b33de03dd3b21fe1435b37065b3a2cedf227

                                                SHA256

                                                89115bd2dbc7a2a69ce59a559195de766e1ef5126d1aab4f5114b0d97ed19b7b

                                                SHA512

                                                2d1a21b174aa34c55c03d5f18397521b0b96c9f487bd734f55938538a6fc0da28cb89e6b57ef5f5c5fe2aa7d1c7dcf7b679761c1a7765e5686c83f64494f217e

                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\datareporting\glean\db\data.safe.tmp

                                                Filesize

                                                5KB

                                                MD5

                                                cbc4e905f66dc0dcc1fcdc4e3f1156c1

                                                SHA1

                                                e4d3bc113115fdb225508b2922b21691164ac314

                                                SHA256

                                                c92ae719ac011a8f6bc1e1d3ab87c451006fc25beabc6ceb595da8446fbb82bc

                                                SHA512

                                                059b38aecd026f30e035bc33c728473392f26cbf9dff242fe04689ed1eb288f576cee312495f144dc1444c2e6a85a008d1961424859606bd81e393cb6abaa1dd

                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\datareporting\glean\db\data.safe.tmp

                                                Filesize

                                                15KB

                                                MD5

                                                b9db24362abf69a2f04ec1bd60363bca

                                                SHA1

                                                6da688d2961727932b757ec4c0029638bfae866f

                                                SHA256

                                                af8331c5d54c5f616864f9d4a8906f5a9ec6b607db35edc254170676e90d229e

                                                SHA512

                                                93279b65e4c785f4edc1ce9adb8e3b2989c7a2e44dabd24e6e897cef7ee5d6dc6c37997242587380319c2ecdbba6f2702d382b8f942a3ab6edfbb8949fb6b40f

                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\datareporting\glean\pending_pings\6a9a2434-2382-4200-b9b5-64b418ad13ba

                                                Filesize

                                                671B

                                                MD5

                                                7d7c0c75765f20b887920b1d582cf5cb

                                                SHA1

                                                f8a2aacc057c3869d75d976a9a492b7921fdd6e5

                                                SHA256

                                                b65979fc7958b47b1b9ff43874680cc9ab1300c43b21869bc4a459e3eedc64bc

                                                SHA512

                                                ef6ee331680630895506ea8b9df45d4854b2caf11e24da51222866b420fa4c0ce4e45df4f431e70f40e439f9e3520104ff0589f5bfd3c1939f7cffff878e6a3e

                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\datareporting\glean\pending_pings\70212e96-0ffd-4c83-8118-435f5ffba07e

                                                Filesize

                                                28KB

                                                MD5

                                                3e565a15ce67420d478383da2f12c2f6

                                                SHA1

                                                19f890e8979486526bb4346bad456d134e6bc467

                                                SHA256

                                                c55919bdf3e4436f3ac0873326c81da62f6477780b75efa84c4d70c1fa58a55b

                                                SHA512

                                                e65ad9a4c7d484bbd734d2e4279bba6dcaac3d45f0263381470918280f64959c384db04dab07198757ad4267684858739c13b7ad56a4eae8c826126d1115d8af

                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\datareporting\glean\pending_pings\c3239b5e-286f-4e9d-bb34-57723b7eb17a

                                                Filesize

                                                982B

                                                MD5

                                                36cd4a66ba64825fc42826c647d167e1

                                                SHA1

                                                264e01effcd325b266b8c62f4ef7690ed9f34ee6

                                                SHA256

                                                2a3c669f8adcf8589550fc91d4b04424b1d1f0844857e93f0dad322529b5ec55

                                                SHA512

                                                4c02bd47e9473a65d14db313be67a88cbd7b1938946053e5d5e747c84f78015b228a3770466adf7764967ba3ffc8c77db3ac3337a7268f82261c81b4636215cf

                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

                                                Filesize

                                                1.1MB

                                                MD5

                                                842039753bf41fa5e11b3a1383061a87

                                                SHA1

                                                3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                                                SHA256

                                                d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                                                SHA512

                                                d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

                                                Filesize

                                                116B

                                                MD5

                                                2a461e9eb87fd1955cea740a3444ee7a

                                                SHA1

                                                b10755914c713f5a4677494dbe8a686ed458c3c5

                                                SHA256

                                                4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                                                SHA512

                                                34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

                                                Filesize

                                                372B

                                                MD5

                                                bf957ad58b55f64219ab3f793e374316

                                                SHA1

                                                a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                                                SHA256

                                                bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                                                SHA512

                                                79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

                                                Filesize

                                                17.8MB

                                                MD5

                                                daf7ef3acccab478aaa7d6dc1c60f865

                                                SHA1

                                                f8246162b97ce4a945feced27b6ea114366ff2ad

                                                SHA256

                                                bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                                                SHA512

                                                5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\prefs-1.js

                                                Filesize

                                                11KB

                                                MD5

                                                ae2ab09a090a2bd1837b4d113612f0f6

                                                SHA1

                                                1c361487f4f48f2c6ae1877dfe8b7dc10f77986a

                                                SHA256

                                                da029bfb9dd32bd2f30b478bc07d5259ab4b1bd3b599d7980d192a47bf5c6174

                                                SHA512

                                                8004d0ea4e404b04ce92baed60e475634fdb647d4d0555c1dadd1c2e0dac3d62d99d053a42dec41920689078a1fa51843d8e07e4802f6f00a0faf85b0b3d380c

                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\prefs-1.js

                                                Filesize

                                                12KB

                                                MD5

                                                2cde08741fe70c29f62f7465e0723bb4

                                                SHA1

                                                9aaaf5afc4a4d041f52ca5313b73621354459632

                                                SHA256

                                                d7c344ead974ccc6540501d1cba299a8e2ed93dbe97f691f499363dc7755ecfd

                                                SHA512

                                                fe6c8723b51a4b0606dd2992c1fff42c8664033a6785cb2e9683db7edf2a6ca9b2b01741faa0e90ce37c902bff8fb3a6bc32e45545e2d661e014653eb5d36158

                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\prefs-1.js

                                                Filesize

                                                15KB

                                                MD5

                                                54a8176e8a6622fa309568f065e21569

                                                SHA1

                                                fb6717fb3fd20fc12c07787bd5dafbebb47bff68

                                                SHA256

                                                f611d92ac1f3e52d99f2c96b5304379710d6956af1e21cf60bc2860336c2053c

                                                SHA512

                                                91f20115864c39af838924f17e0637131abcd1a3e59e604956a06ab29201ae846f077149c60715a6af9825d903fa9a5a5bd128ffc5a406b7bc7b33b0023f7592

                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\prefs.js

                                                Filesize

                                                11KB

                                                MD5

                                                92a069a3b48709f6e1541f098b82fa3a

                                                SHA1

                                                cff03f6c0c78c9f3d065bb6cff825b931b6854a4

                                                SHA256

                                                0fd1999cfcc285d44e052bc46bb5a855003c2978f0851425f6df7abfe5016669

                                                SHA512

                                                9495926fdf9b10f93fa205aa95f42468fab1ba5e98102d5d4ab8cf57b55edb8ccae2fc174e0efa223c972fe13c3b81260f9809908bfe9dcbcbce4e39fdd2bd26

                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

                                                Filesize

                                                376KB

                                                MD5

                                                a189f92d14d5ddb0fd5ca892254188b4

                                                SHA1

                                                4bfaa34f1bf8141b7f135fe837fb38fdd60050f3

                                                SHA256

                                                268e69f8b71019289f38aa11e55094d42d890f84a2ba1c5ae6c17e912a1fa04b

                                                SHA512

                                                a3b1fb9df9d4eb7e612c0c2f523479e0b7eaa3c1eedd82be85172ad59bede077d23cac2c7d90026df0a09d254bb953fa50461c18932200b5df0c7c36629b123b

                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

                                                Filesize

                                                1.3MB

                                                MD5

                                                3778c9b42fc6dc94702d0483d5a6233a

                                                SHA1

                                                9e3347d80370eff63cf829562b874ef9a532a941

                                                SHA256

                                                b1ed552af5174f1d9165353193d211181eb81af31cf6e92f4ca2ae85671f73aa

                                                SHA512

                                                c6c189bbbcdc67df4efc1e516d6374ce2f3dfabc49a25d01e05d93ba721b6c21a1b80caa0aaed1f29dbd0efdde4fd947e2541eac47239d4621e6677971705f04

                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

                                                Filesize

                                                2.2MB

                                                MD5

                                                6eccc29d85b5c7a140c22649dfe95521

                                                SHA1

                                                89f11c08c89374e529af97707c70e6dcea24b75a

                                                SHA256

                                                f10a80a9771ff627bc5befe57fcb05b69a96ca4f8003a62341d6394041472bab

                                                SHA512

                                                44040f694135563900873d53a1bea27fb3fc2152b9e5201c125ef1408f2df290ef28e279a4ac2faad1735761e8f812f3887995bb89aeac0cdacb92deb0cee296

                                              • \??\pipe\crashpad_1508_RXNOOYANFXHANAOZ

                                                MD5

                                                d41d8cd98f00b204e9800998ecf8427e

                                                SHA1

                                                da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                SHA256

                                                e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                SHA512

                                                cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                              • memory/1704-790-0x0000000000430000-0x00000000008F8000-memory.dmp

                                                Filesize

                                                4.8MB

                                              • memory/1704-789-0x0000000000430000-0x00000000008F8000-memory.dmp

                                                Filesize

                                                4.8MB

                                              • memory/1840-791-0x0000000000430000-0x00000000008F8000-memory.dmp

                                                Filesize

                                                4.8MB

                                              • memory/1840-111-0x0000000000430000-0x00000000008F8000-memory.dmp

                                                Filesize

                                                4.8MB

                                              • memory/1840-2886-0x0000000000430000-0x00000000008F8000-memory.dmp

                                                Filesize

                                                4.8MB

                                              • memory/1840-2865-0x0000000000430000-0x00000000008F8000-memory.dmp

                                                Filesize

                                                4.8MB

                                              • memory/1840-2855-0x0000000000430000-0x00000000008F8000-memory.dmp

                                                Filesize

                                                4.8MB

                                              • memory/1840-2845-0x0000000000430000-0x00000000008F8000-memory.dmp

                                                Filesize

                                                4.8MB

                                              • memory/1840-2844-0x0000000000430000-0x00000000008F8000-memory.dmp

                                                Filesize

                                                4.8MB

                                              • memory/1840-2831-0x0000000000430000-0x00000000008F8000-memory.dmp

                                                Filesize

                                                4.8MB

                                              • memory/1840-18-0x0000000000430000-0x00000000008F8000-memory.dmp

                                                Filesize

                                                4.8MB

                                              • memory/1840-19-0x0000000000430000-0x00000000008F8000-memory.dmp

                                                Filesize

                                                4.8MB

                                              • memory/1840-20-0x0000000000430000-0x00000000008F8000-memory.dmp

                                                Filesize

                                                4.8MB

                                              • memory/1840-2800-0x0000000000430000-0x00000000008F8000-memory.dmp

                                                Filesize

                                                4.8MB

                                              • memory/1840-2796-0x0000000000430000-0x00000000008F8000-memory.dmp

                                                Filesize

                                                4.8MB

                                              • memory/1840-570-0x0000000000430000-0x00000000008F8000-memory.dmp

                                                Filesize

                                                4.8MB

                                              • memory/1840-88-0x0000000000430000-0x00000000008F8000-memory.dmp

                                                Filesize

                                                4.8MB

                                              • memory/1840-21-0x0000000000430000-0x00000000008F8000-memory.dmp

                                                Filesize

                                                4.8MB

                                              • memory/1840-2005-0x0000000000430000-0x00000000008F8000-memory.dmp

                                                Filesize

                                                4.8MB

                                              • memory/1840-602-0x0000000000430000-0x00000000008F8000-memory.dmp

                                                Filesize

                                                4.8MB

                                              • memory/1840-22-0x0000000000430000-0x00000000008F8000-memory.dmp

                                                Filesize

                                                4.8MB

                                              • memory/1840-1070-0x0000000000430000-0x00000000008F8000-memory.dmp

                                                Filesize

                                                4.8MB

                                              • memory/1840-64-0x0000000000430000-0x00000000008F8000-memory.dmp

                                                Filesize

                                                4.8MB

                                              • memory/1840-82-0x0000000000430000-0x00000000008F8000-memory.dmp

                                                Filesize

                                                4.8MB

                                              • memory/3180-89-0x0000000006020000-0x0000000006042000-memory.dmp

                                                Filesize

                                                136KB

                                              • memory/3180-90-0x00000000070D0000-0x0000000007674000-memory.dmp

                                                Filesize

                                                5.6MB

                                              • memory/3180-68-0x0000000005380000-0x00000000053E6000-memory.dmp

                                                Filesize

                                                408KB

                                              • memory/3180-108-0x0000000007020000-0x0000000007034000-memory.dmp

                                                Filesize

                                                80KB

                                              • memory/3180-110-0x0000000007050000-0x0000000007058000-memory.dmp

                                                Filesize

                                                32KB

                                              • memory/3180-66-0x0000000004B20000-0x0000000005148000-memory.dmp

                                                Filesize

                                                6.2MB

                                              • memory/3180-67-0x0000000004AF0000-0x0000000004B12000-memory.dmp

                                                Filesize

                                                136KB

                                              • memory/3180-105-0x0000000006FB0000-0x0000000006FBA000-memory.dmp

                                                Filesize

                                                40KB

                                              • memory/3180-69-0x0000000005460000-0x00000000054C6000-memory.dmp

                                                Filesize

                                                408KB

                                              • memory/3180-65-0x00000000044B0000-0x00000000044E6000-memory.dmp

                                                Filesize

                                                216KB

                                              • memory/3180-83-0x0000000005A80000-0x0000000005A9E000-memory.dmp

                                                Filesize

                                                120KB

                                              • memory/3180-107-0x0000000007000000-0x000000000700E000-memory.dmp

                                                Filesize

                                                56KB

                                              • memory/3180-106-0x0000000006FC0000-0x0000000006FD1000-memory.dmp

                                                Filesize

                                                68KB

                                              • memory/3180-104-0x0000000007D00000-0x000000000837A000-memory.dmp

                                                Filesize

                                                6.5MB

                                              • memory/3180-84-0x0000000005AA0000-0x0000000005AEC000-memory.dmp

                                                Filesize

                                                304KB

                                              • memory/3180-103-0x0000000006E10000-0x0000000006EB3000-memory.dmp

                                                Filesize

                                                652KB

                                              • memory/3180-87-0x0000000005F90000-0x0000000005FAA000-memory.dmp

                                                Filesize

                                                104KB

                                              • memory/3180-86-0x0000000006A80000-0x0000000006B16000-memory.dmp

                                                Filesize

                                                600KB

                                              • memory/3180-109-0x0000000007060000-0x000000000707A000-memory.dmp

                                                Filesize

                                                104KB

                                              • memory/3180-79-0x00000000054D0000-0x0000000005824000-memory.dmp

                                                Filesize

                                                3.3MB

                                              • memory/3180-91-0x0000000006BB0000-0x0000000006BE2000-memory.dmp

                                                Filesize

                                                200KB

                                              • memory/3180-92-0x0000000073E00000-0x0000000073E4C000-memory.dmp

                                                Filesize

                                                304KB

                                              • memory/3180-102-0x0000000006BF0000-0x0000000006C0E000-memory.dmp

                                                Filesize

                                                120KB

                                              • memory/3628-2842-0x0000000000430000-0x00000000008F8000-memory.dmp

                                                Filesize

                                                4.8MB

                                              • memory/3628-2843-0x0000000000430000-0x00000000008F8000-memory.dmp

                                                Filesize

                                                4.8MB

                                              • memory/4336-2-0x0000000000871000-0x000000000089F000-memory.dmp

                                                Filesize

                                                184KB

                                              • memory/4336-17-0x0000000000870000-0x0000000000D38000-memory.dmp

                                                Filesize

                                                4.8MB

                                              • memory/4336-0-0x0000000000870000-0x0000000000D38000-memory.dmp

                                                Filesize

                                                4.8MB

                                              • memory/4336-5-0x0000000000870000-0x0000000000D38000-memory.dmp

                                                Filesize

                                                4.8MB

                                              • memory/4336-3-0x0000000000870000-0x0000000000D38000-memory.dmp

                                                Filesize

                                                4.8MB

                                              • memory/4336-1-0x0000000077994000-0x0000000077996000-memory.dmp

                                                Filesize

                                                8KB

                                              • memory/4632-412-0x00000000005C0000-0x0000000000C43000-memory.dmp

                                                Filesize

                                                6.5MB

                                              • memory/4632-56-0x00000000005C0000-0x0000000000C43000-memory.dmp

                                                Filesize

                                                6.5MB

                                              • memory/4700-52-0x0000000005490000-0x0000000005491000-memory.dmp

                                                Filesize

                                                4KB

                                              • memory/4700-54-0x00000000005E1000-0x00000000005F5000-memory.dmp

                                                Filesize

                                                80KB

                                              • memory/4700-38-0x00000000005E0000-0x0000000000C63000-memory.dmp

                                                Filesize

                                                6.5MB

                                              • memory/4700-81-0x00000000005E0000-0x0000000000C63000-memory.dmp

                                                Filesize

                                                6.5MB