Analysis

  • max time kernel
    147s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-09-2024 02:34

General

  • Target

    263c5c85871db56cb3438b6b38aff70fb2447ab02c7bdf2598a40e778ab1191f.exe

  • Size

    1.8MB

  • MD5

    656dad33ed55f336051883f756e7d041

  • SHA1

    83ff37e0f8badb060900511002fb14e8c4deade8

  • SHA256

    263c5c85871db56cb3438b6b38aff70fb2447ab02c7bdf2598a40e778ab1191f

  • SHA512

    ba950f704229070f0515b163630d59fbb9b2ba1b8b775259d84d3828713ab879880a1ee9baa4796898a29a941943868ec8ae111ba38c006fdefb9e12af81316c

  • SSDEEP

    49152:ceMiOEiw+JG001x6xaEQtgCnNSjQ7t1xphS80IHY4LVx:cA9+J/awxaDAjQ9pw80IHY4LV

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

c7817d

C2

http://31.41.244.10

Attributes
  • install_dir

    0e8d0864aa

  • install_file

    svoutse.exe

  • strings_key

    5481b88a6ef75bcf21333988a4e47048

  • url_paths

    /Dem7kTu/index.php

rc4.plain

Extracted

Family

stealc

Botnet

rave

C2

http://185.215.113.103

Attributes
  • url_path

    /e2b1563c6670f193.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Stealc

    Stealc is an infostealer written in C++.

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 12 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Identifies Wine through registry keys 2 TTPs 6 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 14 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 27 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 47 IoCs
  • Suspicious use of SendNotifyMessage 44 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\263c5c85871db56cb3438b6b38aff70fb2447ab02c7bdf2598a40e778ab1191f.exe
    "C:\Users\Admin\AppData\Local\Temp\263c5c85871db56cb3438b6b38aff70fb2447ab02c7bdf2598a40e778ab1191f.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:1060
    • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
      "C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:748
      • C:\Users\Admin\AppData\Roaming\1000026000\5e7edf2ffb.exe
        "C:\Users\Admin\AppData\Roaming\1000026000\5e7edf2ffb.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:2216
      • C:\Users\Admin\AppData\Local\Temp\1000030001\a18fe6e015.exe
        "C:\Users\Admin\AppData\Local\Temp\1000030001\a18fe6e015.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:3916
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\Admin\AppData\Local\Temp\1000039041\do.ps1"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4588
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /c start msedge https://www.youtube.com/account
          4⤵
          • Checks computer location settings
          • System Location Discovery: System Language Discovery
          PID:3816
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.youtube.com/account
            5⤵
            • Enumerates system info in registry
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            PID:4360
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fff780046f8,0x7fff78004708,0x7fff78004718
              6⤵
                PID:3024
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,12808707999866091056,657303998183836494,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
                6⤵
                  PID:5464
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,12808707999866091056,657303998183836494,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
                  6⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:5476
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,12808707999866091056,657303998183836494,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:8
                  6⤵
                    PID:3048
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,12808707999866091056,657303998183836494,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
                    6⤵
                      PID:4840
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,12808707999866091056,657303998183836494,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
                      6⤵
                        PID:4040
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,12808707999866091056,657303998183836494,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3932 /prefetch:1
                        6⤵
                          PID:5604
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,12808707999866091056,657303998183836494,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4800 /prefetch:1
                          6⤵
                            PID:6180
                          • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,12808707999866091056,657303998183836494,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5328 /prefetch:8
                            6⤵
                              PID:5236
                            • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,12808707999866091056,657303998183836494,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5328 /prefetch:8
                              6⤵
                              • Suspicious behavior: EnumeratesProcesses
                              PID:6368
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,12808707999866091056,657303998183836494,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5492 /prefetch:1
                              6⤵
                                PID:6476
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,12808707999866091056,657303998183836494,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
                                6⤵
                                  PID:6480
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,12808707999866091056,657303998183836494,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5836 /prefetch:1
                                  6⤵
                                    PID:2244
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,12808707999866091056,657303998183836494,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:1
                                    6⤵
                                      PID:3616
                                • C:\Windows\SysWOW64\cmd.exe
                                  "C:\Windows\system32\cmd.exe" /c start msedge https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
                                  4⤵
                                  • Checks computer location settings
                                  • System Location Discovery: System Language Discovery
                                  PID:4480
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://accounts.google.com/ServiceLogin?service=accountsettings
                                    5⤵
                                      PID:1708
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fff780046f8,0x7fff78004708,0x7fff78004718
                                        6⤵
                                          PID:1188
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,10799484367671523446,11037391841005517617,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:2
                                          6⤵
                                            PID:4412
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,10799484367671523446,11037391841005517617,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
                                            6⤵
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:4596
                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                        "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
                                        4⤵
                                        • Suspicious use of WriteProcessMemory
                                        PID:2700
                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                          "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
                                          5⤵
                                          • Checks processor information in registry
                                          • Modifies registry class
                                          • Suspicious use of AdjustPrivilegeToken
                                          • Suspicious use of FindShellTrayWindow
                                          • Suspicious use of SendNotifyMessage
                                          • Suspicious use of SetWindowsHookEx
                                          • Suspicious use of WriteProcessMemory
                                          PID:1116
                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2028 -parentBuildID 20240401114208 -prefsHandle 1912 -prefMapHandle 1904 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {98f46d37-7eb1-47a6-8ecb-678c6f423d8a} 1116 "\\.\pipe\gecko-crash-server-pipe.1116" gpu
                                            6⤵
                                              PID:2348
                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2452 -parentBuildID 20240401114208 -prefsHandle 2436 -prefMapHandle 2432 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e4900535-6336-4fc3-a711-a5df8c96c505} 1116 "\\.\pipe\gecko-crash-server-pipe.1116" socket
                                              6⤵
                                                PID:3680
                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3144 -childID 1 -isForBrowser -prefsHandle 3264 -prefMapHandle 3136 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1068 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {140ac495-29c3-4516-b6dc-856dd1fc7687} 1116 "\\.\pipe\gecko-crash-server-pipe.1116" tab
                                                6⤵
                                                  PID:4316
                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3604 -childID 2 -isForBrowser -prefsHandle 3596 -prefMapHandle 3588 -prefsLen 22693 -prefMapSize 244658 -jsInitHandle 1068 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {169843bd-d8b7-4082-bc93-ed105813d4df} 1116 "\\.\pipe\gecko-crash-server-pipe.1116" tab
                                                  6⤵
                                                    PID:1032
                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3760 -childID 3 -isForBrowser -prefsHandle 4120 -prefMapHandle 3596 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1068 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {80723de9-3529-4b03-acea-2113dae73be5} 1116 "\\.\pipe\gecko-crash-server-pipe.1116" tab
                                                    6⤵
                                                      PID:3808
                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4700 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4688 -prefMapHandle 4580 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {280cd765-67d4-4db4-bb31-b2fd357aa2e4} 1116 "\\.\pipe\gecko-crash-server-pipe.1116" utility
                                                      6⤵
                                                      • Checks processor information in registry
                                                      PID:5676
                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5612 -childID 4 -isForBrowser -prefsHandle 5524 -prefMapHandle 5632 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1068 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dc7b248e-08d4-46d2-a6bd-1aa1c2434fd0} 1116 "\\.\pipe\gecko-crash-server-pipe.1116" tab
                                                      6⤵
                                                        PID:5336
                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5812 -childID 5 -isForBrowser -prefsHandle 5732 -prefMapHandle 5736 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1068 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bb9f9489-ab3b-4e17-985c-b693d3a998a8} 1116 "\\.\pipe\gecko-crash-server-pipe.1116" tab
                                                        6⤵
                                                          PID:5548
                                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5916 -childID 6 -isForBrowser -prefsHandle 5924 -prefMapHandle 5928 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1068 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e37c694b-1531-42cd-a3ac-eb0dd5c4a659} 1116 "\\.\pipe\gecko-crash-server-pipe.1116" tab
                                                          6⤵
                                                            PID:5576
                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
                                                        4⤵
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:3204
                                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                                          "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
                                                          5⤵
                                                          • Checks processor information in registry
                                                          PID:3964
                                                • C:\Windows\System32\CompPkgSrv.exe
                                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                  1⤵
                                                    PID:5596
                                                  • C:\Windows\System32\CompPkgSrv.exe
                                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                    1⤵
                                                      PID:5772
                                                    • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                                                      C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                                                      1⤵
                                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                      • Checks BIOS information in registry
                                                      • Executes dropped EXE
                                                      • Identifies Wine through registry keys
                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:5448
                                                    • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                                                      C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                                                      1⤵
                                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                      • Checks BIOS information in registry
                                                      • Executes dropped EXE
                                                      • Identifies Wine through registry keys
                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:4996

                                                    Network

                                                    MITRE ATT&CK Enterprise v15

                                                    Replay Monitor

                                                    Loading Replay Monitor...

                                                    Downloads

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                      Filesize

                                                      152B

                                                      MD5

                                                      0446fcdd21b016db1f468971fb82a488

                                                      SHA1

                                                      726b91562bb75f80981f381e3c69d7d832c87c9d

                                                      SHA256

                                                      62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222

                                                      SHA512

                                                      1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                      Filesize

                                                      152B

                                                      MD5

                                                      9b008261dda31857d68792b46af6dd6d

                                                      SHA1

                                                      e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3

                                                      SHA256

                                                      9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da

                                                      SHA512

                                                      78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                      Filesize

                                                      528B

                                                      MD5

                                                      efb1f0c72b726cdcc3bc60715d048850

                                                      SHA1

                                                      090b87c38e702c0d1a322f219dd282d200bd79f4

                                                      SHA256

                                                      46b3d6598c679931d892ef25d0e6a36172306f584e0b1069ff55fc44436dcd14

                                                      SHA512

                                                      af8dffa4a5e76cedc80940832d59aaf8acc684520c5ebad7c944301368587724f85550412b01842ebd82750811d9845af3d5b6be84cc6ef53ab96fb2781e1342

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                      Filesize

                                                      1KB

                                                      MD5

                                                      acaf4127c7b8d02da6d78fc3bc4b3d7e

                                                      SHA1

                                                      75e3b5148a098c6b5fba620ec1cb35cf47d0baae

                                                      SHA256

                                                      b36df29a2390ef2de257d9dd1438cb3ffcec791dcec91c104945688d8bb70d21

                                                      SHA512

                                                      e4167e123ab0210acce3db4a738a168498860d4f7d20c0b4b3a3f1cab44995bd7ac81f8c6d9e63cd6012e59fbcd176ea4ca0f4059a76b75c82dfe9f472cc234c

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                      Filesize

                                                      5KB

                                                      MD5

                                                      e1e1c3607c100351d59e55d6f69df545

                                                      SHA1

                                                      adea1c086c2cc43e8ac884fdb06ed6d5f07df5e1

                                                      SHA256

                                                      1e3c1e1d5b8770e9aa5dda870aa054e9cd0c9c34a5569a156877303b2489ef64

                                                      SHA512

                                                      ade81b7b5c716ee6ad2240bc3f358890537247f2830f36e55f5615dd682e692889db77f9547291c3a00980fe3ba708758d23ad6d08761ee913a8fc71f1c33686

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                      Filesize

                                                      7KB

                                                      MD5

                                                      b067430c06cb4bc797850a7738ce3ebf

                                                      SHA1

                                                      52df4e5fb3ba3d266c2d11bacabac1917cfe2e7b

                                                      SHA256

                                                      1946e5cc858e31765a6ef6cc1e0cda487248aa5896e201f08c790bf7b42c41c3

                                                      SHA512

                                                      273627f5bd724b24e4ad787831d2e33f15190a048b2a5eac22996333e689f57ee82603a8ab4fcee596b006863cefb7f2ffd5e74abc992280c178192d3b30054d

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                      Filesize

                                                      539B

                                                      MD5

                                                      3bb49f3b1a5c0d7db496c5e2c6347b4e

                                                      SHA1

                                                      cc50626a8610563281a0785cc998b09c56b452e7

                                                      SHA256

                                                      ad57f73317b0fba9b2c117858991b7c6a35a621fb9a313329bb814d22cb0678e

                                                      SHA512

                                                      ea2f72a174dfa91605621e9ca483fc3995e685b5aff01a7e9b9376199faadee4b417a014b565f0f46a8757da77fefa80a85145cc9c92120b94886aa6bfe4038b

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe596e50.TMP

                                                      Filesize

                                                      539B

                                                      MD5

                                                      015ab7c4c7a40433e3d7154d7f6bc888

                                                      SHA1

                                                      9dab4400a4b8c3cf26d8926ff4bd7ff670cf8478

                                                      SHA256

                                                      4c26ca0eca0e4aa508d4c3fcf853023859f2a42924963f2aadf2277ced39b5a1

                                                      SHA512

                                                      5af0c5fc33a55183efd414ac2bebea460d60f059a6a4dd9e585f3e783edfc5c00af2ce776bfde55c1a3673d179e1f1e122e45b3c0a4d9e4be8814c492eb82400

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                      Filesize

                                                      16B

                                                      MD5

                                                      6752a1d65b201c13b62ea44016eb221f

                                                      SHA1

                                                      58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                      SHA256

                                                      0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                      SHA512

                                                      9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                      Filesize

                                                      8KB

                                                      MD5

                                                      9f04e2732fc0293c458fd7e8b02091a6

                                                      SHA1

                                                      b6f68bb7380e310d962c3bda2422185f2167b328

                                                      SHA256

                                                      8dccc911fc3d08c9b23e099216f114893bb87994c464442f41b85f4c2eb3404b

                                                      SHA512

                                                      019d08c1645b72e419c95382d6a5f1aa49163075438c56c6479f02492844bc94bfcd1339afead0393de877daf2ae68b6d25aa687ada5762a2cfeeccd60ee242f

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                      Filesize

                                                      10KB

                                                      MD5

                                                      9c4944c55a1ee1e183a780fa2dfaab23

                                                      SHA1

                                                      d23a112521dacceeed17424e1aab16cb3d8e0b49

                                                      SHA256

                                                      7caaaa92f69c2249f682abb924690c1fad6db7f62b5e5055eb467bb0073346fc

                                                      SHA512

                                                      e8065be32a460d306c055009e92255a37639bd2a90bfc0f13bbd09ed10b816522453249390c73b99e5bbb802f2369afcef9d2de80155293d361d629a067a8a02

                                                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\lirn7gz7.default-release\activity-stream.discovery_stream.json

                                                      Filesize

                                                      26KB

                                                      MD5

                                                      b11e127b6dd9019234d96b22f7dc2f5e

                                                      SHA1

                                                      5df9da9211368b7dc078885aa944412f0f1e88c2

                                                      SHA256

                                                      3aa0ce6aa68c4a3071f274be94ee63c4fb8b65c785d00a0651da3b76d6da71bd

                                                      SHA512

                                                      a3bc038a3fb18b8549d046a41f3f88453597c0ef3703107a8551577ea603e0dbe00cadf0dc294d7f29f86cf99d4908e4211de92d5b6143b70a3c9eaecb3955aa

                                                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\lirn7gz7.default-release\cache2\entries\58EFA56DB4BFFECB0EDA547894BC9A057159E22F

                                                      Filesize

                                                      13KB

                                                      MD5

                                                      7357cf0202213aaffa1469bc1d7550a8

                                                      SHA1

                                                      6adb6ad6cecf582e87bd3608cf5597b69912e5de

                                                      SHA256

                                                      30931d99d25e2f0e1cde04e1c246928f791bbf527957d1b785f0e988dc380dfa

                                                      SHA512

                                                      1d2c6812a7f9929d4eb6416ca9c36c65cd63da89d5fc17b09976db50564100fe90726c50ab5ae846de7eb477b0353d4fcfc131767b48418f3d537001da18a501

                                                    • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe

                                                      Filesize

                                                      1.8MB

                                                      MD5

                                                      656dad33ed55f336051883f756e7d041

                                                      SHA1

                                                      83ff37e0f8badb060900511002fb14e8c4deade8

                                                      SHA256

                                                      263c5c85871db56cb3438b6b38aff70fb2447ab02c7bdf2598a40e778ab1191f

                                                      SHA512

                                                      ba950f704229070f0515b163630d59fbb9b2ba1b8b775259d84d3828713ab879880a1ee9baa4796898a29a941943868ec8ae111ba38c006fdefb9e12af81316c

                                                    • C:\Users\Admin\AppData\Local\Temp\1000039041\do.ps1

                                                      Filesize

                                                      2KB

                                                      MD5

                                                      e05e8f072b373beafe27cc11d85f947c

                                                      SHA1

                                                      1d6daeb98893e8122b8b69287ebd9d43f3c6138e

                                                      SHA256

                                                      717c09427fa5754ba92f92961545534048d0a76528c2e95c4d5ec6cef47c612f

                                                      SHA512

                                                      b3e34162e5ee43bb01f289eebc45fd3ea3e07f30be40dcf6635606540f912fe5c84d301e9f78e97dfe3ffe53e72547e50f3bcd7d4ebe5ab8da451a1989c469a0

                                                    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2piyqq3l.wb5.ps1

                                                      Filesize

                                                      60B

                                                      MD5

                                                      d17fe0a3f47be24a6453e9ef58c94641

                                                      SHA1

                                                      6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                      SHA256

                                                      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                      SHA512

                                                      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                    • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                                                      Filesize

                                                      479KB

                                                      MD5

                                                      09372174e83dbbf696ee732fd2e875bb

                                                      SHA1

                                                      ba360186ba650a769f9303f48b7200fb5eaccee1

                                                      SHA256

                                                      c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                                                      SHA512

                                                      b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                                                    • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                                                      Filesize

                                                      13.8MB

                                                      MD5

                                                      0a8747a2ac9ac08ae9508f36c6d75692

                                                      SHA1

                                                      b287a96fd6cc12433adb42193dfe06111c38eaf0

                                                      SHA256

                                                      32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                                                      SHA512

                                                      59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                                                    • C:\Users\Admin\AppData\Roaming\1000026000\5e7edf2ffb.exe

                                                      Filesize

                                                      1.7MB

                                                      MD5

                                                      6ec533d4b68b9b65f45160ba3bfc9422

                                                      SHA1

                                                      488be541bd2b2e42770c9e2bae875f6f97f51cfb

                                                      SHA256

                                                      dbe5d0f7237469a486de479008f1abca3d06a8a2b0ad64f26453d00e63000258

                                                      SHA512

                                                      99ceac7775eb344221dbba859cc37834e9b553b9b6eb27fa6dc807b5b4fac8016b2802a66cfba6a4f092feb05443c6642cb3fcb400befacdaad3747c6ce46cfc

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\AlternateServices.bin

                                                      Filesize

                                                      12KB

                                                      MD5

                                                      2918a56a816918f1cb9ff49f8e946919

                                                      SHA1

                                                      c4f377c01abc282df94171eae7d41a317da98088

                                                      SHA256

                                                      586c99f970145b75ec349476ab6be9d8ff3106e5632649421b59271ed85b3212

                                                      SHA512

                                                      65438e4f536b91c407ac160861fdbe95140faa144cd465dd48a88b47f3b43ff7b8ca52600600a09e0d8fe2fb5d96a9b5d99952282f1565f46a16023a5f1f527f

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\AlternateServices.bin

                                                      Filesize

                                                      15KB

                                                      MD5

                                                      f5f5b0601af01c848dd4290338a47757

                                                      SHA1

                                                      aa344fc737fff7941fe1b1c7d0858fabd2d3f0a9

                                                      SHA256

                                                      bb6ce5900a05cce10305fa74cf7b2fe46af91dd8f9bd7e0b4b624810d9a86339

                                                      SHA512

                                                      3987629587d47d04c261917d6b658f4944ad9ee87d369a458ad1814cb2fe01314749224bdabd6bea127ad7f04f5eec82247068bc6a61fe43d5d61115425272a1

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\AlternateServices.bin

                                                      Filesize

                                                      20KB

                                                      MD5

                                                      7d2cffba0d132140ac23fc674cc3c125

                                                      SHA1

                                                      1ec57c104e6522e0c1c92d26d1c6b93c6973edb4

                                                      SHA256

                                                      517d5798d5d8e65277464dcc3ec9b03756b0668a20f6b8fff7c8d5fc4e7d869b

                                                      SHA512

                                                      df1a748e736e90855a3d12a0b56ea12ed992f6523f53e680d070f89cdbdd24e8471ad7e5990c6f422b29300ff098a9df2e5c18970e6dd855e2af986ec7a4a6d7

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\AlternateServices.bin

                                                      Filesize

                                                      21KB

                                                      MD5

                                                      9e94300a0997d3de7a4af2ca92ab0174

                                                      SHA1

                                                      e8cda31fb06102349daa3a2ae34ef1976d999d6e

                                                      SHA256

                                                      c266cc103da858f42d5f0fa70f400bd2e7526c9319213f968d84a1f665eea1c1

                                                      SHA512

                                                      c182644459c0e3d3512c61cd46373b19aee1ae78d00e9eb021ed195202ce157428a9dc0fb9c1cda617be47d7cb0b869845825f825d93347f353fa80c1a48bd68

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\AlternateServices.bin

                                                      Filesize

                                                      23KB

                                                      MD5

                                                      9a0f2aa6de56a0de4e5cf45bbe59a9e3

                                                      SHA1

                                                      b9616a89cf1c969c4e47d0f6d38bba83be410a14

                                                      SHA256

                                                      a38b564e6f310e415355147f45a4d1227eb630f0a6ebb549f406780691b508aa

                                                      SHA512

                                                      4afd635a61433eb11c785fc755e37a9e1d843615b0ca14d7d22031ba0863af43033e9f03811a12c59e0207fcd27149f983494d3b8de4587b7dbfe2a8555bab74

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\db\data.safe.tmp

                                                      Filesize

                                                      25KB

                                                      MD5

                                                      bfc631a067572604760a6984ace287c3

                                                      SHA1

                                                      9f539fc24234920af9ad5840808d8d551b0e2b97

                                                      SHA256

                                                      aa64acbed8b2b4fd71814cc56a8b06417c6d0b114ef9d755d2bba3be3d85a7eb

                                                      SHA512

                                                      077cfc33ab49078e245256f247b117a6dbedfbaf385a995469fed0be06469d33d65de062147e454a223ab13055a72be20f7ac80d6d4844b47d5ad95824b7451a

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\db\data.safe.tmp

                                                      Filesize

                                                      21KB

                                                      MD5

                                                      533c8013689986d89106556912a66505

                                                      SHA1

                                                      fcd53af96aca58682fbb54c51465a3dc7fd02ee8

                                                      SHA256

                                                      47a3bd07e6bba7374a21c8125b080e134daa09e69153bddd9c84031ece513175

                                                      SHA512

                                                      13ec316509a94c4f566944a770be8c2e9221dbf2ec31a87d953077132596734c5d72d2623837f4d137273fb9d7ebd08c68cc3ff7cd43293ab3f41aec14f1b332

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\pending_pings\1cda92d8-fd4e-4f32-bd74-d49c21196c1c

                                                      Filesize

                                                      982B

                                                      MD5

                                                      825d780b9408dfbc56b793d8d810efb1

                                                      SHA1

                                                      093b38a3e6afd81f43370d47f964202d62d9d1af

                                                      SHA256

                                                      13a4d72c9277dc6970c7a04eec0e4ee83ac1365030dbf0461353eb0827ee6a91

                                                      SHA512

                                                      6966d1cfcafb02155b56334f3bc40ff30e0cb10bb2f845c525195a993f30c654be1ddd1ffd52ae39253b63a074548b8cd90cfc7c425a3b0aeda13b5da3e955b1

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\pending_pings\cafdf567-e37d-40bd-a3e9-8dfe61d81e76

                                                      Filesize

                                                      659B

                                                      MD5

                                                      d96575e91be24c28c044de53e6165e32

                                                      SHA1

                                                      089e4a19ebb1e86f71ddb2ad7115f8fa2e42280c

                                                      SHA256

                                                      2d56899cbdc9a240f915521e19219d486aabd44d68620e33beada1cb9f53e845

                                                      SHA512

                                                      df1d9eb7d3c1763cb61d2648e8deae54ec4b173b6f3dd73fdb8387c88c806dee1c74c67438ae50393a174a87db082dbc045ed72fc67aa597562d2fcc3a563cdb

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

                                                      Filesize

                                                      1.1MB

                                                      MD5

                                                      842039753bf41fa5e11b3a1383061a87

                                                      SHA1

                                                      3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                                                      SHA256

                                                      d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                                                      SHA512

                                                      d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

                                                      Filesize

                                                      116B

                                                      MD5

                                                      2a461e9eb87fd1955cea740a3444ee7a

                                                      SHA1

                                                      b10755914c713f5a4677494dbe8a686ed458c3c5

                                                      SHA256

                                                      4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                                                      SHA512

                                                      34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

                                                      Filesize

                                                      372B

                                                      MD5

                                                      bf957ad58b55f64219ab3f793e374316

                                                      SHA1

                                                      a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                                                      SHA256

                                                      bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                                                      SHA512

                                                      79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

                                                      Filesize

                                                      17.8MB

                                                      MD5

                                                      daf7ef3acccab478aaa7d6dc1c60f865

                                                      SHA1

                                                      f8246162b97ce4a945feced27b6ea114366ff2ad

                                                      SHA256

                                                      bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                                                      SHA512

                                                      5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\prefs-1.js

                                                      Filesize

                                                      11KB

                                                      MD5

                                                      f9353e4640e4ac930f1678a5e2816d06

                                                      SHA1

                                                      580b93727adf730ec0d7c389f5ffe8e85a543af8

                                                      SHA256

                                                      231c85754419ff61588aad2eee6dcf14bd03a2795609d8903f5c8e4728005c4f

                                                      SHA512

                                                      017e468400b27147e47fe923ed4e7c6b3c87fc1ef30158bd662201b5c3f0296138dfa584c48c41e427c0cde86c859de1e7620c83b92baee0627f8f614c6b097d

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\prefs-1.js

                                                      Filesize

                                                      12KB

                                                      MD5

                                                      6e95444e916268db3d4dfe651fa423bf

                                                      SHA1

                                                      dc843c2a5fb957f8eefeff24ab9008179c1bc8d7

                                                      SHA256

                                                      7ebfdd5a541a5844aa592dfa10f9d415a42261a873c63087d982e3900ab91ea7

                                                      SHA512

                                                      8800502812db73a33ba78c0660cfef3ad8992d81303e8a390ba168411d622086569852e5ab6004f849289eeadb84f2c0f2e1fb3af42d51bfaa9c8f11bc3246f7

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\prefs-1.js

                                                      Filesize

                                                      15KB

                                                      MD5

                                                      ca2c2759eb809526c2a0e3da15abf1a1

                                                      SHA1

                                                      8aac7721ad5e8379f87f4b82fcad895a71270faa

                                                      SHA256

                                                      a062494e7e7438f2e2d4d8449dc3f500588e49f466ba8963c6fd01a51ebce5a3

                                                      SHA512

                                                      e7374561318acaad7b5734075f56a30c131f636c8674cbc53b9e9c142f8398a320ab8751b344112e4e5ef2d4ccdf67d35bd14a681b578d65c4af14729208548c

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\prefs-1.js

                                                      Filesize

                                                      10KB

                                                      MD5

                                                      89f34a555ad11666aec121570e028eae

                                                      SHA1

                                                      0eb19d460f768768039200af37a4b3328a19bd43

                                                      SHA256

                                                      b24129710007053dd62da465c00ba31fe3c1ec5af94a56e471cdd321ab6cfbc2

                                                      SHA512

                                                      f0a6c82728653413e8e05a3a6cc13d433a125357f7344b9c38e2a47442f5dce44a1ee2bb329c5ba90884dca77dbb8e9b68da1a527178a8e583ad740f5bac2de6

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\prefs.js

                                                      Filesize

                                                      11KB

                                                      MD5

                                                      49a1cd6f38a739d8d13b9c47e40597e1

                                                      SHA1

                                                      455eeb6ed576725c60d358a47d91a39fd60d0c21

                                                      SHA256

                                                      341aa1adf9fb65eaa8c60e82ac836228781f8a352219656626922eb85d064d57

                                                      SHA512

                                                      c5bee669c56e216f41bcf7149a4511c717fc8283400cab6f6e84c12e7eee3830f0d64cae889a1f3b1af42a21bfa0f29de297cbb492bbb924fc89cfc686259217

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\sessionstore-backups\recovery.baklz4

                                                      Filesize

                                                      5KB

                                                      MD5

                                                      72484999c52181f633662d4bffb1e35f

                                                      SHA1

                                                      bf3518ba70a445714367c30f055a34f91d15bb58

                                                      SHA256

                                                      08539407f794df45b6baba62f834ccd75292968b66b751e806f28ed4c686ce95

                                                      SHA512

                                                      ddc241520423fb7705869bcb9bd36c22015e1f99ab253f12e282ee135a6b233547a046c2b68cb4f367df8bd37158e1406a7c8713e5c79c3b41577b5d80aae4df

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\sessionstore-backups\recovery.baklz4

                                                      Filesize

                                                      1KB

                                                      MD5

                                                      3d3b74aa48bdc86ee9230013af2fc15c

                                                      SHA1

                                                      f51b47d36de8af10131e9c504be51df0074f28d3

                                                      SHA256

                                                      5e3d56f06e425c4d150b670ba239a45d573b70b2f10f74f07ad1423f7a93fa25

                                                      SHA512

                                                      c4118916b3647a3aac5e253c94b846f6530be016c7c3b2fdcc6e9a504650ad102245136be2051f7650f1216e56b7b85a5a9e2028b8ac9d8881a8a00c31dd55e6

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

                                                      Filesize

                                                      376KB

                                                      MD5

                                                      338ea86ead3bdc42f13d17d0619b999e

                                                      SHA1

                                                      a4c8ca6f61301241b6b46be310dbcbca0a117d59

                                                      SHA256

                                                      056b4d1953862455ac36ef76bc5269d837dfcf366aa99fced53976807131198c

                                                      SHA512

                                                      aae9f2cb132e27e0673d87661fba902a816892cdaa225645a226cf0f7b15a1f19168c99f133daf096f15dd267a2eb7f248aa3f80adfefc914cce0c495e0982e6

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

                                                      Filesize

                                                      1.4MB

                                                      MD5

                                                      5239be90cb256801218c38e9c0627b31

                                                      SHA1

                                                      281bbff8cdd3fc4edb09621a60d449da12e196da

                                                      SHA256

                                                      2192ef9d7d22529aa035b5523665acd479111df0ba23ba3fb48c4727b47515e8

                                                      SHA512

                                                      3920cf4d344319f8fd4e44426302aaaae54223d1150ce4684109971a1c6b9394b19c3c4d3a240f9faff752f22be34b650ff0d7e2a507eebd2b5ec59e0c6985fc

                                                    • \??\pipe\LOCAL\crashpad_4360_CWNIPLQNQLOFYBMD

                                                      MD5

                                                      d41d8cd98f00b204e9800998ecf8427e

                                                      SHA1

                                                      da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                      SHA256

                                                      e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                      SHA512

                                                      cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                    • memory/748-656-0x0000000000850000-0x0000000000D0A000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/748-2821-0x0000000000850000-0x0000000000D0A000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/748-20-0x0000000000850000-0x0000000000D0A000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/748-2889-0x0000000000850000-0x0000000000D0A000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/748-2888-0x0000000000850000-0x0000000000D0A000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/748-2887-0x0000000000850000-0x0000000000D0A000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/748-2886-0x0000000000850000-0x0000000000D0A000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/748-21-0x0000000000850000-0x0000000000D0A000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/748-16-0x0000000000850000-0x0000000000D0A000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/748-944-0x0000000000850000-0x0000000000D0A000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/748-2847-0x0000000000850000-0x0000000000D0A000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/748-45-0x0000000000850000-0x0000000000D0A000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/748-44-0x0000000000850000-0x0000000000D0A000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/748-616-0x0000000000850000-0x0000000000D0A000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/748-43-0x0000000000850000-0x0000000000D0A000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/748-42-0x0000000000850000-0x0000000000D0A000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/748-2836-0x0000000000850000-0x0000000000D0A000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/748-41-0x0000000000850000-0x0000000000D0A000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/748-115-0x0000000000850000-0x0000000000D0A000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/748-19-0x0000000000850000-0x0000000000D0A000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/748-2146-0x0000000000850000-0x0000000000D0A000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/1060-3-0x0000000000B60000-0x000000000101A000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/1060-4-0x0000000000B60000-0x000000000101A000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/1060-2-0x0000000000B61000-0x0000000000B8F000-memory.dmp

                                                      Filesize

                                                      184KB

                                                    • memory/1060-18-0x0000000000B60000-0x000000000101A000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/1060-1-0x0000000077614000-0x0000000077616000-memory.dmp

                                                      Filesize

                                                      8KB

                                                    • memory/1060-0-0x0000000000B60000-0x000000000101A000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/2216-37-0x00000000008C0000-0x0000000000F4D000-memory.dmp

                                                      Filesize

                                                      6.6MB

                                                    • memory/2216-40-0x00000000008C0000-0x0000000000F4D000-memory.dmp

                                                      Filesize

                                                      6.6MB

                                                    • memory/2216-38-0x00000000008C1000-0x00000000008D5000-memory.dmp

                                                      Filesize

                                                      80KB

                                                    • memory/2216-39-0x00000000008C0000-0x0000000000F4D000-memory.dmp

                                                      Filesize

                                                      6.6MB

                                                    • memory/3916-63-0x0000000000660000-0x0000000000CED000-memory.dmp

                                                      Filesize

                                                      6.6MB

                                                    • memory/3916-61-0x0000000000660000-0x0000000000CED000-memory.dmp

                                                      Filesize

                                                      6.6MB

                                                    • memory/4588-89-0x00000000079C0000-0x0000000007A56000-memory.dmp

                                                      Filesize

                                                      600KB

                                                    • memory/4588-71-0x0000000002DE0000-0x0000000002E16000-memory.dmp

                                                      Filesize

                                                      216KB

                                                    • memory/4588-91-0x0000000006C90000-0x0000000006CB2000-memory.dmp

                                                      Filesize

                                                      136KB

                                                    • memory/4588-92-0x0000000008010000-0x00000000085B4000-memory.dmp

                                                      Filesize

                                                      5.6MB

                                                    • memory/4588-74-0x0000000005FD0000-0x0000000006036000-memory.dmp

                                                      Filesize

                                                      408KB

                                                    • memory/4588-75-0x0000000006040000-0x00000000060A6000-memory.dmp

                                                      Filesize

                                                      408KB

                                                    • memory/4588-73-0x0000000005780000-0x00000000057A2000-memory.dmp

                                                      Filesize

                                                      136KB

                                                    • memory/4588-86-0x00000000066D0000-0x00000000066EE000-memory.dmp

                                                      Filesize

                                                      120KB

                                                    • memory/4588-87-0x0000000006700000-0x000000000674C000-memory.dmp

                                                      Filesize

                                                      304KB

                                                    • memory/4588-85-0x00000000061B0000-0x0000000006504000-memory.dmp

                                                      Filesize

                                                      3.3MB

                                                    • memory/4588-90-0x0000000006C20000-0x0000000006C3A000-memory.dmp

                                                      Filesize

                                                      104KB

                                                    • memory/4588-72-0x00000000058A0000-0x0000000005EC8000-memory.dmp

                                                      Filesize

                                                      6.2MB

                                                    • memory/4996-2871-0x0000000000850000-0x0000000000D0A000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/5448-635-0x0000000000850000-0x0000000000D0A000-memory.dmp

                                                      Filesize

                                                      4.7MB