Analysis

  • max time kernel
    145s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-09-2024 09:42

General

  • Target

    e9f315ca8e73dcdd580cfe25f9f231e73178bb876202112806ca5b65a45e93a1.exe

  • Size

    1.8MB

  • MD5

    4f810a4d5286bf5189823ad3cfacd8a2

  • SHA1

    c5c060728031b48834ff5a2739cb173a1879320d

  • SHA256

    e9f315ca8e73dcdd580cfe25f9f231e73178bb876202112806ca5b65a45e93a1

  • SHA512

    2557369861653779d600bba276e0507e3652da0578f0f40f6a47d2f28b9138cfc39929ec6b20cbe262f36b1a8a4fe1362592a02a936dd07a1eb9a569b1ed6937

  • SSDEEP

    49152:SaI6wd/oTMAIR6LNwU+N9UNXx+ameYlJjZA:BedGI8poNeyhZ

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

c7817d

C2

http://31.41.244.10

Attributes
  • install_dir

    0e8d0864aa

  • install_file

    svoutse.exe

  • strings_key

    5481b88a6ef75bcf21333988a4e47048

  • url_paths

    /Dem7kTu/index.php

rc4.plain

Extracted

Family

stealc

Botnet

rave

C2

http://185.215.113.103

Attributes
  • url_path

    /e2b1563c6670f193.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Stealc

    Stealc is an infostealer written in C++.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 14 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 6 IoCs
  • Identifies Wine through registry keys 2 TTPs 7 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 14 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 33 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 46 IoCs
  • Suspicious use of SendNotifyMessage 44 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\e9f315ca8e73dcdd580cfe25f9f231e73178bb876202112806ca5b65a45e93a1.exe
    "C:\Users\Admin\AppData\Local\Temp\e9f315ca8e73dcdd580cfe25f9f231e73178bb876202112806ca5b65a45e93a1.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1876
    • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
      "C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4148
      • C:\Users\Admin\AppData\Roaming\1000026000\e8d6e61f4c.exe
        "C:\Users\Admin\AppData\Roaming\1000026000\e8d6e61f4c.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:4600
      • C:\Users\Admin\AppData\Local\Temp\1000030001\47ee257e79.exe
        "C:\Users\Admin\AppData\Local\Temp\1000030001\47ee257e79.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:3524
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\Admin\AppData\Local\Temp\1000039041\do.ps1"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2680
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /c start msedge https://www.youtube.com/account
          4⤵
          • Checks computer location settings
          • System Location Discovery: System Language Discovery
          PID:4008
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.youtube.com/account
            5⤵
            • Enumerates system info in registry
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            PID:4192
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff842ec46f8,0x7ff842ec4708,0x7ff842ec4718
              6⤵
                PID:3132
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,4952911978487673038,15539292582869840682,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
                6⤵
                  PID:5248
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,4952911978487673038,15539292582869840682,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
                  6⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:5256
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,4952911978487673038,15539292582869840682,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:8
                  6⤵
                    PID:5268
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,4952911978487673038,15539292582869840682,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
                    6⤵
                      PID:5408
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,4952911978487673038,15539292582869840682,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
                      6⤵
                        PID:5416
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,4952911978487673038,15539292582869840682,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2148 /prefetch:1
                        6⤵
                          PID:1080
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,4952911978487673038,15539292582869840682,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4804 /prefetch:1
                          6⤵
                            PID:4348
                          • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,4952911978487673038,15539292582869840682,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5372 /prefetch:8
                            6⤵
                              PID:3840
                            • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,4952911978487673038,15539292582869840682,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5372 /prefetch:8
                              6⤵
                              • Suspicious behavior: EnumeratesProcesses
                              PID:6756
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,4952911978487673038,15539292582869840682,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1
                              6⤵
                                PID:6484
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,4952911978487673038,15539292582869840682,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4272 /prefetch:1
                                6⤵
                                  PID:6784
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,4952911978487673038,15539292582869840682,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5784 /prefetch:1
                                  6⤵
                                    PID:6936
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,4952911978487673038,15539292582869840682,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4232 /prefetch:1
                                    6⤵
                                      PID:6944
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,4952911978487673038,15539292582869840682,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1876 /prefetch:2
                                      6⤵
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:6604
                                • C:\Windows\SysWOW64\cmd.exe
                                  "C:\Windows\system32\cmd.exe" /c start msedge https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
                                  4⤵
                                  • Checks computer location settings
                                  • System Location Discovery: System Language Discovery
                                  PID:1080
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://accounts.google.com/ServiceLogin?service=accountsettings
                                    5⤵
                                      PID:3264
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff842ec46f8,0x7ff842ec4708,0x7ff842ec4718
                                        6⤵
                                          PID:1648
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,17014100322783448644,11081625511367470711,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
                                          6⤵
                                            PID:5276
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,17014100322783448644,11081625511367470711,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
                                            6⤵
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:5284
                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                        "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
                                        4⤵
                                        • Suspicious use of WriteProcessMemory
                                        PID:3972
                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                          "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
                                          5⤵
                                          • Checks processor information in registry
                                          • Modifies registry class
                                          • Suspicious use of AdjustPrivilegeToken
                                          • Suspicious use of FindShellTrayWindow
                                          • Suspicious use of SendNotifyMessage
                                          • Suspicious use of SetWindowsHookEx
                                          • Suspicious use of WriteProcessMemory
                                          PID:1444
                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2016 -parentBuildID 20240401114208 -prefsHandle 1944 -prefMapHandle 1936 -prefsLen 23602 -prefMapSize 244628 -appDir "C:\Program Files\Mozilla Firefox\browser" - {268bdb22-d2ea-4de4-886a-358575ae7b63} 1444 "\\.\pipe\gecko-crash-server-pipe.1444" gpu
                                            6⤵
                                              PID:3604
                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2452 -parentBuildID 20240401114208 -prefsHandle 2444 -prefMapHandle 2440 -prefsLen 24522 -prefMapSize 244628 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1ddc09d0-2a35-4f00-be80-4b7c31d604e4} 1444 "\\.\pipe\gecko-crash-server-pipe.1444" socket
                                              6⤵
                                                PID:5016
                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1372 -childID 1 -isForBrowser -prefsHandle 3224 -prefMapHandle 3356 -prefsLen 22590 -prefMapSize 244628 -jsInitHandle 1164 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4482c1aa-a94d-4e3c-88eb-67e964d5fa38} 1444 "\\.\pipe\gecko-crash-server-pipe.1444" tab
                                                6⤵
                                                  PID:4844
                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3572 -childID 2 -isForBrowser -prefsHandle 3564 -prefMapHandle 3504 -prefsLen 22631 -prefMapSize 244628 -jsInitHandle 1164 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {601919ab-d2b3-4739-b6c7-c3db5f8949e9} 1444 "\\.\pipe\gecko-crash-server-pipe.1444" tab
                                                  6⤵
                                                    PID:1764
                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4380 -childID 3 -isForBrowser -prefsHandle 4364 -prefMapHandle 3688 -prefsLen 29012 -prefMapSize 244628 -jsInitHandle 1164 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {40070048-2266-4dde-8e43-c50588e654d1} 1444 "\\.\pipe\gecko-crash-server-pipe.1444" tab
                                                    6⤵
                                                      PID:4104
                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5136 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 5160 -prefMapHandle 4988 -prefsLen 29012 -prefMapSize 244628 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {472bdd51-1e0d-47f7-a33b-20efc2e07a6e} 1444 "\\.\pipe\gecko-crash-server-pipe.1444" utility
                                                      6⤵
                                                      • Checks processor information in registry
                                                      PID:5540
                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5604 -childID 4 -isForBrowser -prefsHandle 5596 -prefMapHandle 5592 -prefsLen 26989 -prefMapSize 244628 -jsInitHandle 1164 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f0d21092-2e95-4e33-89f1-80e0a898abaf} 1444 "\\.\pipe\gecko-crash-server-pipe.1444" tab
                                                      6⤵
                                                        PID:5420
                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5748 -childID 5 -isForBrowser -prefsHandle 5828 -prefMapHandle 5824 -prefsLen 26989 -prefMapSize 244628 -jsInitHandle 1164 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {12490236-3b70-4025-bf09-97caf48dcf26} 1444 "\\.\pipe\gecko-crash-server-pipe.1444" tab
                                                        6⤵
                                                          PID:5600
                                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6016 -childID 6 -isForBrowser -prefsHandle 5840 -prefMapHandle 5940 -prefsLen 26989 -prefMapSize 244628 -jsInitHandle 1164 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d95083c3-5313-4db6-9a9d-00306069effb} 1444 "\\.\pipe\gecko-crash-server-pipe.1444" tab
                                                          6⤵
                                                            PID:2468
                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
                                                        4⤵
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:1100
                                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                                          "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
                                                          5⤵
                                                          • Checks processor information in registry
                                                          PID:3204
                                                • C:\Windows\System32\CompPkgSrv.exe
                                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                  1⤵
                                                    PID:5308
                                                  • C:\Windows\System32\CompPkgSrv.exe
                                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                    1⤵
                                                      PID:5316
                                                    • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                                                      C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                                                      1⤵
                                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                      • Checks BIOS information in registry
                                                      • Executes dropped EXE
                                                      • Identifies Wine through registry keys
                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:5800
                                                    • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                                                      C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                                                      1⤵
                                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                      • Checks BIOS information in registry
                                                      • Executes dropped EXE
                                                      • Identifies Wine through registry keys
                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:3812
                                                    • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                                                      C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                                                      1⤵
                                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                      • Checks BIOS information in registry
                                                      • Executes dropped EXE
                                                      • Identifies Wine through registry keys
                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:6008

                                                    Network

                                                    MITRE ATT&CK Enterprise v15

                                                    Replay Monitor

                                                    Loading Replay Monitor...

                                                    Downloads

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                      Filesize

                                                      152B

                                                      MD5

                                                      27304926d60324abe74d7a4b571c35ea

                                                      SHA1

                                                      78b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1

                                                      SHA256

                                                      7039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de

                                                      SHA512

                                                      f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                      Filesize

                                                      152B

                                                      MD5

                                                      9e3fc58a8fb86c93d19e1500b873ef6f

                                                      SHA1

                                                      c6aae5f4e26f5570db5e14bba8d5061867a33b56

                                                      SHA256

                                                      828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4

                                                      SHA512

                                                      e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                      Filesize

                                                      528B

                                                      MD5

                                                      3e078f8a311bc3e97dfc03367775304f

                                                      SHA1

                                                      eaba8f913fa59d026a5caef478b5704bbff375c1

                                                      SHA256

                                                      0760ff77db563efe70c347669151205fe749be8acfe9d450f732f860a0fc3ee8

                                                      SHA512

                                                      49850a7ce1553d2b5e7a3fdcc45e53be64dfefadf4fbbd9d548098971d2cfe0d2ba53ec32c64878535c2f6b1d67a4c64ccfd1bd041e47f7851ccbad4fbe6d0c9

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                      Filesize

                                                      1KB

                                                      MD5

                                                      a5ccfebbc4f60b0a8ffd8173fdaf7283

                                                      SHA1

                                                      d958f65dd9af37760f46e542a052aaba01ca748d

                                                      SHA256

                                                      ebea5c9192c81bf9aeb04200f9f546bc17cc21a526d9324c03eaf5696ac1e794

                                                      SHA512

                                                      81e021a92b2260a38813e5057c1fb646c7893738f6439526bcd3930676f972257fdceb3ff784c076f1479d45bd9421f476a16f2bd2268c8b585e9d8ad5b41bac

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                      Filesize

                                                      1KB

                                                      MD5

                                                      cc16214fac17705bff29a1e08558e5cd

                                                      SHA1

                                                      9d16450ea93db09570dadb8deef17fbc3ddd7f7c

                                                      SHA256

                                                      eb190c49da41d65dccf577ba565edd4111c8509878b0cf057534ee753e734a29

                                                      SHA512

                                                      e9356896f91c65af40dd12569fa7fba46fbb759f0c8f53d6d803605beb35a9923d9cc99231a7e32c795a04d6f58596d59935fed120b3b1ddf5e569f50bc5e35d

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                      Filesize

                                                      5KB

                                                      MD5

                                                      273b951c0a6e487d369dcabcb5e8fd24

                                                      SHA1

                                                      7da6928b47f6ffd233b904be9209d5a5a3427dcc

                                                      SHA256

                                                      b35b0d6c76ac646fd8948ae2eedb196cb3a6a44f1cf732d01104c37b1dee71cd

                                                      SHA512

                                                      fcc7f75355fc30fbe4fa7ad84551eed9bcad017b1d135c397d93b99b00ec49c9750adecbca427a8a1bb4584f45eff9f0c8139eaa4194a528486da5a41173655a

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                      Filesize

                                                      7KB

                                                      MD5

                                                      f4b0fcf9e8d69a6b763096acee6cc7d9

                                                      SHA1

                                                      11deeaea188829c9e2fb6064efa28caa5ab9b663

                                                      SHA256

                                                      5453eb3b9ac5a2588f1da5e4563e13499e88ca16b1c997a040d688ff4544fbe2

                                                      SHA512

                                                      96da0d96e4523cde57d81e17cb2b9e3adec9f545572947986e4e2a232738c69f667a8e82ffb36cec68c95184e3b8ed2dbaeaf5b6cbcd8e03734f459464877e89

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                      Filesize

                                                      533B

                                                      MD5

                                                      f345854e349dc4bf86b9f84b5d87470b

                                                      SHA1

                                                      587b9995ecd92fd6649f39ed9f896650d1a2f977

                                                      SHA256

                                                      fb059f3d30e8f877571935b702df901cac439370206cc9d48b7b92228733b0fc

                                                      SHA512

                                                      58659eff4f715157034e81ea207c79142f54fbdc1b154f7dd187ddc966eb7d7e6b80f2afe04eb97b158181a96de00b8d1ce2f966d5b8bf03f2217d83f7b43f15

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58c241.TMP

                                                      Filesize

                                                      533B

                                                      MD5

                                                      d3738a1145f72c7972362ccc4f245e93

                                                      SHA1

                                                      39cbcb089ba4722a598de33335187bae85b7a664

                                                      SHA256

                                                      c2ce7a6fe2b1a56b76f36979df3cb0cc34aee4bd6d7c3fd5f5be74c8a5d88ab7

                                                      SHA512

                                                      2634f30de2eaa8f2b26378ebf4edf1439d228da85d0035578e02122e88a2aae73d5903c7a6d98a7811fb6c40689b607914061a9e664a83fd00b5838526f05058

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                      Filesize

                                                      16B

                                                      MD5

                                                      6752a1d65b201c13b62ea44016eb221f

                                                      SHA1

                                                      58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                      SHA256

                                                      0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                      SHA512

                                                      9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                      Filesize

                                                      8KB

                                                      MD5

                                                      ed86a70815d2297127b9f5c7c827fb83

                                                      SHA1

                                                      84cfe83efb65c422060ee7e4d4196fd882189e92

                                                      SHA256

                                                      4f5f69f3bb3d5adc55770505c702bbd2b480b53e9efbd84a57a4ba650fc145f5

                                                      SHA512

                                                      effac11cbc190bdbdc614aecfb7400ad773dfd88f90c14aba98417618d4695c220947f8e29d327798dbebb602f96cc99bb8dd0de8761c14124b3113d43e57abf

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                      Filesize

                                                      10KB

                                                      MD5

                                                      5c21c2e14d1b5ce5e4994ae3041f0f96

                                                      SHA1

                                                      e43d52dd0cd6edc55f71786785a020affd62fb72

                                                      SHA256

                                                      9c1990c99918bbcd8baa00f480f3bc3ad0c1ec73c53fa5b45d40f2df63758bd4

                                                      SHA512

                                                      045ad463b5937320346f25f7186dfb5ddc496de6e75da1852c5b93ea035a45ff44f1e3372bb63331b18d85615e780e2452e73a020d7f9d7b2d07815fad126083

                                                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5utpapi8.default-release\cache2\entries\58EFA56DB4BFFECB0EDA547894BC9A057159E22F

                                                      Filesize

                                                      13KB

                                                      MD5

                                                      c15275a3fa8c8ae8ee885ecbf8a26839

                                                      SHA1

                                                      348a055695fa9095e7cd07fbbedf9ce320ea0c39

                                                      SHA256

                                                      c1fb02ca82d1a252fdbbfbc30e5510cfd863a7751bd1dc6953817ec77d136335

                                                      SHA512

                                                      bf3fcd3d7bf3064cdaeadeb379542298c38cfa8767af687e74a037a6bd123515a45b2f196b5144f894a723da9b02706f605042723dfb554c08c268c09541995d

                                                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5utpapi8.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

                                                      Filesize

                                                      7KB

                                                      MD5

                                                      c460716b62456449360b23cf5663f275

                                                      SHA1

                                                      06573a83d88286153066bae7062cc9300e567d92

                                                      SHA256

                                                      0ec0f16f92d876a9c1140d4c11e2b346a9292984d9a854360e54e99fdcd99cc0

                                                      SHA512

                                                      476bc3a333aace4c75d9a971ef202d5889561e10d237792ca89f8d379280262ce98cf3d4728460696f8d7ff429a508237764bf4a9ccb59fd615aee07bdcadf30

                                                    • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe

                                                      Filesize

                                                      1.8MB

                                                      MD5

                                                      4f810a4d5286bf5189823ad3cfacd8a2

                                                      SHA1

                                                      c5c060728031b48834ff5a2739cb173a1879320d

                                                      SHA256

                                                      e9f315ca8e73dcdd580cfe25f9f231e73178bb876202112806ca5b65a45e93a1

                                                      SHA512

                                                      2557369861653779d600bba276e0507e3652da0578f0f40f6a47d2f28b9138cfc39929ec6b20cbe262f36b1a8a4fe1362592a02a936dd07a1eb9a569b1ed6937

                                                    • C:\Users\Admin\AppData\Local\Temp\1000039041\do.ps1

                                                      Filesize

                                                      2KB

                                                      MD5

                                                      e05e8f072b373beafe27cc11d85f947c

                                                      SHA1

                                                      1d6daeb98893e8122b8b69287ebd9d43f3c6138e

                                                      SHA256

                                                      717c09427fa5754ba92f92961545534048d0a76528c2e95c4d5ec6cef47c612f

                                                      SHA512

                                                      b3e34162e5ee43bb01f289eebc45fd3ea3e07f30be40dcf6635606540f912fe5c84d301e9f78e97dfe3ffe53e72547e50f3bcd7d4ebe5ab8da451a1989c469a0

                                                    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jkwfdeek.mj2.ps1

                                                      Filesize

                                                      60B

                                                      MD5

                                                      d17fe0a3f47be24a6453e9ef58c94641

                                                      SHA1

                                                      6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                      SHA256

                                                      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                      SHA512

                                                      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                    • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                                                      Filesize

                                                      479KB

                                                      MD5

                                                      09372174e83dbbf696ee732fd2e875bb

                                                      SHA1

                                                      ba360186ba650a769f9303f48b7200fb5eaccee1

                                                      SHA256

                                                      c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                                                      SHA512

                                                      b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                                                    • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                                                      Filesize

                                                      13.8MB

                                                      MD5

                                                      0a8747a2ac9ac08ae9508f36c6d75692

                                                      SHA1

                                                      b287a96fd6cc12433adb42193dfe06111c38eaf0

                                                      SHA256

                                                      32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                                                      SHA512

                                                      59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                                                    • C:\Users\Admin\AppData\Roaming\1000026000\e8d6e61f4c.exe

                                                      Filesize

                                                      1.7MB

                                                      MD5

                                                      2436f5bc4146385648a72a27897ab578

                                                      SHA1

                                                      daf603434b49d4bf2866a3f53069845f05130fcb

                                                      SHA256

                                                      aee2dcc810b97f1bd7809146f7f33887e806561329c0b6288ecb1d315e4f6740

                                                      SHA512

                                                      e32cede58485391ee8621b939f28e7234095391ad67f944929b8475528f8a08f801d3997138c0935f40d17ec3e703d0d499e7427bcc570102636e1ea8cff2a92

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\AlternateServices.bin

                                                      Filesize

                                                      6KB

                                                      MD5

                                                      b017910a376ee8d6f8e7fc0f1ee924ba

                                                      SHA1

                                                      447a0ce2715f9aef63890849608594bd493a84b7

                                                      SHA256

                                                      32c90b33699930078374cf372f99fc091c96a3cc56c00af94f9d22566e4cca3f

                                                      SHA512

                                                      36cdc935d0d344db5720dce104fb4978e2e0110d08b3037ad18b34b9c03c9a2b1675f605dae500e0e1981ee1b0cb4ea02c9ccaaf13e3247eca6a60c38abb9636

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\AlternateServices.bin

                                                      Filesize

                                                      25KB

                                                      MD5

                                                      7263f3c98325f6f153b9af23d1949205

                                                      SHA1

                                                      5c87918bed7db77210b2e49224e133104ca5da26

                                                      SHA256

                                                      67f23c01a6ba09ae29f9fd9a4e5c18cb67729665e06eb0a224be5c910391d4ba

                                                      SHA512

                                                      3d9e908a63e4cfbc26a93774ef7315811e60f492b4a91cc16bae3165602998b7047ed18a2fcc4dcc21894d427bcc0c52db83c0be4fa1a2df3c7be7ca44ef4f88

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\AlternateServices.bin

                                                      Filesize

                                                      10KB

                                                      MD5

                                                      4841e89da3403f07dc452b18f1cae5b4

                                                      SHA1

                                                      18765c27991d343eeb5afab07ba64779ef05412b

                                                      SHA256

                                                      fcd0d22f1b265d0d30cc8278ccd37a977b3b70ea49e0b0c733fdaa487a1a7f57

                                                      SHA512

                                                      4bd6b785711643e4eb91da12974537591493d65d3d935ebd8276402f2780626ab01adfdc1f2db3d7e4afe3c6c6c0c1b9a84a0f50778782ced758b76f8a72c79d

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\AlternateServices.bin

                                                      Filesize

                                                      13KB

                                                      MD5

                                                      102bb0bd68be2374bc22e18430b8b45e

                                                      SHA1

                                                      773bb875e7bae7c9280b3132a6ae06212cf063d9

                                                      SHA256

                                                      b426aadf132de8d8a4251d442ff25d41319214aa3e2993e43d4c3f8ad316ba76

                                                      SHA512

                                                      9eee6f437c904a7eff7c1b41264f72dae6d928e11c012c7bb8d39165ba86673c944756474955f11e1a43480ebf6075f7ad723e912a5cf03cb040e5295e9954da

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\AlternateServices.bin

                                                      Filesize

                                                      16KB

                                                      MD5

                                                      c133b34e19a241b6b6d97064ec56549d

                                                      SHA1

                                                      5dcb3c8dcf8434fa5066b531fa810b22d1dfb1a5

                                                      SHA256

                                                      852039545e810c245ad6e982f2e1c45cc250face361ad34b877c974a96d7777d

                                                      SHA512

                                                      28f073ac77f79d8220afa28254dd24fdd33dacb1e0a58806c0734200bba73e6b021265149f75fbeec0ef11a8e594b5471a4ee520433f481b605fe50efa2927f5

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\AlternateServices.bin

                                                      Filesize

                                                      20KB

                                                      MD5

                                                      f1fb8fcc5d6f83a5bff040767b508c36

                                                      SHA1

                                                      c8d166d510a35c90bb81fd7d058df9497adcc67c

                                                      SHA256

                                                      72af56bc371226b6699cff85e412a9b8b0868beb4cfc00faae89e77768e7068a

                                                      SHA512

                                                      2d5050606b767310388b2b761729f1133d11196a7907ae36d18d558ee249f9c0e87ef1c2b1ed45e728d103ae940800bba4522541387105de947f3fa674a2d292

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\AlternateServices.bin

                                                      Filesize

                                                      23KB

                                                      MD5

                                                      a622ef6724104d862d3f6a6c1847c668

                                                      SHA1

                                                      b2ffbb0782da716d7565e1e9c7a46e4f33f72c88

                                                      SHA256

                                                      65607e49e036483f38db967b1521682f05d08013372a41a6eb5b4310ac9f39d1

                                                      SHA512

                                                      6a07cf0afe66b4a8628af1e3cb6343f5d7a5438e94d52d8b6e7b196f53c6260e54dc2a4403e3c4901a7c99e285d8178b7484d9fe778c6f2c4b75b5a2bfd4e86b

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\datareporting\glean\db\data.safe.tmp

                                                      Filesize

                                                      6KB

                                                      MD5

                                                      90d4f6f48c94e37a1f5e7d6461a5b1ae

                                                      SHA1

                                                      0bcbe7307842c21474dedc5c542e2fa94fc7ef90

                                                      SHA256

                                                      f6e90e2f6f4f8f448bb59066b3bbaa97198e4fff979a60462f86c8e0d25f0647

                                                      SHA512

                                                      9f8586051e5dffe77cba4a826ece6fd4494fabaa67e58d77f36fec87bfb707390e41ebd8814bfff9304377ee2fd31564718524ac274ed99386977c4f762d952c

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\datareporting\glean\db\data.safe.tmp

                                                      Filesize

                                                      15KB

                                                      MD5

                                                      0b2076d66d7d19ca340bd61a3a0d6ae8

                                                      SHA1

                                                      abc4ed58c192de47f5965833db401e401a366971

                                                      SHA256

                                                      6b29f0c0aadfd212736a1f5210e22ac095ab489909c47fe1525f1cda296adbc3

                                                      SHA512

                                                      03dba07382b55b1521e9e798c78cc2dbdfd66d2a94e71cbd06e6cda555a6b77670211a826687d470f05c669439aa1f38b1fd4c03f9a70b8aff31dfe3e8b48e5b

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\datareporting\glean\db\data.safe.tmp

                                                      Filesize

                                                      5KB

                                                      MD5

                                                      5ab6045694eb300b7539aa18b688cb19

                                                      SHA1

                                                      cc6d4147bb2eb0917049641d2eb975f60614e3be

                                                      SHA256

                                                      9020ea3762cc1b7e8cf7d70db2c8e116c27c34abdb30ca13d34738af31d76c57

                                                      SHA512

                                                      ddf2c2248936f0a258d4ca92eb0b79f31d6d5c4cce7c8b4a071ec86e9f4645a050c41eb51121a1eca859f60b869a1118455057a06513ac7bd5795cae9790952f

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\datareporting\glean\pending_pings\051697ef-52a8-4fb8-8205-4408897fccda

                                                      Filesize

                                                      29KB

                                                      MD5

                                                      c61794ea9ec248a26db9ef3befdddbf1

                                                      SHA1

                                                      3217f05fd175874b3a9cec174025fb006e77d3fd

                                                      SHA256

                                                      709be50a69ea942cae31fcb60022e0783ae164f0d125f8c0ca4ff2f55b1533f0

                                                      SHA512

                                                      c93a9d3a00a000fbe02732eab42b64062224b7741a10429e509c4ad16daa9c59bf37e30d7c6007e18287cb0da95bda54a900cf3f4f2f5752d8f9c4b65f59b8f2

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\datareporting\glean\pending_pings\375d8b6d-264b-4379-b108-8a5c53875ac2

                                                      Filesize

                                                      671B

                                                      MD5

                                                      cbb67105199034e0f41a5ca007b9c597

                                                      SHA1

                                                      35f8301967851973d034174d9636cfdb83218e03

                                                      SHA256

                                                      97ee8dc7dabd2dae7926461972a8b2efd01fe3fb3dfb3b6dbc56bb368118bcfe

                                                      SHA512

                                                      e888acb75e5070b80ed55971b62f9b68d03f4c83cf67ddd763452e5b084900625b8c1500c038d08648e418f018f09652c1787ec301bb049dabfdaf9caac7a320

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\datareporting\glean\pending_pings\6fda5813-5272-46ab-9887-16f08b69867f

                                                      Filesize

                                                      982B

                                                      MD5

                                                      b186fc758a27f5932a187ff456eb4e45

                                                      SHA1

                                                      12866fe62a002d57685f4c2e51455e92e256c39f

                                                      SHA256

                                                      8bbe12942a391bd6d66434c1d570e4b40e7e754bdc5db712843026bab2b4bd72

                                                      SHA512

                                                      05f35f40d66a318c31f3a1b5f969948b41221069976c57fd2cd813503a18f741b5509a13054d3bb3d45490e2749c4c0e4dc644a78026555f1498d0ea31cc6aa1

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

                                                      Filesize

                                                      1.1MB

                                                      MD5

                                                      842039753bf41fa5e11b3a1383061a87

                                                      SHA1

                                                      3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                                                      SHA256

                                                      d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                                                      SHA512

                                                      d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

                                                      Filesize

                                                      116B

                                                      MD5

                                                      2a461e9eb87fd1955cea740a3444ee7a

                                                      SHA1

                                                      b10755914c713f5a4677494dbe8a686ed458c3c5

                                                      SHA256

                                                      4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                                                      SHA512

                                                      34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

                                                      Filesize

                                                      372B

                                                      MD5

                                                      bf957ad58b55f64219ab3f793e374316

                                                      SHA1

                                                      a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                                                      SHA256

                                                      bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                                                      SHA512

                                                      79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

                                                      Filesize

                                                      17.8MB

                                                      MD5

                                                      daf7ef3acccab478aaa7d6dc1c60f865

                                                      SHA1

                                                      f8246162b97ce4a945feced27b6ea114366ff2ad

                                                      SHA256

                                                      bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                                                      SHA512

                                                      5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\prefs-1.js

                                                      Filesize

                                                      16KB

                                                      MD5

                                                      6bdd3b65bd1f7cd4f5d0b8f637a226dc

                                                      SHA1

                                                      45d3ddd655cd0290ee8321581a610e0c1c311377

                                                      SHA256

                                                      761c372fa08b3c401654f4670ee437598739d31499b15a1d470ffddb63a25aa0

                                                      SHA512

                                                      ada5bf7971114183f64f67ebd1e3bea20bb8479ca10330d7e850e8eeb3898198049ebe635a0303e5af64ded084b34b9f350b4d138b81a3942e27fd17b2138872

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\prefs-1.js

                                                      Filesize

                                                      10KB

                                                      MD5

                                                      24f21a2f78105b8e8d033b68e4030590

                                                      SHA1

                                                      c42fad5c1a512b8baf597fc43a2a7e7a4ac71f76

                                                      SHA256

                                                      e0b89862f5a067025d972a45c5100bca67b76f5e6126f8a07d52c5429b402e69

                                                      SHA512

                                                      ab19cde4d39265407035da2ac9ce510219eeff072b5c7946a7723cdeeb523bd0fc08729ebc667445e691d2f7483eeb1af847001561cc6a4fb490cef8bc625329

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\prefs-1.js

                                                      Filesize

                                                      12KB

                                                      MD5

                                                      dc2f11c146bfaecda6da32bd08b273ee

                                                      SHA1

                                                      0eacbe9c09a73ae85fd183b957b14b15aa489026

                                                      SHA256

                                                      ae730f2c82c4cef0447e067abff963ec3b19c9b6fc4f125b5398a77d008d7750

                                                      SHA512

                                                      c10e97e92ce9efc080f375ea0e47f11aca4beb7794c101adba5878de85dbcc4e8ba9c6dbf3d8d49c1242d3eb88e4d47052454c2443e4c97f0c835b988b0407b1

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\prefs.js

                                                      Filesize

                                                      11KB

                                                      MD5

                                                      a446b8681ab60374871bd3814f8654f0

                                                      SHA1

                                                      f32d7399575ed0bf3d86b9a0df72c06455036c9b

                                                      SHA256

                                                      ebc01082902906720536d0e2bf94126c4fcec3d6814e9bb89479039fd96d9c30

                                                      SHA512

                                                      b2db3274e99764ccbe01b85da6dc2793d631594e4f5ec8fcaa071775a7359c646252a160acafa2d17a95b24e51aab7e3c399427f31a5d9bfcc85321b116fccec

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\sessionstore-backups\recovery.baklz4

                                                      Filesize

                                                      1KB

                                                      MD5

                                                      2b6612962cbba0ef3f9ac933070daa10

                                                      SHA1

                                                      e18a3675791cece3795a95b21be22fc7e0015c09

                                                      SHA256

                                                      9bf2cb7ff96b48b617299551c17e11f852f610fd8113ab171a775a66c8e6a704

                                                      SHA512

                                                      a6504d9893b3426f2dca7bf7d47c1d7b4d870d4574a1e9d0d6fd42556b4ffbd2e5f34dce8d0321e4838d29a1b5a892ca0c4806f0775bedf7091b88f7dd528278

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\sessionstore-backups\recovery.baklz4

                                                      Filesize

                                                      5KB

                                                      MD5

                                                      e3fe0472689be806b8c962fb93fca4d5

                                                      SHA1

                                                      e3c58f1c93460bfd61d66fdee69a9553e94d3b0d

                                                      SHA256

                                                      2cbff33f6e3074362c64dba65719f76af37b38e332244c9692014f7bfcea4dd2

                                                      SHA512

                                                      cd77282acd319c891523ebc963dde0f3ea7dc7d795569c1274f5325fe97fbf0c76321970a5bf7328a237ec426830394427a98aede71d518c27601a9dd7dafff5

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

                                                      Filesize

                                                      1.4MB

                                                      MD5

                                                      690fff3ef79d0567b9424635aa557745

                                                      SHA1

                                                      270b1a3b63a8e4a88bc6f6164d1488d23d84977c

                                                      SHA256

                                                      902f839333589ffa7043da3eee616cec4368c7e15161e5c475405b715d803f95

                                                      SHA512

                                                      37f9e94bb854dc12ef423045f0550f1caed91bf24f4b2bba092fd75ce9a963bd192c49517ddbbf5202a13d141d11bc056210475c0a997a30c07781de3501ec41

                                                    • \??\pipe\LOCAL\crashpad_4192_HVTFMOSAWDJKAUMV

                                                      MD5

                                                      d41d8cd98f00b204e9800998ecf8427e

                                                      SHA1

                                                      da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                      SHA256

                                                      e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                      SHA512

                                                      cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                    • memory/1876-0-0x0000000000EC0000-0x0000000001388000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                    • memory/1876-1-0x00000000774B4000-0x00000000774B6000-memory.dmp

                                                      Filesize

                                                      8KB

                                                    • memory/1876-2-0x0000000000EC1000-0x0000000000EEF000-memory.dmp

                                                      Filesize

                                                      184KB

                                                    • memory/1876-3-0x0000000000EC0000-0x0000000001388000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                    • memory/1876-4-0x0000000000EC0000-0x0000000001388000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                    • memory/1876-17-0x0000000000EC0000-0x0000000001388000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                    • memory/2680-87-0x0000000006850000-0x0000000006872000-memory.dmp

                                                      Filesize

                                                      136KB

                                                    • memory/2680-69-0x0000000005380000-0x00000000053A2000-memory.dmp

                                                      Filesize

                                                      136KB

                                                    • memory/2680-71-0x00000000055C0000-0x0000000005626000-memory.dmp

                                                      Filesize

                                                      408KB

                                                    • memory/2680-86-0x00000000067A0000-0x00000000067BA000-memory.dmp

                                                      Filesize

                                                      104KB

                                                    • memory/2680-66-0x0000000001050000-0x0000000001086000-memory.dmp

                                                      Filesize

                                                      216KB

                                                    • memory/2680-81-0x0000000005D50000-0x00000000060A4000-memory.dmp

                                                      Filesize

                                                      3.3MB

                                                    • memory/2680-88-0x0000000007BB0000-0x0000000008154000-memory.dmp

                                                      Filesize

                                                      5.6MB

                                                    • memory/2680-67-0x0000000005720000-0x0000000005D48000-memory.dmp

                                                      Filesize

                                                      6.2MB

                                                    • memory/2680-70-0x00000000054A0000-0x0000000005506000-memory.dmp

                                                      Filesize

                                                      408KB

                                                    • memory/2680-82-0x0000000006270000-0x000000000628E000-memory.dmp

                                                      Filesize

                                                      120KB

                                                    • memory/2680-85-0x0000000007560000-0x00000000075F6000-memory.dmp

                                                      Filesize

                                                      600KB

                                                    • memory/2680-83-0x00000000062B0000-0x00000000062FC000-memory.dmp

                                                      Filesize

                                                      304KB

                                                    • memory/3524-54-0x0000000000B20000-0x00000000011A0000-memory.dmp

                                                      Filesize

                                                      6.5MB

                                                    • memory/3524-506-0x0000000000B20000-0x00000000011A0000-memory.dmp

                                                      Filesize

                                                      6.5MB

                                                    • memory/3812-3256-0x0000000000770000-0x0000000000C38000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                    • memory/4148-21-0x0000000000770000-0x0000000000C38000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                    • memory/4148-3273-0x0000000000770000-0x0000000000C38000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                    • memory/4148-18-0x0000000000770000-0x0000000000C38000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                    • memory/4148-802-0x0000000000770000-0x0000000000C38000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                    • memory/4148-19-0x0000000000771000-0x000000000079F000-memory.dmp

                                                      Filesize

                                                      184KB

                                                    • memory/4148-687-0x0000000000770000-0x0000000000C38000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                    • memory/4148-3294-0x0000000000770000-0x0000000000C38000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                    • memory/4148-20-0x0000000000770000-0x0000000000C38000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                    • memory/4148-3284-0x0000000000770000-0x0000000000C38000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                    • memory/4148-68-0x0000000000770000-0x0000000000C38000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                    • memory/4148-22-0x0000000000770000-0x0000000000C38000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                    • memory/4148-2179-0x0000000000770000-0x0000000000C38000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                    • memory/4148-3212-0x0000000000770000-0x0000000000C38000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                    • memory/4148-3222-0x0000000000770000-0x0000000000C38000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                    • memory/4148-3234-0x0000000000770000-0x0000000000C38000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                    • memory/4148-522-0x0000000000770000-0x0000000000C38000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                    • memory/4148-89-0x0000000000770000-0x0000000000C38000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                    • memory/4148-3275-0x0000000000770000-0x0000000000C38000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                    • memory/4148-441-0x0000000000770000-0x0000000000C38000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                    • memory/4148-3274-0x0000000000770000-0x0000000000C38000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                    • memory/4148-3271-0x0000000000770000-0x0000000000C38000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                    • memory/4148-3272-0x0000000000770000-0x0000000000C38000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                    • memory/4600-65-0x0000000000CE0000-0x0000000001360000-memory.dmp

                                                      Filesize

                                                      6.5MB

                                                    • memory/4600-56-0x0000000000CE1000-0x0000000000CF5000-memory.dmp

                                                      Filesize

                                                      80KB

                                                    • memory/4600-55-0x0000000005490000-0x0000000005491000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/4600-38-0x0000000000CE0000-0x0000000001360000-memory.dmp

                                                      Filesize

                                                      6.5MB

                                                    • memory/5800-674-0x0000000000770000-0x0000000000C38000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                    • memory/5800-684-0x0000000000770000-0x0000000000C38000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                    • memory/6008-3293-0x0000000000770000-0x0000000000C38000-memory.dmp

                                                      Filesize

                                                      4.8MB