Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-09-2024 12:21

General

  • Target

    77bb28459e7ff70cdcaf060e93a1479dd6b90278564beb083384b4ba8b542911.exe

  • Size

    1.8MB

  • MD5

    092ee2fd910b7750ce6ab2a25281d078

  • SHA1

    6ca5cf489e2db521001ebd9644fa3e87433ad280

  • SHA256

    77bb28459e7ff70cdcaf060e93a1479dd6b90278564beb083384b4ba8b542911

  • SHA512

    2c0c78544a70ccdf3595eda755e0b8b70b6e2232665653728f312bdcdb75d4ca05e4a12cd35cfd19076e910978124887c1a6f990a451f076d318934a4c35e75a

  • SSDEEP

    49152:YL0Bu3HQgr2izp4Wt1EDCEXM/giYojF48jWtEW:az3HQAFhgCCY/G8jE

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

c7817d

C2

http://31.41.244.10

Attributes
  • install_dir

    0e8d0864aa

  • install_file

    svoutse.exe

  • strings_key

    5481b88a6ef75bcf21333988a4e47048

  • url_paths

    /Dem7kTu/index.php

rc4.plain

Extracted

Family

stealc

Botnet

rave

C2

http://185.215.113.103

Attributes
  • url_path

    /e2b1563c6670f193.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Stealc

    Stealc is an infostealer written in C++.

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 14 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 6 IoCs
  • Identifies Wine through registry keys 2 TTPs 7 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 14 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 33 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 46 IoCs
  • Suspicious use of SendNotifyMessage 44 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\77bb28459e7ff70cdcaf060e93a1479dd6b90278564beb083384b4ba8b542911.exe
    "C:\Users\Admin\AppData\Local\Temp\77bb28459e7ff70cdcaf060e93a1479dd6b90278564beb083384b4ba8b542911.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1220
    • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
      "C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:456
      • C:\Users\Admin\AppData\Roaming\1000026000\f1f2b8d5cc.exe
        "C:\Users\Admin\AppData\Roaming\1000026000\f1f2b8d5cc.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:4684
      • C:\Users\Admin\AppData\Local\Temp\1000030001\ef75379242.exe
        "C:\Users\Admin\AppData\Local\Temp\1000030001\ef75379242.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:3724
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\Admin\AppData\Local\Temp\1000039041\do.ps1"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3448
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /c start msedge https://www.youtube.com/account
          4⤵
          • Checks computer location settings
          • System Location Discovery: System Language Discovery
          PID:4436
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.youtube.com/account
            5⤵
              PID:4316
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff9a81d46f8,0x7ff9a81d4708,0x7ff9a81d4718
                6⤵
                  PID:4360
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1936,17509424506966286329,8416970906043548963,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1948 /prefetch:2
                  6⤵
                    PID:5556
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1936,17509424506966286329,8416970906043548963,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
                    6⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:3232
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\system32\cmd.exe" /c start msedge https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
                4⤵
                • Checks computer location settings
                • System Location Discovery: System Language Discovery
                PID:3196
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://accounts.google.com/ServiceLogin?service=accountsettings
                  5⤵
                  • Enumerates system info in registry
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  PID:888
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff9a81d46f8,0x7ff9a81d4708,0x7ff9a81d4718
                    6⤵
                      PID:4976
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,14272679128683407941,2283175448885840063,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2196 /prefetch:2
                      6⤵
                        PID:4900
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,14272679128683407941,2283175448885840063,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:3
                        6⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:1620
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,14272679128683407941,2283175448885840063,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:8
                        6⤵
                          PID:5124
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,14272679128683407941,2283175448885840063,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
                          6⤵
                            PID:5472
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,14272679128683407941,2283175448885840063,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
                            6⤵
                              PID:5476
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,14272679128683407941,2283175448885840063,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3920 /prefetch:1
                              6⤵
                                PID:5248
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,14272679128683407941,2283175448885840063,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4692 /prefetch:1
                                6⤵
                                  PID:4436
                                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,14272679128683407941,2283175448885840063,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5324 /prefetch:8
                                  6⤵
                                    PID:6916
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,14272679128683407941,2283175448885840063,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5324 /prefetch:8
                                    6⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:7040
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,14272679128683407941,2283175448885840063,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:1
                                    6⤵
                                      PID:336
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,14272679128683407941,2283175448885840063,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
                                      6⤵
                                        PID:400
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,14272679128683407941,2283175448885840063,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4152 /prefetch:1
                                        6⤵
                                          PID:3036
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,14272679128683407941,2283175448885840063,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5912 /prefetch:1
                                          6⤵
                                            PID:6444
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,14272679128683407941,2283175448885840063,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5628 /prefetch:2
                                            6⤵
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:3348
                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                        "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
                                        4⤵
                                        • Suspicious use of WriteProcessMemory
                                        PID:1412
                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                          "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
                                          5⤵
                                          • Checks processor information in registry
                                          • Modifies registry class
                                          • Suspicious use of AdjustPrivilegeToken
                                          • Suspicious use of FindShellTrayWindow
                                          • Suspicious use of SendNotifyMessage
                                          • Suspicious use of SetWindowsHookEx
                                          • Suspicious use of WriteProcessMemory
                                          PID:3192
                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1984 -parentBuildID 20240401114208 -prefsHandle 1920 -prefMapHandle 1912 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e8cfc942-7c1d-4119-a848-a62e99d27076} 3192 "\\.\pipe\gecko-crash-server-pipe.3192" gpu
                                            6⤵
                                              PID:1260
                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2468 -parentBuildID 20240401114208 -prefsHandle 2460 -prefMapHandle 2456 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e20182d2-2b08-41b2-997a-8d26a5f88071} 3192 "\\.\pipe\gecko-crash-server-pipe.3192" socket
                                              6⤵
                                                PID:4004
                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3172 -childID 1 -isForBrowser -prefsHandle 2972 -prefMapHandle 3192 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3ba91691-5cae-4e1e-b87a-1326fb33269c} 3192 "\\.\pipe\gecko-crash-server-pipe.3192" tab
                                                6⤵
                                                  PID:3724
                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3644 -childID 2 -isForBrowser -prefsHandle 3640 -prefMapHandle 3632 -prefsLen 22693 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {68cc7653-3d3f-4199-9918-6237857c96a3} 3192 "\\.\pipe\gecko-crash-server-pipe.3192" tab
                                                  6⤵
                                                    PID:2900
                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4308 -childID 3 -isForBrowser -prefsHandle 4300 -prefMapHandle 4288 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f6aef31b-dac9-4207-a0d4-5dfc3e6d1531} 3192 "\\.\pipe\gecko-crash-server-pipe.3192" tab
                                                    6⤵
                                                      PID:4792
                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4720 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4780 -prefMapHandle 4772 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1972538a-cd93-404b-96f3-fcf6ec66a3b1} 3192 "\\.\pipe\gecko-crash-server-pipe.3192" utility
                                                      6⤵
                                                      • Checks processor information in registry
                                                      PID:5272
                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5732 -childID 4 -isForBrowser -prefsHandle 5776 -prefMapHandle 5772 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {586fd36a-6c2b-4259-a426-8cf1c0666184} 3192 "\\.\pipe\gecko-crash-server-pipe.3192" tab
                                                      6⤵
                                                        PID:5928
                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5912 -childID 5 -isForBrowser -prefsHandle 5920 -prefMapHandle 5924 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fb5c5bd9-5d60-4c2d-be1f-0d09113f4bc9} 3192 "\\.\pipe\gecko-crash-server-pipe.3192" tab
                                                        6⤵
                                                          PID:4324
                                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6088 -childID 6 -isForBrowser -prefsHandle 6096 -prefMapHandle 6100 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0fbaa3bf-f7cd-42d0-acef-b1f40cf5da88} 3192 "\\.\pipe\gecko-crash-server-pipe.3192" tab
                                                          6⤵
                                                            PID:3092
                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
                                                        4⤵
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:4580
                                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                                          "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
                                                          5⤵
                                                          • Checks processor information in registry
                                                          PID:2156
                                                • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                                                  C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                                                  1⤵
                                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                  • Checks BIOS information in registry
                                                  • Executes dropped EXE
                                                  • Identifies Wine through registry keys
                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:1268
                                                • C:\Windows\System32\CompPkgSrv.exe
                                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                  1⤵
                                                    PID:4352
                                                  • C:\Windows\System32\CompPkgSrv.exe
                                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                    1⤵
                                                      PID:5440
                                                    • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                                                      C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                                                      1⤵
                                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                      • Checks BIOS information in registry
                                                      • Executes dropped EXE
                                                      • Identifies Wine through registry keys
                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:6036
                                                    • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                                                      C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                                                      1⤵
                                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                      • Checks BIOS information in registry
                                                      • Executes dropped EXE
                                                      • Identifies Wine through registry keys
                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:2884

                                                    Network

                                                    MITRE ATT&CK Enterprise v15

                                                    Replay Monitor

                                                    Loading Replay Monitor...

                                                    Downloads

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                      Filesize

                                                      152B

                                                      MD5

                                                      27304926d60324abe74d7a4b571c35ea

                                                      SHA1

                                                      78b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1

                                                      SHA256

                                                      7039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de

                                                      SHA512

                                                      f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                      Filesize

                                                      152B

                                                      MD5

                                                      9e3fc58a8fb86c93d19e1500b873ef6f

                                                      SHA1

                                                      c6aae5f4e26f5570db5e14bba8d5061867a33b56

                                                      SHA256

                                                      828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4

                                                      SHA512

                                                      e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                      Filesize

                                                      504B

                                                      MD5

                                                      5f98d1f3115d6e800a446e126096115a

                                                      SHA1

                                                      b91455f1e06bbf547989ae2b3fa581bdf0b372f7

                                                      SHA256

                                                      e3011b5365bddf3aaa0c9b8c19c289412b33a1d66f24d3845e34313e2556df66

                                                      SHA512

                                                      33761cbfd57eaa985a4533ca71be0135e89c4a07f24cdf0d54f027d8e877b9f97ef881dfeffca2fd7fd1384393592199d364483aafd114a9c13a4ca15c31f8be

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                      Filesize

                                                      1KB

                                                      MD5

                                                      fc39792e67922feabbde8e71f2099d66

                                                      SHA1

                                                      f1a90fd83cb415feb19e76e01129abcc206e7680

                                                      SHA256

                                                      179c7de9fd2b4ad7657ac62cc2e0b8811396f8401eebeb85a04521d7b2e4075f

                                                      SHA512

                                                      0cb34e7053dbf3528bf8019298b1ce8077fec15138b54377412acfc9128da820495717538c5d2366d62a8e69b37a18d7755af1de0eaa633018af048b406408a2

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                      Filesize

                                                      5KB

                                                      MD5

                                                      d0c2f918cc0137f8a90e5b08d06f4942

                                                      SHA1

                                                      26f50b843e4ef43bdbc68e85ae0d6b3129e98f6e

                                                      SHA256

                                                      f427b1a69b1be6d543dbd903de952d982f22924d8cde0768714ad3ca32f91af1

                                                      SHA512

                                                      4d8d53917b292f32ca1b20b30a0ad7475a2b8e8b8edb50dd9ea25399ce0c37a8c059cce8fd51d0d026f02ee7c84ede217a92d4335dcb6d4352a7455363d53832

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                      Filesize

                                                      7KB

                                                      MD5

                                                      f3ddc43b7d5b7cbcd73fa5aac437dbb4

                                                      SHA1

                                                      cb1394847a66f21b61f44fab330e26628c82dbec

                                                      SHA256

                                                      f5e0660d6c6d924326fb39ed22baefefbb4c11600b8f45d663a40fd151188abd

                                                      SHA512

                                                      693a940e0888cbb2fda76e691cd50e9658dbada029d6b3646dc92cc288ac76efe8785966ec7c8ab01135afb9722c3e84128f7ded61f5839edb31e5763c17a4fa

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                      Filesize

                                                      16B

                                                      MD5

                                                      6752a1d65b201c13b62ea44016eb221f

                                                      SHA1

                                                      58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                      SHA256

                                                      0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                      SHA512

                                                      9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                      Filesize

                                                      8KB

                                                      MD5

                                                      3e3110ab9ae68ac267a1e09e22632317

                                                      SHA1

                                                      5927ada9ebff3dd575a08afdfd6e85065e7d390f

                                                      SHA256

                                                      34d2e3e18f36344cce9c72726f7155ee10ca7700092f77867b6db42eee8a84f6

                                                      SHA512

                                                      97cd6f2235b1e5d81bddc5bb77be76ca1e0d03c6abf7d4f65dc09e58f633cb17258cdfb7ca006397baa699b1f7600a4dfcd80da59dd321366579b98434044e8e

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                      Filesize

                                                      10KB

                                                      MD5

                                                      6220c9616b8f92c18949394e562c7895

                                                      SHA1

                                                      6afae096f8d07acd370fc17ff4467f55d99cc74a

                                                      SHA256

                                                      a657c89936f54dbe004998323302e393be3c3e8e1e741608a04f8a4b55753cfb

                                                      SHA512

                                                      563b0d6eef24c977a88933aafcd64756cc4a4a77e5ad55ef36225d766aed4930dc33f12a61dae190dc382d5259b9682dcf9bc8e9c0c801ce6de6504f4a426f10

                                                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5utpapi8.default-release\cache2\entries\58EFA56DB4BFFECB0EDA547894BC9A057159E22F

                                                      Filesize

                                                      13KB

                                                      MD5

                                                      be08a3fce8cc1b573ed8176a390f342b

                                                      SHA1

                                                      5202295e0ef7368a77314d475c7c092c87ff68fa

                                                      SHA256

                                                      776a3a4ef708869f1636c1b1e7da5f475128ea844c87d6cae37d4930d41bddd3

                                                      SHA512

                                                      599cd70ae28fc989b1b71057afcf7854a3205352abca534e152658c22b8a927380ff62e5d2f3b43b73ef238523ee366ffb55becb0d574ad73d5d5d5377df174f

                                                    • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe

                                                      Filesize

                                                      1.8MB

                                                      MD5

                                                      092ee2fd910b7750ce6ab2a25281d078

                                                      SHA1

                                                      6ca5cf489e2db521001ebd9644fa3e87433ad280

                                                      SHA256

                                                      77bb28459e7ff70cdcaf060e93a1479dd6b90278564beb083384b4ba8b542911

                                                      SHA512

                                                      2c0c78544a70ccdf3595eda755e0b8b70b6e2232665653728f312bdcdb75d4ca05e4a12cd35cfd19076e910978124887c1a6f990a451f076d318934a4c35e75a

                                                    • C:\Users\Admin\AppData\Local\Temp\1000039041\do.ps1

                                                      Filesize

                                                      2KB

                                                      MD5

                                                      e05e8f072b373beafe27cc11d85f947c

                                                      SHA1

                                                      1d6daeb98893e8122b8b69287ebd9d43f3c6138e

                                                      SHA256

                                                      717c09427fa5754ba92f92961545534048d0a76528c2e95c4d5ec6cef47c612f

                                                      SHA512

                                                      b3e34162e5ee43bb01f289eebc45fd3ea3e07f30be40dcf6635606540f912fe5c84d301e9f78e97dfe3ffe53e72547e50f3bcd7d4ebe5ab8da451a1989c469a0

                                                    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vtol0cjt.53n.ps1

                                                      Filesize

                                                      60B

                                                      MD5

                                                      d17fe0a3f47be24a6453e9ef58c94641

                                                      SHA1

                                                      6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                      SHA256

                                                      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                      SHA512

                                                      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                    • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                                                      Filesize

                                                      479KB

                                                      MD5

                                                      09372174e83dbbf696ee732fd2e875bb

                                                      SHA1

                                                      ba360186ba650a769f9303f48b7200fb5eaccee1

                                                      SHA256

                                                      c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                                                      SHA512

                                                      b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                                                    • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                                                      Filesize

                                                      13.8MB

                                                      MD5

                                                      0a8747a2ac9ac08ae9508f36c6d75692

                                                      SHA1

                                                      b287a96fd6cc12433adb42193dfe06111c38eaf0

                                                      SHA256

                                                      32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                                                      SHA512

                                                      59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                                                    • C:\Users\Admin\AppData\Roaming\1000026000\f1f2b8d5cc.exe

                                                      Filesize

                                                      1.7MB

                                                      MD5

                                                      250051046eae3713ed1af118169d9227

                                                      SHA1

                                                      66ecbbeffdbb6bae912fc9f21b52faeac7b73d49

                                                      SHA256

                                                      c1d2816e557482077a88b8e23581cd82a92dfca70fd1e7ceaec4ba3adbd7d136

                                                      SHA512

                                                      a9a49aaf7e56466ec9cbdf86564ba5ad875d8233f12b26c718dc163dfb7d9e139891e5a422eca933e41c3bc19d5dc62d47606e23019fb0cce8f281a981a82d1e

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\AlternateServices.bin

                                                      Filesize

                                                      6KB

                                                      MD5

                                                      c1da954c2580b29798d56f7846ee57b4

                                                      SHA1

                                                      10e70e22f550bdf277d663ddf38df8c5fad7f4e9

                                                      SHA256

                                                      26254b0af3595ed52644168d43d3998ea3191d4c19f705bfdce4021681c9a566

                                                      SHA512

                                                      2fa05061e066447879256de78b706b2fb810f82646eb59f2a730a25cc364e3772c869cbf681f42e44e9253ac5a70a97aa1d83cdbb3d23e6e7e0f15170a74c9b6

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\AlternateServices.bin

                                                      Filesize

                                                      12KB

                                                      MD5

                                                      22f07f6e3cbbf1a980fc768c53bbfb4e

                                                      SHA1

                                                      75650e2d529ba569fa8cfbdda65ac1efde4cce56

                                                      SHA256

                                                      a40a0e67a489d3e9d32a9dd4bfe40664ffda16d5bfd36f8eed5a679adad599da

                                                      SHA512

                                                      efe1cde8fae9c207cff63b7ca1fc4dde5e5007484a4bc17f84240e5c152a686b78ad47963cc9fcc643d1855e2648ae597e1beeff3fce4b78f33a178dee1eff48

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\AlternateServices.bin

                                                      Filesize

                                                      12KB

                                                      MD5

                                                      a6aab6332fc320ab8a36aca253ad3d73

                                                      SHA1

                                                      b235d6315328bfcb5cb3bbe017fd2592234ab859

                                                      SHA256

                                                      a034e58a3cc95be09f1229e19cdd3c49038705c830823968abfe0d1175d578ed

                                                      SHA512

                                                      d3a67bccec24864f3b6a7f8b3827c4e3f630f098f8911ffc51aee3fa95a0f08015561781d9ab5fb2ab2e45468ac37a6984dcd18e1a6b8c55c36300f614cfb2ba

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\AlternateServices.bin

                                                      Filesize

                                                      17KB

                                                      MD5

                                                      59254a98490217f9e836a31b96203f5e

                                                      SHA1

                                                      f17514e48bd369686a8fbefa510d3f3539ca65fc

                                                      SHA256

                                                      1b131de21ab0a46de15cf8a7468d69d4d59aa4d0363286df9a6ac506574e355a

                                                      SHA512

                                                      8a67e0bf36099d5c05e1a38f25ede5169a9fb3b78278122ef721a8ced86fed17e24e077239a2c1791d1cddc8995d3f0312ae830af7933ecf36054cfa7984f568

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\AlternateServices.bin

                                                      Filesize

                                                      20KB

                                                      MD5

                                                      66fd4b0992f7ed1cca32552da6c00339

                                                      SHA1

                                                      09b44c8141fdb2af432d6c005cc45b808f3641a4

                                                      SHA256

                                                      e391b01b309eb2f03f26b01f320e502879e01db7aac99978412f9c0200e17fd0

                                                      SHA512

                                                      3a3f67fb8125408950d498825730153f7a8ed1b1573664236a4bcae5000f573cf9fe4584e8d261b566dc4db14e54c4cba3d67976a3da959db543120d48f80a0f

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\AlternateServices.bin

                                                      Filesize

                                                      21KB

                                                      MD5

                                                      3a908604eebc00567fb189339f60008d

                                                      SHA1

                                                      6fd8719bfacf7078d70f484434a9f801183f066a

                                                      SHA256

                                                      2d9fbb48a732b5f7ebed25856a9dc30c18560a3f74de6f37247e3f0cde73c3b8

                                                      SHA512

                                                      92c0684cc548aada96a2958e1d450d6535b7aa7cc7654f739bc7e610b6de86f97c210835edee86e91784c4997dab42cf5e23ce0dc1511df499ba62306d8a5aa9

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\AlternateServices.bin

                                                      Filesize

                                                      23KB

                                                      MD5

                                                      628d26b874e87efc36476e0efdb086c5

                                                      SHA1

                                                      aa1c906695d8a8581aa8a51c3083d105ba5bf7d9

                                                      SHA256

                                                      752f7bfff397a134d6cb4339f07497ae25e16989ae54f3ddae683304b6713867

                                                      SHA512

                                                      b0ede09d495b5163a9f9af465ad8ca71ca7147bfcc2dd3fff1aa7c209a76a9d0419bd50e1e13d33df39ad2b89bd6034641bba251f4c2385900573c2416c850b6

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\datareporting\glean\db\data.safe.tmp

                                                      Filesize

                                                      5KB

                                                      MD5

                                                      ddd86f9dc0040a581e34b6856ce5ab35

                                                      SHA1

                                                      917a2284e8616ce3b201a53a06c37a8f906e0b0c

                                                      SHA256

                                                      4cb392aed2aa9fcfa48927e4e794d9a926ce660750a8c307e073c88acf0135bb

                                                      SHA512

                                                      dba8e4fcb8922b0b260147db1667120109c935a1000fc9c04862577ca9024f7a8335ea64ec6e4cf8768853916fc120741bd5c94133b210a23a9ba30a019fa1cb

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\datareporting\glean\db\data.safe.tmp

                                                      Filesize

                                                      15KB

                                                      MD5

                                                      31eea54ba3a74b1d98cee248fc849912

                                                      SHA1

                                                      d74a616237425d5b98393658088f9976f0c0a74c

                                                      SHA256

                                                      e69889db36d1ab2da9149967446cb6d4fa085a61dc1ec28b3cda7acfe5b0041a

                                                      SHA512

                                                      7bb4cc0edbab5b59868c235aa834453103add86432c4336beca08ed9ade570dc48dff14c8f51092455e3b8254fbe372a5dacc3dad5e575e9190113a1a485efa6

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\datareporting\glean\pending_pings\1de39501-6846-4583-81d4-adf0f6eda06f

                                                      Filesize

                                                      982B

                                                      MD5

                                                      2fd1c3b196c5d54745650ed10cb66d1e

                                                      SHA1

                                                      131fe23dcca12dc3267419a798ae2b3f204ff990

                                                      SHA256

                                                      4881f487096dbdd1ec0374b464b2366760ee7cd1b08660d968189883905d92b3

                                                      SHA512

                                                      74ab1f8b89fe211a3f1678b1c68a7968a2848ce27ea8c4889b556d498ae62bdacba41d642f978eca039e48ed6eaf7b6efc444ef4e63a58524307b303175e7b01

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\datareporting\glean\pending_pings\9fce7e03-5924-4396-9767-4aa133118f2c

                                                      Filesize

                                                      671B

                                                      MD5

                                                      a25405df0845a0ca2d80af7698722ebc

                                                      SHA1

                                                      1de7e6913492b817c9c4bbf9c5289f368c40f744

                                                      SHA256

                                                      a6047fb68b678ec173a28fc34b329c7d2538ab1edadc19148971291b7803aa64

                                                      SHA512

                                                      b398d5fec0c1c94677b7d5604c28e274541ecc133321fede201ca549f8a26eae63b437404869ec6f22b7cf94dc71f0a665a27836059fa4608b370a35def92bc0

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\datareporting\glean\pending_pings\cad990a1-bf12-41e9-b22d-cdc550e620ed

                                                      Filesize

                                                      26KB

                                                      MD5

                                                      08e01b484b830c70bc78af30666fece2

                                                      SHA1

                                                      cebd91521159f5b56f3e3cbf31e2666a5bc3e180

                                                      SHA256

                                                      6f32d9b5080f5821c064ca2769f23c952856312bc3ebd0de9901007994f016ac

                                                      SHA512

                                                      ef89f5d215612788c210d433d42698040955dbcd3255e19d7435189dc01250f1c6b1f88ed6a916cc612ec29404101b6462a0d8bb96f362884b71ba50374d108a

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

                                                      Filesize

                                                      1.1MB

                                                      MD5

                                                      842039753bf41fa5e11b3a1383061a87

                                                      SHA1

                                                      3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                                                      SHA256

                                                      d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                                                      SHA512

                                                      d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

                                                      Filesize

                                                      116B

                                                      MD5

                                                      2a461e9eb87fd1955cea740a3444ee7a

                                                      SHA1

                                                      b10755914c713f5a4677494dbe8a686ed458c3c5

                                                      SHA256

                                                      4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                                                      SHA512

                                                      34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

                                                      Filesize

                                                      372B

                                                      MD5

                                                      bf957ad58b55f64219ab3f793e374316

                                                      SHA1

                                                      a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                                                      SHA256

                                                      bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                                                      SHA512

                                                      79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

                                                      Filesize

                                                      17.8MB

                                                      MD5

                                                      daf7ef3acccab478aaa7d6dc1c60f865

                                                      SHA1

                                                      f8246162b97ce4a945feced27b6ea114366ff2ad

                                                      SHA256

                                                      bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                                                      SHA512

                                                      5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\prefs-1.js

                                                      Filesize

                                                      11KB

                                                      MD5

                                                      0f765cedf305f7741ff57af41e0e3384

                                                      SHA1

                                                      02bb78fd0bffcd68b02573b2f8396135d4e5db47

                                                      SHA256

                                                      21b365e3dca0641213de2f0d7072d76f6cc4738a299eddb369865ebb1ce6167a

                                                      SHA512

                                                      21fcb18a9a5502896b09094f2856555c6b665cbcf1cf8b76569650a067aa7c2775db119aa640092f873528e4be412a52d7777f4aeccc87f2d58baaccbcf8d311

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\prefs-1.js

                                                      Filesize

                                                      15KB

                                                      MD5

                                                      655d4a94cbec9640af7c5de91773d5bc

                                                      SHA1

                                                      7d9a2c31f317a22ca9deced59d9d87f99be7c5d6

                                                      SHA256

                                                      807dd8863f356679adec093dc94fed59c5ba8cc2de22ce7135c30f05a0a8424e

                                                      SHA512

                                                      f7c64ca7d9704c591f58432125ed5fa7421393f8a010816c05b3d5e26ef11eda66c4f5b8881b186cac2bb873459b7ed96fb25cfcbe02b73086956c49affb069d

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\prefs-1.js

                                                      Filesize

                                                      11KB

                                                      MD5

                                                      5cfd480b84f501f7a6871fd58471d5b8

                                                      SHA1

                                                      5e490f8d23e91e21b4727ea6003c81742561c3ac

                                                      SHA256

                                                      d2e358fb43bbe31d25e365b3fdf6a423196f974b464931cf9b6f3fcc7762b6b4

                                                      SHA512

                                                      11cbf0b37bc60707c09975be87df790071f1d2835641d82319c7e9e74a49169a8bbe8aee72105c7f756e496a9462415aadbd2acc814d79d9d193b460ff1a68eb

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\prefs.js

                                                      Filesize

                                                      11KB

                                                      MD5

                                                      0e787fdeee8d5ef413ed8f305765a54c

                                                      SHA1

                                                      f0ace7684bcab5132ba6caf45ec3dd4feb6e0a85

                                                      SHA256

                                                      8fbcc7171e006235c4cb481f7c1d2847c2610b6a60d349883918fea2b50e3093

                                                      SHA512

                                                      b12cee4fa0cca12f32bc92ef3640b680f4cfa58322525cb1cafbba1f537ae457e89c50cf2ee771b340dbce15afa34b73bb82745f99303edda4823fba751bb79f

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\sessionstore-backups\recovery.baklz4

                                                      Filesize

                                                      1KB

                                                      MD5

                                                      2c1154d048370886d4a65f704f45790d

                                                      SHA1

                                                      3ee83cc8f0476ca3753f7bf392e322e5a3c57e42

                                                      SHA256

                                                      1505468e34938e23e7877277df02c97372343bddc6a2d0c9293677a8743688b4

                                                      SHA512

                                                      975d9194a50f8216b81b4632b473b41717e3228901a9a7d228aeac642ee926799739551622ee915573ec805c45d39f96eb3f689df837d568619ee935f206b383

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\sessionstore-backups\recovery.baklz4

                                                      Filesize

                                                      5KB

                                                      MD5

                                                      9e162a9499fd57619254c7b59e845230

                                                      SHA1

                                                      850c46cac5e55b875386c013f8d7f66068e14831

                                                      SHA256

                                                      a11857cd0ffe07bba63c383efb76cd52efab40b78a9cf302e4ddb81ab8a5bd4c

                                                      SHA512

                                                      c77ac3e58fc3feacceaeb13d6c75a64d2ca0243ba991e0080ef07e5aebc481813f9e436ea1cc5b52350b18c02e03c8719b9e4cc3bd29591adcbe54639666fc9f

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

                                                      Filesize

                                                      1.4MB

                                                      MD5

                                                      afcb9dafe0cfd76a9524a65a8089107d

                                                      SHA1

                                                      6c4fb4c061b074ef438ab130c149caa30d81bf4d

                                                      SHA256

                                                      80085406adfd72fb6784ed11b52922930c27ea25d0ea6781134d9beb03d79cd3

                                                      SHA512

                                                      514849e52d0f5e9802e765d72ddeb346db9a70f67cc2a4fba35554ee4d4e8f552982ecda37e642bf2ef650c92bf2e40e12e49e420529bc258e7701b7cef455aa

                                                    • \??\pipe\LOCAL\crashpad_888_KAMPLOTTFOVNXPIF

                                                      MD5

                                                      d41d8cd98f00b204e9800998ecf8427e

                                                      SHA1

                                                      da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                      SHA256

                                                      e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                      SHA512

                                                      cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                    • memory/456-1054-0x0000000000800000-0x0000000000CBC000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/456-20-0x0000000000800000-0x0000000000CBC000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/456-2964-0x0000000000800000-0x0000000000CBC000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/456-2963-0x0000000000800000-0x0000000000CBC000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/456-2960-0x0000000000800000-0x0000000000CBC000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/456-2959-0x0000000000800000-0x0000000000CBC000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/456-2567-0x0000000000800000-0x0000000000CBC000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/456-18-0x0000000000800000-0x0000000000CBC000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/456-2220-0x0000000000800000-0x0000000000CBC000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/456-1920-0x0000000000800000-0x0000000000CBC000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/456-1400-0x0000000000800000-0x0000000000CBC000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/456-19-0x0000000000800000-0x0000000000CBC000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/456-85-0x0000000000800000-0x0000000000CBC000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/456-22-0x0000000000800000-0x0000000000CBC000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/456-613-0x0000000000800000-0x0000000000CBC000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/456-21-0x0000000000800000-0x0000000000CBC000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/456-811-0x0000000000800000-0x0000000000CBC000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/456-648-0x0000000000800000-0x0000000000CBC000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/1220-0-0x0000000000800000-0x0000000000CBC000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/1220-2-0x0000000000801000-0x000000000082F000-memory.dmp

                                                      Filesize

                                                      184KB

                                                    • memory/1220-3-0x0000000000800000-0x0000000000CBC000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/1220-1-0x0000000076FE4000-0x0000000076FE6000-memory.dmp

                                                      Filesize

                                                      8KB

                                                    • memory/1220-16-0x0000000000800000-0x0000000000CBC000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/1220-4-0x0000000000800000-0x0000000000CBC000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/1268-88-0x0000000000800000-0x0000000000CBC000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/1268-94-0x0000000000800000-0x0000000000CBC000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/2884-2966-0x0000000000800000-0x0000000000CBC000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/3448-92-0x00000000080A0000-0x0000000008644000-memory.dmp

                                                      Filesize

                                                      5.6MB

                                                    • memory/3448-72-0x0000000006250000-0x00000000062B6000-memory.dmp

                                                      Filesize

                                                      408KB

                                                    • memory/3448-91-0x0000000006F30000-0x0000000006F52000-memory.dmp

                                                      Filesize

                                                      136KB

                                                    • memory/3448-90-0x0000000006EB0000-0x0000000006ECA000-memory.dmp

                                                      Filesize

                                                      104KB

                                                    • memory/3448-83-0x0000000006940000-0x000000000695E000-memory.dmp

                                                      Filesize

                                                      120KB

                                                    • memory/3448-67-0x0000000005BB0000-0x00000000061D8000-memory.dmp

                                                      Filesize

                                                      6.2MB

                                                    • memory/3448-89-0x0000000007A50000-0x0000000007AE6000-memory.dmp

                                                      Filesize

                                                      600KB

                                                    • memory/3448-70-0x0000000005940000-0x0000000005962000-memory.dmp

                                                      Filesize

                                                      136KB

                                                    • memory/3448-66-0x0000000002FB0000-0x0000000002FE6000-memory.dmp

                                                      Filesize

                                                      216KB

                                                    • memory/3448-82-0x00000000062C0000-0x0000000006614000-memory.dmp

                                                      Filesize

                                                      3.3MB

                                                    • memory/3448-71-0x00000000061E0000-0x0000000006246000-memory.dmp

                                                      Filesize

                                                      408KB

                                                    • memory/3448-84-0x00000000069E0000-0x0000000006A2C000-memory.dmp

                                                      Filesize

                                                      304KB

                                                    • memory/3724-55-0x0000000000580000-0x0000000000BFF000-memory.dmp

                                                      Filesize

                                                      6.5MB

                                                    • memory/3724-69-0x0000000000580000-0x0000000000BFF000-memory.dmp

                                                      Filesize

                                                      6.5MB

                                                    • memory/4684-65-0x00000000006C0000-0x0000000000D3F000-memory.dmp

                                                      Filesize

                                                      6.5MB

                                                    • memory/4684-48-0x00000000006C0000-0x0000000000D3F000-memory.dmp

                                                      Filesize

                                                      6.5MB

                                                    • memory/4684-47-0x00000000006C0000-0x0000000000D3F000-memory.dmp

                                                      Filesize

                                                      6.5MB

                                                    • memory/4684-38-0x00000000006C0000-0x0000000000D3F000-memory.dmp

                                                      Filesize

                                                      6.5MB

                                                    • memory/6036-1956-0x0000000000800000-0x0000000000CBC000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/6036-1946-0x0000000000800000-0x0000000000CBC000-memory.dmp

                                                      Filesize

                                                      4.7MB