Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-09-2024 10:03

General

  • Target

    e9ea805e9928c1b071e362151ab49c55dd37924fe51c62c2445bf4e91d6b17e3.exe

  • Size

    1.8MB

  • MD5

    d4a8074d0e6ec329e01d59e2c977bcc3

  • SHA1

    2e680f12aed4c51ed2277082c3f8af9368f7f3cd

  • SHA256

    e9ea805e9928c1b071e362151ab49c55dd37924fe51c62c2445bf4e91d6b17e3

  • SHA512

    f670ea342da46e72001b55a7ec396638284baafeb6f7ee4c261d1323fbcf9cd9718eeeb2c917ac28d5a76939a7321895a277104ce654e6f037d477e72eb74e7f

  • SSDEEP

    24576:GDyzKfdwfy9f1QEz/srIUP1VEv6UEfYW7GobWa+n1YvaANs57ttoMOzzD+yVn5Az:Gf13NQdTPXdNBbN+WvrseMOzzD+yLAY

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

c7817d

C2

http://31.41.244.10

Attributes
  • install_dir

    0e8d0864aa

  • install_file

    svoutse.exe

  • strings_key

    5481b88a6ef75bcf21333988a4e47048

  • url_paths

    /Dem7kTu/index.php

rc4.plain

Extracted

Family

stealc

Botnet

rave

C2

http://185.215.113.103

Attributes
  • url_path

    /e2b1563c6670f193.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Stealc

    Stealc is an infostealer written in C++.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 12 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Identifies Wine through registry keys 2 TTPs 6 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 14 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 29 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 47 IoCs
  • Suspicious use of SendNotifyMessage 44 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\e9ea805e9928c1b071e362151ab49c55dd37924fe51c62c2445bf4e91d6b17e3.exe
    "C:\Users\Admin\AppData\Local\Temp\e9ea805e9928c1b071e362151ab49c55dd37924fe51c62c2445bf4e91d6b17e3.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:4012
    • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
      "C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2432
      • C:\Users\Admin\AppData\Local\Temp\1000030001\812b16d33c.exe
        "C:\Users\Admin\AppData\Local\Temp\1000030001\812b16d33c.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:5104
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\Admin\AppData\Local\Temp\1000039041\do.ps1"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1460
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /c start msedge https://www.youtube.com/account
          4⤵
          • Checks computer location settings
          • System Location Discovery: System Language Discovery
          PID:3448
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.youtube.com/account
            5⤵
            • Enumerates system info in registry
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            PID:324
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffc011446f8,0x7ffc01144708,0x7ffc01144718
              6⤵
                PID:3972
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2212,1606088957600998930,15359883203998422311,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2220 /prefetch:2
                6⤵
                  PID:5996
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2212,1606088957600998930,15359883203998422311,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:3
                  6⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:6004
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2212,1606088957600998930,15359883203998422311,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2696 /prefetch:8
                  6⤵
                    PID:6036
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,1606088957600998930,15359883203998422311,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
                    6⤵
                      PID:4448
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,1606088957600998930,15359883203998422311,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
                      6⤵
                        PID:448
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,1606088957600998930,15359883203998422311,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3892 /prefetch:1
                        6⤵
                          PID:5572
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,1606088957600998930,15359883203998422311,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4808 /prefetch:1
                          6⤵
                            PID:4628
                          • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2212,1606088957600998930,15359883203998422311,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5480 /prefetch:8
                            6⤵
                              PID:4956
                            • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2212,1606088957600998930,15359883203998422311,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5480 /prefetch:8
                              6⤵
                              • Suspicious behavior: EnumeratesProcesses
                              PID:5928
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,1606088957600998930,15359883203998422311,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
                              6⤵
                                PID:4760
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,1606088957600998930,15359883203998422311,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:1
                                6⤵
                                  PID:6096
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,1606088957600998930,15359883203998422311,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5896 /prefetch:1
                                  6⤵
                                    PID:4088
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,1606088957600998930,15359883203998422311,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5832 /prefetch:1
                                    6⤵
                                      PID:3524
                                • C:\Windows\SysWOW64\cmd.exe
                                  "C:\Windows\system32\cmd.exe" /c start msedge https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
                                  4⤵
                                  • Checks computer location settings
                                  • System Location Discovery: System Language Discovery
                                  PID:2776
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://accounts.google.com/ServiceLogin?service=accountsettings
                                    5⤵
                                      PID:1272
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffc011446f8,0x7ffc01144708,0x7ffc01144718
                                        6⤵
                                          PID:2808
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1936,15955108826535031488,12552280043719619447,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
                                          6⤵
                                            PID:4220
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1936,15955108826535031488,12552280043719619447,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
                                            6⤵
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:5160
                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                        "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
                                        4⤵
                                        • Suspicious use of WriteProcessMemory
                                        PID:3584
                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                          "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
                                          5⤵
                                          • Checks processor information in registry
                                          PID:4088
                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                        "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
                                        4⤵
                                        • Checks processor information in registry
                                        • Modifies registry class
                                        • Suspicious use of FindShellTrayWindow
                                        • Suspicious use of SendNotifyMessage
                                        • Suspicious use of SetWindowsHookEx
                                        • Suspicious use of WriteProcessMemory
                                        PID:4484
                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1932 -parentBuildID 20240401114208 -prefsHandle 1856 -prefMapHandle 1848 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {67f87667-91ad-4984-9713-d78ae18d69e4} 4484 "\\.\pipe\gecko-crash-server-pipe.4484" gpu
                                          5⤵
                                            PID:752
                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2416 -parentBuildID 20240401114208 -prefsHandle 2408 -prefMapHandle 2404 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1992747a-d145-4bf1-8ca2-08f0f0c47b2a} 4484 "\\.\pipe\gecko-crash-server-pipe.4484" socket
                                            5⤵
                                              PID:4884
                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3376 -childID 1 -isForBrowser -prefsHandle 3204 -prefMapHandle 3216 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1260 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {81424bbe-7ba1-47a7-995d-542512828acd} 4484 "\\.\pipe\gecko-crash-server-pipe.4484" tab
                                              5⤵
                                                PID:4068
                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3600 -childID 2 -isForBrowser -prefsHandle 3616 -prefMapHandle 3612 -prefsLen 22693 -prefMapSize 244658 -jsInitHandle 1260 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bc76a70d-c0cf-4c5c-80fd-7b4c0b5ae2ec} 4484 "\\.\pipe\gecko-crash-server-pipe.4484" tab
                                                5⤵
                                                  PID:1012
                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3616 -childID 3 -isForBrowser -prefsHandle 3832 -prefMapHandle 4092 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1260 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d2495ebf-1bdb-444a-aed4-be6fa9a48e7a} 4484 "\\.\pipe\gecko-crash-server-pipe.4484" tab
                                                  5⤵
                                                    PID:992
                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4476 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4564 -prefMapHandle 4552 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8b6ba667-a403-4750-b980-3514627b65e7} 4484 "\\.\pipe\gecko-crash-server-pipe.4484" utility
                                                    5⤵
                                                    • Checks processor information in registry
                                                    PID:5232
                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5560 -childID 4 -isForBrowser -prefsHandle 5768 -prefMapHandle 5616 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1260 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f05d08b6-8941-47a0-9301-1586e762709c} 4484 "\\.\pipe\gecko-crash-server-pipe.4484" tab
                                                    5⤵
                                                      PID:6120
                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5932 -childID 5 -isForBrowser -prefsHandle 6012 -prefMapHandle 6008 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1260 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5666f12d-77c4-4bed-b1db-f31a87f4d3fc} 4484 "\\.\pipe\gecko-crash-server-pipe.4484" tab
                                                      5⤵
                                                        PID:4748
                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5852 -childID 6 -isForBrowser -prefsHandle 6024 -prefMapHandle 6124 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1260 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cc9ac3e6-7875-408a-b037-315641564e5f} 4484 "\\.\pipe\gecko-crash-server-pipe.4484" tab
                                                        5⤵
                                                          PID:6028
                                                • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                                                  C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                                                  1⤵
                                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                  • Checks BIOS information in registry
                                                  • Executes dropped EXE
                                                  • Identifies Wine through registry keys
                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:4288
                                                • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                                                  C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                                                  1⤵
                                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                  • Checks BIOS information in registry
                                                  • Executes dropped EXE
                                                  • Identifies Wine through registry keys
                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:4488
                                                • C:\Windows\System32\CompPkgSrv.exe
                                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                  1⤵
                                                    PID:4556
                                                  • C:\Windows\System32\CompPkgSrv.exe
                                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                    1⤵
                                                      PID:5904
                                                    • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                                                      C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                                                      1⤵
                                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                      • Checks BIOS information in registry
                                                      • Executes dropped EXE
                                                      • Identifies Wine through registry keys
                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:5960

                                                    Network

                                                    MITRE ATT&CK Enterprise v15

                                                    Replay Monitor

                                                    Loading Replay Monitor...

                                                    Downloads

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                      Filesize

                                                      152B

                                                      MD5

                                                      719923124ee00fb57378e0ebcbe894f7

                                                      SHA1

                                                      cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

                                                      SHA256

                                                      aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

                                                      SHA512

                                                      a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                      Filesize

                                                      152B

                                                      MD5

                                                      d7114a6cd851f9bf56cf771c37d664a2

                                                      SHA1

                                                      769c5d04fd83e583f15ab1ef659de8f883ecab8a

                                                      SHA256

                                                      d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

                                                      SHA512

                                                      33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                      Filesize

                                                      504B

                                                      MD5

                                                      d19b0d6c2d311926e861bc2984c7ff07

                                                      SHA1

                                                      6caaacfa6fd34b83a8ffbaa9dfc4258041623cba

                                                      SHA256

                                                      b8b93216e59c2a17010c4aef0d682e897c133430055021f54b29ba00a8692280

                                                      SHA512

                                                      e7534b3ce545915d8b1d2432442f0b7c68a83c2af6102b2956d712a45c6c7defea1eeb0d1d86619471f03709a81310ddf97caa3d1fe3a11cbfdd5a7a222f9618

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                      Filesize

                                                      5KB

                                                      MD5

                                                      a811ecbdbe21ab3cb62df9e8aa181811

                                                      SHA1

                                                      baa8f52e27774edf94083d4039bf62e5af3fba17

                                                      SHA256

                                                      14a7503a044eb09c05d81c0614d7080af3e71f5d85aacb6ccb0e0297a022d96f

                                                      SHA512

                                                      7b5fc9e61fde0ecfc2e95e681dea01311d62ce317658b19174e345a33b7848cb15c561235c7220a34c1a59af086e007c7ad5c80ccd132734a7194e6326c9ca5f

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                      Filesize

                                                      7KB

                                                      MD5

                                                      2fd555e302660820cb07c37cdd7ff537

                                                      SHA1

                                                      2110ca5227ddd1a830ca08d493851365ef92c4cc

                                                      SHA256

                                                      425d92191adf094ecec8941b2cfacfd9179e0f293dd0fe5876e89082199dc689

                                                      SHA512

                                                      aaba079af40aa9c9f2665de42a06abefff40644f319963c8de934403bfaa93c9d9e70bf7a88ac9bed1c6dae638a90e07a325ece78964af0cca0e9baa49753605

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                      Filesize

                                                      16B

                                                      MD5

                                                      6752a1d65b201c13b62ea44016eb221f

                                                      SHA1

                                                      58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                      SHA256

                                                      0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                      SHA512

                                                      9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                      Filesize

                                                      8KB

                                                      MD5

                                                      aa035ae442b5d34b403e2c408d84e873

                                                      SHA1

                                                      8928027f58c647ec0007e7f5f6b1855381755238

                                                      SHA256

                                                      67c56f7a023e8968c3487599a324b01b630bdcf38ecf156a8914e29dd279a8ae

                                                      SHA512

                                                      85103cc51a1dd6c551da58be5f9f1d0605ec955fdac145c3b250c399ef0b271d8aa5bcbadf0e410470182a27350b4997db5c1954b9146a4e13dcefdef1d44ad5

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                      Filesize

                                                      10KB

                                                      MD5

                                                      54bbe34d9cc2b201eccc0316bfcec624

                                                      SHA1

                                                      45071b58b3d3e27727ad4760f9b702ef1465195d

                                                      SHA256

                                                      f7ac620f526ac988d144d268f100322d0116d4537bd248beb74ed971ba34eec2

                                                      SHA512

                                                      166ed79c28a2c4ed0412029effac7c3d9bbb59a5dde907ff2ba97f4920fbd4acf184f7cfcc2113eef1bd0b5daa374be009775685ad4381cc2f21dbcd1593ad04

                                                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\activity-stream.discovery_stream.json

                                                      Filesize

                                                      31KB

                                                      MD5

                                                      ca751cd0b23bfa3d817df639461edc6f

                                                      SHA1

                                                      368ff4d369f1dc86db3dadadd669d92f4a4eca93

                                                      SHA256

                                                      f5160ab17c9aaf273364fa4aba6c973a87b70deec0fbd48b189b24f12769a6b6

                                                      SHA512

                                                      ac0ea3cdd0f8b39f5b014b70617ae5d075c341d36097752acf94723455507e1d40742ec202605a8da742684019afb2ccd0f2483e7f91a6e73b0bc824be955ed7

                                                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\cache2\entries\58EFA56DB4BFFECB0EDA547894BC9A057159E22F

                                                      Filesize

                                                      13KB

                                                      MD5

                                                      94abcbdbb4b5629f8d7ac4ef526671ad

                                                      SHA1

                                                      3b414e450ee18a039535e94b92f48878f5287643

                                                      SHA256

                                                      dcd4f35469596c1b0ee26b3d2907a9101c7d284c2cff73ca75c8993c1bba0c4a

                                                      SHA512

                                                      5f8140131d2d0562f27b2ee2a7470bea95a8c31533f04ae49c3d2334c18137929397e931c98657271b7ab8eef43d7b428d14cf5894105894bfb19b38d30b329b

                                                    • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe

                                                      Filesize

                                                      1.8MB

                                                      MD5

                                                      d4a8074d0e6ec329e01d59e2c977bcc3

                                                      SHA1

                                                      2e680f12aed4c51ed2277082c3f8af9368f7f3cd

                                                      SHA256

                                                      e9ea805e9928c1b071e362151ab49c55dd37924fe51c62c2445bf4e91d6b17e3

                                                      SHA512

                                                      f670ea342da46e72001b55a7ec396638284baafeb6f7ee4c261d1323fbcf9cd9718eeeb2c917ac28d5a76939a7321895a277104ce654e6f037d477e72eb74e7f

                                                    • C:\Users\Admin\AppData\Local\Temp\1000030001\812b16d33c.exe

                                                      Filesize

                                                      1.7MB

                                                      MD5

                                                      250051046eae3713ed1af118169d9227

                                                      SHA1

                                                      66ecbbeffdbb6bae912fc9f21b52faeac7b73d49

                                                      SHA256

                                                      c1d2816e557482077a88b8e23581cd82a92dfca70fd1e7ceaec4ba3adbd7d136

                                                      SHA512

                                                      a9a49aaf7e56466ec9cbdf86564ba5ad875d8233f12b26c718dc163dfb7d9e139891e5a422eca933e41c3bc19d5dc62d47606e23019fb0cce8f281a981a82d1e

                                                    • C:\Users\Admin\AppData\Local\Temp\1000039041\do.ps1

                                                      Filesize

                                                      2KB

                                                      MD5

                                                      e05e8f072b373beafe27cc11d85f947c

                                                      SHA1

                                                      1d6daeb98893e8122b8b69287ebd9d43f3c6138e

                                                      SHA256

                                                      717c09427fa5754ba92f92961545534048d0a76528c2e95c4d5ec6cef47c612f

                                                      SHA512

                                                      b3e34162e5ee43bb01f289eebc45fd3ea3e07f30be40dcf6635606540f912fe5c84d301e9f78e97dfe3ffe53e72547e50f3bcd7d4ebe5ab8da451a1989c469a0

                                                    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_20vl3yap.euj.ps1

                                                      Filesize

                                                      60B

                                                      MD5

                                                      d17fe0a3f47be24a6453e9ef58c94641

                                                      SHA1

                                                      6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                      SHA256

                                                      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                      SHA512

                                                      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                    • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                                                      Filesize

                                                      479KB

                                                      MD5

                                                      09372174e83dbbf696ee732fd2e875bb

                                                      SHA1

                                                      ba360186ba650a769f9303f48b7200fb5eaccee1

                                                      SHA256

                                                      c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                                                      SHA512

                                                      b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                                                    • C:\Users\Admin\AppData\Roaming\1000026000\3c9a2f2f34.exe

                                                      Filesize

                                                      160KB

                                                      MD5

                                                      46ac298f71f21e18d32578a99b5aed1e

                                                      SHA1

                                                      cb9fcb254358ccdb7e902cd5ddf98bcc056d6607

                                                      SHA256

                                                      a5133e4c3f06275acd9a97e4341f45cd415739d85f338efc54a77fd69caf12d1

                                                      SHA512

                                                      d072ab3aa7aa210e1a22e30aa158d3e497ecb8122345ea69e2aa8c7d0243ca61499602612b2c53cc73808209fc8bc2524d5aac6e08f559ca251e6e6adb2e6de5

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\AlternateServices.bin

                                                      Filesize

                                                      6KB

                                                      MD5

                                                      e8d4a2273a93c954e154695997236884

                                                      SHA1

                                                      2a975b8d6549c076ab3f75bd0c038dc4ee3d17c1

                                                      SHA256

                                                      87866f95510e93add43e250673245b4a4400d352f74a89706ec48bb9c08c28ed

                                                      SHA512

                                                      f768f8f1e5bcebb572739f5ca1da50299f58d3857e1e144f00fa88b7151fabcb61c4128bc9b1ab7925dcd9e6c262486206e86b506bbf3d56c3392ffc9f65fa09

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\AlternateServices.bin

                                                      Filesize

                                                      10KB

                                                      MD5

                                                      a451fa5d5c70a6a206be97440d933e8a

                                                      SHA1

                                                      5ba7237e567593a5c24e9673a5ded7cf306fdaa0

                                                      SHA256

                                                      2cbb142490cee1647fcf8ee01eeec22684fa84e0ac14c893cb4cb69a88796c74

                                                      SHA512

                                                      c3bab64be754e19a1cedc03ad48e9ff29d359e094cb1903c64fb6fd9913029f72d39ccf6ef4222b7efc4380ba08438fd0e6d080e00d7bfd759fa607ea13fc29f

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\AlternateServices.bin

                                                      Filesize

                                                      20KB

                                                      MD5

                                                      169bb0228e381954f9c8e5ea605b7987

                                                      SHA1

                                                      2a15d4641e68dcda6842da533ac4c4daff95fc67

                                                      SHA256

                                                      d548fac1ae3ee49d935aeeac906d2f99bc4734051080d87150c323d06a83b225

                                                      SHA512

                                                      dda5e91dcb2cd8204cccc52bfa2b408e5bcde7ec0c737d7759b4e03c5b3bcae7e38f14cb4f06bc0c7404ae24444522e4eb3beba5e432121bc808269fa556078c

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\AlternateServices.bin

                                                      Filesize

                                                      23KB

                                                      MD5

                                                      71ae2dead150c6d1278d5ddaa69db075

                                                      SHA1

                                                      3acbfa02fd25e16c28d5e328e521a66f88a1af51

                                                      SHA256

                                                      079cec73affbf0dd59fa41e6b2b23b127ee61dc581a8defa58223775877ee350

                                                      SHA512

                                                      09966eea39c878adc526ce81f6f997a713a1ec00046d97e65dbaa7ee4a396a1158856ee767a968e6c0a2003d87f74872e02b1a87ad2c6c4d4a9a989667f68412

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\datareporting\glean\db\data.safe.tmp

                                                      Filesize

                                                      5KB

                                                      MD5

                                                      548eb4b861794ec88e110532ef1ee725

                                                      SHA1

                                                      614b753821fd8a7fa67445a68a76ec19cda39f9a

                                                      SHA256

                                                      0cd247cf215b9deb8cfb6f3dcd36203eecbdb1ea4a7dd020f32ac19f62e3f9af

                                                      SHA512

                                                      d51bdc7a0305095cfc468cd8b2e6453a8327e0cf3b7f43b9a41eedc5523faa3396925fc595ef94aaf14d7d81d32263556cd029f9a306f87f43ce7a0c278b0be1

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\datareporting\glean\db\data.safe.tmp

                                                      Filesize

                                                      6KB

                                                      MD5

                                                      37554f68ca991637ab13aaa5754334e5

                                                      SHA1

                                                      bc5f82985b3e65269891a479ae29ca949bc395c5

                                                      SHA256

                                                      3c8f56b2d3cd9d4aa616c7000b760c56dbf14014f4b5fa7957538eeb80fbe357

                                                      SHA512

                                                      47a604cdb6a07ad64c4f9006d57bc1955749589ad081c4aa54e401de4ea96c6b759e2546b637c5a15c7d29b363f5a735539153112de1d6b257125b89766d2c98

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\datareporting\glean\db\data.safe.tmp

                                                      Filesize

                                                      6KB

                                                      MD5

                                                      09551f7fb87a8785ae1f2231ca2eb7f3

                                                      SHA1

                                                      187a6ab3c3e78ef9ef34fd4c4bf62be4acf7fbdb

                                                      SHA256

                                                      f30c0aff10099fd37f5fdfe88aad9188e96f981b0a58d83d356c1c2e4d814fe2

                                                      SHA512

                                                      6f096011b37c425332a26539c615e71295c9048d045cfae2ea4ba92cdf5d1415924dae7191e02f3409c32fdb216b6150c1cbecc544f60e9e443ab70919b2b74e

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\datareporting\glean\db\data.safe.tmp

                                                      Filesize

                                                      15KB

                                                      MD5

                                                      5148f2c0167e5aa28268a4ff235c3d69

                                                      SHA1

                                                      610756649ed2275c3338777a7f9f6b8e8402655c

                                                      SHA256

                                                      21c5c4cb212b2dbe435df4341a3c150f5f9db8f649a8adf727653a56ab0d4e8d

                                                      SHA512

                                                      38e54c01782dddab170fecbe4258efc9099155cc55f514304d10b3211b1b6d167c95146c5c34328c9588e59ef0b837a8fb6cecba5e69a4264a499ec2bade0b09

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\datareporting\glean\pending_pings\b190fb98-3799-468e-af68-e2953e4cf331

                                                      Filesize

                                                      26KB

                                                      MD5

                                                      0abe4791e78184340264afb1a5d1274d

                                                      SHA1

                                                      f0e1d023698c9c255467e078f2202a2dcb61d93a

                                                      SHA256

                                                      02d6ec4313c81fad5747558ca318f70c90d7bd61bb464d3bc32d889235f2efd0

                                                      SHA512

                                                      9318a416120512050a2aaf7251443380fb15923e5ea9f736859ff0a4676d2c61c4f6a16112a7404a883aed9a2f809a189977c7a917d2617a8fe30659f9ac40c7

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\datareporting\glean\pending_pings\cd6f9fe4-30be-4eef-be37-526a23ce0cc4

                                                      Filesize

                                                      671B

                                                      MD5

                                                      a9d3f753f2c5f48eeae62f78a958568c

                                                      SHA1

                                                      a1ee489e60918166dc8816468cfb3bc1ae204b09

                                                      SHA256

                                                      d804129938dcb61bff2e5ad0ceeaecd367da10265b792646051e0faaeb4abee3

                                                      SHA512

                                                      49c12ae87e6020b5edfe197a6dc7964fa60d1851c27b848f006396216794e1284a987a63280dc24ab038a6ce051b9ef321a0dd0c72c792a9513f0dff712e18b0

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\datareporting\glean\pending_pings\db70d01d-be72-483c-8a1f-6c060a498fc9

                                                      Filesize

                                                      982B

                                                      MD5

                                                      0f2d7f76b9f276e6baa5d20545f0aa2a

                                                      SHA1

                                                      eee083bfd079bf65269191a190c5cd61b5e75cab

                                                      SHA256

                                                      ec3632d5c65c76e2a5f966aa2dfaa76c41e54485a7123c311c108a2d9226f5d4

                                                      SHA512

                                                      6b5fc2134239afc752f550accd138b000476f269a4d03cc5c4ba2e8b5ead3a80976065cfee9cef2de9cbc1c41e6b4e050338a50b3df4cd533da9c5d38fc95c9e

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

                                                      Filesize

                                                      1.1MB

                                                      MD5

                                                      842039753bf41fa5e11b3a1383061a87

                                                      SHA1

                                                      3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                                                      SHA256

                                                      d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                                                      SHA512

                                                      d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

                                                      Filesize

                                                      116B

                                                      MD5

                                                      2a461e9eb87fd1955cea740a3444ee7a

                                                      SHA1

                                                      b10755914c713f5a4677494dbe8a686ed458c3c5

                                                      SHA256

                                                      4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                                                      SHA512

                                                      34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\prefs.js

                                                      Filesize

                                                      11KB

                                                      MD5

                                                      dbe565e9750fd8f3f3f156b5b507bd9f

                                                      SHA1

                                                      97c44140f5b503d053cf6bc2bf03dee09497a386

                                                      SHA256

                                                      d6abc212ccede78af0c778c62d8271c4bed6136e4db7867fcf94025bd6403b96

                                                      SHA512

                                                      6adc3cb220fde2b64405c386279746b243ea8fddd58d0438ba9519bf23d66ce81a3fb4d4f61464fcfe11228353561c971963f130479afd81567942ca3d5d0257

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\prefs.js

                                                      Filesize

                                                      10KB

                                                      MD5

                                                      a34152b1c545c7edf4c37c25e8bfe042

                                                      SHA1

                                                      2e6fbfdd572003baa726c1d2c88758ac06d64911

                                                      SHA256

                                                      0eaf407393bac6c66a11b35f6ad5a47bab6aba22bbd50baf2b4291001f63a25e

                                                      SHA512

                                                      40473ef1a2db331dd5e4be25551483cc8c76756fbe8f657d756c3d9bc0802a75d55efcba735e0c478bcfe245cf5750c96bf7945420c369560c1a73072cea499a

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\prefs.js

                                                      Filesize

                                                      11KB

                                                      MD5

                                                      06775b104687a666858186be6aafc241

                                                      SHA1

                                                      ec55885334e0f53e57fbce82b30c88e2f3139992

                                                      SHA256

                                                      98f5e189546b4b8f86638a07368b4032daced9cbcedabde519a800c3b1804594

                                                      SHA512

                                                      d470438d45bfe4a5c7f2e1b33a1f538989ce61b944be3fd546b00549ba7efa4337a1080bb22fa20fc92f04a382b421bff357723bcaa7edbf7cc47e879981a6e7

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\sessionstore-backups\recovery.baklz4

                                                      Filesize

                                                      1KB

                                                      MD5

                                                      c6006eb09152ce6378639f5341c9d6aa

                                                      SHA1

                                                      e22c79b19971928d056279a9419c56ca9c2563ee

                                                      SHA256

                                                      3b96963433a28d9098db185b30a8a3f9f89bffd7120dc0bed0eaeb3c4bce13e3

                                                      SHA512

                                                      0444eee35755d6dc981e063ef3dd8cac0e488ea78928f90028d3f5ea9d5669c915daf61fef110fb4722b41ab174ab377cae28e3be864ff6431ee161ca1e8cca3

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

                                                      Filesize

                                                      376KB

                                                      MD5

                                                      a189f92d14d5ddb0fd5ca892254188b4

                                                      SHA1

                                                      4bfaa34f1bf8141b7f135fe837fb38fdd60050f3

                                                      SHA256

                                                      268e69f8b71019289f38aa11e55094d42d890f84a2ba1c5ae6c17e912a1fa04b

                                                      SHA512

                                                      a3b1fb9df9d4eb7e612c0c2f523479e0b7eaa3c1eedd82be85172ad59bede077d23cac2c7d90026df0a09d254bb953fa50461c18932200b5df0c7c36629b123b

                                                    • \??\pipe\LOCAL\crashpad_1272_HKQTWBHFAYHCHCRL

                                                      MD5

                                                      d41d8cd98f00b204e9800998ecf8427e

                                                      SHA1

                                                      da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                      SHA256

                                                      e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                      SHA512

                                                      cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                    • memory/1460-90-0x00000000056A0000-0x0000000005706000-memory.dmp

                                                      Filesize

                                                      408KB

                                                    • memory/1460-105-0x0000000007080000-0x0000000007116000-memory.dmp

                                                      Filesize

                                                      600KB

                                                    • memory/1460-108-0x00000000076D0000-0x0000000007C74000-memory.dmp

                                                      Filesize

                                                      5.6MB

                                                    • memory/1460-87-0x00000000047E0000-0x0000000004816000-memory.dmp

                                                      Filesize

                                                      216KB

                                                    • memory/1460-88-0x0000000004F40000-0x0000000005568000-memory.dmp

                                                      Filesize

                                                      6.2MB

                                                    • memory/1460-89-0x0000000004F00000-0x0000000004F22000-memory.dmp

                                                      Filesize

                                                      136KB

                                                    • memory/1460-107-0x0000000006370000-0x0000000006392000-memory.dmp

                                                      Filesize

                                                      136KB

                                                    • memory/1460-91-0x0000000005710000-0x0000000005776000-memory.dmp

                                                      Filesize

                                                      408KB

                                                    • memory/1460-106-0x00000000062C0000-0x00000000062DA000-memory.dmp

                                                      Filesize

                                                      104KB

                                                    • memory/1460-101-0x0000000005980000-0x0000000005CD4000-memory.dmp

                                                      Filesize

                                                      3.3MB

                                                    • memory/1460-102-0x0000000005DA0000-0x0000000005DBE000-memory.dmp

                                                      Filesize

                                                      120KB

                                                    • memory/1460-103-0x0000000005DC0000-0x0000000005E0C000-memory.dmp

                                                      Filesize

                                                      304KB

                                                    • memory/2432-35-0x0000000000210000-0x00000000006C9000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/2432-22-0x0000000000210000-0x00000000006C9000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/2432-16-0x0000000000210000-0x00000000006C9000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/2432-20-0x0000000000210000-0x00000000006C9000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/2432-59-0x0000000000210000-0x00000000006C9000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/2432-58-0x0000000000210000-0x00000000006C9000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/2432-57-0x0000000000210000-0x00000000006C9000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/2432-56-0x0000000000210000-0x00000000006C9000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/2432-19-0x0000000000211000-0x000000000023F000-memory.dmp

                                                      Filesize

                                                      184KB

                                                    • memory/2432-21-0x0000000000210000-0x00000000006C9000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/2432-52-0x0000000000210000-0x00000000006C9000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/2432-51-0x0000000000210000-0x00000000006C9000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/2432-36-0x0000000000210000-0x00000000006C9000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/2432-673-0x0000000000210000-0x00000000006C9000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/2432-34-0x0000000000210000-0x00000000006C9000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/2432-33-0x0000000000210000-0x00000000006C9000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/2432-32-0x0000000000210000-0x00000000006C9000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/2432-31-0x0000000000210000-0x00000000006C9000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/2432-60-0x0000000000210000-0x00000000006C9000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/2432-24-0x0000000000210000-0x00000000006C9000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/2432-508-0x0000000000210000-0x00000000006C9000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/2432-652-0x0000000000210000-0x00000000006C9000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4012-18-0x0000000000AD0000-0x0000000000F89000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4012-1-0x00000000777D4000-0x00000000777D6000-memory.dmp

                                                      Filesize

                                                      8KB

                                                    • memory/4012-2-0x0000000000AD1000-0x0000000000AFF000-memory.dmp

                                                      Filesize

                                                      184KB

                                                    • memory/4012-3-0x0000000000AD0000-0x0000000000F89000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4012-4-0x0000000000AD0000-0x0000000000F89000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4012-0-0x0000000000AD0000-0x0000000000F89000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4288-27-0x0000000000210000-0x00000000006C9000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4288-30-0x0000000000211000-0x000000000023F000-memory.dmp

                                                      Filesize

                                                      184KB

                                                    • memory/4288-29-0x0000000000210000-0x00000000006C9000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4288-26-0x0000000000210000-0x00000000006C9000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4288-25-0x0000000000210000-0x00000000006C9000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4488-54-0x0000000000210000-0x00000000006C9000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4488-55-0x0000000000210000-0x00000000006C9000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/5104-77-0x0000000000380000-0x00000000009FF000-memory.dmp

                                                      Filesize

                                                      6.5MB

                                                    • memory/5104-86-0x0000000000380000-0x00000000009FF000-memory.dmp

                                                      Filesize

                                                      6.5MB

                                                    • memory/5960-624-0x0000000000210000-0x00000000006C9000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/5960-620-0x0000000000210000-0x00000000006C9000-memory.dmp

                                                      Filesize

                                                      4.7MB