Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-09-2024 06:42

General

  • Target

    9bfa2dd417b91950744e8037196965546d11adb4ed41ce4eef7a60bb57a99464.exe

  • Size

    1.8MB

  • MD5

    430fbb946370ff955dae5e717d188413

  • SHA1

    0e50738a179534126da1721597e22719cb9d0734

  • SHA256

    9bfa2dd417b91950744e8037196965546d11adb4ed41ce4eef7a60bb57a99464

  • SHA512

    b581d4bd81c8922e10c59fd51dc3250c5cb1a53e959f4a65684e748c52c80510da6dfa2e71f58712ab0c8217b4e1c5e6597a7671632c53de78a968fe827a901d

  • SSDEEP

    49152:st0b7Uk2XIwaVqnHkj1+vMBjNbsjvA0EWh:st0b7JuaVqijBjNYAdW

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

c7817d

C2

http://31.41.244.10

Attributes
  • install_dir

    0e8d0864aa

  • install_file

    svoutse.exe

  • strings_key

    5481b88a6ef75bcf21333988a4e47048

  • url_paths

    /Dem7kTu/index.php

rc4.plain

Extracted

Family

stealc

Botnet

rave

C2

http://185.215.113.103

Attributes
  • url_path

    /e2b1563c6670f193.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Stealc

    Stealc is an infostealer written in C++.

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 14 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 6 IoCs
  • Identifies Wine through registry keys 2 TTPs 7 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 14 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 33 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 47 IoCs
  • Suspicious use of SendNotifyMessage 44 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\9bfa2dd417b91950744e8037196965546d11adb4ed41ce4eef7a60bb57a99464.exe
    "C:\Users\Admin\AppData\Local\Temp\9bfa2dd417b91950744e8037196965546d11adb4ed41ce4eef7a60bb57a99464.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:2492
    • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
      "C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4212
      • C:\Users\Admin\AppData\Roaming\1000026000\f998e7ae68.exe
        "C:\Users\Admin\AppData\Roaming\1000026000\f998e7ae68.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:4448
      • C:\Users\Admin\AppData\Local\Temp\1000030001\2e8f31ed17.exe
        "C:\Users\Admin\AppData\Local\Temp\1000030001\2e8f31ed17.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:4784
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\Admin\AppData\Local\Temp\1000039041\do.ps1"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3688
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /c start msedge https://www.youtube.com/account
          4⤵
          • Checks computer location settings
          • System Location Discovery: System Language Discovery
          PID:1760
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.youtube.com/account
            5⤵
            • Enumerates system info in registry
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            PID:776
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffc4f6246f8,0x7ffc4f624708,0x7ffc4f624718
              6⤵
                PID:3840
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,11114702791353142446,13923236874704235193,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
                6⤵
                  PID:5280
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,11114702791353142446,13923236874704235193,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
                  6⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:5304
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,11114702791353142446,13923236874704235193,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2696 /prefetch:8
                  6⤵
                    PID:5328
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,11114702791353142446,13923236874704235193,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
                    6⤵
                      PID:5564
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,11114702791353142446,13923236874704235193,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
                      6⤵
                        PID:5576
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,11114702791353142446,13923236874704235193,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3864 /prefetch:1
                        6⤵
                          PID:5636
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,11114702791353142446,13923236874704235193,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:1
                          6⤵
                            PID:5692
                          • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,11114702791353142446,13923236874704235193,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5420 /prefetch:8
                            6⤵
                              PID:6560
                            • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,11114702791353142446,13923236874704235193,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5420 /prefetch:8
                              6⤵
                              • Suspicious behavior: EnumeratesProcesses
                              PID:6756
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,11114702791353142446,13923236874704235193,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5476 /prefetch:1
                              6⤵
                                PID:6772
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,11114702791353142446,13923236874704235193,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
                                6⤵
                                  PID:6780
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,11114702791353142446,13923236874704235193,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4472 /prefetch:1
                                  6⤵
                                    PID:7096
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,11114702791353142446,13923236874704235193,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:1
                                    6⤵
                                      PID:7104
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,11114702791353142446,13923236874704235193,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5148 /prefetch:2
                                      6⤵
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:6960
                                • C:\Windows\SysWOW64\cmd.exe
                                  "C:\Windows\system32\cmd.exe" /c start msedge https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
                                  4⤵
                                  • Checks computer location settings
                                  • System Location Discovery: System Language Discovery
                                  PID:3828
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://accounts.google.com/ServiceLogin?service=accountsettings
                                    5⤵
                                      PID:1944
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc4f6246f8,0x7ffc4f624708,0x7ffc4f624718
                                        6⤵
                                          PID:3120
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,3066859620048516404,12368518798783479019,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1904 /prefetch:2
                                          6⤵
                                            PID:4068
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,3066859620048516404,12368518798783479019,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 /prefetch:3
                                            6⤵
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:5456
                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                        "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
                                        4⤵
                                        • Suspicious use of WriteProcessMemory
                                        PID:3172
                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                          "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
                                          5⤵
                                          • Checks processor information in registry
                                          • Modifies registry class
                                          • Suspicious use of AdjustPrivilegeToken
                                          • Suspicious use of FindShellTrayWindow
                                          • Suspicious use of SendNotifyMessage
                                          • Suspicious use of SetWindowsHookEx
                                          • Suspicious use of WriteProcessMemory
                                          PID:2208
                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1976 -parentBuildID 20240401114208 -prefsHandle 1900 -prefMapHandle 1884 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ca7b5bec-b16a-4811-a2f2-d79206b00c6a} 2208 "\\.\pipe\gecko-crash-server-pipe.2208" gpu
                                            6⤵
                                              PID:4088
                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2468 -parentBuildID 20240401114208 -prefsHandle 2444 -prefMapHandle 2432 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {16952929-7e59-4f14-a088-b640e73c2806} 2208 "\\.\pipe\gecko-crash-server-pipe.2208" socket
                                              6⤵
                                                PID:4076
                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3052 -childID 1 -isForBrowser -prefsHandle 3080 -prefMapHandle 3108 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1140 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0c45b8be-49e9-40b4-b1f7-fcd0c70756e1} 2208 "\\.\pipe\gecko-crash-server-pipe.2208" tab
                                                6⤵
                                                  PID:5024
                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3608 -childID 2 -isForBrowser -prefsHandle 3620 -prefMapHandle 3360 -prefsLen 22693 -prefMapSize 244658 -jsInitHandle 1140 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {75398772-c1a1-4c20-8e10-92306277b941} 2208 "\\.\pipe\gecko-crash-server-pipe.2208" tab
                                                  6⤵
                                                    PID:3804
                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3792 -childID 3 -isForBrowser -prefsHandle 4052 -prefMapHandle 4048 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1140 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {697754e7-8756-446b-b9bf-53a099c6fd24} 2208 "\\.\pipe\gecko-crash-server-pipe.2208" tab
                                                    6⤵
                                                      PID:4960
                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4476 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4504 -prefMapHandle 4500 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3ba0d9a5-75da-478e-973c-104206028215} 2208 "\\.\pipe\gecko-crash-server-pipe.2208" utility
                                                      6⤵
                                                      • Checks processor information in registry
                                                      PID:5660
                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5740 -childID 4 -isForBrowser -prefsHandle 5604 -prefMapHandle 5776 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1140 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6e319e43-fd26-4a95-9106-b68e486695c6} 2208 "\\.\pipe\gecko-crash-server-pipe.2208" tab
                                                      6⤵
                                                        PID:720
                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5904 -childID 5 -isForBrowser -prefsHandle 5980 -prefMapHandle 5976 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1140 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {25779bb4-cbd8-41fa-a23d-a2778d11064f} 2208 "\\.\pipe\gecko-crash-server-pipe.2208" tab
                                                        6⤵
                                                          PID:5088
                                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6108 -childID 6 -isForBrowser -prefsHandle 6116 -prefMapHandle 6120 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1140 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9f5053de-c1cf-4b59-a355-2343a4e104a6} 2208 "\\.\pipe\gecko-crash-server-pipe.2208" tab
                                                          6⤵
                                                            PID:5312
                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
                                                        4⤵
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:2372
                                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                                          "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
                                                          5⤵
                                                          • Checks processor information in registry
                                                          PID:720
                                                • C:\Windows\System32\CompPkgSrv.exe
                                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                  1⤵
                                                    PID:4728
                                                  • C:\Windows\System32\CompPkgSrv.exe
                                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                    1⤵
                                                      PID:5380
                                                    • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                                                      C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                                                      1⤵
                                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                      • Checks BIOS information in registry
                                                      • Executes dropped EXE
                                                      • Identifies Wine through registry keys
                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:6308
                                                    • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                                                      C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                                                      1⤵
                                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                      • Checks BIOS information in registry
                                                      • Executes dropped EXE
                                                      • Identifies Wine through registry keys
                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:1644
                                                    • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                                                      C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                                                      1⤵
                                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                      • Checks BIOS information in registry
                                                      • Executes dropped EXE
                                                      • Identifies Wine through registry keys
                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:3132

                                                    Network

                                                    MITRE ATT&CK Enterprise v15

                                                    Replay Monitor

                                                    Loading Replay Monitor...

                                                    Downloads

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                      Filesize

                                                      152B

                                                      MD5

                                                      983cbc1f706a155d63496ebc4d66515e

                                                      SHA1

                                                      223d0071718b80cad9239e58c5e8e64df6e2a2fe

                                                      SHA256

                                                      cc34b8f8e3f4bfe4c9a227d88f56ea2dd276ca3ac81df622ff5e9a8ec46b951c

                                                      SHA512

                                                      d9cf2ca46d9379902730c81e615a3eb694873ffd535c6bb3ded2dc97cdbbfb71051ab11a07754ed6f610f04285605b702b5a48a6cfda3ee3287230c41c9c45cd

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                      Filesize

                                                      152B

                                                      MD5

                                                      111c361619c017b5d09a13a56938bd54

                                                      SHA1

                                                      e02b363a8ceb95751623f25025a9299a2c931e07

                                                      SHA256

                                                      d7be4042a1e3511b0dbf0ab5c493245e4ac314440a4ae0732813db01a21ef8bc

                                                      SHA512

                                                      fc16a4ad0b56899b82d05114d7b0ca8ee610cdba6ff0b6a67dea44faf17b3105109335359b78c0a59c9011a13152744a7f5d4f6a5b66ea519df750ef03f622b2

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                      Filesize

                                                      528B

                                                      MD5

                                                      b4e85fc6d0d761f859df2675188b603a

                                                      SHA1

                                                      e51c469f2d235c3a9d6354018f02b825184c4ef3

                                                      SHA256

                                                      6d606fc9f376392cad8ecfce82534449bdba88cd86918664e6bea4eacb6d6c33

                                                      SHA512

                                                      15ce48446ef371c9db8b9385bb133f3791fa6e31b19fe50cbd03e9fcc15c1deb97394e864210533ab3779cd8e909d3cf4907db6f3e6ca8e13383e47f624dc2c7

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                      Filesize

                                                      1KB

                                                      MD5

                                                      3e8d966a6ddb6debf854d3f4a0060cd2

                                                      SHA1

                                                      4d90e1c896389a9f93dd2baf24b5f2aa695ae58c

                                                      SHA256

                                                      39e00fdb59463aa046090cdcfb7a0533251570a2548921f5937221049a59714e

                                                      SHA512

                                                      4edf5d84dd1c774b7357e7adbdc0eb77adf6d7f05193b546fba102fc95f278ec93452c131fbb7eedd58da73967838660b6a1c1cd5ba365fd2b60b9e9bcf1788f

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                      Filesize

                                                      1KB

                                                      MD5

                                                      a1eb39234a5b5c845e53a6585411351f

                                                      SHA1

                                                      94723b87ea569c402e3a1a886ad8f50987d7c49c

                                                      SHA256

                                                      7badbafc509dfd966d54903ccf5ab6121289600a0adffa262bc35c584df419f2

                                                      SHA512

                                                      1198d99803d5f1071b369999fe65ee6d28cf91c7953cb5421100eedabc8dd0b7e04cb05fb718ea4f5cf344d74bd536bdd59532a27888e3395e353bfa3a22a6cc

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                      Filesize

                                                      5KB

                                                      MD5

                                                      0300d8545ce3e75aed96b112336148a7

                                                      SHA1

                                                      419eb8d8b2bf302beb58e51477f502829fb629a1

                                                      SHA256

                                                      1c5d0f1195e5837c8c83fe184d04b75f7e7ccb9d12c1e58d1064959572195444

                                                      SHA512

                                                      b1267103a6b88bb04ec4fa111bf1a0734fb75ae5dfd726eaa61bc6f3844a84cea9e1e9b41e0ff9f1751c87fd049f0b2072da5c504af2133f985ca4ae2ea9adb1

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                      Filesize

                                                      7KB

                                                      MD5

                                                      93b3b71f908c029de7f845e1c7b46cf7

                                                      SHA1

                                                      4470046f560ba55e7488cf39564740ad7e9ac10d

                                                      SHA256

                                                      a9e3dbba203c42f0d3b492531926864795a2230a4975f0d5bdda5de99d3bfe4e

                                                      SHA512

                                                      f1c073d951b9fc842b8e41b1ab602aee19e62ccf0754bdd47cf5bcba5f2df9593901f11700c0d1972e181f6e3b6f0c42e37129a043996fd48db95a0a5937e7f4

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                      Filesize

                                                      535B

                                                      MD5

                                                      2ab34c17c6e59e6885dca1b191fc58c6

                                                      SHA1

                                                      7a93ec8531e765e335d60e21ca8aeb9a2069f2f1

                                                      SHA256

                                                      8faa79cb3fb89e4fdd4a89555a1b5fa647912926764cb264c0f31e3de9a63319

                                                      SHA512

                                                      384ea464d75036fcb428c4abc7c50f0493d5cee40b25fdb4474b4356c9f05f9716152a8f7d08038dc3bc0de26830469a34634ac64c45686d34f60a18c813760e

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58c407.TMP

                                                      Filesize

                                                      537B

                                                      MD5

                                                      e65f27d7ea75d5ace8acb6dbcfa1bda3

                                                      SHA1

                                                      aec8ac5fc3ce1c3897b8db03fe209f6461e27f0f

                                                      SHA256

                                                      e6611fa013c8b9d3bbad747c71e4961da8587af14c8d4f1eb03d52863dd52602

                                                      SHA512

                                                      27bf9a46af21be1f24fbc810e3a7e5fa3735ce5eec6010f6903b1ac6ee15d10339dcf853ee0b83dcf50df0c7cb7de62aa1544e084ac8f52b4d27bde20bd5d225

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                      Filesize

                                                      16B

                                                      MD5

                                                      6752a1d65b201c13b62ea44016eb221f

                                                      SHA1

                                                      58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                      SHA256

                                                      0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                      SHA512

                                                      9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                      Filesize

                                                      8KB

                                                      MD5

                                                      bfe99d6b3f1f15cf01f1b740b5019f7e

                                                      SHA1

                                                      9d7d886c9524c5cd8f786b1cb86746ada3e80ed0

                                                      SHA256

                                                      cc87ace96b3cf27f24034151e3b7a7de69c08a0374e96e50e37f8ee762fade2b

                                                      SHA512

                                                      0278cecb2cf832511b001965f9ffbb33a0459605a9b243bf3f3f7934e016536e57d8ff853b80cb4173485b2ceffc870ff4af104e99cd69ddbe04e9d724788c80

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                      Filesize

                                                      10KB

                                                      MD5

                                                      1a1cfa71b844867ca66b2286356b5cae

                                                      SHA1

                                                      6a37bc1c5ff1e40882da7cd89b312277a05b11bb

                                                      SHA256

                                                      db740534ff23a66df192b41f0e1d9d1c482fd8a83a41423e1858841a051f5b86

                                                      SHA512

                                                      59050ac875e3a97d9b0564cf3229b0f585eef76872926e0c8f3069ba26e2fbcbb0b647361efa850bcb707582221f56e1329d985265bf6eac2cfe430fae634f70

                                                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zrrtvxky.default-release\cache2\entries\58EFA56DB4BFFECB0EDA547894BC9A057159E22F

                                                      Filesize

                                                      13KB

                                                      MD5

                                                      e570f113c253a56014f1b4902db054eb

                                                      SHA1

                                                      f80a47db1630eb2587b16d1126b0c03c695ad7c4

                                                      SHA256

                                                      36f6b2f4f90320a72c733c0ffa4ed518653b7809d14af9b16bb394f5f2a0bc7d

                                                      SHA512

                                                      ce6cb2c2a293ede9f93a1e1508c71047db08e8d48fb2bb1a994848419f80d39cc690c4184431f4e444008f41dece48bd8ee5e50cf925f6786cc5343a312f3438

                                                    • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe

                                                      Filesize

                                                      1.8MB

                                                      MD5

                                                      430fbb946370ff955dae5e717d188413

                                                      SHA1

                                                      0e50738a179534126da1721597e22719cb9d0734

                                                      SHA256

                                                      9bfa2dd417b91950744e8037196965546d11adb4ed41ce4eef7a60bb57a99464

                                                      SHA512

                                                      b581d4bd81c8922e10c59fd51dc3250c5cb1a53e959f4a65684e748c52c80510da6dfa2e71f58712ab0c8217b4e1c5e6597a7671632c53de78a968fe827a901d

                                                    • C:\Users\Admin\AppData\Local\Temp\1000039041\do.ps1

                                                      Filesize

                                                      2KB

                                                      MD5

                                                      e05e8f072b373beafe27cc11d85f947c

                                                      SHA1

                                                      1d6daeb98893e8122b8b69287ebd9d43f3c6138e

                                                      SHA256

                                                      717c09427fa5754ba92f92961545534048d0a76528c2e95c4d5ec6cef47c612f

                                                      SHA512

                                                      b3e34162e5ee43bb01f289eebc45fd3ea3e07f30be40dcf6635606540f912fe5c84d301e9f78e97dfe3ffe53e72547e50f3bcd7d4ebe5ab8da451a1989c469a0

                                                    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ut4luefh.m4d.ps1

                                                      Filesize

                                                      60B

                                                      MD5

                                                      d17fe0a3f47be24a6453e9ef58c94641

                                                      SHA1

                                                      6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                      SHA256

                                                      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                      SHA512

                                                      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                    • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                                                      Filesize

                                                      479KB

                                                      MD5

                                                      09372174e83dbbf696ee732fd2e875bb

                                                      SHA1

                                                      ba360186ba650a769f9303f48b7200fb5eaccee1

                                                      SHA256

                                                      c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                                                      SHA512

                                                      b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                                                    • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                                                      Filesize

                                                      13.8MB

                                                      MD5

                                                      0a8747a2ac9ac08ae9508f36c6d75692

                                                      SHA1

                                                      b287a96fd6cc12433adb42193dfe06111c38eaf0

                                                      SHA256

                                                      32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                                                      SHA512

                                                      59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                                                    • C:\Users\Admin\AppData\Roaming\1000026000\f998e7ae68.exe

                                                      Filesize

                                                      1.7MB

                                                      MD5

                                                      6ec533d4b68b9b65f45160ba3bfc9422

                                                      SHA1

                                                      488be541bd2b2e42770c9e2bae875f6f97f51cfb

                                                      SHA256

                                                      dbe5d0f7237469a486de479008f1abca3d06a8a2b0ad64f26453d00e63000258

                                                      SHA512

                                                      99ceac7775eb344221dbba859cc37834e9b553b9b6eb27fa6dc807b5b4fac8016b2802a66cfba6a4f092feb05443c6642cb3fcb400befacdaad3747c6ce46cfc

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\AlternateServices.bin

                                                      Filesize

                                                      6KB

                                                      MD5

                                                      8d0dc8619aa1c7dc48ce024d79f92ae1

                                                      SHA1

                                                      b908e35e6a447251878dbfa0195c185eaa7232b6

                                                      SHA256

                                                      f8551516638737305d528ff0ace77a196b08dee274e295e9863ba2650c787780

                                                      SHA512

                                                      bbb961d08e43944e0db84a552f1d86059d030aeeceece6d16c49b267fa4a85e1ad08b2b9a31a8be98b6a4878367dd564b2bbe6c659aed3087724c551405d81a9

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\AlternateServices.bin

                                                      Filesize

                                                      25KB

                                                      MD5

                                                      0bb7aab20bec10e5384c52cc9175d86d

                                                      SHA1

                                                      c7916374770739f86f88cd023a5a0f91cfa8b378

                                                      SHA256

                                                      8b5a8d18b15e267a7e81847a7cacb16ab571f9c022071bf9009f8665d4d26838

                                                      SHA512

                                                      5a27cc106ad7dc93a11a192c2055c3c4d26ad3544f15ffa3f12e8e749b5a667a45f4e1e614d77df2c6f2fb81dfc98e86cb3d6e1835c252019c69bec89401d16e

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\AlternateServices.bin

                                                      Filesize

                                                      10KB

                                                      MD5

                                                      0882d8c775441d2e96b6a2d399c1cdc0

                                                      SHA1

                                                      f7249dea891b49faf4cffb96b6661dad7bc04ee7

                                                      SHA256

                                                      f1e4a0cc35b1be7cf076805f2834b5aed910acdc5b3e5e7b717ff0c2e4ab776f

                                                      SHA512

                                                      884dc3568b7c4a59f594d37ab2f191a929702a38bc25e8233c82d81d2165b48131d45a9eea84b4acb6484011980d6a3ae518b3546f5562bfcac531aa23a07f01

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\AlternateServices.bin

                                                      Filesize

                                                      10KB

                                                      MD5

                                                      124a14933e8065f392df2acbc7dd080d

                                                      SHA1

                                                      8d81264a57d1c8ca5cb32117854e6bb0b12abf41

                                                      SHA256

                                                      304fa53d237d426bdc0a178ca4152e0437918b109538fca232a5f5f8f9fc096f

                                                      SHA512

                                                      78bf579df1e5a7ad18f0572f8e050ddcd2ff5e3a31031396fc2af1cf8e7b1c3f8ae2467758119735fa507b53cb629b6ba452e20adedf7b700631d4b73f1d4fff

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\datareporting\glean\db\data.safe.tmp

                                                      Filesize

                                                      5KB

                                                      MD5

                                                      781f9083d24fae1831d730d70d8d7257

                                                      SHA1

                                                      8e5d41d1eafa09e6abc99a563586d5151d488eb4

                                                      SHA256

                                                      7f542d74b0f8b14dd6abdd2ac33bd6e8b570d71b15d58fc0c240f96303a41212

                                                      SHA512

                                                      d1ad5d37a1ed643063cc2287855b219fca3735dccf442fe430d422066a0128eba3fe09088f663c235ec365e64f46095e1915989552c1e2b9a94fc645bab056ef

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\datareporting\glean\db\data.safe.tmp

                                                      Filesize

                                                      15KB

                                                      MD5

                                                      1e229bc119f87cafaecac896c64d3446

                                                      SHA1

                                                      deab71eab9ea3d0b354580d3dc1aee5fc5fc1c8e

                                                      SHA256

                                                      439523b5cb52da693203053c63d2ac6744e18a3e960a82c89a32e68659484f68

                                                      SHA512

                                                      de4a8ebdd1f6b11a94a26941eca38e04db85d626ba07ba6238711bc3b54cfa9134520c8e3ce426c072cf6d6835e708791460de9b2b253165b447bce834d40bf9

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\datareporting\glean\db\data.safe.tmp

                                                      Filesize

                                                      6KB

                                                      MD5

                                                      f824287e26fd766d82632945984c2a04

                                                      SHA1

                                                      0bf7f7daa46179f8323cdb4b368080e5a45b0a4c

                                                      SHA256

                                                      72377ca67484080da387a4d4bf2e01d159c0fe36bb3fdccabe3ff35774c2a89e

                                                      SHA512

                                                      1f925b19348e312d1d2dcf9b7424b38eaa1b738d88db228917f24698f3f62d7937f47fd931d8a19a7424acc4f2c50abeb69ea2e9f91178b1825abb17c47ede8d

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\datareporting\glean\pending_pings\73cd4f8d-e34b-4082-b779-23940720bee6

                                                      Filesize

                                                      982B

                                                      MD5

                                                      78975d0e4398cb512fa73b528c5de36b

                                                      SHA1

                                                      4c17f1c3a1c52b4b30fc65b93b958a69789e6093

                                                      SHA256

                                                      b296971cf55bf6c2750e74c69531821cc6036e41eeac4c9e77e5d733f9125b6e

                                                      SHA512

                                                      c1d931cd251e7ccbf13d17ac8eff4aad7a0a52467af6d1559468d7060148bf9e411ef45abbccc722b5a3a9245be49b5b8a6793baa59abeed0b5a70d572a24f58

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\datareporting\glean\pending_pings\87e4fafe-6eb9-4061-84d1-3aa09663823b

                                                      Filesize

                                                      27KB

                                                      MD5

                                                      ff5b5c581e99584a7665e8bcfb57d09a

                                                      SHA1

                                                      454f6c296cc012d421cc763007664e2475e72545

                                                      SHA256

                                                      19e8f515ea007a9d446a1c12b5b64db08962acc5bdfb853ade52af762371f7b5

                                                      SHA512

                                                      3fd1f2c8ec976a64ea0c385c8317393440a1d631cd99213b2cda3045ad26e5c85da3b471ce25e0c1c2be21fa0befda1b2fd27b6f151c60fe2d50a22a73f8ce11

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\datareporting\glean\pending_pings\afc63f8a-bb3b-4ff3-b30b-352c40a34e07

                                                      Filesize

                                                      671B

                                                      MD5

                                                      e4dd6170a22ce3bd839046d077222e5a

                                                      SHA1

                                                      843784fc5c3d6018f89bc0c49a0d33e76a7de9e8

                                                      SHA256

                                                      92377f69b9c0c16dbe82bbf0182ef89fb61ea2a1bfe64fa807a1659d81c02047

                                                      SHA512

                                                      b937cc572da092902fdf9fdeddb39758f221c6f9c9cb7da7f00ba89de3038867f8a73e99e6ebea20ae2dec82b857deb6da6366b12089f83fa33a0194b57990c7

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

                                                      Filesize

                                                      1.1MB

                                                      MD5

                                                      842039753bf41fa5e11b3a1383061a87

                                                      SHA1

                                                      3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                                                      SHA256

                                                      d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                                                      SHA512

                                                      d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

                                                      Filesize

                                                      116B

                                                      MD5

                                                      2a461e9eb87fd1955cea740a3444ee7a

                                                      SHA1

                                                      b10755914c713f5a4677494dbe8a686ed458c3c5

                                                      SHA256

                                                      4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                                                      SHA512

                                                      34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

                                                      Filesize

                                                      372B

                                                      MD5

                                                      bf957ad58b55f64219ab3f793e374316

                                                      SHA1

                                                      a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                                                      SHA256

                                                      bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                                                      SHA512

                                                      79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

                                                      Filesize

                                                      17.8MB

                                                      MD5

                                                      daf7ef3acccab478aaa7d6dc1c60f865

                                                      SHA1

                                                      f8246162b97ce4a945feced27b6ea114366ff2ad

                                                      SHA256

                                                      bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                                                      SHA512

                                                      5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\prefs-1.js

                                                      Filesize

                                                      12KB

                                                      MD5

                                                      a0e3c9c059cf38bf7e053900035a25de

                                                      SHA1

                                                      8c4a2801da75d7783269f0e9d642f015d8c92007

                                                      SHA256

                                                      044705f37571ffcf9b0db8387f2c71861460bccb8d84d8c3b428902380406ec0

                                                      SHA512

                                                      7be3bc7e8ca4657da2e7a6d8b0a3c671013a2298024dd627ccc5a01d6079a566579ea229dd6f1ac40d5c236610df6f6e9c9bf0705b2ca118a0274d4bef30fe9b

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\prefs.js

                                                      Filesize

                                                      11KB

                                                      MD5

                                                      022aa22afbc5e7438f2ba57d1da8a501

                                                      SHA1

                                                      33c4b6a266ecec6dd7d7e84a831919c6e905c474

                                                      SHA256

                                                      790c3a8f7ed43873f6b81e175d9d9464375e55781f819059c385efec4a6a97a6

                                                      SHA512

                                                      7773c7331355785e91ac710223415006ae5e61f78fa7b15c8868eb304338848343ab53d5ff6a1ea248eda1a6c023fb9f2b77869f24c51a339b338cec20b083b9

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\prefs.js

                                                      Filesize

                                                      11KB

                                                      MD5

                                                      86390e10296a77f36d8971a9ac42ad37

                                                      SHA1

                                                      aa600a731742601888b1a61d1fe73a707753fc0a

                                                      SHA256

                                                      405016c5e799161b206072e9f2c08bfc5b4a7a2e5383e73b8f9cd34ceed49bae

                                                      SHA512

                                                      65e2a2880ff22040b2613d00ff921671e12a78992174a95c4c792c1e6c00cbbc31a24071ceef8697be3ccbc5a4980fee846c8674195cc168864fbbb7b74791e3

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\sessionstore-backups\recovery.baklz4

                                                      Filesize

                                                      1KB

                                                      MD5

                                                      a8b2be7d8d1a90a8eb852aef698cd799

                                                      SHA1

                                                      9f8c299a0cbc8694b602a0d8b1885c9830f36991

                                                      SHA256

                                                      67d052818a3e75080ac38b35ef7525e90178eeb34fceed60976fcb8ccbd67215

                                                      SHA512

                                                      df5db5ac81fad97760b092e7452b9a6b7c33068c4655bb4d3ab0e834419889175bee52bc0b5c815aaa222802cc8a306c64299e8b7885a1892cacd553fe33f411

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\sessionstore-backups\recovery.baklz4

                                                      Filesize

                                                      5KB

                                                      MD5

                                                      7ae2c2bc0b9d868acd03a19a2f55b311

                                                      SHA1

                                                      ad879361c6a472ebf52abe95ad84cb4c5166c42a

                                                      SHA256

                                                      d88c67292dffa55ab6062132029fe3202c811c3572807203de7d7f6b0321fe0e

                                                      SHA512

                                                      1061d74bc34289538d7fd46325161a451a31413803a0a5ac2a2dc95d67b53a30205215deb5a9fac23686d2d5ecfbe0dee2e375a8bfe38b36fc2a568c07968f1c

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

                                                      Filesize

                                                      1.4MB

                                                      MD5

                                                      4554a0989510e34c3d09ded478fccb39

                                                      SHA1

                                                      6f981afa7be3af8dd8b89219f906193e68e4deaf

                                                      SHA256

                                                      ab7ffd8188ce60d0efb4d2601edc9f2fab36078f7d7791917bb9a2d14fca1be6

                                                      SHA512

                                                      eee932db19b8222806cc14f55eb47655412ad91a731552bfef3a3dd91b55bc0439c8335042886ad5ea480223a835f65a8fa844664ce73383d52f5d4f6531d8ba

                                                    • \??\pipe\LOCAL\crashpad_1944_SBQFTXWGNFEGNVYM

                                                      MD5

                                                      d41d8cd98f00b204e9800998ecf8427e

                                                      SHA1

                                                      da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                      SHA256

                                                      e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                      SHA512

                                                      cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                    • memory/1644-3577-0x0000000000C90000-0x000000000114D000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/2492-1-0x0000000077314000-0x0000000077316000-memory.dmp

                                                      Filesize

                                                      8KB

                                                    • memory/2492-15-0x0000000000010000-0x00000000004CD000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/2492-0-0x0000000000010000-0x00000000004CD000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/2492-4-0x0000000000010000-0x00000000004CD000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/2492-2-0x0000000000011000-0x000000000003F000-memory.dmp

                                                      Filesize

                                                      184KB

                                                    • memory/2492-3-0x0000000000010000-0x00000000004CD000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/3132-3604-0x0000000000C90000-0x000000000114D000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/3688-85-0x00000000056F0000-0x0000000005A44000-memory.dmp

                                                      Filesize

                                                      3.3MB

                                                    • memory/3688-68-0x0000000002390000-0x00000000023C6000-memory.dmp

                                                      Filesize

                                                      216KB

                                                    • memory/3688-69-0x0000000004EF0000-0x0000000005518000-memory.dmp

                                                      Filesize

                                                      6.2MB

                                                    • memory/3688-72-0x0000000004D10000-0x0000000004D32000-memory.dmp

                                                      Filesize

                                                      136KB

                                                    • memory/3688-74-0x0000000005680000-0x00000000056E6000-memory.dmp

                                                      Filesize

                                                      408KB

                                                    • memory/3688-87-0x0000000005CF0000-0x0000000005D3C000-memory.dmp

                                                      Filesize

                                                      304KB

                                                    • memory/3688-73-0x0000000005610000-0x0000000005676000-memory.dmp

                                                      Filesize

                                                      408KB

                                                    • memory/3688-86-0x0000000005CC0000-0x0000000005CDE000-memory.dmp

                                                      Filesize

                                                      120KB

                                                    • memory/3688-93-0x0000000007400000-0x00000000079A4000-memory.dmp

                                                      Filesize

                                                      5.6MB

                                                    • memory/3688-92-0x0000000006280000-0x00000000062A2000-memory.dmp

                                                      Filesize

                                                      136KB

                                                    • memory/3688-91-0x0000000006220000-0x000000000623A000-memory.dmp

                                                      Filesize

                                                      104KB

                                                    • memory/3688-90-0x0000000006DB0000-0x0000000006E46000-memory.dmp

                                                      Filesize

                                                      600KB

                                                    • memory/4212-3518-0x0000000000C90000-0x000000000114D000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4212-1491-0x0000000000C90000-0x000000000114D000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4212-3581-0x0000000000C90000-0x000000000114D000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4212-22-0x0000000000C90000-0x000000000114D000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4212-21-0x0000000000C90000-0x000000000114D000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4212-671-0x0000000000C90000-0x000000000114D000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4212-19-0x0000000000C91000-0x0000000000CBF000-memory.dmp

                                                      Filesize

                                                      184KB

                                                    • memory/4212-89-0x0000000000C90000-0x000000000114D000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4212-75-0x0000000000C90000-0x000000000114D000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4212-20-0x0000000000C90000-0x000000000114D000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4212-3580-0x0000000000C90000-0x000000000114D000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4212-3591-0x0000000000C90000-0x000000000114D000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4212-18-0x0000000000C90000-0x000000000114D000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4212-3582-0x0000000000C90000-0x000000000114D000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4212-635-0x0000000000C90000-0x000000000114D000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4212-3514-0x0000000000C90000-0x000000000114D000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4212-58-0x0000000000C90000-0x000000000114D000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4212-3534-0x0000000000C90000-0x000000000114D000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4212-54-0x0000000000C90000-0x000000000114D000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4212-3543-0x0000000000C90000-0x000000000114D000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4212-3579-0x0000000000C90000-0x000000000114D000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4212-67-0x0000000000C90000-0x000000000114D000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4212-3578-0x0000000000C90000-0x000000000114D000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4212-119-0x0000000000C90000-0x000000000114D000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4448-47-0x0000000000880000-0x0000000000F0D000-memory.dmp

                                                      Filesize

                                                      6.6MB

                                                    • memory/4448-59-0x0000000000880000-0x0000000000F0D000-memory.dmp

                                                      Filesize

                                                      6.6MB

                                                    • memory/4448-48-0x0000000000880000-0x0000000000F0D000-memory.dmp

                                                      Filesize

                                                      6.6MB

                                                    • memory/4448-38-0x0000000000880000-0x0000000000F0D000-memory.dmp

                                                      Filesize

                                                      6.6MB

                                                    • memory/4784-71-0x0000000000DA0000-0x000000000142D000-memory.dmp

                                                      Filesize

                                                      6.6MB

                                                    • memory/4784-57-0x0000000000DA0000-0x000000000142D000-memory.dmp

                                                      Filesize

                                                      6.6MB

                                                    • memory/6308-663-0x0000000000C90000-0x000000000114D000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/6308-664-0x0000000000C90000-0x000000000114D000-memory.dmp

                                                      Filesize

                                                      4.7MB