Analysis

  • max time kernel
    143s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-09-2024 21:16

General

  • Target

    3a5bba257d06af78b46d980fc2a285026c354056c4cbaaa5a4aa477d96a13712.exe

  • Size

    1.8MB

  • MD5

    260bb7213697b9eab79cfff7cd5bebe1

  • SHA1

    350b664626ee1dcf9fd7bca4cd04a87a4c11adf4

  • SHA256

    3a5bba257d06af78b46d980fc2a285026c354056c4cbaaa5a4aa477d96a13712

  • SHA512

    2d8bb03f5b4ed992902aefa7535add761f74e981791bc9058d30bda43b53f92dc86d6e84e0703add200ba2987aa15de188f9eb493d4c8ecc1058094efbbaed99

  • SSDEEP

    24576:Od3g80i4dff2KOXpXPqQw6hs37gIQmMYhdY5eGFvsG7C7TwbQgYhLe+XEM:OKvfzgp7wEkggMYhEvzswbQgIB9

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

c7817d

C2

http://31.41.244.10

Attributes
  • install_dir

    0e8d0864aa

  • install_file

    svoutse.exe

  • strings_key

    5481b88a6ef75bcf21333988a4e47048

  • url_paths

    /Dem7kTu/index.php

rc4.plain

Extracted

Family

stealc

Botnet

rave

C2

http://185.215.113.103

Attributes
  • url_path

    /e2b1563c6670f193.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Stealc

    Stealc is an infostealer written in C++.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 12 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Identifies Wine through registry keys 2 TTPs 6 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 14 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 31 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 46 IoCs
  • Suspicious use of SendNotifyMessage 44 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\3a5bba257d06af78b46d980fc2a285026c354056c4cbaaa5a4aa477d96a13712.exe
    "C:\Users\Admin\AppData\Local\Temp\3a5bba257d06af78b46d980fc2a285026c354056c4cbaaa5a4aa477d96a13712.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3976
    • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
      "C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3644
      • C:\Users\Admin\AppData\Roaming\1000026000\6eb5ff5e86.exe
        "C:\Users\Admin\AppData\Roaming\1000026000\6eb5ff5e86.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:1648
      • C:\Users\Admin\AppData\Local\Temp\1000030001\053f231eba.exe
        "C:\Users\Admin\AppData\Local\Temp\1000030001\053f231eba.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:1188
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\Admin\AppData\Local\Temp\1000039041\do.ps1"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1152
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /c start msedge https://www.youtube.com/account
          4⤵
          • Checks computer location settings
          • System Location Discovery: System Language Discovery
          PID:2780
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.youtube.com/account
            5⤵
            • Enumerates system info in registry
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            PID:3200
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7fff5c8746f8,0x7fff5c874708,0x7fff5c874718
              6⤵
                PID:3804
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,16638039516643793851,16025883657250897254,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:2
                6⤵
                  PID:6000
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2028,16638039516643793851,16025883657250897254,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 /prefetch:3
                  6⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:6032
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2028,16638039516643793851,16025883657250897254,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2796 /prefetch:8
                  6⤵
                    PID:6076
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,16638039516643793851,16025883657250897254,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
                    6⤵
                      PID:4456
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,16638039516643793851,16025883657250897254,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
                      6⤵
                        PID:1808
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,16638039516643793851,16025883657250897254,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3908 /prefetch:1
                        6⤵
                          PID:5516
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,16638039516643793851,16025883657250897254,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:1
                          6⤵
                            PID:5348
                          • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,16638039516643793851,16025883657250897254,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5352 /prefetch:8
                            6⤵
                              PID:4164
                            • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,16638039516643793851,16025883657250897254,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5352 /prefetch:8
                              6⤵
                              • Suspicious behavior: EnumeratesProcesses
                              PID:1700
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,16638039516643793851,16025883657250897254,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:1
                              6⤵
                                PID:5964
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,16638039516643793851,16025883657250897254,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:1
                                6⤵
                                  PID:1996
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,16638039516643793851,16025883657250897254,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4176 /prefetch:1
                                  6⤵
                                    PID:6324
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,16638039516643793851,16025883657250897254,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5816 /prefetch:1
                                    6⤵
                                      PID:6332
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,16638039516643793851,16025883657250897254,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2220 /prefetch:2
                                      6⤵
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:6672
                                • C:\Windows\SysWOW64\cmd.exe
                                  "C:\Windows\system32\cmd.exe" /c start msedge https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
                                  4⤵
                                  • Checks computer location settings
                                  • System Location Discovery: System Language Discovery
                                  PID:3704
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://accounts.google.com/ServiceLogin?service=accountsettings
                                    5⤵
                                      PID:1016
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7fff5c8746f8,0x7fff5c874708,0x7fff5c874718
                                        6⤵
                                          PID:4600
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,3500442194228025836,5535943886462856965,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
                                          6⤵
                                            PID:6048
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,3500442194228025836,5535943886462856965,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
                                            6⤵
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:6056
                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                        "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
                                        4⤵
                                        • Suspicious use of WriteProcessMemory
                                        PID:1096
                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                          "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
                                          5⤵
                                          • Checks processor information in registry
                                          • Modifies registry class
                                          • Suspicious use of AdjustPrivilegeToken
                                          • Suspicious use of FindShellTrayWindow
                                          • Suspicious use of SendNotifyMessage
                                          • Suspicious use of SetWindowsHookEx
                                          • Suspicious use of WriteProcessMemory
                                          PID:4864
                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1956 -parentBuildID 20240401114208 -prefsHandle 1872 -prefMapHandle 1864 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {361f3db3-f8af-4279-b01e-0a0cb5f3083a} 4864 "\\.\pipe\gecko-crash-server-pipe.4864" gpu
                                            6⤵
                                              PID:1868
                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2432 -parentBuildID 20240401114208 -prefsHandle 2400 -prefMapHandle 2396 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9d027afb-b720-4bdf-bb36-65e48c7d9e08} 4864 "\\.\pipe\gecko-crash-server-pipe.4864" socket
                                              6⤵
                                                PID:2384
                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2704 -childID 1 -isForBrowser -prefsHandle 3280 -prefMapHandle 2976 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {25f3dc05-ee81-4a68-9b7d-2df4aea98596} 4864 "\\.\pipe\gecko-crash-server-pipe.4864" tab
                                                6⤵
                                                  PID:2668
                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3228 -childID 2 -isForBrowser -prefsHandle 3680 -prefMapHandle 3676 -prefsLen 22693 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2cffda46-414d-4e01-90f6-148ae176efda} 4864 "\\.\pipe\gecko-crash-server-pipe.4864" tab
                                                  6⤵
                                                    PID:688
                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4496 -childID 3 -isForBrowser -prefsHandle 4488 -prefMapHandle 4484 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fbaa580b-9895-48fc-8893-e80660683a71} 4864 "\\.\pipe\gecko-crash-server-pipe.4864" tab
                                                    6⤵
                                                      PID:3832
                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5076 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 5084 -prefMapHandle 5068 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d187bbcb-841a-4e7b-af35-7ea4b6f74048} 4864 "\\.\pipe\gecko-crash-server-pipe.4864" utility
                                                      6⤵
                                                      • Checks processor information in registry
                                                      PID:3484
                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5592 -childID 4 -isForBrowser -prefsHandle 5568 -prefMapHandle 5584 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {eee98600-c3ff-4f30-9773-d741880f6618} 4864 "\\.\pipe\gecko-crash-server-pipe.4864" tab
                                                      6⤵
                                                        PID:5892
                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5752 -childID 5 -isForBrowser -prefsHandle 5760 -prefMapHandle 5764 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {79cb04e3-fc5a-4008-a36d-a1bb51baeacd} 4864 "\\.\pipe\gecko-crash-server-pipe.4864" tab
                                                        6⤵
                                                          PID:5360
                                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5944 -childID 6 -isForBrowser -prefsHandle 5952 -prefMapHandle 5956 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {987db807-68a2-45cd-9350-63cb3aec4631} 4864 "\\.\pipe\gecko-crash-server-pipe.4864" tab
                                                          6⤵
                                                            PID:4732
                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
                                                        4⤵
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:1992
                                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                                          "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
                                                          5⤵
                                                          • Checks processor information in registry
                                                          PID:860
                                                • C:\Windows\System32\CompPkgSrv.exe
                                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                  1⤵
                                                    PID:5192
                                                  • C:\Windows\System32\CompPkgSrv.exe
                                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                    1⤵
                                                      PID:5828
                                                    • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                                                      C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                                                      1⤵
                                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                      • Checks BIOS information in registry
                                                      • Executes dropped EXE
                                                      • Identifies Wine through registry keys
                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:5348
                                                    • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                                                      C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                                                      1⤵
                                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                      • Checks BIOS information in registry
                                                      • Executes dropped EXE
                                                      • Identifies Wine through registry keys
                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:6532

                                                    Network

                                                    MITRE ATT&CK Enterprise v15

                                                    Replay Monitor

                                                    Loading Replay Monitor...

                                                    Downloads

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                      Filesize

                                                      152B

                                                      MD5

                                                      111c361619c017b5d09a13a56938bd54

                                                      SHA1

                                                      e02b363a8ceb95751623f25025a9299a2c931e07

                                                      SHA256

                                                      d7be4042a1e3511b0dbf0ab5c493245e4ac314440a4ae0732813db01a21ef8bc

                                                      SHA512

                                                      fc16a4ad0b56899b82d05114d7b0ca8ee610cdba6ff0b6a67dea44faf17b3105109335359b78c0a59c9011a13152744a7f5d4f6a5b66ea519df750ef03f622b2

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                      Filesize

                                                      152B

                                                      MD5

                                                      983cbc1f706a155d63496ebc4d66515e

                                                      SHA1

                                                      223d0071718b80cad9239e58c5e8e64df6e2a2fe

                                                      SHA256

                                                      cc34b8f8e3f4bfe4c9a227d88f56ea2dd276ca3ac81df622ff5e9a8ec46b951c

                                                      SHA512

                                                      d9cf2ca46d9379902730c81e615a3eb694873ffd535c6bb3ded2dc97cdbbfb71051ab11a07754ed6f610f04285605b702b5a48a6cfda3ee3287230c41c9c45cd

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                      Filesize

                                                      528B

                                                      MD5

                                                      1dd5ee10f083a1246fa464187473d6e4

                                                      SHA1

                                                      1e963ed0b358b70d0dd26bf03ed64e8726dde4e4

                                                      SHA256

                                                      52c970babb871cad4370156be576d656c6e9f02e3caa4bd8b6e524ee4c0a851d

                                                      SHA512

                                                      71f38a3f2f856353a115474e413c97cf37f6664d8c755c3a00b5d18fd056bac4df25ba994218b05d68ee4297f322f9d0cc7f33d6d15b458b61b5f5c66daaea78

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                      Filesize

                                                      1KB

                                                      MD5

                                                      f7b34ab905f6d1d2a7a45bb832e9f42c

                                                      SHA1

                                                      c84bffc0ea1eddec6697ac3bf14a8997245cff42

                                                      SHA256

                                                      06455dc23242817419cfd21a29a1fc8c4cad273593fb77f372756eb6fdf0aca7

                                                      SHA512

                                                      20fcd88200b9eaea3f22130d49a9afc38f87074bed205276f176ce6461c83fe31119f256d09a3e9760b1d5d0a6116e8e90f1ee533a23063e6ad4a00b93edffa7

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                      Filesize

                                                      1KB

                                                      MD5

                                                      4f3b85ad0bda26134006debd80117cd0

                                                      SHA1

                                                      a387610866ca12334d6229f4d0659ba0f686f512

                                                      SHA256

                                                      ff8b9c4d725e34b3b2236c1d6722170f4cc63a1e83323449b39a43561b2cd69a

                                                      SHA512

                                                      c52613fc81098a891a8d3174ecb937ed77fe105fe1542dce1e6f1e0985a8729e328693a89392bea5b834034b6ec6dab8622748a66aa130b0511dd10a817849ef

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                      Filesize

                                                      7KB

                                                      MD5

                                                      a714a25215e63b9d2076e0227ed617fe

                                                      SHA1

                                                      839120f299531ada7a40610c40db47d2286ec03d

                                                      SHA256

                                                      33d739772de34f051b64ea84ce6f584c46113ec8f1e0f0448dc90629bcbe9a21

                                                      SHA512

                                                      a4e1ddfbda95a4174b5aa5329b1d577528e071ebc1db53ef07690afdf55be002b4c4f8797287cd8b54b88252dc06880c1fbd6f4fc17d10bff3d3b11201aba64b

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                      Filesize

                                                      5KB

                                                      MD5

                                                      eb4e1b49c98f5223099ffaaa70421132

                                                      SHA1

                                                      bf1e4dfe793d0c3acba5e097010ee5f5530fe4b7

                                                      SHA256

                                                      72d76d10a63c5ef4d622b427605b112f09925b6906158e90f42a413a11f38360

                                                      SHA512

                                                      f011f5c5456248ee98b587e53411c61d172de9d7b75e21dcdfaa470bbc0a78a8aec3b9ac15d78cc42fc616f8690aa637e9bf8baf936d30949922baca80351cd0

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                      Filesize

                                                      535B

                                                      MD5

                                                      d7e1c3aea099309c0e37b3556093887f

                                                      SHA1

                                                      908d4940958ce1f81fa407750e5fec289969d082

                                                      SHA256

                                                      e4083584b0f2be89eb7730a2620595b002a336021ec611a58dc5f28673dcdc95

                                                      SHA512

                                                      27140faa14ab1f854b08950fc00a41f3e8c52dc2907220998808140e510a274d442eeb585314e613fe919da0794775e9d73f7531a47194b0200ebc813cbd701d

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                      Filesize

                                                      535B

                                                      MD5

                                                      d017b50bb9a761c5398e01b5f256f6ef

                                                      SHA1

                                                      dbe17c510d13a4daf1d4a4565cc224226c74e8fb

                                                      SHA256

                                                      dd818710ed5667fe477e2bdfeb8dc4da20169effc1d0e785d564cda4e526ad69

                                                      SHA512

                                                      acd2b94e71bab6729a4f04967c65b79857f1a8842f53cec052e4ce014f95879700601a93be778664fbe6708cadec64d96cff79d60d9faacf0dffc3f78bbae67b

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5906ad.TMP

                                                      Filesize

                                                      537B

                                                      MD5

                                                      5929a6f863773c5324a8fde09a3eb969

                                                      SHA1

                                                      6b2bf60dca7218926e51976639b9b642dae6b7a2

                                                      SHA256

                                                      8e78addf76ecf14629137ef62769a8a555e7ebc7d36aef9277186495130b9f5b

                                                      SHA512

                                                      61fc6014272edece9cb5a65f9d7ed8ac299c14dba6521aaf14eb1bbc5e86124c4036ccd0ac848875a25e229cdf1641a9003bb12fded87cc5e77b059cbd6c772f

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                      Filesize

                                                      16B

                                                      MD5

                                                      6752a1d65b201c13b62ea44016eb221f

                                                      SHA1

                                                      58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                      SHA256

                                                      0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                      SHA512

                                                      9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                      Filesize

                                                      8KB

                                                      MD5

                                                      128e5234a2f64554d5909303b1a18a7b

                                                      SHA1

                                                      04df3f78a8a1358f8dcd71e29179b127727274bb

                                                      SHA256

                                                      3a862736b0565a155054a3cf1153347f7110b2ee9dabb40fca8b35fd6ad61d7f

                                                      SHA512

                                                      a926e5bc871898ee43fa222a50335b4d9a820fa7a714d715d5ae1793f196dfccf96cb4e18d588c0bd275fe73d1f7199b8ade4f3160a1d974136978d3766e95e9

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                      Filesize

                                                      10KB

                                                      MD5

                                                      163aca5d77bf6b48053d04a4d76db0cd

                                                      SHA1

                                                      b695684b1335552f44e05edb9eea8d751e552458

                                                      SHA256

                                                      0ea74bc275c9e33414db74c7af4da8a3204e3490dd01d26bf5f1e50657e5d1b9

                                                      SHA512

                                                      ed13d480d9d7d9c6b96ef7e15f814691ebd1c158ebcacea86ffa693f011f62b8ae3bdf0bb8463f0f017277ae6c149c32eaaa83e129f6f6f748f4042af299a96a

                                                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zrrtvxky.default-release\cache2\entries\58EFA56DB4BFFECB0EDA547894BC9A057159E22F

                                                      Filesize

                                                      13KB

                                                      MD5

                                                      b036f12dde74bc8761debbede3ae5c3c

                                                      SHA1

                                                      14f6a661c1043f1e34d0e06d9ce3123e7bebe230

                                                      SHA256

                                                      255460fbf8efa6eb972d1d3b98c0642d1c9293a3dfb6fa7fd573a72381ca7a79

                                                      SHA512

                                                      09ab530cff5f6777f472d66af8b246480a8e88f107590fc680cd19328ee58c53bf6c49e2c89aea620f1726cc0901f1c6b911f4eef31a1e2d0135f157acf8b562

                                                    • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe

                                                      Filesize

                                                      1.8MB

                                                      MD5

                                                      260bb7213697b9eab79cfff7cd5bebe1

                                                      SHA1

                                                      350b664626ee1dcf9fd7bca4cd04a87a4c11adf4

                                                      SHA256

                                                      3a5bba257d06af78b46d980fc2a285026c354056c4cbaaa5a4aa477d96a13712

                                                      SHA512

                                                      2d8bb03f5b4ed992902aefa7535add761f74e981791bc9058d30bda43b53f92dc86d6e84e0703add200ba2987aa15de188f9eb493d4c8ecc1058094efbbaed99

                                                    • C:\Users\Admin\AppData\Local\Temp\1000039041\do.ps1

                                                      Filesize

                                                      2KB

                                                      MD5

                                                      e05e8f072b373beafe27cc11d85f947c

                                                      SHA1

                                                      1d6daeb98893e8122b8b69287ebd9d43f3c6138e

                                                      SHA256

                                                      717c09427fa5754ba92f92961545534048d0a76528c2e95c4d5ec6cef47c612f

                                                      SHA512

                                                      b3e34162e5ee43bb01f289eebc45fd3ea3e07f30be40dcf6635606540f912fe5c84d301e9f78e97dfe3ffe53e72547e50f3bcd7d4ebe5ab8da451a1989c469a0

                                                    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zkueobnw.uek.ps1

                                                      Filesize

                                                      60B

                                                      MD5

                                                      d17fe0a3f47be24a6453e9ef58c94641

                                                      SHA1

                                                      6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                      SHA256

                                                      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                      SHA512

                                                      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                    • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                                                      Filesize

                                                      479KB

                                                      MD5

                                                      09372174e83dbbf696ee732fd2e875bb

                                                      SHA1

                                                      ba360186ba650a769f9303f48b7200fb5eaccee1

                                                      SHA256

                                                      c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                                                      SHA512

                                                      b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                                                    • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                                                      Filesize

                                                      13.8MB

                                                      MD5

                                                      0a8747a2ac9ac08ae9508f36c6d75692

                                                      SHA1

                                                      b287a96fd6cc12433adb42193dfe06111c38eaf0

                                                      SHA256

                                                      32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                                                      SHA512

                                                      59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                                                    • C:\Users\Admin\AppData\Roaming\1000026000\6eb5ff5e86.exe

                                                      Filesize

                                                      1.7MB

                                                      MD5

                                                      ac12bb478b2ae055df15787d43a8dd61

                                                      SHA1

                                                      78b92499be7174aff470707436ee99eb5e1306f1

                                                      SHA256

                                                      7c4160768d4c205ed30a845b211a04a53f870d55ab8276f0c6de420a0345025c

                                                      SHA512

                                                      22b786889143f6886972ba6dad0d8617ef8f54536db514dfc5d9de8c74c22b7429fd0b4feea31fed1d928db46752d64615e94d56b856c1681dccc52f2f8e4aca

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\AlternateServices.bin

                                                      Filesize

                                                      6KB

                                                      MD5

                                                      3ca1c7e1475917a62d6cd04d5a58f7a5

                                                      SHA1

                                                      40cb1976f110360bb8245ba169b34cdaffc8117b

                                                      SHA256

                                                      04a490c774174484bf38dbb5ff47ac99e54b1575c7c4ef035558f32f94bb3da7

                                                      SHA512

                                                      b18cb83ad69f3f8e9ed4259b695ecd39de21b39a3014d293e93d1cce6d67109633e3b7198cfb52694416ecf64e7d239783df9f80e38784725c1edd0c95b9d6c6

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\AlternateServices.bin

                                                      Filesize

                                                      25KB

                                                      MD5

                                                      cd46a25a8ad570b7c441be983919b6d0

                                                      SHA1

                                                      7400025433e401404fe5c44d39311edbcbd984b6

                                                      SHA256

                                                      812bd94238da6606d0a19d83e12ef7e2e89406b64ddb71ae738defe55d243506

                                                      SHA512

                                                      a381e1b19bdd54149fe757d1156539610e36afe8a6a7e0d7e1acf1ba38091ad07b60dd5a6fa2420b5e0a1b83d6ca2a10dd1937128d9ce29b68dd223c6463d043

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\AlternateServices.bin

                                                      Filesize

                                                      8KB

                                                      MD5

                                                      62bd8a062c2eba9ae9e4c80fc4125603

                                                      SHA1

                                                      7b5886dd828510f60b2a7a0176bf9d9c0aad261d

                                                      SHA256

                                                      5e88d088ce5dacfed5e2d65a87d51b1587cfb09cb5365e746d44b15928f94b14

                                                      SHA512

                                                      973de4cb7919d3068f1b6b915ec8b0ce86e9f953fb11bce30276dcaae504d814ad7d99728f92994bcd374c8d5508a374224eb5f4f5a44b6fe38bc5c547748c72

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\AlternateServices.bin

                                                      Filesize

                                                      12KB

                                                      MD5

                                                      872cd8d4a7bdad30660d6dc8b69ea2e8

                                                      SHA1

                                                      510aecb72a0022a4efef7d166c6d9e4f5f9d72d3

                                                      SHA256

                                                      6f5e13041f10573377da742f9bb9416d792704439c3a3763d4ebea058bfe077b

                                                      SHA512

                                                      1eee08322604d6b7bf555a509dde6623c30e0d15ab37ce2ed5ef563d5f0cd4856784edee6fbe1de31ae050b12a62c4c3de9e27532ccd0e32b10e5feed8ff8fbe

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\AlternateServices.bin

                                                      Filesize

                                                      20KB

                                                      MD5

                                                      6a9ae39b4b8e2b9bfef21610ae39f1b0

                                                      SHA1

                                                      c8390085af77abbfd00ae54e4e1fe111dff42fe3

                                                      SHA256

                                                      c059f3377dffea48efd75160a92f57d2f30b4aace7a304b52915471ff0910e52

                                                      SHA512

                                                      8c37aae6a850fbeb3e7f3b0eacd37fccfaf5b88979ff17c0765e7cf781e9894fe1a456a4d743bd30b746c0cd53faa8770dae432848ac3babb4fb9738a4f22263

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\AlternateServices.bin

                                                      Filesize

                                                      23KB

                                                      MD5

                                                      add89a86a48b11acdc9c896145032aa2

                                                      SHA1

                                                      3c35fc13fe9107b2a7845afda434e60090c0d818

                                                      SHA256

                                                      62f86e01d6dc639c95a6343a3adf076f14e9a501bb7e551548e04da945d000d5

                                                      SHA512

                                                      4997612acf02ebeae0a2af490fb268f0083c401d2cf820eb9fa6684f80eaf99b61fe18ebb16f2ce18d44792ee112db2f237e3b724f17bad5747c3641a39009b2

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\datareporting\glean\db\data.safe.tmp

                                                      Filesize

                                                      5KB

                                                      MD5

                                                      642fef074cd98e5f3f5fb8c0c8ee28f8

                                                      SHA1

                                                      4637417070aaadcc5c5ff29485b9bbd6e8dce9c9

                                                      SHA256

                                                      3247ba1c6ec428a20c5cf718bb30821f36e1126a779329341f9fcdb7b07e420f

                                                      SHA512

                                                      cda011565f08854bcfc4b7c886746eafcf6448d2d356d2ee8516284e12b30ba980afb326123fe9277cbc4fb1753371a0f7d16fe7c6cacf44ed8fc9330efa8de8

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\datareporting\glean\db\data.safe.tmp

                                                      Filesize

                                                      6KB

                                                      MD5

                                                      4c2f2d2b28db90385587305d3de31755

                                                      SHA1

                                                      2c7240879648dffeb5b76b0c0823e3539809b0a9

                                                      SHA256

                                                      9fd79c97df10e14c425a1bc6ea2d663ed5e448997b94a03b6a1a41c1fccfade1

                                                      SHA512

                                                      08bb136925e44950fde403e9b032d809295a428496ccc6f3f4fa4d290cacc9cebe80648d585009140faf581e9597cfe34d5c88eee6bffcdebaeb5f66b18f6752

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\datareporting\glean\db\data.safe.tmp

                                                      Filesize

                                                      3KB

                                                      MD5

                                                      607e1996d22a815c9738ba5ad7381049

                                                      SHA1

                                                      f6d5515b8c9409a4aa317b42ac34432848a88169

                                                      SHA256

                                                      d08a048c436b8d55978957b1e4628e0b11f81b75593791ddfa6d95503225c0c3

                                                      SHA512

                                                      839672e60711ac10300809b8126753c71ca7aae8a85b226c127634ac69058988f9d426100558cb1f76fd759bbc8b2b0b61ccffd48591909d3b3f3a3a5d8018e4

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\datareporting\glean\db\data.safe.tmp

                                                      Filesize

                                                      15KB

                                                      MD5

                                                      e27c7be941361616a4e8090e57f317a5

                                                      SHA1

                                                      3edb097758e29fc149cde6078e6509d36313c7cf

                                                      SHA256

                                                      a05fb840dd7fd7498f1a13100f7ca102cdf386de931d50dd6338868cab54f0f7

                                                      SHA512

                                                      8f821baac7582de26a461e95c8384ee78e561a34660d4542508eff0997be57ac2d3ba745828fb27132dc1ca4c09b78712264cbacb7aeb821e4d7ae23c026986a

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\datareporting\glean\db\data.safe.tmp

                                                      Filesize

                                                      15KB

                                                      MD5

                                                      c900251827328d8a4862095326afb559

                                                      SHA1

                                                      f458d7a1d3540e3c76e80d75e52cf952117faf54

                                                      SHA256

                                                      986837d2b364f7ce71082ee9ce07d1fa7efa06bda9228124d7d0124cec1ef299

                                                      SHA512

                                                      e6023faeea5314309052c2b497367ea0b2301bd7cb0c878f30fa0902d62060b9bac6e05c1b5fd3c49d0e052ef4e34fe7e6a5f0538d6f66d0993d8e8dfdd71039

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\datareporting\glean\pending_pings\4b017bcd-9759-443a-8e0f-949d6f96435d

                                                      Filesize

                                                      25KB

                                                      MD5

                                                      18242f5a179a1a91d3f27d2eeaf80226

                                                      SHA1

                                                      9f87479f3672f82bb70dbfa18d0bb4807c74332b

                                                      SHA256

                                                      0ed5994ac495395e4a681d89d031367b517495d250066a07568d2f2e106acf5f

                                                      SHA512

                                                      2d2cf688305cb13cd6d51337931eda00cad91f5ecf91f1e39f8457cd95da33887588db89d1a625c6ada85b5ba4df675494b3802f53ad9b367eff2c6cb12f1829

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\datareporting\glean\pending_pings\d1a78dee-46de-4ae3-9309-78f495367780

                                                      Filesize

                                                      671B

                                                      MD5

                                                      5421be46d5c3bbcabce4d1a267d5b0ca

                                                      SHA1

                                                      beab05446ea57063dd932f683fe952f6074832ca

                                                      SHA256

                                                      a84ac0103daa3f1347ca83c2cb5bf6e4e4e3182b4a8e87ad455f2245248a907c

                                                      SHA512

                                                      38df61ecd47be86a48f84264f8d8687e8b314a26f0f57adb6f10049522509d8a5b1aa52cb01959c42729a00995bc3daeb123d79ffd2d9628ed8f5dcdd4b1e714

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\datareporting\glean\pending_pings\e59617dd-b71c-4de1-9297-c1fc81e62410

                                                      Filesize

                                                      982B

                                                      MD5

                                                      e53894ce02b0c5677e58e4fa17b8b00b

                                                      SHA1

                                                      93ae8ba8af66b3045c4992bc03b2e1d97e15907b

                                                      SHA256

                                                      40ba92db16e7b76f7d5eccfddfcfaf9fdada61d7413cd39a66d7d4d6961d0a12

                                                      SHA512

                                                      358b83b4c4ca97eb080b5496341e91626b009b42beafa53ec1e0cd2ea5b16183a646c335e8b3dc3d39001cede4933fce9a6d0d49fd5db5bb58ca04ddc63f41f4

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

                                                      Filesize

                                                      1.1MB

                                                      MD5

                                                      842039753bf41fa5e11b3a1383061a87

                                                      SHA1

                                                      3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                                                      SHA256

                                                      d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                                                      SHA512

                                                      d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

                                                      Filesize

                                                      116B

                                                      MD5

                                                      2a461e9eb87fd1955cea740a3444ee7a

                                                      SHA1

                                                      b10755914c713f5a4677494dbe8a686ed458c3c5

                                                      SHA256

                                                      4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                                                      SHA512

                                                      34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

                                                      Filesize

                                                      372B

                                                      MD5

                                                      bf957ad58b55f64219ab3f793e374316

                                                      SHA1

                                                      a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                                                      SHA256

                                                      bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                                                      SHA512

                                                      79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

                                                      Filesize

                                                      17.8MB

                                                      MD5

                                                      daf7ef3acccab478aaa7d6dc1c60f865

                                                      SHA1

                                                      f8246162b97ce4a945feced27b6ea114366ff2ad

                                                      SHA256

                                                      bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                                                      SHA512

                                                      5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\prefs-1.js

                                                      Filesize

                                                      11KB

                                                      MD5

                                                      a4c0523c4cb47c933fc7de2805c3a4cf

                                                      SHA1

                                                      585245a3224a39482ea5524dfa1d9eb9d42aa782

                                                      SHA256

                                                      b24df93be100b131cfdf28d1a2c206d8ef46250260ebb2d3e67aa0e260c702e5

                                                      SHA512

                                                      216c4d076ec25680cacf787e69a883eb3893dd5b274cfae5c74da23234405087befd07faae51889e1856c9ef5c8fa956ec2c4b89829bdae71f5dc5af21a4130e

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\prefs-1.js

                                                      Filesize

                                                      12KB

                                                      MD5

                                                      e641f3b225b89ae91e9d72f24177e946

                                                      SHA1

                                                      69610ac4bf3abaf60588b8d5c1ac1614d7f94131

                                                      SHA256

                                                      875fa60bbd79f1b8cafdb2d0852eba369c789d5865718e164eee5e777f5ada9a

                                                      SHA512

                                                      d74c445d6bc141440e935458067944c0d8560b2fe6fd8a2d7de622f3fb5c712df639378de237466ca7d81475dccc39add3b11aa1b8df684b0422fa38881759ac

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\prefs-1.js

                                                      Filesize

                                                      16KB

                                                      MD5

                                                      027c3d7ebd701aac41a498ecf6c0bdb6

                                                      SHA1

                                                      c4b5ba576279e55aeaf098ccd443eb2e9e62c841

                                                      SHA256

                                                      b9bd51156a2b94f697babe3804fa63d0bf19d843c013dee3a1dffacaa2d49a93

                                                      SHA512

                                                      b2a3045331b26c96785a17cb3f879496f0ff1cd2fcf9c8bb7acf64770425217694bec9d877b0d617fc2851300e4e2166db55320a8eb7ecd92473a7593f61c896

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\prefs.js

                                                      Filesize

                                                      11KB

                                                      MD5

                                                      fb8460ba5960f2ae218340f1fa6a6b0f

                                                      SHA1

                                                      74c11170984433ee9de40799fbb53357b349a086

                                                      SHA256

                                                      ea60467a94f0ab7592a10f232772f4005c92b7fa2056a82288107525d4cca02c

                                                      SHA512

                                                      8941a0e94047b5ba0b4bd80bfd49333a6dcbd42b1bdd295577eff17804b7aa8c2366cf60005f7b865fa01c88972d20f41be75d3ad3f608daa10d095d208dcf50

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\sessionstore-backups\recovery.baklz4

                                                      Filesize

                                                      1KB

                                                      MD5

                                                      cfd60873d851ee2520d1fcdd879b0a0e

                                                      SHA1

                                                      5a745eb4bc682e6195f3f3e8eb06cce4a6476409

                                                      SHA256

                                                      084b1f467fbb263c189f7dc6d155077d921eb331f219250ee1f87afafe0fc796

                                                      SHA512

                                                      5c10ff72e93d273b80ea1fdf41c66172f665368fe580408df93f11198dd0b33e4a5062df5d2bcae771479c50ce651ec3de1f3fc5be043f0b5006518148e68f7f

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\sessionstore-backups\recovery.baklz4

                                                      Filesize

                                                      5KB

                                                      MD5

                                                      b172ac718a0bf2464754594c9dfffe44

                                                      SHA1

                                                      32e0700d0ffa9de7e971091c2327833e5328e3e5

                                                      SHA256

                                                      98d0735c163260fdcd1782cc48619fcf25fd935bde4d65e8efc9f8425ce8a651

                                                      SHA512

                                                      8c7db529513adbfd237f806c001a1ebb1abce3522a3a1c6eb31617b75f4d4513dd8fae26e0a684330de5052d4f958b9d0543bc200455d1f2177566359d63911d

                                                    • \??\pipe\LOCAL\crashpad_3200_SKWVYYMKXMJIZNUU

                                                      MD5

                                                      d41d8cd98f00b204e9800998ecf8427e

                                                      SHA1

                                                      da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                      SHA256

                                                      e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                      SHA512

                                                      cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                    • memory/1152-71-0x0000000005BA0000-0x0000000005C06000-memory.dmp

                                                      Filesize

                                                      408KB

                                                    • memory/1152-90-0x0000000007B00000-0x00000000080A4000-memory.dmp

                                                      Filesize

                                                      5.6MB

                                                    • memory/1152-84-0x00000000062D0000-0x000000000631C000-memory.dmp

                                                      Filesize

                                                      304KB

                                                    • memory/1152-82-0x0000000005D80000-0x00000000060D4000-memory.dmp

                                                      Filesize

                                                      3.3MB

                                                    • memory/1152-87-0x0000000007290000-0x0000000007326000-memory.dmp

                                                      Filesize

                                                      600KB

                                                    • memory/1152-88-0x00000000067B0000-0x00000000067CA000-memory.dmp

                                                      Filesize

                                                      104KB

                                                    • memory/1152-89-0x0000000006810000-0x0000000006832000-memory.dmp

                                                      Filesize

                                                      136KB

                                                    • memory/1152-72-0x0000000005C10000-0x0000000005C76000-memory.dmp

                                                      Filesize

                                                      408KB

                                                    • memory/1152-70-0x0000000005B00000-0x0000000005B22000-memory.dmp

                                                      Filesize

                                                      136KB

                                                    • memory/1152-83-0x0000000006230000-0x000000000624E000-memory.dmp

                                                      Filesize

                                                      120KB

                                                    • memory/1152-67-0x00000000053D0000-0x00000000059F8000-memory.dmp

                                                      Filesize

                                                      6.2MB

                                                    • memory/1152-66-0x0000000002970000-0x00000000029A6000-memory.dmp

                                                      Filesize

                                                      216KB

                                                    • memory/1188-69-0x0000000000690000-0x0000000000D02000-memory.dmp

                                                      Filesize

                                                      6.4MB

                                                    • memory/1188-56-0x0000000000690000-0x0000000000D02000-memory.dmp

                                                      Filesize

                                                      6.4MB

                                                    • memory/1648-38-0x0000000000820000-0x0000000000E92000-memory.dmp

                                                      Filesize

                                                      6.4MB

                                                    • memory/1648-58-0x0000000000820000-0x0000000000E92000-memory.dmp

                                                      Filesize

                                                      6.4MB

                                                    • memory/1648-48-0x0000000000820000-0x0000000000E92000-memory.dmp

                                                      Filesize

                                                      6.4MB

                                                    • memory/1648-47-0x0000000000821000-0x0000000000835000-memory.dmp

                                                      Filesize

                                                      80KB

                                                    • memory/3644-22-0x00000000001E0000-0x00000000006A2000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                    • memory/3644-3608-0x00000000001E0000-0x00000000006A2000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                    • memory/3644-102-0x00000000001E0000-0x00000000006A2000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                    • memory/3644-785-0x00000000001E0000-0x00000000006A2000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                    • memory/3644-21-0x00000000001E0000-0x00000000006A2000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                    • memory/3644-20-0x00000000001E0000-0x00000000006A2000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                    • memory/3644-3686-0x00000000001E0000-0x00000000006A2000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                    • memory/3644-488-0x00000000001E0000-0x00000000006A2000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                    • memory/3644-19-0x00000000001E0000-0x00000000006A2000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                    • memory/3644-367-0x00000000001E0000-0x00000000006A2000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                    • memory/3644-86-0x00000000001E0000-0x00000000006A2000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                    • memory/3644-2780-0x00000000001E0000-0x00000000006A2000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                    • memory/3644-3669-0x00000000001E0000-0x00000000006A2000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                    • memory/3644-3660-0x00000000001E0000-0x00000000006A2000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                    • memory/3644-3596-0x00000000001E0000-0x00000000006A2000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                    • memory/3644-650-0x00000000001E0000-0x00000000006A2000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                    • memory/3644-3620-0x00000000001E0000-0x00000000006A2000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                    • memory/3644-18-0x00000000001E0000-0x00000000006A2000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                    • memory/3644-3659-0x00000000001E0000-0x00000000006A2000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                    • memory/3644-3656-0x00000000001E0000-0x00000000006A2000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                    • memory/3644-3655-0x00000000001E0000-0x00000000006A2000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                    • memory/3644-3654-0x00000000001E0000-0x00000000006A2000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                    • memory/3976-3-0x0000000000320000-0x00000000007E2000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                    • memory/3976-5-0x0000000000320000-0x00000000007E2000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                    • memory/3976-17-0x0000000000320000-0x00000000007E2000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                    • memory/3976-2-0x0000000000321000-0x000000000034F000-memory.dmp

                                                      Filesize

                                                      184KB

                                                    • memory/3976-0-0x0000000000320000-0x00000000007E2000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                    • memory/3976-1-0x0000000077604000-0x0000000077606000-memory.dmp

                                                      Filesize

                                                      8KB

                                                    • memory/5348-3325-0x00000000001E0000-0x00000000006A2000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                    • memory/5348-3270-0x00000000001E0000-0x00000000006A2000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                    • memory/6532-3658-0x00000000001E0000-0x00000000006A2000-memory.dmp

                                                      Filesize

                                                      4.8MB