Analysis

  • max time kernel
    147s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-09-2024 22:10

General

  • Target

    e72c30dd2fef80237f6eee270269656dc0e2a525ae38c2df8fc95f77334f9e0d.exe

  • Size

    1.8MB

  • MD5

    7f8b4777a6921d7fe085191955d8f9e8

  • SHA1

    0157193e769423cc5073c6e0f48b2cd879c06497

  • SHA256

    e72c30dd2fef80237f6eee270269656dc0e2a525ae38c2df8fc95f77334f9e0d

  • SHA512

    1d9fae6f2289e3b4818d718d45860dbca8bbfd577ef9a082336be43782a280a54bd2ca038753ce19b1ea7cc9e2f56d3b3cd30aeda1a550cd06cddb071cf73964

  • SSDEEP

    49152:Xe/kzuTmV8R34t+ZJG/Kh/NKwDK3KFZa6UlHLQNJ:6kuzWQXX/NKD3ckG

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

c7817d

C2

http://31.41.244.10

Attributes
  • install_dir

    0e8d0864aa

  • install_file

    svoutse.exe

  • strings_key

    5481b88a6ef75bcf21333988a4e47048

  • url_paths

    /Dem7kTu/index.php

rc4.plain

Extracted

Family

stealc

Botnet

rave

C2

http://185.215.113.103

Attributes
  • url_path

    /e2b1563c6670f193.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Stealc

    Stealc is an infostealer written in C++.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 14 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 6 IoCs
  • Identifies Wine through registry keys 2 TTPs 7 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 14 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 29 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 47 IoCs
  • Suspicious use of SendNotifyMessage 44 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\e72c30dd2fef80237f6eee270269656dc0e2a525ae38c2df8fc95f77334f9e0d.exe
    "C:\Users\Admin\AppData\Local\Temp\e72c30dd2fef80237f6eee270269656dc0e2a525ae38c2df8fc95f77334f9e0d.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:4244
    • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
      "C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4432
      • C:\Users\Admin\AppData\Roaming\1000026000\ff7f5d0903.exe
        "C:\Users\Admin\AppData\Roaming\1000026000\ff7f5d0903.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:4776
      • C:\Users\Admin\AppData\Local\Temp\1000030001\26935f8e78.exe
        "C:\Users\Admin\AppData\Local\Temp\1000030001\26935f8e78.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:5060
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\Admin\AppData\Local\Temp\1000039041\do.ps1"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4308
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /c start msedge https://www.youtube.com/account
          4⤵
          • Checks computer location settings
          • System Location Discovery: System Language Discovery
          PID:720
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.youtube.com/account
            5⤵
              PID:3324
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fff42d746f8,0x7fff42d74708,0x7fff42d74718
                6⤵
                  PID:2696
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1940,7951260034246629184,14094744811415041104,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1952 /prefetch:2
                  6⤵
                    PID:5184
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1940,7951260034246629184,14094744811415041104,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2392 /prefetch:3
                    6⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:5196
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\system32\cmd.exe" /c start msedge https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
                4⤵
                • Checks computer location settings
                • System Location Discovery: System Language Discovery
                PID:1620
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://accounts.google.com/ServiceLogin?service=accountsettings
                  5⤵
                  • Enumerates system info in registry
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  PID:2704
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7fff42d746f8,0x7fff42d74708,0x7fff42d74718
                    6⤵
                      PID:4400
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2224,9305568260227832905,12381671371592165643,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2236 /prefetch:2
                      6⤵
                        PID:5140
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2224,9305568260227832905,12381671371592165643,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:3
                        6⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:5148
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2224,9305568260227832905,12381671371592165643,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2696 /prefetch:8
                        6⤵
                          PID:5176
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,9305568260227832905,12381671371592165643,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
                          6⤵
                            PID:5392
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,9305568260227832905,12381671371592165643,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
                            6⤵
                              PID:5400
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,9305568260227832905,12381671371592165643,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3928 /prefetch:1
                              6⤵
                                PID:3936
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,9305568260227832905,12381671371592165643,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4080 /prefetch:1
                                6⤵
                                  PID:6136
                                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2224,9305568260227832905,12381671371592165643,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5428 /prefetch:8
                                  6⤵
                                    PID:1572
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2224,9305568260227832905,12381671371592165643,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5428 /prefetch:8
                                    6⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:5192
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,9305568260227832905,12381671371592165643,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:1
                                    6⤵
                                      PID:5396
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,9305568260227832905,12381671371592165643,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:1
                                      6⤵
                                        PID:5496
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,9305568260227832905,12381671371592165643,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
                                        6⤵
                                          PID:6392
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,9305568260227832905,12381671371592165643,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
                                          6⤵
                                            PID:6400
                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                        "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
                                        4⤵
                                        • Suspicious use of WriteProcessMemory
                                        PID:2368
                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                          "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
                                          5⤵
                                          • Checks processor information in registry
                                          • Modifies registry class
                                          • Suspicious use of AdjustPrivilegeToken
                                          • Suspicious use of FindShellTrayWindow
                                          • Suspicious use of SendNotifyMessage
                                          • Suspicious use of SetWindowsHookEx
                                          • Suspicious use of WriteProcessMemory
                                          PID:4852
                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1968 -parentBuildID 20240401114208 -prefsHandle 1888 -prefMapHandle 1880 -prefsLen 23602 -prefMapSize 244628 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9ceb39f7-1732-4ac8-8f96-2813435f4cff} 4852 "\\.\pipe\gecko-crash-server-pipe.4852" gpu
                                            6⤵
                                              PID:1744
                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2452 -parentBuildID 20240401114208 -prefsHandle 2428 -prefMapHandle 2424 -prefsLen 24522 -prefMapSize 244628 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ab87b7d2-29b0-465b-934b-11ae93f19810} 4852 "\\.\pipe\gecko-crash-server-pipe.4852" socket
                                              6⤵
                                                PID:1196
                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3184 -childID 1 -isForBrowser -prefsHandle 3568 -prefMapHandle 3564 -prefsLen 22590 -prefMapSize 244628 -jsInitHandle 1280 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f694fce4-00bb-41d8-b497-880c5235d416} 4852 "\\.\pipe\gecko-crash-server-pipe.4852" tab
                                                6⤵
                                                  PID:3732
                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3344 -childID 2 -isForBrowser -prefsHandle 3728 -prefMapHandle 3732 -prefsLen 22631 -prefMapSize 244628 -jsInitHandle 1280 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b8fbf1c1-e474-47e4-b95f-028134e224bd} 4852 "\\.\pipe\gecko-crash-server-pipe.4852" tab
                                                  6⤵
                                                    PID:4244
                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4400 -childID 3 -isForBrowser -prefsHandle 4392 -prefMapHandle 4388 -prefsLen 29012 -prefMapSize 244628 -jsInitHandle 1280 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ebcacdd3-3d8c-40e0-9d1d-934f7bc33c2e} 4852 "\\.\pipe\gecko-crash-server-pipe.4852" tab
                                                    6⤵
                                                      PID:2156
                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5004 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4872 -prefMapHandle 4968 -prefsLen 29012 -prefMapSize 244628 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {68ef5450-0705-4684-afa6-85a661f11fff} 4852 "\\.\pipe\gecko-crash-server-pipe.4852" utility
                                                      6⤵
                                                      • Checks processor information in registry
                                                      PID:5636
                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5616 -childID 4 -isForBrowser -prefsHandle 5360 -prefMapHandle 5636 -prefsLen 26989 -prefMapSize 244628 -jsInitHandle 1280 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ea49fbd1-606a-4773-8c20-5ceda90c39f5} 4852 "\\.\pipe\gecko-crash-server-pipe.4852" tab
                                                      6⤵
                                                        PID:5628
                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5956 -childID 5 -isForBrowser -prefsHandle 5876 -prefMapHandle 5880 -prefsLen 26989 -prefMapSize 244628 -jsInitHandle 1280 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {92cafb57-dae4-414d-8c6b-e80e53a9bc4e} 4852 "\\.\pipe\gecko-crash-server-pipe.4852" tab
                                                        6⤵
                                                          PID:5548
                                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6076 -childID 6 -isForBrowser -prefsHandle 6084 -prefMapHandle 6088 -prefsLen 26989 -prefMapSize 244628 -jsInitHandle 1280 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3ea12f19-0d86-448c-8668-c2b13eb6fc89} 4852 "\\.\pipe\gecko-crash-server-pipe.4852" tab
                                                          6⤵
                                                            PID:4568
                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
                                                        4⤵
                                                        • Checks processor information in registry
                                                        PID:4128
                                                • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                                                  C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                                                  1⤵
                                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                  • Checks BIOS information in registry
                                                  • Executes dropped EXE
                                                  • Identifies Wine through registry keys
                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:4168
                                                • C:\Windows\System32\CompPkgSrv.exe
                                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                  1⤵
                                                    PID:6072
                                                  • C:\Windows\System32\CompPkgSrv.exe
                                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                    1⤵
                                                      PID:5484
                                                    • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                                                      C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                                                      1⤵
                                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                      • Checks BIOS information in registry
                                                      • Executes dropped EXE
                                                      • Identifies Wine through registry keys
                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:5304
                                                    • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                                                      C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                                                      1⤵
                                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                      • Checks BIOS information in registry
                                                      • Executes dropped EXE
                                                      • Identifies Wine through registry keys
                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:6188

                                                    Network

                                                    MITRE ATT&CK Enterprise v15

                                                    Replay Monitor

                                                    Loading Replay Monitor...

                                                    Downloads

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                      Filesize

                                                      152B

                                                      MD5

                                                      27304926d60324abe74d7a4b571c35ea

                                                      SHA1

                                                      78b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1

                                                      SHA256

                                                      7039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de

                                                      SHA512

                                                      f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                      Filesize

                                                      152B

                                                      MD5

                                                      9e3fc58a8fb86c93d19e1500b873ef6f

                                                      SHA1

                                                      c6aae5f4e26f5570db5e14bba8d5061867a33b56

                                                      SHA256

                                                      828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4

                                                      SHA512

                                                      e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                      Filesize

                                                      528B

                                                      MD5

                                                      1801021d1b9ee46784883019d988a4af

                                                      SHA1

                                                      e890074a6427ed781d2b560226ef8b02e4199097

                                                      SHA256

                                                      e020a7a468f1914d2d92bb6508241829f31a28a78b774539562c6fa35a506db8

                                                      SHA512

                                                      9e95193cf94128c90b829e9e2637b4d66c89d14fcb5fa11e87f4dbb1ea8abece84c4c042c2edf67266c29e31ab038a9ba8ca280e866a8a0dd1e1fbd360be68be

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                      Filesize

                                                      1KB

                                                      MD5

                                                      1a68848218765072243bec47724a3e42

                                                      SHA1

                                                      cbe2890728a2299d4403a51128c6f9d880517064

                                                      SHA256

                                                      609f2431148a9da111843c10d8c4e4004dc91f708c7198466e46a4b31b1ac104

                                                      SHA512

                                                      5c92c777b233e638f17b8be229f4b59b6d811b2400d4f3ee1f5ccfcc56c923893e23921fd17c4c432e24cadce3f5a2fc494eb4eb102adc7363bf09f0880f33da

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                      Filesize

                                                      7KB

                                                      MD5

                                                      001ffeece8d52a5e6ad48276b0f20a9d

                                                      SHA1

                                                      6686e5a9b9e665c6f9fbea8722415c5e34c840c7

                                                      SHA256

                                                      7d41ba67e5c06c0d4a5d88e944b881199b4778c01f622eff24600eeef49c73eb

                                                      SHA512

                                                      793fc9999c4309e5afaebc13d6269cabe02fadf9cd161d7fb150b62ad9618740f4594e6d386472e42ac3be83cdaa09a7f112211f173fedf871ea7a0c29555a62

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                      Filesize

                                                      5KB

                                                      MD5

                                                      e762ca45eaf3698b3d20ff91538c7a3f

                                                      SHA1

                                                      1bee221ad0ab1371c278616db2b36ac92153bb1e

                                                      SHA256

                                                      4eb7f8ef18ceffcddec09be761bed6386200e8c8d76d6ed5b9ec189a22cdb42f

                                                      SHA512

                                                      aa17d4aa9b4d4806b8d790f889dee319dff4d50c2b5d55301f7cb6a9f5356feada3d9f58e30d5ab58611f6fa8890340f5c982a3ebc28a32fc608cd96570b8a84

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                      Filesize

                                                      539B

                                                      MD5

                                                      7a084e265b8e81c6515d85b62b897afa

                                                      SHA1

                                                      443d50968ca94acdc32fc161b47d98e22fe684f6

                                                      SHA256

                                                      70d5ce496c634673653d6190f08aea607b665e198e5991c7006a55ebf18c0fbf

                                                      SHA512

                                                      e78a55ffe7ab608f91fdc7e8cb5495688499646682d0b7d5e30e299b146957e280f9e974f84a3a238e20e8f7d192a070542c317fbf59bdf89e620a80cc4f2e9d

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe59306d.TMP

                                                      Filesize

                                                      539B

                                                      MD5

                                                      99d5fffe4671db326a3991156c51f5f1

                                                      SHA1

                                                      4532db51f8b10aae6fc1571b17405e4658ef7e01

                                                      SHA256

                                                      11548231df78e09a60b0fec4f76464d2e4bda32a1c0837aa81cd642317211fa0

                                                      SHA512

                                                      ef443ea07ec648ebeeda90d259d75a83a9f096257de9b2ec44d8d0d2dbaabf3d42c9dd8189e2d114ddcb01b4fc1bb7dccb52581df7a7d1f4065af4ef903a80b5

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                      Filesize

                                                      16B

                                                      MD5

                                                      6752a1d65b201c13b62ea44016eb221f

                                                      SHA1

                                                      58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                      SHA256

                                                      0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                      SHA512

                                                      9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                      Filesize

                                                      8KB

                                                      MD5

                                                      9518e437001e95819eeac6acea59a95b

                                                      SHA1

                                                      386b87199d173f83e4022dce0fb264bb8b545167

                                                      SHA256

                                                      f076fb159850579e509d01d4be2193041b1d64e37720cb2913218ab798696cd8

                                                      SHA512

                                                      1a07f33cfd3a8c0f4682a82d5af9ec59001e848408ca8832a3f97026af3e4191075d9372c44ac24a5d2f796f2d2028dcb4b833a615a50aa054af2246bc048ca8

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                      Filesize

                                                      10KB

                                                      MD5

                                                      2bebb74aee42885947d91ee5ce111ce1

                                                      SHA1

                                                      3b2d78be80ad7156c3f2cfe00acb452c88f00232

                                                      SHA256

                                                      185a7f7d79be679929ce405391715914fb0e60dec775ecb5f8c6d9a0760c2743

                                                      SHA512

                                                      e13f93c8056d435f23e179596893121541ac83bdf3fc687942722b3a911aadb0e2955f025906e1add2ce0c8b645cbb2f8a1f425d2d15782f6db8b8ff68e8e11f

                                                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5utpapi8.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

                                                      Filesize

                                                      7KB

                                                      MD5

                                                      c460716b62456449360b23cf5663f275

                                                      SHA1

                                                      06573a83d88286153066bae7062cc9300e567d92

                                                      SHA256

                                                      0ec0f16f92d876a9c1140d4c11e2b346a9292984d9a854360e54e99fdcd99cc0

                                                      SHA512

                                                      476bc3a333aace4c75d9a971ef202d5889561e10d237792ca89f8d379280262ce98cf3d4728460696f8d7ff429a508237764bf4a9ccb59fd615aee07bdcadf30

                                                    • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe

                                                      Filesize

                                                      1.8MB

                                                      MD5

                                                      7f8b4777a6921d7fe085191955d8f9e8

                                                      SHA1

                                                      0157193e769423cc5073c6e0f48b2cd879c06497

                                                      SHA256

                                                      e72c30dd2fef80237f6eee270269656dc0e2a525ae38c2df8fc95f77334f9e0d

                                                      SHA512

                                                      1d9fae6f2289e3b4818d718d45860dbca8bbfd577ef9a082336be43782a280a54bd2ca038753ce19b1ea7cc9e2f56d3b3cd30aeda1a550cd06cddb071cf73964

                                                    • C:\Users\Admin\AppData\Local\Temp\1000039041\do.ps1

                                                      Filesize

                                                      2KB

                                                      MD5

                                                      e05e8f072b373beafe27cc11d85f947c

                                                      SHA1

                                                      1d6daeb98893e8122b8b69287ebd9d43f3c6138e

                                                      SHA256

                                                      717c09427fa5754ba92f92961545534048d0a76528c2e95c4d5ec6cef47c612f

                                                      SHA512

                                                      b3e34162e5ee43bb01f289eebc45fd3ea3e07f30be40dcf6635606540f912fe5c84d301e9f78e97dfe3ffe53e72547e50f3bcd7d4ebe5ab8da451a1989c469a0

                                                    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_v4get4bw.k0k.ps1

                                                      Filesize

                                                      60B

                                                      MD5

                                                      d17fe0a3f47be24a6453e9ef58c94641

                                                      SHA1

                                                      6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                      SHA256

                                                      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                      SHA512

                                                      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                    • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                                                      Filesize

                                                      479KB

                                                      MD5

                                                      09372174e83dbbf696ee732fd2e875bb

                                                      SHA1

                                                      ba360186ba650a769f9303f48b7200fb5eaccee1

                                                      SHA256

                                                      c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                                                      SHA512

                                                      b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                                                    • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                                                      Filesize

                                                      13.8MB

                                                      MD5

                                                      0a8747a2ac9ac08ae9508f36c6d75692

                                                      SHA1

                                                      b287a96fd6cc12433adb42193dfe06111c38eaf0

                                                      SHA256

                                                      32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                                                      SHA512

                                                      59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                                                    • C:\Users\Admin\AppData\Roaming\1000026000\ff7f5d0903.exe

                                                      Filesize

                                                      1.6MB

                                                      MD5

                                                      50d7b4ddde987f738f29064556b31177

                                                      SHA1

                                                      8665b718cf44194c50d2eed8981b8e643debb98b

                                                      SHA256

                                                      0c38ce400b5a99c4d0350fc0e3a5c8f7bb366d73ba850ead3bd63dcc709941c8

                                                      SHA512

                                                      4cd03621fea07ca785792fae5fd4ac36281ab0718c1db0c4b6d0bd63a57ff1bf45ce5852b6c84782f2eb153fb7c5acde8096fe407dd5acf454bf0b9aad0a21f5

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\AlternateServices.bin

                                                      Filesize

                                                      6KB

                                                      MD5

                                                      149de576d27953c43ca7b34cb1b8dabe

                                                      SHA1

                                                      392dd0d867ff9d6a3a2984d3c3d5815af97c2b1d

                                                      SHA256

                                                      06379c09bfa41ff881631740e808e374d5fce9da2a1bb6364505829967e560ab

                                                      SHA512

                                                      057bef13ca104fa72cd4f07c3aa3753fe9f1f600c58cc6b63b6c53dee7392bc328ff3678b74a7f2fa42774322bd826ad7126e9fae8e23c69e158de3d4a573fde

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\AlternateServices.bin

                                                      Filesize

                                                      8KB

                                                      MD5

                                                      bf2156310b53bd4aeb8a58dd06fb5ed8

                                                      SHA1

                                                      2d1b7e397ea054f61d7e3f813020109f4376e730

                                                      SHA256

                                                      a07cfde624890e1e3a0eecb6333616ac914dd7e2ef37448eeb6a19b367171ba0

                                                      SHA512

                                                      66ac7ac68a89b9440939bf2297ce7958c9f34824ab07975f0c1bdbc09ec7e26231e3f33916b9688da04e238cb6c0f2f827fb9bc24b1c160d0ed1e1ba6134faa7

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\AlternateServices.bin

                                                      Filesize

                                                      13KB

                                                      MD5

                                                      e77712d31098d44f68e286902e81d4ca

                                                      SHA1

                                                      af050122b89eb9affda95a9d11734d67a2400287

                                                      SHA256

                                                      39383a9ecc29cda2ce704d90da5d4d16f7a6f7443f419223a8c488f0f466ed82

                                                      SHA512

                                                      f1b5abd60839541db0e01462031ce8047540d1bc0b6def6f10a6afc5330eb05249b760dced974806a41a1dcbb214c308e14f5da1714987daa382a9535a224357

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\AlternateServices.bin

                                                      Filesize

                                                      16KB

                                                      MD5

                                                      3c6f758b5a1c2bcbf620430e3e0ac132

                                                      SHA1

                                                      4a16c8474f4209d8492ae58b91c227c5c37ae200

                                                      SHA256

                                                      7bfa20e89227a93d2d1f716b86eca48ecf663a5cbab5950289c969efa2055825

                                                      SHA512

                                                      d9843e22ba447b6d629059715d2e15fbe85d6662addc01a14f82e814ec93022761459119da4aa008b126def5c757f901f78597b2ea16dff3c3d474b2bc207f40

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\AlternateServices.bin

                                                      Filesize

                                                      20KB

                                                      MD5

                                                      1dfb0bdccb4493ea1d478dfc9a71c357

                                                      SHA1

                                                      8058fd1afeb19a9da2a546c52888fd3305df3b58

                                                      SHA256

                                                      b7e3e770bbe9c5ceb2ae111fc2c8e8c22fde3c57633477b361bd05981c7a2e41

                                                      SHA512

                                                      416ec69957515b202ba41ea1833d8e7f41a9467bc27bf4d352c1108d4c5638cb0dbdd4c608fbefa2fe2567b6405075b8e96a0b7422f63dd3b5e1db6a5a00a9e8

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\AlternateServices.bin

                                                      Filesize

                                                      23KB

                                                      MD5

                                                      656780032115cd1886752978bb1a1e5f

                                                      SHA1

                                                      83a0c96a03cb569452646f9729e06905042df0db

                                                      SHA256

                                                      8a0fa96e069fa3c4f26a3d7c657d959b50089b3afed4748f0368f957d00983e7

                                                      SHA512

                                                      cede569055c0c895ce770677a892b6c84deff7aa0678ce5e3a38b86dfdaff5d10f7f873e7b2d7bdf9d6fc77da7bf399b7b4114fd15eaf78428dd8f7c85601a70

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\datareporting\glean\db\data.safe.tmp

                                                      Filesize

                                                      6KB

                                                      MD5

                                                      fbdcadb7321be89f0f2f6d762dd2d0e7

                                                      SHA1

                                                      4f3b9204f64a97425903212d04b936d3883e99d8

                                                      SHA256

                                                      e52bb0487a615b865496ca60d36c33e5a99c5c1517ed9a084aef317bdaec957e

                                                      SHA512

                                                      6bfa93148490cfc36828c09873ca1ba439d3966fe0948991b341c12ea25e1c973a975d223e237c8bb72ae14ffe77374cc03869624fd340feaaa81b6f4a2beb23

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\datareporting\glean\db\data.safe.tmp

                                                      Filesize

                                                      5KB

                                                      MD5

                                                      46b4376f639a8065efe838092c254e65

                                                      SHA1

                                                      9988d871d2233091a3a14a35cb166c4bce35f548

                                                      SHA256

                                                      9222cdb1d718412c13a7206e84126fbb3d004d706c37ee62bb2c0ece70b4ca23

                                                      SHA512

                                                      a7d5f8646e54c3f992618039d8eaaec7582bb6354b0069037c21ff7ac71e71b2b47af6afd7d0584f7e1a2a051636bac17536eeda5044f2d3f0354898d414cd2b

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\datareporting\glean\db\data.safe.tmp

                                                      Filesize

                                                      6KB

                                                      MD5

                                                      72cae1f6cb939acf3bc11c7155214f5a

                                                      SHA1

                                                      1dec0695b318fc4bf43ad1aabe27608753fffc0d

                                                      SHA256

                                                      dc36ba14de055a4cbae63b54c156184753455cb26e5672bdde85c88d701a4b61

                                                      SHA512

                                                      3f3e0b8290b706536d7cb9d06281baf79690d5785e8f3be5b2f6af3bcea9df62a10b267c1e287dc75c5033783fdc740a5d002fc058225d36ef26fe7a15a16194

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\datareporting\glean\pending_pings\393b9c67-d6ea-4f77-91f3-ce8d4233490f

                                                      Filesize

                                                      27KB

                                                      MD5

                                                      93782fa5269d8146c8825fe0674ad602

                                                      SHA1

                                                      c517e6cff121deb49af64f39c0d829c5abf58dac

                                                      SHA256

                                                      1e836e05b2c7c9e07a31265a391121844234b70d410c20483e970555558c4dbc

                                                      SHA512

                                                      592310628ad42bb7958d696f259ce6ec6948dd85cdc724b485f48cc6720863dcfc2044d95ab367224363443daf5007599f8bcfaad212db39e1599e147bf3c634

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\datareporting\glean\pending_pings\6cc9b93f-8bf8-48a3-90a8-bb09cae4c7e4

                                                      Filesize

                                                      671B

                                                      MD5

                                                      414d7def5d3f42478b23b29218b83d08

                                                      SHA1

                                                      be93ef5b5ab835e20d5c3547df7ee8d5492c8e75

                                                      SHA256

                                                      78bdef2c7885d054774412a757eb503d2c9bbe4e26ed92307a612bb1f8611422

                                                      SHA512

                                                      0292ad2c7cd9ba95bc0d3c3682096e4ebf81ce321eac5cf40ca3cd2b97514e3ad24b6c35d3cdabb88ea3204f9245825fc48225670b36b242256633e030710dc8

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\datareporting\glean\pending_pings\ebb5263f-aa09-45cb-9098-9defd2ec6c44

                                                      Filesize

                                                      905B

                                                      MD5

                                                      680a3837b6e3d9d1b34f5adf55a52453

                                                      SHA1

                                                      e303a35cbcfc7a0f5ba6ed11dd6e219fb2ccb864

                                                      SHA256

                                                      2f8e7497bb6ff9a833172988975b1b55b0d2b57bbff6509174cac0f457e267b9

                                                      SHA512

                                                      a74aa908a7cd98a243c3824b6f3f957cdb42f6b40daff492a33a17076f26921143fe148a390a0fd0f9b5f13a4fedac39236264a38b1f75074181c044dd17bb4b

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

                                                      Filesize

                                                      1.1MB

                                                      MD5

                                                      842039753bf41fa5e11b3a1383061a87

                                                      SHA1

                                                      3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                                                      SHA256

                                                      d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                                                      SHA512

                                                      d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

                                                      Filesize

                                                      116B

                                                      MD5

                                                      2a461e9eb87fd1955cea740a3444ee7a

                                                      SHA1

                                                      b10755914c713f5a4677494dbe8a686ed458c3c5

                                                      SHA256

                                                      4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                                                      SHA512

                                                      34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

                                                      Filesize

                                                      372B

                                                      MD5

                                                      bf957ad58b55f64219ab3f793e374316

                                                      SHA1

                                                      a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                                                      SHA256

                                                      bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                                                      SHA512

                                                      79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

                                                      Filesize

                                                      17.8MB

                                                      MD5

                                                      daf7ef3acccab478aaa7d6dc1c60f865

                                                      SHA1

                                                      f8246162b97ce4a945feced27b6ea114366ff2ad

                                                      SHA256

                                                      bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                                                      SHA512

                                                      5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\prefs-1.js

                                                      Filesize

                                                      11KB

                                                      MD5

                                                      a85a9e732361b8b519e78990208a97fd

                                                      SHA1

                                                      9c36ec4369642036c26cf190067adb6dd343fb78

                                                      SHA256

                                                      db2c959c70752eb27783927077e83a5fcf6e6e02eb9121d2c70186c437af1cf0

                                                      SHA512

                                                      338ea0922979d56de500ae3fb11425ebaed91782da71905adb18ec7248f9acb5680d6cb3b87a268ae9cd8d8c2e28cba47824d495ad5544dc5b2aecb3d585ce1f

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\prefs.js

                                                      Filesize

                                                      11KB

                                                      MD5

                                                      8c7205e5dc66a034471bc5ebf20e66c2

                                                      SHA1

                                                      2edfcb6858dd379939aafd21980ac1475bb24693

                                                      SHA256

                                                      a66da394ab00af74ecad56e8736eb35d43d60ce916e8399bc56c090e6739aa7b

                                                      SHA512

                                                      1cd558adb03d32ba5dd60448f7ebdbb5e81a3d61d8ff80741dd7265a40c7d01c9f0fbc18d1287a4a895c860075548f7c3cea5655b26865b8af2ec8d1404fc668

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\prefs.js

                                                      Filesize

                                                      10KB

                                                      MD5

                                                      d4f3bc24abc1762547a5148a32eb6633

                                                      SHA1

                                                      761b787a0254865d3731572ba34886dd4de8adf2

                                                      SHA256

                                                      69bbea0d548d5641f679c2ecf0e53665b31b4fe4f2cc1c7d2dec453d0d2f8a64

                                                      SHA512

                                                      256a14a7efff045d701a65503ceff873ec9ad71d736bd8690ada7692e00f31d1198d34dd1804fcf9cc6cc79b498af2c7fd7db2d573a3afbb8c9ccd79adb9f4cc

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\prefs.js

                                                      Filesize

                                                      11KB

                                                      MD5

                                                      e3a5e3aac41ae45db7834a32176b4f03

                                                      SHA1

                                                      920f2f136f511597595d1468e97b48c1f4507e4c

                                                      SHA256

                                                      8aebc416038c5aab54661776590dff8d9623dd87666cd0bac13105cc86138bed

                                                      SHA512

                                                      e13128128d08283011ae728f3366d57cd29336e2db455c499afcc09d975babd18dd75d202aaf504eb58657780cc9dcd20c086308ce52e5d359a841f581d3c008

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\sessionstore-backups\recovery.baklz4

                                                      Filesize

                                                      1KB

                                                      MD5

                                                      4b43c1286b477638137530f9ed8bd1f7

                                                      SHA1

                                                      a51be2e6b9820b5276a8f9de3f3157bded783f7d

                                                      SHA256

                                                      2281e62a54a2a272ffaff127be9d7cccbcb74bf01bd2e1c92203aa5fb484e076

                                                      SHA512

                                                      3d5412a27af7177513f56f3235b8765fc8d1a084a9747d436458a06bd14848a634e14cfe44ef81897da9751482416137e12e5f45b1b9898a361b5ddf77e24717

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\sessionstore-backups\recovery.baklz4

                                                      Filesize

                                                      5KB

                                                      MD5

                                                      15f8f13547ab87d172e5cabdc1171566

                                                      SHA1

                                                      0c844b9f167d3ffa78d5ac860041b7e7ea3781fd

                                                      SHA256

                                                      fa23ed7c0435e084235eee940e780d09ce74327729e6da979319c16da1208ef4

                                                      SHA512

                                                      3c3029cb6dd370b373d0fff91d1c5c8cf0cddb18179553d220b74b05b51b3221ba56f241d3303494d8d4f0858e2997a5451ba9fdb1415f949a3463fa9a644fec

                                                    • \??\pipe\LOCAL\crashpad_2704_HVJUTPYRNCFDZHCM

                                                      MD5

                                                      d41d8cd98f00b204e9800998ecf8427e

                                                      SHA1

                                                      da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                      SHA256

                                                      e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                      SHA512

                                                      cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                    • memory/4168-28-0x0000000000F81000-0x0000000000FAF000-memory.dmp

                                                      Filesize

                                                      184KB

                                                    • memory/4168-29-0x0000000000F80000-0x000000000143F000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4168-25-0x0000000000F80000-0x000000000143F000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4168-26-0x0000000000F80000-0x000000000143F000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4244-3-0x0000000000C40000-0x00000000010FF000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4244-4-0x0000000000C40000-0x00000000010FF000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4244-0-0x0000000000C40000-0x00000000010FF000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4244-1-0x00000000779F4000-0x00000000779F6000-memory.dmp

                                                      Filesize

                                                      8KB

                                                    • memory/4244-2-0x0000000000C41000-0x0000000000C6F000-memory.dmp

                                                      Filesize

                                                      184KB

                                                    • memory/4244-17-0x0000000000C40000-0x00000000010FF000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4308-93-0x0000000007550000-0x00000000075E6000-memory.dmp

                                                      Filesize

                                                      600KB

                                                    • memory/4308-95-0x0000000006820000-0x0000000006842000-memory.dmp

                                                      Filesize

                                                      136KB

                                                    • memory/4308-94-0x0000000006790000-0x00000000067AA000-memory.dmp

                                                      Filesize

                                                      104KB

                                                    • memory/4308-77-0x0000000005B80000-0x0000000005BE6000-memory.dmp

                                                      Filesize

                                                      408KB

                                                    • memory/4308-96-0x0000000007BA0000-0x0000000008144000-memory.dmp

                                                      Filesize

                                                      5.6MB

                                                    • memory/4308-88-0x0000000005EB0000-0x0000000006204000-memory.dmp

                                                      Filesize

                                                      3.3MB

                                                    • memory/4308-74-0x0000000004CA0000-0x0000000004CD6000-memory.dmp

                                                      Filesize

                                                      216KB

                                                    • memory/4308-75-0x0000000005370000-0x0000000005998000-memory.dmp

                                                      Filesize

                                                      6.2MB

                                                    • memory/4308-78-0x0000000005BF0000-0x0000000005C56000-memory.dmp

                                                      Filesize

                                                      408KB

                                                    • memory/4308-89-0x0000000006250000-0x000000000626E000-memory.dmp

                                                      Filesize

                                                      120KB

                                                    • memory/4308-76-0x00000000059E0000-0x0000000005A02000-memory.dmp

                                                      Filesize

                                                      136KB

                                                    • memory/4308-90-0x0000000006290000-0x00000000062DC000-memory.dmp

                                                      Filesize

                                                      304KB

                                                    • memory/4432-651-0x0000000000F80000-0x000000000143F000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4432-841-0x0000000000F80000-0x000000000143F000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4432-21-0x0000000000F80000-0x000000000143F000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4432-20-0x0000000000F80000-0x000000000143F000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4432-22-0x0000000000F80000-0x000000000143F000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4432-19-0x0000000000F81000-0x0000000000FAF000-memory.dmp

                                                      Filesize

                                                      184KB

                                                    • memory/4432-24-0x0000000000F80000-0x000000000143F000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4432-18-0x0000000000F80000-0x000000000143F000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4432-881-0x0000000000F80000-0x000000000143F000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4432-758-0x0000000000F80000-0x000000000143F000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4432-30-0x0000000000F80000-0x000000000143F000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4432-31-0x0000000000F80000-0x000000000143F000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4432-32-0x0000000000F80000-0x000000000143F000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4432-880-0x0000000000F80000-0x000000000143F000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4432-877-0x0000000000F80000-0x000000000143F000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4432-876-0x0000000000F80000-0x000000000143F000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4432-820-0x0000000000F80000-0x000000000143F000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4432-823-0x0000000000F80000-0x000000000143F000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4432-836-0x0000000000F80000-0x000000000143F000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4432-703-0x0000000000F80000-0x000000000143F000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4432-91-0x0000000000F80000-0x000000000143F000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4776-66-0x0000000000E70000-0x00000000014C7000-memory.dmp

                                                      Filesize

                                                      6.3MB

                                                    • memory/4776-48-0x0000000000E70000-0x00000000014C7000-memory.dmp

                                                      Filesize

                                                      6.3MB

                                                    • memory/5060-64-0x0000000000B30000-0x0000000001187000-memory.dmp

                                                      Filesize

                                                      6.3MB

                                                    • memory/5060-503-0x0000000000B30000-0x0000000001187000-memory.dmp

                                                      Filesize

                                                      6.3MB

                                                    • memory/5304-817-0x0000000000F80000-0x000000000143F000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/5304-813-0x0000000000F80000-0x000000000143F000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/6188-879-0x0000000000F80000-0x000000000143F000-memory.dmp

                                                      Filesize

                                                      4.7MB