Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-09-2024 06:56

General

  • Target

    263c5c85871db56cb3438b6b38aff70fb2447ab02c7bdf2598a40e778ab1191f.exe

  • Size

    1.8MB

  • MD5

    656dad33ed55f336051883f756e7d041

  • SHA1

    83ff37e0f8badb060900511002fb14e8c4deade8

  • SHA256

    263c5c85871db56cb3438b6b38aff70fb2447ab02c7bdf2598a40e778ab1191f

  • SHA512

    ba950f704229070f0515b163630d59fbb9b2ba1b8b775259d84d3828713ab879880a1ee9baa4796898a29a941943868ec8ae111ba38c006fdefb9e12af81316c

  • SSDEEP

    49152:ceMiOEiw+JG001x6xaEQtgCnNSjQ7t1xphS80IHY4LVx:cA9+J/awxaDAjQ9pw80IHY4LV

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

c7817d

C2

http://31.41.244.10

Attributes
  • install_dir

    0e8d0864aa

  • install_file

    svoutse.exe

  • strings_key

    5481b88a6ef75bcf21333988a4e47048

  • url_paths

    /Dem7kTu/index.php

rc4.plain

Extracted

Family

stealc

Botnet

rave

C2

http://185.215.113.103

Attributes
  • url_path

    /e2b1563c6670f193.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Stealc

    Stealc is an infostealer written in C++.

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 12 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Identifies Wine through registry keys 2 TTPs 6 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 14 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 31 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 47 IoCs
  • Suspicious use of SendNotifyMessage 44 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\263c5c85871db56cb3438b6b38aff70fb2447ab02c7bdf2598a40e778ab1191f.exe
    "C:\Users\Admin\AppData\Local\Temp\263c5c85871db56cb3438b6b38aff70fb2447ab02c7bdf2598a40e778ab1191f.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:736
    • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
      "C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4904
      • C:\Users\Admin\AppData\Roaming\1000026000\9d5ed897e9.exe
        "C:\Users\Admin\AppData\Roaming\1000026000\9d5ed897e9.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:4936
      • C:\Users\Admin\AppData\Local\Temp\1000030001\a7eca94474.exe
        "C:\Users\Admin\AppData\Local\Temp\1000030001\a7eca94474.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:3936
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\Admin\AppData\Local\Temp\1000039041\do.ps1"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2240
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /c start msedge https://www.youtube.com/account
          4⤵
          • Checks computer location settings
          • System Location Discovery: System Language Discovery
          PID:1488
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.youtube.com/account
            5⤵
            • Enumerates system info in registry
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            PID:3376
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffb9a8546f8,0x7ffb9a854708,0x7ffb9a854718
              6⤵
                PID:2176
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2240,8164217213740951845,7845870023510113853,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2252 /prefetch:2
                6⤵
                  PID:5320
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2240,8164217213740951845,7845870023510113853,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2316 /prefetch:3
                  6⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:5328
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2240,8164217213740951845,7845870023510113853,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:8
                  6⤵
                    PID:5392
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,8164217213740951845,7845870023510113853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
                    6⤵
                      PID:5772
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,8164217213740951845,7845870023510113853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
                      6⤵
                        PID:5780
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,8164217213740951845,7845870023510113853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3924 /prefetch:1
                        6⤵
                          PID:5296
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,8164217213740951845,7845870023510113853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4720 /prefetch:1
                          6⤵
                            PID:6520
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,8164217213740951845,7845870023510113853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1
                            6⤵
                              PID:6704
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,8164217213740951845,7845870023510113853,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:1
                              6⤵
                                PID:6712
                              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2240,8164217213740951845,7845870023510113853,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5640 /prefetch:8
                                6⤵
                                  PID:6736
                                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2240,8164217213740951845,7845870023510113853,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5640 /prefetch:8
                                  6⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:6396
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,8164217213740951845,7845870023510113853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3640 /prefetch:1
                                  6⤵
                                    PID:7032
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,8164217213740951845,7845870023510113853,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4820 /prefetch:1
                                    6⤵
                                      PID:7040
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2240,8164217213740951845,7845870023510113853,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2208 /prefetch:2
                                      6⤵
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:5464
                                • C:\Windows\SysWOW64\cmd.exe
                                  "C:\Windows\system32\cmd.exe" /c start msedge https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
                                  4⤵
                                  • Checks computer location settings
                                  • System Location Discovery: System Language Discovery
                                  PID:3436
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://accounts.google.com/ServiceLogin?service=accountsettings
                                    5⤵
                                      PID:3664
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffb9a8546f8,0x7ffb9a854708,0x7ffb9a854718
                                        6⤵
                                          PID:4260
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,1366928157184829864,1037347526009546023,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
                                          6⤵
                                            PID:5644
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,1366928157184829864,1037347526009546023,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
                                            6⤵
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:5652
                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                        "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
                                        4⤵
                                        • Suspicious use of WriteProcessMemory
                                        PID:4880
                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                          "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
                                          5⤵
                                          • Checks processor information in registry
                                          • Modifies registry class
                                          • Suspicious use of AdjustPrivilegeToken
                                          • Suspicious use of FindShellTrayWindow
                                          • Suspicious use of SendNotifyMessage
                                          • Suspicious use of SetWindowsHookEx
                                          • Suspicious use of WriteProcessMemory
                                          PID:3472
                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2028 -parentBuildID 20240401114208 -prefsHandle 1944 -prefMapHandle 1936 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {66d5d3f4-9722-48f8-9a65-a8bb246375df} 3472 "\\.\pipe\gecko-crash-server-pipe.3472" gpu
                                            6⤵
                                              PID:2892
                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2464 -parentBuildID 20240401114208 -prefsHandle 2452 -prefMapHandle 2448 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b1de080c-fcdc-4176-8b9b-c6fd269bb3db} 3472 "\\.\pipe\gecko-crash-server-pipe.3472" socket
                                              6⤵
                                                PID:2224
                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3144 -childID 1 -isForBrowser -prefsHandle 3136 -prefMapHandle 3132 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {53b2a2ec-b34a-46d8-b24b-f8bd933d2a68} 3472 "\\.\pipe\gecko-crash-server-pipe.3472" tab
                                                6⤵
                                                  PID:1752
                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3616 -childID 2 -isForBrowser -prefsHandle 3612 -prefMapHandle 3604 -prefsLen 22693 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {14ae01a3-5a77-4da9-83a0-4f2580a6b594} 3472 "\\.\pipe\gecko-crash-server-pipe.3472" tab
                                                  6⤵
                                                    PID:4224
                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4540 -childID 3 -isForBrowser -prefsHandle 4532 -prefMapHandle 4528 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ce19dbba-22b4-4aa5-b5d6-093f4c9a55c1} 3472 "\\.\pipe\gecko-crash-server-pipe.3472" tab
                                                    6⤵
                                                      PID:4296
                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5064 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 2788 -prefMapHandle 5080 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {69e0c841-7b32-47fa-8528-ac1d0c2c0f75} 3472 "\\.\pipe\gecko-crash-server-pipe.3472" utility
                                                      6⤵
                                                      • Checks processor information in registry
                                                      PID:5492
                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5716 -childID 4 -isForBrowser -prefsHandle 5580 -prefMapHandle 5600 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {25937fba-0668-4ba2-9009-a67650f8278f} 3472 "\\.\pipe\gecko-crash-server-pipe.3472" tab
                                                      6⤵
                                                        PID:5360
                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5952 -childID 5 -isForBrowser -prefsHandle 5872 -prefMapHandle 5876 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3c62a98a-ffb8-4296-979e-b7f542432b01} 3472 "\\.\pipe\gecko-crash-server-pipe.3472" tab
                                                        6⤵
                                                          PID:5412
                                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6056 -childID 6 -isForBrowser -prefsHandle 6064 -prefMapHandle 6068 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {794f68c2-d20d-45a7-97f9-4a4dfcc3c21e} 3472 "\\.\pipe\gecko-crash-server-pipe.3472" tab
                                                          6⤵
                                                            PID:5900
                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
                                                        4⤵
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:4352
                                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                                          "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
                                                          5⤵
                                                          • Checks processor information in registry
                                                          PID:1240
                                                • C:\Windows\System32\CompPkgSrv.exe
                                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                  1⤵
                                                    PID:3436
                                                  • C:\Windows\System32\CompPkgSrv.exe
                                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                    1⤵
                                                      PID:6412
                                                    • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                                                      C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                                                      1⤵
                                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                      • Checks BIOS information in registry
                                                      • Executes dropped EXE
                                                      • Identifies Wine through registry keys
                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:5452
                                                    • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                                                      C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                                                      1⤵
                                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                      • Checks BIOS information in registry
                                                      • Executes dropped EXE
                                                      • Identifies Wine through registry keys
                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:6692

                                                    Network

                                                    MITRE ATT&CK Enterprise v15

                                                    Replay Monitor

                                                    Loading Replay Monitor...

                                                    Downloads

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                      Filesize

                                                      152B

                                                      MD5

                                                      9b008261dda31857d68792b46af6dd6d

                                                      SHA1

                                                      e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3

                                                      SHA256

                                                      9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da

                                                      SHA512

                                                      78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                      Filesize

                                                      152B

                                                      MD5

                                                      0446fcdd21b016db1f468971fb82a488

                                                      SHA1

                                                      726b91562bb75f80981f381e3c69d7d832c87c9d

                                                      SHA256

                                                      62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222

                                                      SHA512

                                                      1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                      Filesize

                                                      528B

                                                      MD5

                                                      502d4b574bf2e1411f11474ecc7510fc

                                                      SHA1

                                                      5b3933078636ae53617cb44972e0e9961e5c9ed2

                                                      SHA256

                                                      2efbf447798f4e5697dee9df8df25210ef344d2a15df842afdc46b7a15c0d2e0

                                                      SHA512

                                                      6d2ac17c080ced9284d337023da925f731a8e0b1d34665f90177c3d11936cc981a9d3f4eb0e67c1ff11226a6752b07661247c62000464b0ddfa7262b7f63ae37

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                      Filesize

                                                      1KB

                                                      MD5

                                                      871e65b53dddfd24ee74da1835aaba31

                                                      SHA1

                                                      72d5a563fb72e5cfec58655884b05893f2da837d

                                                      SHA256

                                                      3ab4a2a74c70289bc3e740c129aa81c985aef16fa8525e138c97a0849cd5b3d7

                                                      SHA512

                                                      61230821aac67e6dbadb43afdee632c4e964aa1a596e86782f6b39854e48a3fff42e7883ae6d9ec47f21acca637bb5c077369862819b240ccfa1f265fac6a1c1

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                      Filesize

                                                      1KB

                                                      MD5

                                                      120abb2b2d9a6edc9563be716b56d332

                                                      SHA1

                                                      98eda72c3d75990b8384b2dfb5ae9289eb605801

                                                      SHA256

                                                      37f420fb18fd72b94614af65eef18870eced24df5ee536b5f20f82177654c91d

                                                      SHA512

                                                      263f0454463b14884cc91c64ad0c5d631a351ec85df2877def34ea6d246fe5304d2dc1c85ae30eae05cc2eb51c63cd3ddd947fcb8b36624a5c27b472c6556eae

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                      Filesize

                                                      5KB

                                                      MD5

                                                      007e9a5bd4ade48fcf221819e788d9e1

                                                      SHA1

                                                      1d64c80604e192c7ba3c4f8686418a5ea8662bcc

                                                      SHA256

                                                      774ba421896ceda4a4d38067d5c49af86a77025fe83ced2a996fb40c0ea1fa0d

                                                      SHA512

                                                      934e16a0eb78475e0339c30c21c9f697bee0f649cd7ed8c64b3ff59b6ba7733c03963848ebc1a2e2f75290c557d032a6e60d9d4509eea34f6af02ee8b5aebc69

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                      Filesize

                                                      7KB

                                                      MD5

                                                      23e17ba0dceb665305f3720643356b66

                                                      SHA1

                                                      d671629334e0bb0dcd704bda855695cb9d1f4fc9

                                                      SHA256

                                                      0d216a8e0752eda25745629ceb9535f734c3814aa6fd667f5ead0957b6ffb929

                                                      SHA512

                                                      e884e52cc6ad2e6bc231bcc8f3c7fec73c1fa3064fbd66791aca3aa2cf92fef694e06e77e8485c0e792239ae73f4d38596502a28a1ab1fd41a44a971ff49a395

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                      Filesize

                                                      535B

                                                      MD5

                                                      8ae62e85a4430dba38cd142113ae5556

                                                      SHA1

                                                      9c4f0e433ffd9b44d740227d94b7e350eb39b80b

                                                      SHA256

                                                      3afc0858212d70512b873bc9abb9c786408886c44c0427e566d6284358c14c8f

                                                      SHA512

                                                      f8190ce6e7d1838a0f5edbca1fb5c556b988c2498e02685a0d49a0a6cfc3b6c3360e5acfa42e8e5e269202390e9572e6d8c604626403f5d5411c2ff692c5a720

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                      Filesize

                                                      535B

                                                      MD5

                                                      5be4cbf751be312ad68e7e05b915ce78

                                                      SHA1

                                                      0472eede2fe8e2b29b243c2d06191f21d2119c00

                                                      SHA256

                                                      3e429a712c2738a9d91d9b1f01827bfedbd6652bf960b10c527c0f712018cbd5

                                                      SHA512

                                                      7e56b5a129bd67aa7432bab16c7f51f739a96aed0814668b5a5e0eed06bb6b836d6b03fe2daff6be035950ef13eb825d710d35dfb13ea3e37f84910235da127f

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58f94f.TMP

                                                      Filesize

                                                      537B

                                                      MD5

                                                      b9203649ceec009bfecc7d9f907bc02e

                                                      SHA1

                                                      98202fb54b72581099a201884d7af7c92c63aa6f

                                                      SHA256

                                                      a057c34ab10c8605550d938343c7191b0b8189e29e19f1e35c3983da30a54b3f

                                                      SHA512

                                                      9cc6e993881a2ca69bbd9802e439bb34cefd9cc78d38d1c7a020a9882e076754acc7f4d57f2c6ff639cd37adafbf0a181c5df7d3ffec629fd6213b8f5d7dc1ae

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                      Filesize

                                                      16B

                                                      MD5

                                                      6752a1d65b201c13b62ea44016eb221f

                                                      SHA1

                                                      58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                      SHA256

                                                      0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                      SHA512

                                                      9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                      Filesize

                                                      8KB

                                                      MD5

                                                      b3e85c659778e01f06205a7c6bdce9e2

                                                      SHA1

                                                      f970596f4707571c0c8add44c92064750efc1029

                                                      SHA256

                                                      2f1c878d46feb2ac5f125b9eeb400b4a47e82518dffec880cd4d424b7a3e401a

                                                      SHA512

                                                      ff87475243aac43157a3cf208675537d8b4f58edabf1343b8cb936332ef2ec6230106f82a75cd24ad75ff1518a835c03a8d8be2c61e847dcd79bed05c020aa19

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                      Filesize

                                                      10KB

                                                      MD5

                                                      9a4a474e319fe5072d8b9d6a5cbfd820

                                                      SHA1

                                                      f9dd2610d0dfe92aa04ca8eace45c8c0f416c6e1

                                                      SHA256

                                                      f1b8a229b80158e4e6d9ae9fce221234e4245703895ce8ecfee61260ecd45254

                                                      SHA512

                                                      4d29d6eb9c80116c20aae40499a8cac4712f19990748999d1fad51ba871f3d09206d99f285de8e5a66d333ab869cbd62bec5ea7dac15d154757d2343d608f325

                                                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\lirn7gz7.default-release\activity-stream.discovery_stream.json

                                                      Filesize

                                                      29KB

                                                      MD5

                                                      adf52c247f1433ce50a906b48c31a392

                                                      SHA1

                                                      077547da0432c29e5491e80416b1400d47b92970

                                                      SHA256

                                                      7c2cfef5dab328f28774d9ba7deb94f285f7becdd6e833e7c92d5f88e7b1dbc2

                                                      SHA512

                                                      ecef2306d91d1e66a43af917bd6fd3d2f161d55c7e387f32163509104bd5350fa1694a6b35bf2eaa7a8ac78201e521ead033eb3224cbedcb6e258def75692ef3

                                                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\lirn7gz7.default-release\cache2\entries\58EFA56DB4BFFECB0EDA547894BC9A057159E22F

                                                      Filesize

                                                      13KB

                                                      MD5

                                                      6f78e76486383cdd58dc767f9eff39b2

                                                      SHA1

                                                      6281df0a1bf33cafdfd3ceb201c552506483f34c

                                                      SHA256

                                                      4971bc4e54a3c6c84f9ab233ffb125a4f457af00c27345ff302a6341d0ed41a1

                                                      SHA512

                                                      795ff7bd7a1dcc86c0f53944e58dca018e27fdfbd27ec11d11f2b2df80dfd325f5c3be14de715dafea243d1af8acc1fe9ea0ad9f173f57711f48d1825bd91e6d

                                                    • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe

                                                      Filesize

                                                      1.8MB

                                                      MD5

                                                      656dad33ed55f336051883f756e7d041

                                                      SHA1

                                                      83ff37e0f8badb060900511002fb14e8c4deade8

                                                      SHA256

                                                      263c5c85871db56cb3438b6b38aff70fb2447ab02c7bdf2598a40e778ab1191f

                                                      SHA512

                                                      ba950f704229070f0515b163630d59fbb9b2ba1b8b775259d84d3828713ab879880a1ee9baa4796898a29a941943868ec8ae111ba38c006fdefb9e12af81316c

                                                    • C:\Users\Admin\AppData\Local\Temp\1000039041\do.ps1

                                                      Filesize

                                                      2KB

                                                      MD5

                                                      e05e8f072b373beafe27cc11d85f947c

                                                      SHA1

                                                      1d6daeb98893e8122b8b69287ebd9d43f3c6138e

                                                      SHA256

                                                      717c09427fa5754ba92f92961545534048d0a76528c2e95c4d5ec6cef47c612f

                                                      SHA512

                                                      b3e34162e5ee43bb01f289eebc45fd3ea3e07f30be40dcf6635606540f912fe5c84d301e9f78e97dfe3ffe53e72547e50f3bcd7d4ebe5ab8da451a1989c469a0

                                                    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bid2skol.qnm.ps1

                                                      Filesize

                                                      60B

                                                      MD5

                                                      d17fe0a3f47be24a6453e9ef58c94641

                                                      SHA1

                                                      6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                      SHA256

                                                      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                      SHA512

                                                      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                    • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                                                      Filesize

                                                      479KB

                                                      MD5

                                                      09372174e83dbbf696ee732fd2e875bb

                                                      SHA1

                                                      ba360186ba650a769f9303f48b7200fb5eaccee1

                                                      SHA256

                                                      c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                                                      SHA512

                                                      b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                                                    • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                                                      Filesize

                                                      13.8MB

                                                      MD5

                                                      0a8747a2ac9ac08ae9508f36c6d75692

                                                      SHA1

                                                      b287a96fd6cc12433adb42193dfe06111c38eaf0

                                                      SHA256

                                                      32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                                                      SHA512

                                                      59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                                                    • C:\Users\Admin\AppData\Roaming\1000026000\9d5ed897e9.exe

                                                      Filesize

                                                      1.7MB

                                                      MD5

                                                      6ec533d4b68b9b65f45160ba3bfc9422

                                                      SHA1

                                                      488be541bd2b2e42770c9e2bae875f6f97f51cfb

                                                      SHA256

                                                      dbe5d0f7237469a486de479008f1abca3d06a8a2b0ad64f26453d00e63000258

                                                      SHA512

                                                      99ceac7775eb344221dbba859cc37834e9b553b9b6eb27fa6dc807b5b4fac8016b2802a66cfba6a4f092feb05443c6642cb3fcb400befacdaad3747c6ce46cfc

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\AlternateServices.bin

                                                      Filesize

                                                      6KB

                                                      MD5

                                                      88452b5e9cd0eface35055506faea2c4

                                                      SHA1

                                                      ae842a5e6dea35afd24ae6043ee57f414a6193e1

                                                      SHA256

                                                      59f521b84045c868897acc9969ab106e923108c2faae5ad76a771eb0bf75bd52

                                                      SHA512

                                                      a530013e43a3a6fd95f06b530c346d4f3ddbe004226e613b720a77d675e608b3d003a8556c289cfb2caee79682426ef910bc2f0f91dac96e6b29b21b8814c4f7

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\AlternateServices.bin

                                                      Filesize

                                                      10KB

                                                      MD5

                                                      af1fb2f579aa10bc84625fa7a24c6a99

                                                      SHA1

                                                      b6b08cae7a82b2527a4aa49299c83ec824b18e49

                                                      SHA256

                                                      2357a705698c8bcc868751cf237f68a1198bf01f836c93abdc565cf719559f76

                                                      SHA512

                                                      622156a1bc8820d02ecc8b42e16443b2a55b64a42aab6eb16c35f528ba9e201f9e2654251db6c162808d1c255fe5438d794dfe8d8a804986c2b8a9deb92a6366

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\AlternateServices.bin

                                                      Filesize

                                                      25KB

                                                      MD5

                                                      707bd3a208df854dffffda76f2b30931

                                                      SHA1

                                                      e3ca67939fb484c9e0858e0bbe8cc1d1d7cc2ec4

                                                      SHA256

                                                      9da37cb7f478f5e87521f85ad94d3e1238f2dcabeae0f73e3f91778c2006661f

                                                      SHA512

                                                      f1694a9fb64fe285b6c35ede180c27900cb4fa3a8b8cf3a13d81f23ba8d6c665f8b9f5a57de33092d6f04de8efe6be7be754dbb6c68aa42508f9c84384cd926e

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\AlternateServices.bin

                                                      Filesize

                                                      10KB

                                                      MD5

                                                      da81bc4b305e006e9038364f13a948b6

                                                      SHA1

                                                      b9ad7ecdbfaac60c47efbba12c59d760ce7f5f7b

                                                      SHA256

                                                      6fe82a2ae34ba13eee71752eae4554716e44be69de685f86bb8759f116ed6fee

                                                      SHA512

                                                      6013e275c35a8bd08cf6a56ad3e8e76331d9d619f9af9e2cfcaf65b43971da981bbe68fa64bf1ba4edea0751251038fdda208c0cdecc11b8d0b63f503ea7ae52

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\AlternateServices.bin

                                                      Filesize

                                                      17KB

                                                      MD5

                                                      62218a968adfd2d2fefc181f2611b41b

                                                      SHA1

                                                      dcfba17271713d9e7c26e1260002e3a7da35779c

                                                      SHA256

                                                      4f51d7c8e548eaa6db26fe2f7c42b8534d002e7248511f616a7bcb729b287741

                                                      SHA512

                                                      8ea5147d15708d0ef663f359069fcc5c490e1f3fd45de0641bd4eb11302079dff64530b26d23f2e2ebb6239eefbabeff174af53af6685319aad9bacc6a36843d

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\AlternateServices.bin

                                                      Filesize

                                                      23KB

                                                      MD5

                                                      73386d9a9a8d8fe7da562dcc2a579f95

                                                      SHA1

                                                      8d6b1cb5b9ffa76dee57eba0cf8af953a458c6ab

                                                      SHA256

                                                      fc326e1d5852f812ea045bb21774419a53bcf469799321981bb9dcbb509fd229

                                                      SHA512

                                                      09d6a0d0f14494120858b08e254482a34c9e6646254199e32acd02daeedf16199f479d8e8e50a2d81a5b94bbbc2d6dea840d942b9ba83f4ab43cfcc1365b9175

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\db\data.safe.tmp

                                                      Filesize

                                                      5KB

                                                      MD5

                                                      00fa40b6f9044996642f45b79cedd0a0

                                                      SHA1

                                                      9910e0d584b2dcbc8803bcea4bfdd772c34b4119

                                                      SHA256

                                                      fd6eb855d9339cd51b2275ea1ff11e97acba82d408d0c7c717fe9ef1ae9e326d

                                                      SHA512

                                                      5560ecb2fd382c32af9485f9ba1b512f53d42f8a82f3660dacca57c9aded75513c4d4446a1bbf07058e879ec9fba75e3d6316a348d4f7ba15b55e56285c63e4c

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\db\data.safe.tmp

                                                      Filesize

                                                      4KB

                                                      MD5

                                                      22e264367c8d556e19377a9d20487ee8

                                                      SHA1

                                                      c9e6512bb16df1c8c499ae876e30168a50a04e7b

                                                      SHA256

                                                      b246ff0bb1827a5b0bdd42ad28f52f1bb62e86ad0e3b5e9278b5908d2f0af309

                                                      SHA512

                                                      73cb1062e7ef10995484f27d4742f771f7634aab3aa44d911cd8d83245ebaa503b608964b03a92a4fe022dfcb0e89d33b02ecbfb13daa9a548d7134eebd96bda

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\db\data.safe.tmp

                                                      Filesize

                                                      15KB

                                                      MD5

                                                      115d8dfeb660d335d14688e9d9a044f5

                                                      SHA1

                                                      4f4c7df61cb1063ea24cac172590a5a1ef9b8735

                                                      SHA256

                                                      d327c83514de3e3d7c970109ba06b489cb8b34dc46f9a9b5de41b3319e19c327

                                                      SHA512

                                                      f47205f48cc68134f425ebe41a07ae4fb4c31bee92a3ae7373d485ec33937861499609a350c903dbd12e03749f5bfa8466a59c45a8277d3f7dc1c5b82104f19a

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\pending_pings\3d576677-2e6f-45c5-88b3-458445182166

                                                      Filesize

                                                      671B

                                                      MD5

                                                      51a7702255e0a2cb4a6a96a9e1036d56

                                                      SHA1

                                                      61e6eb692d2fae38738d737bb572214296e986bd

                                                      SHA256

                                                      3b85e472b014eff3e6b42a707f0dfba9a8c7b1b8e5cde35420cd2b8272629a50

                                                      SHA512

                                                      6189c6891480493e3690eeb2c37fad6673cb469f04c31447381eaa4ff1ff8a003a7766ee452320c9b90caba87c553a5f482343028bc13a0d7089c6c26acc7d3f

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\pending_pings\778ddebd-2813-47fe-a124-e2b4d469a9a8

                                                      Filesize

                                                      982B

                                                      MD5

                                                      830eed5d690786d73f50aaf6ce2e722b

                                                      SHA1

                                                      c9081f60f58d6fb6e0e1f0cc30ef39ebe437eba0

                                                      SHA256

                                                      72f2a134d3cc69261a74e4c48831a7b5f6f0953a2b611364a6ce461cdf80ac6b

                                                      SHA512

                                                      7cf54d20770a6c0bd28afcb61fc2263b7f28ebeab0abe76aebcfea6a41f76400f38cf67a4632f4121e1e6e2bcd23d71cb96190cf05367572c699ba4645aa7504

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\pending_pings\d71c89bc-e39a-4fa9-ba36-85e0675c38cf

                                                      Filesize

                                                      25KB

                                                      MD5

                                                      75cbe9ecdf7d3adf8de45c8babf00ef9

                                                      SHA1

                                                      fd4e7982235d3297fb700c3c421141fc2a5efc59

                                                      SHA256

                                                      1f3a151e8de45c55219d2a3286479afc471676244cd0702be041aaa99fd3daa3

                                                      SHA512

                                                      5c6477b28c40b3f137d00d339aba5193897e4e74d5855b7ee645ca28c4dcfdb20845f42b14457b4cfc05842b24564e4463c2232857d125c74535a38bbb94e56d

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

                                                      Filesize

                                                      1.1MB

                                                      MD5

                                                      842039753bf41fa5e11b3a1383061a87

                                                      SHA1

                                                      3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                                                      SHA256

                                                      d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                                                      SHA512

                                                      d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

                                                      Filesize

                                                      116B

                                                      MD5

                                                      2a461e9eb87fd1955cea740a3444ee7a

                                                      SHA1

                                                      b10755914c713f5a4677494dbe8a686ed458c3c5

                                                      SHA256

                                                      4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                                                      SHA512

                                                      34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

                                                      Filesize

                                                      372B

                                                      MD5

                                                      bf957ad58b55f64219ab3f793e374316

                                                      SHA1

                                                      a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                                                      SHA256

                                                      bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                                                      SHA512

                                                      79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

                                                      Filesize

                                                      17.8MB

                                                      MD5

                                                      daf7ef3acccab478aaa7d6dc1c60f865

                                                      SHA1

                                                      f8246162b97ce4a945feced27b6ea114366ff2ad

                                                      SHA256

                                                      bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                                                      SHA512

                                                      5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\prefs-1.js

                                                      Filesize

                                                      10KB

                                                      MD5

                                                      05ac0eec99b8e79aff3739baaa4a2b38

                                                      SHA1

                                                      b55e063ab5797003d4e18e5686f254789423ae5d

                                                      SHA256

                                                      daaae26918f529611f37906b4a387d049c04022e38e227d25481387eb0dda09a

                                                      SHA512

                                                      04d4b68df5afdb2dd7102ee1701cfe9396ffe84e4490a4a8a2d1c7369a6295cedb3ac681b533d1fa572d73a28650a5ebe2971846aa84ff4f2051e7f70ca6170d

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\prefs-1.js

                                                      Filesize

                                                      12KB

                                                      MD5

                                                      86374ac2571284f36703b664faa4cc8a

                                                      SHA1

                                                      bafbea3cb15cce43cd6ce111cf75d106ff342060

                                                      SHA256

                                                      85d296fd43b3557d7c7e14fa3001412afa0eeb0cb6d11626eebd33a37df8dd32

                                                      SHA512

                                                      fa993fdfa83ceb41bd45d4235654543717b76703014089363f0679d9a5510bf3b44e5a380ae662a12a62264737c6059ab9a678cff4d293d433483799a3981648

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\prefs-1.js

                                                      Filesize

                                                      15KB

                                                      MD5

                                                      d2727bf759a3b371ff0f9120b58efdae

                                                      SHA1

                                                      154b651aa5bac1809e3bc642046b177d866cdef1

                                                      SHA256

                                                      f5d939e05e84893106c218af100042fdfd95154ed13a347fa1ddf79ed6abb3ff

                                                      SHA512

                                                      2e495a2a1634aa4bdc2a17e867c7ed69c13b7f7c4d7b1f4e8da2b79823ceb0296e8b01edbe7102c8690a683e0898b4b63b75522bfcf412ebd4f16cec14b11c6d

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\prefs.js

                                                      Filesize

                                                      11KB

                                                      MD5

                                                      880164e4396e24262425f48258550577

                                                      SHA1

                                                      1170946536b6f6c819d3b4f51ec0333bc1a8f492

                                                      SHA256

                                                      b6b392917e333078bd1bc998119c155dd567cc5962716f68082d237bfa2b2dbd

                                                      SHA512

                                                      2fa67cb236c02aeda7729ce59d4c10ccd67b61905826ec554f575c91aaefd18f9ba438a3ad41e50d4a06358b64b6f3d02e13f0a52edc1b5c45c31a32b612ce77

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\sessionstore-backups\recovery.baklz4

                                                      Filesize

                                                      1KB

                                                      MD5

                                                      a870f31559a7b1cc83dd4452675837d1

                                                      SHA1

                                                      fd2c75ecba0874fd971e2b890432bf1c9dfc58c8

                                                      SHA256

                                                      7fd9a06bf969172a6aca448f3fed159b8c7e58b255d8210399ee59778c198e5f

                                                      SHA512

                                                      14a752cb0d3e70c45e997669dea74c97a3c81ce474f93446a13feaad64ce182f1984730f86afbc6cc43fad3bc61c5630a4575bf27dc60e53c7ae87ce9f5affc0

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\sessionstore-backups\recovery.baklz4

                                                      Filesize

                                                      5KB

                                                      MD5

                                                      f79245255994f12bc46487c3dfba74cf

                                                      SHA1

                                                      4cf4b8e8fb4e940a2f13b5dfbbf5ae31435b6498

                                                      SHA256

                                                      5330c34100a473cc9a454bb19e5d1c11bf6a7d2de5a257a573b648bc56f41405

                                                      SHA512

                                                      34351a780dd3ae1bfc0a3d6681bc2e5125eba3827dbcb6ada07ba61103a537f8e500b90a7ce8422d9aed77fba0dbe25d4bd29c0bffdcc12a65215aa351f8e7ac

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

                                                      Filesize

                                                      384KB

                                                      MD5

                                                      cd809dc65ed8026e95c062961c6bac3a

                                                      SHA1

                                                      fcf10cb845d97618af2cc50a02d420f5bba8439b

                                                      SHA256

                                                      845a8bca36b1726654379ec37d70f199a508127bd5387ceae7afc5721f0333fb

                                                      SHA512

                                                      2b74130cd3126b9a580c5711a88e19df3e3d024ccec19962a057b3efed5f5bbb5837db4ee046db3d24bb19a55418850c527d0f9f5d1829d9e57eea1f541c0ed5

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

                                                      Filesize

                                                      1.4MB

                                                      MD5

                                                      5239be90cb256801218c38e9c0627b31

                                                      SHA1

                                                      281bbff8cdd3fc4edb09621a60d449da12e196da

                                                      SHA256

                                                      2192ef9d7d22529aa035b5523665acd479111df0ba23ba3fb48c4727b47515e8

                                                      SHA512

                                                      3920cf4d344319f8fd4e44426302aaaae54223d1150ce4684109971a1c6b9394b19c3c4d3a240f9faff752f22be34b650ff0d7e2a507eebd2b5ec59e0c6985fc

                                                    • \??\pipe\LOCAL\crashpad_3664_SKDGPZGJFWTNMVFX

                                                      MD5

                                                      d41d8cd98f00b204e9800998ecf8427e

                                                      SHA1

                                                      da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                      SHA256

                                                      e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                      SHA512

                                                      cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                    • memory/736-18-0x0000000000210000-0x00000000006CA000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/736-0-0x0000000000210000-0x00000000006CA000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/736-1-0x0000000077614000-0x0000000077616000-memory.dmp

                                                      Filesize

                                                      8KB

                                                    • memory/736-2-0x0000000000211000-0x000000000023F000-memory.dmp

                                                      Filesize

                                                      184KB

                                                    • memory/736-3-0x0000000000210000-0x00000000006CA000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/736-4-0x0000000000210000-0x00000000006CA000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/2240-67-0x00000000058A0000-0x0000000005906000-memory.dmp

                                                      Filesize

                                                      408KB

                                                    • memory/2240-78-0x0000000005B70000-0x0000000005EC4000-memory.dmp

                                                      Filesize

                                                      3.3MB

                                                    • memory/2240-68-0x0000000005910000-0x0000000005976000-memory.dmp

                                                      Filesize

                                                      408KB

                                                    • memory/2240-79-0x0000000005F60000-0x0000000005F7E000-memory.dmp

                                                      Filesize

                                                      120KB

                                                    • memory/2240-82-0x0000000007260000-0x00000000072F6000-memory.dmp

                                                      Filesize

                                                      600KB

                                                    • memory/2240-83-0x00000000064F0000-0x000000000650A000-memory.dmp

                                                      Filesize

                                                      104KB

                                                    • memory/2240-66-0x0000000004FC0000-0x0000000004FE2000-memory.dmp

                                                      Filesize

                                                      136KB

                                                    • memory/2240-84-0x0000000006510000-0x0000000006532000-memory.dmp

                                                      Filesize

                                                      136KB

                                                    • memory/2240-65-0x0000000005040000-0x0000000005668000-memory.dmp

                                                      Filesize

                                                      6.2MB

                                                    • memory/2240-85-0x00000000078B0000-0x0000000007E54000-memory.dmp

                                                      Filesize

                                                      5.6MB

                                                    • memory/2240-63-0x0000000002650000-0x0000000002686000-memory.dmp

                                                      Filesize

                                                      216KB

                                                    • memory/2240-80-0x0000000005FA0000-0x0000000005FEC000-memory.dmp

                                                      Filesize

                                                      304KB

                                                    • memory/3936-54-0x0000000000270000-0x00000000008FD000-memory.dmp

                                                      Filesize

                                                      6.6MB

                                                    • memory/3936-513-0x0000000000270000-0x00000000008FD000-memory.dmp

                                                      Filesize

                                                      6.6MB

                                                    • memory/4904-667-0x00000000009C0000-0x0000000000E7A000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4904-86-0x00000000009C0000-0x0000000000E7A000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4904-3611-0x00000000009C0000-0x0000000000E7A000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4904-20-0x00000000009C0000-0x0000000000E7A000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4904-19-0x00000000009C1000-0x00000000009EF000-memory.dmp

                                                      Filesize

                                                      184KB

                                                    • memory/4904-483-0x00000000009C0000-0x0000000000E7A000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4904-2378-0x00000000009C0000-0x0000000000E7A000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4904-676-0x00000000009C0000-0x0000000000E7A000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4904-3662-0x00000000009C0000-0x0000000000E7A000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4904-3661-0x00000000009C0000-0x0000000000E7A000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4904-3302-0x00000000009C0000-0x0000000000E7A000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4904-3597-0x00000000009C0000-0x0000000000E7A000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4904-21-0x00000000009C0000-0x0000000000E7A000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4904-22-0x00000000009C0000-0x0000000000E7A000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4904-3651-0x00000000009C0000-0x0000000000E7A000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4904-16-0x00000000009C0000-0x0000000000E7A000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4904-106-0x00000000009C0000-0x0000000000E7A000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4904-482-0x00000000009C0000-0x0000000000E7A000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4904-3646-0x00000000009C0000-0x0000000000E7A000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4904-3647-0x00000000009C0000-0x0000000000E7A000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4904-3652-0x00000000009C0000-0x0000000000E7A000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4904-3631-0x00000000009C0000-0x0000000000E7A000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4936-64-0x0000000000260000-0x00000000008ED000-memory.dmp

                                                      Filesize

                                                      6.6MB

                                                    • memory/4936-37-0x0000000000260000-0x00000000008ED000-memory.dmp

                                                      Filesize

                                                      6.6MB

                                                    • memory/5452-2618-0x00000000009C0000-0x0000000000E7A000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/5452-2571-0x00000000009C0000-0x0000000000E7A000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/6692-3650-0x00000000009C0000-0x0000000000E7A000-memory.dmp

                                                      Filesize

                                                      4.7MB