Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-09-2024 20:01

General

  • Target

    de43f53aa96dac7458f3131343e076429ed33b4eb29c65af41e6a0275b50ea32.exe

  • Size

    1.8MB

  • MD5

    0178074bff7cac97ce00f5e4048c530e

  • SHA1

    c500242fba88b0b8e4a4ff0fc0821fdd5f64d97a

  • SHA256

    de43f53aa96dac7458f3131343e076429ed33b4eb29c65af41e6a0275b50ea32

  • SHA512

    5ba88657414f55b79bd93dcf248979fb3a726e7b2e0ec259eea495d2954a5d1f5c3b9bb9223325d17babaa15bfd8ebe247cd4a3f2a761e4538632486eb0b5bc9

  • SSDEEP

    49152:eGWo+p9tDSYNHO1Tu/MWS/UBFArbz+3YsbF:eGWoStDpNHNxs8yre3PR

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

c7817d

C2

http://31.41.244.10

Attributes
  • install_dir

    0e8d0864aa

  • install_file

    svoutse.exe

  • strings_key

    5481b88a6ef75bcf21333988a4e47048

  • url_paths

    /Dem7kTu/index.php

rc4.plain

Extracted

Family

stealc

Botnet

rave

C2

http://185.215.113.103

Attributes
  • url_path

    /e2b1563c6670f193.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Stealc

    Stealc is an infostealer written in C++.

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 14 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 6 IoCs
  • Identifies Wine through registry keys 2 TTPs 7 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 14 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 29 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 47 IoCs
  • Suspicious use of SendNotifyMessage 44 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\de43f53aa96dac7458f3131343e076429ed33b4eb29c65af41e6a0275b50ea32.exe
    "C:\Users\Admin\AppData\Local\Temp\de43f53aa96dac7458f3131343e076429ed33b4eb29c65af41e6a0275b50ea32.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:64
    • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
      "C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2872
      • C:\Users\Admin\AppData\Roaming\1000026000\22520f2363.exe
        "C:\Users\Admin\AppData\Roaming\1000026000\22520f2363.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:3148
      • C:\Users\Admin\AppData\Local\Temp\1000030001\e34e98ef5e.exe
        "C:\Users\Admin\AppData\Local\Temp\1000030001\e34e98ef5e.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:1688
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\Admin\AppData\Local\Temp\1000039041\do.ps1"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1476
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /c start msedge https://www.youtube.com/account
          4⤵
          • Checks computer location settings
          • System Location Discovery: System Language Discovery
          PID:5044
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.youtube.com/account
            5⤵
            • Enumerates system info in registry
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            PID:316
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff4a2146f8,0x7fff4a214708,0x7fff4a214718
              6⤵
                PID:464
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,2853325151221497178,13896580638630086844,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
                6⤵
                  PID:2720
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,2853325151221497178,13896580638630086844,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3
                  6⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:5636
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,2853325151221497178,13896580638630086844,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2728 /prefetch:8
                  6⤵
                    PID:3232
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,2853325151221497178,13896580638630086844,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
                    6⤵
                      PID:5488
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,2853325151221497178,13896580638630086844,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3488 /prefetch:1
                      6⤵
                        PID:5492
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,2853325151221497178,13896580638630086844,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3932 /prefetch:1
                        6⤵
                          PID:5280
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,2853325151221497178,13896580638630086844,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4852 /prefetch:1
                          6⤵
                            PID:5804
                          • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,2853325151221497178,13896580638630086844,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5448 /prefetch:8
                            6⤵
                              PID:6432
                            • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,2853325151221497178,13896580638630086844,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5448 /prefetch:8
                              6⤵
                              • Suspicious behavior: EnumeratesProcesses
                              PID:6508
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,2853325151221497178,13896580638630086844,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3656 /prefetch:1
                              6⤵
                                PID:1148
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,2853325151221497178,13896580638630086844,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4148 /prefetch:1
                                6⤵
                                  PID:1704
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,2853325151221497178,13896580638630086844,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3484 /prefetch:1
                                  6⤵
                                    PID:6612
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,2853325151221497178,13896580638630086844,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:1
                                    6⤵
                                      PID:5372
                                • C:\Windows\SysWOW64\cmd.exe
                                  "C:\Windows\system32\cmd.exe" /c start msedge https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
                                  4⤵
                                  • Checks computer location settings
                                  • System Location Discovery: System Language Discovery
                                  PID:4524
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://accounts.google.com/ServiceLogin?service=accountsettings
                                    5⤵
                                      PID:4044
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7fff4a2146f8,0x7fff4a214708,0x7fff4a214718
                                        6⤵
                                          PID:1640
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,6950120023124610419,6498145593456389248,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
                                          6⤵
                                            PID:4992
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,6950120023124610419,6498145593456389248,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
                                            6⤵
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:2896
                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                        "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
                                        4⤵
                                        • Suspicious use of WriteProcessMemory
                                        PID:2952
                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                          "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
                                          5⤵
                                          • Checks processor information in registry
                                          • Modifies registry class
                                          • Suspicious use of AdjustPrivilegeToken
                                          • Suspicious use of FindShellTrayWindow
                                          • Suspicious use of SendNotifyMessage
                                          • Suspicious use of SetWindowsHookEx
                                          • Suspicious use of WriteProcessMemory
                                          PID:1416
                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2020 -parentBuildID 20240401114208 -prefsHandle 1912 -prefMapHandle 1904 -prefsLen 23602 -prefMapSize 244628 -appDir "C:\Program Files\Mozilla Firefox\browser" - {88f9368a-7c61-4cc3-90a6-f7504dc4d5de} 1416 "\\.\pipe\gecko-crash-server-pipe.1416" gpu
                                            6⤵
                                              PID:2056
                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2468 -parentBuildID 20240401114208 -prefsHandle 2440 -prefMapHandle 2436 -prefsLen 24522 -prefMapSize 244628 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2429f130-0d8e-49ea-b595-ee2e77d23db2} 1416 "\\.\pipe\gecko-crash-server-pipe.1416" socket
                                              6⤵
                                                PID:388
                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3020 -childID 1 -isForBrowser -prefsHandle 3196 -prefMapHandle 1624 -prefsLen 22590 -prefMapSize 244628 -jsInitHandle 984 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9a0661f0-41c2-4dbc-a0b8-348f523d32c9} 1416 "\\.\pipe\gecko-crash-server-pipe.1416" tab
                                                6⤵
                                                  PID:1740
                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3468 -childID 2 -isForBrowser -prefsHandle 3520 -prefMapHandle 3544 -prefsLen 22631 -prefMapSize 244628 -jsInitHandle 984 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {18b0ec6f-30bc-417a-a23e-287409fe064c} 1416 "\\.\pipe\gecko-crash-server-pipe.1416" tab
                                                  6⤵
                                                    PID:4292
                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4084 -childID 3 -isForBrowser -prefsHandle 4076 -prefMapHandle 4072 -prefsLen 29012 -prefMapSize 244628 -jsInitHandle 984 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {208e854d-05c2-4a49-a3fe-dd235ab496a1} 1416 "\\.\pipe\gecko-crash-server-pipe.1416" tab
                                                    6⤵
                                                      PID:1396
                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5052 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 5028 -prefMapHandle 5008 -prefsLen 29012 -prefMapSize 244628 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9251b2ee-1f68-4b6d-9e73-5ef5407d9418} 1416 "\\.\pipe\gecko-crash-server-pipe.1416" utility
                                                      6⤵
                                                      • Checks processor information in registry
                                                      PID:5616
                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5800 -childID 4 -isForBrowser -prefsHandle 5792 -prefMapHandle 5788 -prefsLen 26989 -prefMapSize 244628 -jsInitHandle 984 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ba69228b-a8c9-4ccd-b767-18da5d7c938d} 1416 "\\.\pipe\gecko-crash-server-pipe.1416" tab
                                                      6⤵
                                                        PID:5344
                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5888 -childID 5 -isForBrowser -prefsHandle 5896 -prefMapHandle 5900 -prefsLen 26989 -prefMapSize 244628 -jsInitHandle 984 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b6a3e01d-9e09-402b-9b68-aea812fa6b03} 1416 "\\.\pipe\gecko-crash-server-pipe.1416" tab
                                                        6⤵
                                                          PID:2468
                                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5960 -childID 6 -isForBrowser -prefsHandle 5968 -prefMapHandle 5908 -prefsLen 26989 -prefMapSize 244628 -jsInitHandle 984 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5b361d0c-ce70-4163-95ad-b790274f9cc9} 1416 "\\.\pipe\gecko-crash-server-pipe.1416" tab
                                                          6⤵
                                                            PID:5828
                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
                                                        4⤵
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:4808
                                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                                          "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
                                                          5⤵
                                                          • Checks processor information in registry
                                                          PID:3424
                                                • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                                                  C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                                                  1⤵
                                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                  • Checks BIOS information in registry
                                                  • Executes dropped EXE
                                                  • Identifies Wine through registry keys
                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:1712
                                                • C:\Windows\System32\CompPkgSrv.exe
                                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                  1⤵
                                                    PID:5248
                                                  • C:\Windows\System32\CompPkgSrv.exe
                                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                    1⤵
                                                      PID:5412
                                                    • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                                                      C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                                                      1⤵
                                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                      • Checks BIOS information in registry
                                                      • Executes dropped EXE
                                                      • Identifies Wine through registry keys
                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:6936
                                                    • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                                                      C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                                                      1⤵
                                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                      • Checks BIOS information in registry
                                                      • Executes dropped EXE
                                                      • Identifies Wine through registry keys
                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:7164

                                                    Network

                                                    MITRE ATT&CK Enterprise v15

                                                    Replay Monitor

                                                    Loading Replay Monitor...

                                                    Downloads

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                      Filesize

                                                      152B

                                                      MD5

                                                      27304926d60324abe74d7a4b571c35ea

                                                      SHA1

                                                      78b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1

                                                      SHA256

                                                      7039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de

                                                      SHA512

                                                      f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                      Filesize

                                                      152B

                                                      MD5

                                                      9e3fc58a8fb86c93d19e1500b873ef6f

                                                      SHA1

                                                      c6aae5f4e26f5570db5e14bba8d5061867a33b56

                                                      SHA256

                                                      828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4

                                                      SHA512

                                                      e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                      Filesize

                                                      504B

                                                      MD5

                                                      3336858d94f75b88e95ecd7fc1f32682

                                                      SHA1

                                                      4e52bb391dd1cb56646fc0ae0e29877fe2e7554f

                                                      SHA256

                                                      c4b46bdaef8e04c609091d79c165a642714803be0b1fb823d79400c06df87db8

                                                      SHA512

                                                      d804f91a8a9bfdc1b69e566486e505bed1a4df3857e16e3c8485db246f2b2dc317ca4a6fcfa436afd9947796c1cd6b24f292675064bc1db189d9f6cd342428e2

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                      Filesize

                                                      1KB

                                                      MD5

                                                      70007a5d917dddd5dbf0569f8412fe8f

                                                      SHA1

                                                      a59703d0f0fe190b411e0f2e0ccef6296165db20

                                                      SHA256

                                                      09c8f8ed2a9ac93c3dfbbf273cc1851d22e3617e90dd43093101c3a887c3e036

                                                      SHA512

                                                      9e0f82e8b5f2e6d8ed89c2477bdb5e8dad16d49492980c01a1dcac6dd08c66ec65ed37b0f77442f5c1fc30b1a371b43f8e35b84e896371124485c2a67cd6d817

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                      Filesize

                                                      7KB

                                                      MD5

                                                      ceec6efd3716a6f9c8571340b04f1db0

                                                      SHA1

                                                      6283df9c366aa74a4996ff65425f7021d20debb2

                                                      SHA256

                                                      0f41e97e1eddcf1eedcc7ce02f24f5ffab85b6d14e62872a82f2b23b9da84576

                                                      SHA512

                                                      b507127dbeeac971160db6ee5e29b9fa1c57b1be3269f5e5d84f807bb683ba7ef2706381b05b48cda9d5fdb677ab84d8badd7637e3778c2140977b1357807fea

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                      Filesize

                                                      6KB

                                                      MD5

                                                      2dc8705d7cb9d7d5995c07f2a705f8c7

                                                      SHA1

                                                      0d88ca80efe3ace7f3af929d0e7bb1733d2a4976

                                                      SHA256

                                                      6979be7eeb2b15522578a7e12e9441e2f27dd3377680ab864488232eae1aadeb

                                                      SHA512

                                                      2f2f628a05546386d55c19cdf1c4f21a1bc09701513f57fcdbb338308f1cba7e005e72e5be32a1e1a6250a274ed9997f240594666a9f9c9aaea5e6c4311ab18e

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                      Filesize

                                                      535B

                                                      MD5

                                                      51cdd9857ce88b190fac89c6d089ca61

                                                      SHA1

                                                      9262885b8e7e03ab96a0a00c120df114576be97d

                                                      SHA256

                                                      f3942989c6881142abb380539734ef0940190b750cb3ede4a6763f6ca41cab14

                                                      SHA512

                                                      8e7b13d61000dfbc9aca76d7139f10bfe0c30db2fd9a36450176e0d3eb1886db02b5b3110a9c041bc196ee72a982335ef4b5563e76829c0127cfef5e3cb36363

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe59a908.TMP

                                                      Filesize

                                                      535B

                                                      MD5

                                                      0158e2dccb7f7c9852f1464610083509

                                                      SHA1

                                                      896bbc7004ed561ea2811870368ca0729830ef81

                                                      SHA256

                                                      9f207c2d10f7a16d0caf16063b1fd5a3333deded0777ad01f22a762dc6c64c56

                                                      SHA512

                                                      5e96a8d93394e96a60bdfab64b48f169e52fa28f982b74bfa814828a42641b0744a2a2862bb4040b3ddb3950b7ec97903bf606cf5b261e701597adae9253f83b

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                      Filesize

                                                      16B

                                                      MD5

                                                      6752a1d65b201c13b62ea44016eb221f

                                                      SHA1

                                                      58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                      SHA256

                                                      0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                      SHA512

                                                      9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                      Filesize

                                                      8KB

                                                      MD5

                                                      53df7948a112e11018da573f793e0fdd

                                                      SHA1

                                                      bd7037ebdeadb25a4a1079051c0b051ae45c2fb0

                                                      SHA256

                                                      872b604fb90b815449325b25d195b55ad6eeec7e46fdf19b0f7dbee025d2f8bf

                                                      SHA512

                                                      ef0462541a12b95df35f4b329a3c73c5e550f00a59e69eeaf033f18eb0427b75483794336ab572de5ba3bf98a1ed08316ceb0c73ed8ae4489096f727c0cbc399

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                      Filesize

                                                      10KB

                                                      MD5

                                                      c0a2aca22cb66cf43b3a20d1ef38dba2

                                                      SHA1

                                                      ab0c7115c9fdc18ea23309c1bd5a6c893c7412dc

                                                      SHA256

                                                      b51346bdad2686200cb80676d92d18d5e8e479f5228b7a834c576edf271c0a25

                                                      SHA512

                                                      e38ce6b2f45cb3847c79e57ce51d8a13f010273957f0d7245b6aaa87cf8c60ed699f7a1f422fa15954e6e020178c4750d249cc728a01bd96fe2f74f2281f9ce7

                                                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5utpapi8.default-release\cache2\entries\58EFA56DB4BFFECB0EDA547894BC9A057159E22F

                                                      Filesize

                                                      13KB

                                                      MD5

                                                      3144f246d5f457e242565f26b32661b5

                                                      SHA1

                                                      d2ecb579b23666524e83ca91c59cc12e0648d200

                                                      SHA256

                                                      854d0b4a5aa0b97221ca908b090bee437888e2f5d50d0123fa2792702cb597ec

                                                      SHA512

                                                      541ec5946203bc890c36f3b3d0105f7d4724394d0b0c52c73e4095f2590cb10b1e82d78612efaddfa51d382577a040d450ea4d4969faff19694331628006dcd0

                                                    • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe

                                                      Filesize

                                                      1.8MB

                                                      MD5

                                                      0178074bff7cac97ce00f5e4048c530e

                                                      SHA1

                                                      c500242fba88b0b8e4a4ff0fc0821fdd5f64d97a

                                                      SHA256

                                                      de43f53aa96dac7458f3131343e076429ed33b4eb29c65af41e6a0275b50ea32

                                                      SHA512

                                                      5ba88657414f55b79bd93dcf248979fb3a726e7b2e0ec259eea495d2954a5d1f5c3b9bb9223325d17babaa15bfd8ebe247cd4a3f2a761e4538632486eb0b5bc9

                                                    • C:\Users\Admin\AppData\Local\Temp\1000039041\do.ps1

                                                      Filesize

                                                      2KB

                                                      MD5

                                                      e05e8f072b373beafe27cc11d85f947c

                                                      SHA1

                                                      1d6daeb98893e8122b8b69287ebd9d43f3c6138e

                                                      SHA256

                                                      717c09427fa5754ba92f92961545534048d0a76528c2e95c4d5ec6cef47c612f

                                                      SHA512

                                                      b3e34162e5ee43bb01f289eebc45fd3ea3e07f30be40dcf6635606540f912fe5c84d301e9f78e97dfe3ffe53e72547e50f3bcd7d4ebe5ab8da451a1989c469a0

                                                    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nzgcfhuu.ldb.ps1

                                                      Filesize

                                                      60B

                                                      MD5

                                                      d17fe0a3f47be24a6453e9ef58c94641

                                                      SHA1

                                                      6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                      SHA256

                                                      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                      SHA512

                                                      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                    • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                                                      Filesize

                                                      479KB

                                                      MD5

                                                      09372174e83dbbf696ee732fd2e875bb

                                                      SHA1

                                                      ba360186ba650a769f9303f48b7200fb5eaccee1

                                                      SHA256

                                                      c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                                                      SHA512

                                                      b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                                                    • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                                                      Filesize

                                                      13.8MB

                                                      MD5

                                                      0a8747a2ac9ac08ae9508f36c6d75692

                                                      SHA1

                                                      b287a96fd6cc12433adb42193dfe06111c38eaf0

                                                      SHA256

                                                      32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                                                      SHA512

                                                      59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                                                    • C:\Users\Admin\AppData\Roaming\1000026000\22520f2363.exe

                                                      Filesize

                                                      1.7MB

                                                      MD5

                                                      ac12bb478b2ae055df15787d43a8dd61

                                                      SHA1

                                                      78b92499be7174aff470707436ee99eb5e1306f1

                                                      SHA256

                                                      7c4160768d4c205ed30a845b211a04a53f870d55ab8276f0c6de420a0345025c

                                                      SHA512

                                                      22b786889143f6886972ba6dad0d8617ef8f54536db514dfc5d9de8c74c22b7429fd0b4feea31fed1d928db46752d64615e94d56b856c1681dccc52f2f8e4aca

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\AlternateServices.bin

                                                      Filesize

                                                      23KB

                                                      MD5

                                                      187be537828600cf619d05343206073d

                                                      SHA1

                                                      c3f95c5092eb507ed292653d4949e1ad3f553446

                                                      SHA256

                                                      b8d99c4a14f1f87e671321109fd0948a1e678cb74c2e0c998d05d76ff506762f

                                                      SHA512

                                                      094ee0989f9f33116c41e25bc43834ab28b48421746030eae42afb47fe8030020a1ef8911857decf37829e80d6b340db3d7a15b557331911232271700349f3ae

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\AlternateServices.bin

                                                      Filesize

                                                      11KB

                                                      MD5

                                                      9ee44b64bb2b9ec95e4c390fd4aaadf0

                                                      SHA1

                                                      24b4e3480469e19268b632d24212cdb632b194ad

                                                      SHA256

                                                      d6597c2b7370be47658d2b36a87987578c6e6cc23e6541e8489eb45bdcae1d9f

                                                      SHA512

                                                      c7132aaed454054460a4987b0f2f3772df4a5148d40638e84db1222df3e787a97cbca14833363bec86a94beb0036fe3f5b8330a1bbdc4fd43c9dc4cbea1a50c9

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\AlternateServices.bin

                                                      Filesize

                                                      11KB

                                                      MD5

                                                      6069f514279b6e32e9b21d3030f58cfe

                                                      SHA1

                                                      dc36a0a4f190d257950c8616ab4bbd07617992cc

                                                      SHA256

                                                      c22ec181000f81f96fbf99924a3d1014f47d2bbab3275b6fcde6259b18513e98

                                                      SHA512

                                                      049702450fb0176f004dd6180def565045fbde96eed12106fdee99a79b71792ede2acba3fb8e18c0194ea528bb992259df52123800099d01ef2b1cf59c6860ad

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\datareporting\glean\db\data.safe.tmp

                                                      Filesize

                                                      16KB

                                                      MD5

                                                      3b4edc09168ca828d3208d4a8af1c49a

                                                      SHA1

                                                      b587739ad624b64ff82be72e0edbe68d2c6dcd97

                                                      SHA256

                                                      fcf6030ea82ffc4e82cbc7956b8caba7f24ae4d2736556e8598a5f91bb003ed0

                                                      SHA512

                                                      d6770cdead4a70f05d254cf814c233fa8573ae0c0e3bfd2f3d2610435bac9913ab366fe0290d03df5824d4a58e16a61ae31478f04344585cbba32c78aa8c3a99

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\datareporting\glean\db\data.safe.tmp

                                                      Filesize

                                                      16KB

                                                      MD5

                                                      6cf7237287530dbe0cd0394defd228d5

                                                      SHA1

                                                      ab360e1e6d86f154d03f68ba25cc36d598db4bf4

                                                      SHA256

                                                      098ef4b97a743fe2ffab74ca20056ef02b5fb69480a4a1784c8d84ee24e65a22

                                                      SHA512

                                                      9a4edbbdd7978ffaff481ebedcda3acd79c3aa17da6180c568a885680d598b81b2b7ef886abc5fa18037f9b211571cfc8ffb592af52afd0ff6d8351fa37f7f4b

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\datareporting\glean\db\data.safe.tmp

                                                      Filesize

                                                      5KB

                                                      MD5

                                                      d4e471e2717019960b24c87de3abda3f

                                                      SHA1

                                                      df7319840e077365cae1e6b8a9136696fb17f904

                                                      SHA256

                                                      37ea5170556b22362371f7e16ccdc30b55d24378456771ccc76853b6d789f2f1

                                                      SHA512

                                                      73a69ade8b7d2d5d90ba0ce5ea90a646e34491895070120ecd54bff081d549470003b74467c784a5b94d6e328987d7559ec97a13aab1bfa2155437fb57bfc112

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\datareporting\glean\pending_pings\122b7ce5-58df-4bcb-9ecc-8968f7878cd6

                                                      Filesize

                                                      671B

                                                      MD5

                                                      c058dcdafccee22fe99a54c5b60550bb

                                                      SHA1

                                                      0cfcf52e71b961816c0d9fc3c4df6744c9089b0d

                                                      SHA256

                                                      79e86c55a98067569349dfc05cffc528a36bb87707532762324bfb415990e9b6

                                                      SHA512

                                                      f55764a3d7cec031dcccf972e31e04e3f849e1c59c50512b042beb112d213b48a978abdb4939432e744c479d7b38f837a6bd84d60422c7e000b0835d744935f2

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\datareporting\glean\pending_pings\2bf86c50-67ed-41ef-8c74-e54e1250b240

                                                      Filesize

                                                      27KB

                                                      MD5

                                                      2029f9e1b0ad7ad5a67294710aa48b1a

                                                      SHA1

                                                      a4a50b5b88bc1edd179c9a87cbdff3c72a630098

                                                      SHA256

                                                      88d7b8da31cc3f1f92f6318d3f937dbf9ee016e0c0b3c25560084904195cdd1d

                                                      SHA512

                                                      f8d56f991a3ee2e497a0e94c3f2bf8d8b571293fe02a4155b8040dbf7a93c659bda2581b3ea9243f802df4085bb9ef62ab278bf1b5fd52664cc683f306ba4f86

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\datareporting\glean\pending_pings\7726aadf-08f1-4620-bd6d-f8831a5c1f2b

                                                      Filesize

                                                      982B

                                                      MD5

                                                      4f881965b8ce70c444c7da908fa9902f

                                                      SHA1

                                                      bad834a4d1e28fe86df5981fac236f9a3d73742a

                                                      SHA256

                                                      e437a47cfc8787f10ecc23dbf8be0db57b6ff0dcc41b9a0b0e8897ea6b08ff4d

                                                      SHA512

                                                      2199db969380cb5f045a650c3a883b369eef7b4b46a9c4bbff0465445cf7b47ff1ca8a0b377065a423eb720c693870875c3108c287cdfc5970851bd10a90dae4

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

                                                      Filesize

                                                      1.1MB

                                                      MD5

                                                      842039753bf41fa5e11b3a1383061a87

                                                      SHA1

                                                      3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                                                      SHA256

                                                      d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                                                      SHA512

                                                      d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

                                                      Filesize

                                                      116B

                                                      MD5

                                                      2a461e9eb87fd1955cea740a3444ee7a

                                                      SHA1

                                                      b10755914c713f5a4677494dbe8a686ed458c3c5

                                                      SHA256

                                                      4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                                                      SHA512

                                                      34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

                                                      Filesize

                                                      372B

                                                      MD5

                                                      bf957ad58b55f64219ab3f793e374316

                                                      SHA1

                                                      a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                                                      SHA256

                                                      bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                                                      SHA512

                                                      79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

                                                      Filesize

                                                      17.8MB

                                                      MD5

                                                      daf7ef3acccab478aaa7d6dc1c60f865

                                                      SHA1

                                                      f8246162b97ce4a945feced27b6ea114366ff2ad

                                                      SHA256

                                                      bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                                                      SHA512

                                                      5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\prefs-1.js

                                                      Filesize

                                                      10KB

                                                      MD5

                                                      d8c0d92b57edd81894cda623578a9751

                                                      SHA1

                                                      c5826a1d842e24269de876dadf3bac76c247fe82

                                                      SHA256

                                                      494fdb6385907b9c89cfa41461ae881861348e54992ec71633bae7bf1ad469ee

                                                      SHA512

                                                      b7710b3a443826a279da6079b513a26f26c54b8fda0be6cfda93a49b2c44417dce59e3ac9d1b4ffe7d1a241af4920b020f76949601ee0ba86c5f5fa81c01c28f

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\prefs-1.js

                                                      Filesize

                                                      11KB

                                                      MD5

                                                      b8665258da38ee3465c3129d8f9a82ae

                                                      SHA1

                                                      d0e37e4ae8c4fd49aa57c331c235d205202e6c15

                                                      SHA256

                                                      d728072f1d2d56ae76cbc58df775b9d05eec0b7ca66580616b561202f407b67f

                                                      SHA512

                                                      990d629ed4a497f3558d52d88a21b83f883e68de115de5735504a09a0dfffe381d66a7610addf85d330d9892ec6b1f3266c3fdaf8fa35fce9f123c9e5c1fe7fc

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\prefs-1.js

                                                      Filesize

                                                      12KB

                                                      MD5

                                                      3475957ade0303f77ea2acd1379c5612

                                                      SHA1

                                                      4d041b5a88aa2d84c09af7a5fa42dccc5c3548f8

                                                      SHA256

                                                      dfbf57d9fa6998c1ebfdba54aa86864d9aa3991282ed5460ea6f9f6237b2cfa6

                                                      SHA512

                                                      5851c396ced10369d17a72f3fb098d666e263d4e93ad481c3244781488ad4f136e20d615c98fa8faedd65269680d5e885f79fe0627a2322c2fb1c016c9a1885d

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\prefs.js

                                                      Filesize

                                                      11KB

                                                      MD5

                                                      d8d443dd6a37f10bd2ed41dc646760cf

                                                      SHA1

                                                      53a85d30c03a12b1941d9805a543aecbed02eebb

                                                      SHA256

                                                      765e2ee1bd5407e0424ec5989c61cce68dfb56bcdd643d0d60384013db8903d7

                                                      SHA512

                                                      ea34e5162f65f6503400dd2706186cbf053db5fafcc09c5e1ce17d2cf5bb00b4f2141d9a729c2f2bea76328459af96b458ef91a2f9c2bc5fe9b872e403a8f1f0

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\sessionstore-backups\recovery.baklz4

                                                      Filesize

                                                      1KB

                                                      MD5

                                                      3ffcae2e6717267f14dc91b738f9d225

                                                      SHA1

                                                      84b72bf1a647c2ad3a1d81758a76282936502bc5

                                                      SHA256

                                                      86b2bd28dde495af5b066c4143248d7c19e6d4b85ee5b97b4c592616f089dac9

                                                      SHA512

                                                      228fd84704c72e3345a8fdc8d10a15eabc5eb5d380b7e25307a607b3e6384a2f28e123fd129850c322a556391837cffcccc8d3c9a4497c4d4ca7ca3f7d8cf283

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\sessionstore-backups\recovery.baklz4

                                                      Filesize

                                                      5KB

                                                      MD5

                                                      eedccffcb232ce53c655c8709cbd6b83

                                                      SHA1

                                                      796e65a32aa456af6f2ade9c72694c9949791ccd

                                                      SHA256

                                                      b52a7eea3b6ce6dfafb52d0c6b55601482e0c98ab5177c043dcb311be3a9a71d

                                                      SHA512

                                                      6875ab22747a3d450442b4e1b5b4273f6f9fc25b650d693c9a503359ec3bfb717c5706077b60995aaa6a0653b727370f431bc760feb93901462341c8edae1a94

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

                                                      Filesize

                                                      2.2MB

                                                      MD5

                                                      22a497262015b4a0487ded284ba50069

                                                      SHA1

                                                      1c7a70cdb697cf3f7a8b84f945d73b6d795e4d3e

                                                      SHA256

                                                      e798e27ffe8be322a97e93cd658eee396ef12ab9771ad8cd9ec8099b9a09f75d

                                                      SHA512

                                                      a80aeef3a81ef3fab42adf4e0388ffc0eb695f9954424e0efe9cd595351c939d16ff6cbb52198b5a6113d499e2b5fc570e49e3bd2f47923d925c30587da5baa9

                                                    • \??\pipe\LOCAL\crashpad_4044_WFXRGCBTWTJHVOJY

                                                      MD5

                                                      d41d8cd98f00b204e9800998ecf8427e

                                                      SHA1

                                                      da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                      SHA256

                                                      e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                      SHA512

                                                      cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                    • memory/64-2-0x00000000006D1000-0x00000000006FF000-memory.dmp

                                                      Filesize

                                                      184KB

                                                    • memory/64-4-0x00000000006D0000-0x0000000000B89000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/64-1-0x00000000773E4000-0x00000000773E6000-memory.dmp

                                                      Filesize

                                                      8KB

                                                    • memory/64-0-0x00000000006D0000-0x0000000000B89000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/64-18-0x00000000006D0000-0x0000000000B89000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/64-3-0x00000000006D0000-0x0000000000B89000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/1476-93-0x00000000076A0000-0x0000000007736000-memory.dmp

                                                      Filesize

                                                      600KB

                                                    • memory/1476-89-0x00000000061B0000-0x0000000006504000-memory.dmp

                                                      Filesize

                                                      3.3MB

                                                    • memory/1476-94-0x0000000006AF0000-0x0000000006B0A000-memory.dmp

                                                      Filesize

                                                      104KB

                                                    • memory/1476-75-0x0000000002C60000-0x0000000002C96000-memory.dmp

                                                      Filesize

                                                      216KB

                                                    • memory/1476-91-0x0000000006650000-0x000000000669C000-memory.dmp

                                                      Filesize

                                                      304KB

                                                    • memory/1476-90-0x00000000065A0000-0x00000000065BE000-memory.dmp

                                                      Filesize

                                                      120KB

                                                    • memory/1476-96-0x0000000007CF0000-0x0000000008294000-memory.dmp

                                                      Filesize

                                                      5.6MB

                                                    • memory/1476-95-0x0000000006B90000-0x0000000006BB2000-memory.dmp

                                                      Filesize

                                                      136KB

                                                    • memory/1476-77-0x00000000056F0000-0x0000000005712000-memory.dmp

                                                      Filesize

                                                      136KB

                                                    • memory/1476-76-0x0000000005940000-0x0000000005F68000-memory.dmp

                                                      Filesize

                                                      6.2MB

                                                    • memory/1476-78-0x00000000057A0000-0x0000000005806000-memory.dmp

                                                      Filesize

                                                      408KB

                                                    • memory/1476-79-0x0000000005810000-0x0000000005876000-memory.dmp

                                                      Filesize

                                                      408KB

                                                    • memory/1688-66-0x0000000000710000-0x0000000000D82000-memory.dmp

                                                      Filesize

                                                      6.4MB

                                                    • memory/1688-510-0x0000000000710000-0x0000000000D82000-memory.dmp

                                                      Filesize

                                                      6.4MB

                                                    • memory/1712-24-0x0000000000660000-0x0000000000B19000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/1712-26-0x0000000000660000-0x0000000000B19000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/1712-28-0x0000000000661000-0x000000000068F000-memory.dmp

                                                      Filesize

                                                      184KB

                                                    • memory/1712-29-0x0000000000660000-0x0000000000B19000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/2872-30-0x0000000000660000-0x0000000000B19000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/2872-719-0x0000000000660000-0x0000000000B19000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/2872-782-0x0000000000660000-0x0000000000B19000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/2872-21-0x0000000000660000-0x0000000000B19000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/2872-2561-0x0000000000660000-0x0000000000B19000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/2872-20-0x0000000000660000-0x0000000000B19000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/2872-19-0x0000000000660000-0x0000000000B19000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/2872-2032-0x0000000000660000-0x0000000000B19000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/2872-620-0x0000000000660000-0x0000000000B19000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/2872-871-0x0000000000660000-0x0000000000B19000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/2872-25-0x0000000000660000-0x0000000000B19000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/2872-64-0x0000000000660000-0x0000000000B19000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/2872-31-0x0000000000660000-0x0000000000B19000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/2872-912-0x0000000000660000-0x0000000000B19000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/2872-922-0x0000000000660000-0x0000000000B19000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/2872-17-0x0000000000660000-0x0000000000B19000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/2872-32-0x0000000000660000-0x0000000000B19000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/2872-1223-0x0000000000660000-0x0000000000B19000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/2872-33-0x0000000000660000-0x0000000000B19000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/2872-22-0x0000000000660000-0x0000000000B19000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/2872-1817-0x0000000000660000-0x0000000000B19000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/3148-49-0x0000000000A20000-0x0000000001092000-memory.dmp

                                                      Filesize

                                                      6.4MB

                                                    • memory/3148-67-0x0000000000A20000-0x0000000001092000-memory.dmp

                                                      Filesize

                                                      6.4MB

                                                    • memory/6936-762-0x0000000000660000-0x0000000000B19000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/6936-775-0x0000000000660000-0x0000000000B19000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/7164-2031-0x0000000000660000-0x0000000000B19000-memory.dmp

                                                      Filesize

                                                      4.7MB