Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-09-2024 16:26

General

  • Target

    ac9d727f71fde0eeb640065fb857e797eb55c7b0570270769db0cf1ad5b48801.exe

  • Size

    1.8MB

  • MD5

    eeb139916aa5a94fb6de01d67d329939

  • SHA1

    7881a77833d76054afee411c19b37b5ee08ca9b1

  • SHA256

    ac9d727f71fde0eeb640065fb857e797eb55c7b0570270769db0cf1ad5b48801

  • SHA512

    f9645cadcc7893d3a4d5d5db17654653c3336c58f98106a28ee04d5f3570582d9c6ec8bc8e76c092f4795f7779b8571eb561d5651e7ee667205727938a0f2bef

  • SSDEEP

    49152:U7cDiWv20IGA9yOEwr22eavHXsQQVQutTqrIBxjsSst06:Ug5+Zoa22eav3MVQutTkIBx1st0

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

c7817d

C2

http://31.41.244.10

Attributes
  • install_dir

    0e8d0864aa

  • install_file

    svoutse.exe

  • strings_key

    5481b88a6ef75bcf21333988a4e47048

  • url_paths

    /Dem7kTu/index.php

rc4.plain

Extracted

Family

stealc

Botnet

rave

C2

http://185.215.113.103

Attributes
  • url_path

    /e2b1563c6670f193.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Stealc

    Stealc is an infostealer written in C++.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 12 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Identifies Wine through registry keys 2 TTPs 6 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 14 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 28 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 47 IoCs
  • Suspicious use of SendNotifyMessage 44 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\ac9d727f71fde0eeb640065fb857e797eb55c7b0570270769db0cf1ad5b48801.exe
    "C:\Users\Admin\AppData\Local\Temp\ac9d727f71fde0eeb640065fb857e797eb55c7b0570270769db0cf1ad5b48801.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:3628
    • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
      "C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:448
      • C:\Users\Admin\AppData\Roaming\1000026000\3de546954f.exe
        "C:\Users\Admin\AppData\Roaming\1000026000\3de546954f.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:1152
      • C:\Users\Admin\AppData\Local\Temp\1000030001\114eb35934.exe
        "C:\Users\Admin\AppData\Local\Temp\1000030001\114eb35934.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:4892
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\Admin\AppData\Local\Temp\1000039041\do.ps1"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4532
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /c start msedge https://www.youtube.com/account
          4⤵
          • Checks computer location settings
          • System Location Discovery: System Language Discovery
          PID:1684
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.youtube.com/account
            5⤵
              PID:4088
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffc8b1946f8,0x7ffc8b194708,0x7ffc8b194718
                6⤵
                  PID:4924
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,14715744104998962272,3232219489734209996,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
                  6⤵
                    PID:4452
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,14715744104998962272,3232219489734209996,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
                    6⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:2740
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\system32\cmd.exe" /c start msedge https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
                4⤵
                • Checks computer location settings
                • System Location Discovery: System Language Discovery
                PID:3700
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://accounts.google.com/ServiceLogin?service=accountsettings
                  5⤵
                  • Enumerates system info in registry
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  PID:4700
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffc8b1946f8,0x7ffc8b194708,0x7ffc8b194718
                    6⤵
                      PID:1208
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,18114063376230738770,2860260644491805883,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
                      6⤵
                        PID:5964
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,18114063376230738770,2860260644491805883,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
                        6⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:5976
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,18114063376230738770,2860260644491805883,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2724 /prefetch:8
                        6⤵
                          PID:5448
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,18114063376230738770,2860260644491805883,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
                          6⤵
                            PID:5212
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,18114063376230738770,2860260644491805883,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
                            6⤵
                              PID:5284
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,18114063376230738770,2860260644491805883,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3948 /prefetch:1
                              6⤵
                                PID:5480
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,18114063376230738770,2860260644491805883,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4320 /prefetch:1
                                6⤵
                                  PID:6160
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,18114063376230738770,2860260644491805883,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5816 /prefetch:1
                                  6⤵
                                    PID:6076
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,18114063376230738770,2860260644491805883,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:1
                                    6⤵
                                      PID:5556
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,18114063376230738770,2860260644491805883,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4360 /prefetch:8
                                      6⤵
                                        PID:5380
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,18114063376230738770,2860260644491805883,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4360 /prefetch:8
                                        6⤵
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:4248
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,18114063376230738770,2860260644491805883,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6084 /prefetch:1
                                        6⤵
                                          PID:6832
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,18114063376230738770,2860260644491805883,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6076 /prefetch:1
                                          6⤵
                                            PID:6844
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,18114063376230738770,2860260644491805883,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5364 /prefetch:2
                                            6⤵
                                              PID:4964
                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                          "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
                                          4⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:4152
                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                            "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
                                            5⤵
                                            • Checks processor information in registry
                                            • Modifies registry class
                                            • Suspicious use of AdjustPrivilegeToken
                                            • Suspicious use of FindShellTrayWindow
                                            • Suspicious use of SendNotifyMessage
                                            • Suspicious use of SetWindowsHookEx
                                            • Suspicious use of WriteProcessMemory
                                            PID:4980
                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1960 -parentBuildID 20240401114208 -prefsHandle 1876 -prefMapHandle 1868 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9f030041-1cbf-4a89-8c6e-d285aaf8a5e5} 4980 "\\.\pipe\gecko-crash-server-pipe.4980" gpu
                                              6⤵
                                                PID:4792
                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2436 -parentBuildID 20240401114208 -prefsHandle 2424 -prefMapHandle 2408 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bb70f9be-bf07-4b4f-a4bc-59e93eabdf68} 4980 "\\.\pipe\gecko-crash-server-pipe.4980" socket
                                                6⤵
                                                  PID:4076
                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3176 -childID 1 -isForBrowser -prefsHandle 3208 -prefMapHandle 2872 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1296 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0fe13f1a-459a-44a7-8b08-fa8f1612a2ac} 4980 "\\.\pipe\gecko-crash-server-pipe.4980" tab
                                                  6⤵
                                                    PID:4904
                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3108 -childID 2 -isForBrowser -prefsHandle 3572 -prefMapHandle 3568 -prefsLen 22693 -prefMapSize 244658 -jsInitHandle 1296 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b1bc92c4-323a-4f39-94dd-96b9dfd298e4} 4980 "\\.\pipe\gecko-crash-server-pipe.4980" tab
                                                    6⤵
                                                      PID:432
                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4240 -childID 3 -isForBrowser -prefsHandle 4104 -prefMapHandle 3692 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1296 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6200554b-9d33-4327-b2e9-56fa27596384} 4980 "\\.\pipe\gecko-crash-server-pipe.4980" tab
                                                      6⤵
                                                        PID:3580
                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4956 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4904 -prefMapHandle 5004 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f4e41c32-3751-4c2b-ba96-c45f94bb8898} 4980 "\\.\pipe\gecko-crash-server-pipe.4980" utility
                                                        6⤵
                                                        • Checks processor information in registry
                                                        PID:5680
                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5788 -childID 4 -isForBrowser -prefsHandle 4512 -prefMapHandle 3696 -prefsLen 26944 -prefMapSize 244658 -jsInitHandle 1296 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3ee9b834-c728-42eb-944e-dbe70ca15709} 4980 "\\.\pipe\gecko-crash-server-pipe.4980" tab
                                                        6⤵
                                                          PID:6308
                                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5940 -childID 5 -isForBrowser -prefsHandle 6016 -prefMapHandle 6012 -prefsLen 26944 -prefMapSize 244658 -jsInitHandle 1296 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3b610f19-1ad9-4309-8437-50aa2d1c7940} 4980 "\\.\pipe\gecko-crash-server-pipe.4980" tab
                                                          6⤵
                                                            PID:6320
                                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6108 -childID 6 -isForBrowser -prefsHandle 6116 -prefMapHandle 6120 -prefsLen 26944 -prefMapSize 244658 -jsInitHandle 1296 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c91302e9-566a-4362-8755-d1bba90632e5} 4980 "\\.\pipe\gecko-crash-server-pipe.4980" tab
                                                            6⤵
                                                              PID:6332
                                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                                          "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
                                                          4⤵
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:1348
                                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                                            "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
                                                            5⤵
                                                            • Checks processor information in registry
                                                            PID:3636
                                                  • C:\Windows\System32\CompPkgSrv.exe
                                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                    1⤵
                                                      PID:5356
                                                    • C:\Windows\System32\CompPkgSrv.exe
                                                      C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                      1⤵
                                                        PID:5612
                                                      • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                                                        C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                                                        1⤵
                                                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                        • Checks BIOS information in registry
                                                        • Executes dropped EXE
                                                        • Identifies Wine through registry keys
                                                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        PID:7164
                                                      • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                                                        C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                                                        1⤵
                                                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                        • Checks BIOS information in registry
                                                        • Executes dropped EXE
                                                        • Identifies Wine through registry keys
                                                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        PID:3496

                                                      Network

                                                      MITRE ATT&CK Enterprise v15

                                                      Replay Monitor

                                                      Loading Replay Monitor...

                                                      Downloads

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                        Filesize

                                                        152B

                                                        MD5

                                                        2dc1a9f2f3f8c3cfe51bb29b078166c5

                                                        SHA1

                                                        eaf3c3dad3c8dc6f18dc3e055b415da78b704402

                                                        SHA256

                                                        dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa

                                                        SHA512

                                                        682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                        Filesize

                                                        152B

                                                        MD5

                                                        e4f80e7950cbd3bb11257d2000cb885e

                                                        SHA1

                                                        10ac643904d539042d8f7aa4a312b13ec2106035

                                                        SHA256

                                                        1184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124

                                                        SHA512

                                                        2b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                        Filesize

                                                        504B

                                                        MD5

                                                        f03e3976a60908fac8d71e3a19266166

                                                        SHA1

                                                        4407f83170bf8c8b2a7e408fdb9de73505766007

                                                        SHA256

                                                        eee171beaaf5438c4831c03a4e66e2f6217874e6543171193ccacf83c40df271

                                                        SHA512

                                                        7551c1d7754ce8bfc1221b9fc40c7e9afe5a79c241518d8ee08ceb63c099eb367269f592293e3ba7034b40ff93526f4016657dabbf789a51ff79044c5d8fb72a

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                        Filesize

                                                        1KB

                                                        MD5

                                                        3bf6cb6bc8a1ea15c6732e8599316ae5

                                                        SHA1

                                                        a94e0106dddc1267cb2df4ec359f98bcba14820d

                                                        SHA256

                                                        37c0912c1807fd5516f8509e2ff2e1ac1814e70cfffe28edc6f4a24d7f471d2e

                                                        SHA512

                                                        bbbe83c6cee5cc505d366171646c09271ca56a7cea3e8ac57b33fc92c5778b3e9c73f7754181f7f20cf207e970bfd537ff7d2f04481fb65293cad3784251b787

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                        Filesize

                                                        5KB

                                                        MD5

                                                        0220da29e5e173aa8dfacd92ac9c11e3

                                                        SHA1

                                                        6aa85d8038bc8e2707c5f5c0e10a393a795043e3

                                                        SHA256

                                                        e4b814b8364814d1f69f4c7d80c11179ea1383ba13c8afb517c6e46f9f9d0daa

                                                        SHA512

                                                        a89ce3ec4dc5cb24ec82b700008fd1d0c85ce2efd46b705c4eae03d106a664fa3d81d7f043aa1a17b3f0721d084863bd42a161ec9d45deee9dcec8a8a0a41e05

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                        Filesize

                                                        7KB

                                                        MD5

                                                        7f109c41befdbe00c7b0228edc4bb4c6

                                                        SHA1

                                                        3a0abf61fd7c76ad399f6b901399e9699e840e93

                                                        SHA256

                                                        bfdd4a46e8adb7470e447d580c124c117bc293ddaea564345393994ab7285798

                                                        SHA512

                                                        c4c50fcc29e19094927160dee924921eeeff2bc545e2404885d4121b650f9a59e5d9dfa8ccad5a4696a383e823530f9c923abbf0704af12b9672fb4ba100362a

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                        Filesize

                                                        16B

                                                        MD5

                                                        6752a1d65b201c13b62ea44016eb221f

                                                        SHA1

                                                        58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                        SHA256

                                                        0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                        SHA512

                                                        9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                        Filesize

                                                        8KB

                                                        MD5

                                                        028547cbbbd4ce73e7e28f3822e3798d

                                                        SHA1

                                                        687ca3aab259226bd17a4ff10f32f52bbdf6f2ff

                                                        SHA256

                                                        f6656fcde1e1eb747539b3203f025c0937b77ada047346c7d1f7c5dfdad3febb

                                                        SHA512

                                                        596fe26d1e58d2ddf7ce5eea414ae674ec082a91786ec18953744d555c6e66ef6338bd1d40d0814735d5bc5e4ca4d3edbae2d0f9fd07b5dbdd2fd417f08e72a5

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                        Filesize

                                                        10KB

                                                        MD5

                                                        36f1f825369f29339ab30386fa7a6cdd

                                                        SHA1

                                                        91bd939250e1bc30c5816ce1cabc3a5fd79973e4

                                                        SHA256

                                                        a69416be70734048fbd242346aba731651e44824e388337c482558e33019b0b9

                                                        SHA512

                                                        eeceffa4b2c30bacd7ce706f7a4d3d9f35cd9a70d47e16f1e080b25c13d12fba6460cab6a9d5eca39637841a0ce305b3bd5fdca1a1359c4cfc5c16af5cdcfb57

                                                      • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\cache2\entries\58EFA56DB4BFFECB0EDA547894BC9A057159E22F

                                                        Filesize

                                                        13KB

                                                        MD5

                                                        4877dc93ed31d16dc55365f0422875e9

                                                        SHA1

                                                        e628796d69afbe37c68a15639c0922f9455f9ce5

                                                        SHA256

                                                        d52ca1b5780c65628fbd6d30a7705dcbb9a2b1b8cc0dd9e3684c59421e18cca6

                                                        SHA512

                                                        883acac347e926f82a72715f9a287d76a7893d3f35408040c52518a43eda8cb51c0eb64f15b5bd7cdd67c1fb67a6e6596d3d98f86a5d8a4e9663a599621c4230

                                                      • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe

                                                        Filesize

                                                        1.8MB

                                                        MD5

                                                        eeb139916aa5a94fb6de01d67d329939

                                                        SHA1

                                                        7881a77833d76054afee411c19b37b5ee08ca9b1

                                                        SHA256

                                                        ac9d727f71fde0eeb640065fb857e797eb55c7b0570270769db0cf1ad5b48801

                                                        SHA512

                                                        f9645cadcc7893d3a4d5d5db17654653c3336c58f98106a28ee04d5f3570582d9c6ec8bc8e76c092f4795f7779b8571eb561d5651e7ee667205727938a0f2bef

                                                      • C:\Users\Admin\AppData\Local\Temp\1000039041\do.ps1

                                                        Filesize

                                                        2KB

                                                        MD5

                                                        e05e8f072b373beafe27cc11d85f947c

                                                        SHA1

                                                        1d6daeb98893e8122b8b69287ebd9d43f3c6138e

                                                        SHA256

                                                        717c09427fa5754ba92f92961545534048d0a76528c2e95c4d5ec6cef47c612f

                                                        SHA512

                                                        b3e34162e5ee43bb01f289eebc45fd3ea3e07f30be40dcf6635606540f912fe5c84d301e9f78e97dfe3ffe53e72547e50f3bcd7d4ebe5ab8da451a1989c469a0

                                                      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nsey3xaq.oxy.ps1

                                                        Filesize

                                                        60B

                                                        MD5

                                                        d17fe0a3f47be24a6453e9ef58c94641

                                                        SHA1

                                                        6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                        SHA256

                                                        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                        SHA512

                                                        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                      • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                                                        Filesize

                                                        479KB

                                                        MD5

                                                        09372174e83dbbf696ee732fd2e875bb

                                                        SHA1

                                                        ba360186ba650a769f9303f48b7200fb5eaccee1

                                                        SHA256

                                                        c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                                                        SHA512

                                                        b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                                                      • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                                                        Filesize

                                                        13.8MB

                                                        MD5

                                                        0a8747a2ac9ac08ae9508f36c6d75692

                                                        SHA1

                                                        b287a96fd6cc12433adb42193dfe06111c38eaf0

                                                        SHA256

                                                        32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                                                        SHA512

                                                        59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                                                      • C:\Users\Admin\AppData\Roaming\1000026000\3de546954f.exe

                                                        Filesize

                                                        1.7MB

                                                        MD5

                                                        73bbd225dee50a7cd44e58a8fc26e148

                                                        SHA1

                                                        6ac24985dc5d2e03d1c603c05b9b739b3e5bc7eb

                                                        SHA256

                                                        dc21dbe83a9a684aa2e77849977a9ab60e8c5b52af4e2a4f4f0aaa148dfda587

                                                        SHA512

                                                        5ab645b0da9e90cac4b66de3cf89325fde48de512bbedf7555c1da8da6dfdc193a7790d5b14c7215459acffe02cb393ff9f9b42dfccf0cdc78db413571f442f6

                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\AlternateServices.bin

                                                        Filesize

                                                        6KB

                                                        MD5

                                                        57c674b4a364b31aad43865359d23121

                                                        SHA1

                                                        435875cbbc7817e53943131828ce239b603820c8

                                                        SHA256

                                                        8d2012a67c31552f1986e2fbb2042c13beb1735b00e9c4dd692294ed786e51b9

                                                        SHA512

                                                        fdc8f5f31ef8135cc70a4df154668c5166afb7225d8c90f01f98f1c03d6e9a1ba38a56fc0c8f265c16b9fc2c7bf66e3319ca07b8a55cd0b2c11c458908b8156a

                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\AlternateServices.bin

                                                        Filesize

                                                        8KB

                                                        MD5

                                                        6f91b461b4b9d0a6455cd21c494c25a4

                                                        SHA1

                                                        87f529c7cb9edb6280f4f33f324dc4de873dddab

                                                        SHA256

                                                        b1086910cd6b6fcfe2088972e34ae8de3460b3966e113b07c3d3fe5b1c90dca4

                                                        SHA512

                                                        96867779495f112997cc1312a5b3ce1e2b206d1042f6e8b8b60f833db04cdcbdde0704bc1e991c79d8f8bd16ea7fee9750283cd44d0a7aa91ec9b8275393cfb0

                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\AlternateServices.bin

                                                        Filesize

                                                        17KB

                                                        MD5

                                                        606d9f1f6dfeaa3c2e7caedb92c50132

                                                        SHA1

                                                        cba570bd615b0e4903bd0d19d08a7f81ecdc31bc

                                                        SHA256

                                                        44c925c742e37a41a1b1d97a183121315395ba880441a713183fd44adaa2b9ba

                                                        SHA512

                                                        c2a2eb0fe2370aaa4168765be452822e8c1313981aff130c8c458086e57b681a76122872c142b2b13a10261f9442404dcd78fc2c3ea7a93d8e73b61ee5b93da3

                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\AlternateServices.bin

                                                        Filesize

                                                        20KB

                                                        MD5

                                                        253e46d87c1bd43e27866e0a895b461e

                                                        SHA1

                                                        0966824c3df9437a84b0d2f24ae40f38106ad2e1

                                                        SHA256

                                                        2ae5961245f840ecbfb1f12c970a4abd3d1f28dac7936e5524eb9ae674182bd8

                                                        SHA512

                                                        997885224a88f15001e36bbf9c148c8b044a55f17a7819b0c7822a25f85e918fa99fdd0e243aea413c16a38b97bbfea05cb69de0e9020e00638b8ecf4e6ab41c

                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\AlternateServices.bin

                                                        Filesize

                                                        23KB

                                                        MD5

                                                        10050648372a7073e43a06bbccbaed98

                                                        SHA1

                                                        c0e080a3fa9e5dbdb3bb7e4fca8dabe524496d85

                                                        SHA256

                                                        07a4ec0dab31350d44eab13e7d5ebfd8341785623984fdd1a67b947436bb7ee3

                                                        SHA512

                                                        416ff6de59155a8907d5b95a98ee3c3f5e2ba1d7a040d5ec84432e2a137677be108f921515a3848ce8cbebe5467b21cf014f835af89141ab4bd8970f32025e39

                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\datareporting\glean\db\data.safe.tmp

                                                        Filesize

                                                        5KB

                                                        MD5

                                                        6588faba16ebfdea6afca166747691a8

                                                        SHA1

                                                        72c69494199bf788c7b6b25e34668071b369ca2c

                                                        SHA256

                                                        4e9d7bc2755388f6dfb0634048621e25d335baf37c7a2e00e45480c36d6831c0

                                                        SHA512

                                                        794af58ff8370aaf1c1660c67b7cc082b151f3d051635bb2235340e3d24e34329d700ea25d8f570cce7b8fa89465f384d97bc951b2199245080ea88398c1304a

                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\datareporting\glean\db\data.safe.tmp

                                                        Filesize

                                                        15KB

                                                        MD5

                                                        d347d917b511201b377626f11e8b74b0

                                                        SHA1

                                                        627f8fa782440d73a232fbff75f5471a36d69242

                                                        SHA256

                                                        8f269c33821d5933c9b7f007b71a07137366fd32b81f1cdadc8545d2ff9e131f

                                                        SHA512

                                                        50877a8d92e4828db59ee3546aaf24846b7a8e912a54a50ae79e6a26d84f822a9671e23b45f9449fe7bd962e27a9887faa25f6dcdba88f3a5120db8ab03d73b5

                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\datareporting\glean\db\data.safe.tmp

                                                        Filesize

                                                        15KB

                                                        MD5

                                                        ba3333cfb1d34e81aff8fe8bb5350c19

                                                        SHA1

                                                        6eb8de48a554512ca8efe8d7b88b5ebc4b272da4

                                                        SHA256

                                                        fd61fe15fae40484a36ac2d24becdc5ab752a40faf504beedf094f754f234980

                                                        SHA512

                                                        4d81377f8e98eace2f46a645b5dfc57b5c0bf774e851cbf26cba23d5a1bbd0c32a514213388f1661fbe47ecf756df15828b88114208b99cdf37cfa4c65a83f51

                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\datareporting\glean\pending_pings\11871588-0c1f-4973-aea5-fedc530525e1

                                                        Filesize

                                                        25KB

                                                        MD5

                                                        c246a7008e8e79f6b3ea2f3f2fe430b7

                                                        SHA1

                                                        e76f1c2d4d1791f665db21abd97704c322dcaf5b

                                                        SHA256

                                                        7cae706a1e3ff24b2db604c7e6e827e55efb15a3b2d5478c7571350a4112dc37

                                                        SHA512

                                                        c6454a469839af5997fa3b7d4313ebc70c233f4498bbd5122ee4a24fb887c73fe9f1a35b52a96d8188fed5da7aed9ca991bfcefa7b1acc7839d66d3e2529e82e

                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\datareporting\glean\pending_pings\1dfc0d1d-36dd-4b01-b079-66542b3356a1

                                                        Filesize

                                                        671B

                                                        MD5

                                                        f2eec096c19745da4ab2f0e6a6b4a817

                                                        SHA1

                                                        77161008a4715c59d024870b731fe5542f7346d5

                                                        SHA256

                                                        5d26ff3f22ed78c31da020c88e8f97583fb86d508a3f7451626fb7c321efb07e

                                                        SHA512

                                                        8562f6cd0aea5c82c745254eab2c3cd135165787400a39e8fc119ade479ca4bde4a0d3b9c0b545ffabcb8b475648d5df2a332d67e95aea9b864358d23aba3599

                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\datareporting\glean\pending_pings\ef38f441-573e-424d-8ba6-2df9242b9edf

                                                        Filesize

                                                        982B

                                                        MD5

                                                        17484a77fb447c0eb4f0640f4ee1bf87

                                                        SHA1

                                                        889ce6e24188997bca13cc4c490664a79e6d52e7

                                                        SHA256

                                                        f7df970b122fc55fb3beb5f208b80029435fb9683fe61f6c15deaba0c131e19b

                                                        SHA512

                                                        39eda8b0978cd01969fd906e7012345f6dca8af4e0366c4243c67b2007d780e0e61b792438a6d3b74a1dbc4c932885408eb91eebcfe6f0a852709487a9306709

                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

                                                        Filesize

                                                        1.1MB

                                                        MD5

                                                        842039753bf41fa5e11b3a1383061a87

                                                        SHA1

                                                        3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                                                        SHA256

                                                        d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                                                        SHA512

                                                        d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

                                                        Filesize

                                                        116B

                                                        MD5

                                                        2a461e9eb87fd1955cea740a3444ee7a

                                                        SHA1

                                                        b10755914c713f5a4677494dbe8a686ed458c3c5

                                                        SHA256

                                                        4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                                                        SHA512

                                                        34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

                                                        Filesize

                                                        372B

                                                        MD5

                                                        bf957ad58b55f64219ab3f793e374316

                                                        SHA1

                                                        a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                                                        SHA256

                                                        bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                                                        SHA512

                                                        79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

                                                        Filesize

                                                        17.8MB

                                                        MD5

                                                        daf7ef3acccab478aaa7d6dc1c60f865

                                                        SHA1

                                                        f8246162b97ce4a945feced27b6ea114366ff2ad

                                                        SHA256

                                                        bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                                                        SHA512

                                                        5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\prefs-1.js

                                                        Filesize

                                                        11KB

                                                        MD5

                                                        a3eedac08b4accdfb80acc4b4b883117

                                                        SHA1

                                                        60d929ff237ecc77ed3b8de018abcf4c98318671

                                                        SHA256

                                                        0bac366f49966649af6c460da01878c9dbec73a1f929d8f292b0d3272d78a30c

                                                        SHA512

                                                        79a5fd48a10b9f5042251ee78d895f8aa427c893442d80f13bdc71abb0d7c28f793bd07241df43c0dd4997a496731fc685ca14e1401877b644a90e59b4bf8de6

                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\prefs-1.js

                                                        Filesize

                                                        11KB

                                                        MD5

                                                        39bce4a195eaefd6ec9afd907f9b8a3f

                                                        SHA1

                                                        79108f3e8197fd360690a05a9b507fb0aca6ab94

                                                        SHA256

                                                        698ce5864b88e425dbacb4fb91c669e2235a16abffd8af813b2b558f845b1916

                                                        SHA512

                                                        e75c5843ab191b82e4d56c93d3c6d8f96ea14c3f9f554efd496d4b49c79e4591608919bc24b594d3889f166efe82ef41c007a3e10b04c110e9fc81876a9d20f4

                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\prefs-1.js

                                                        Filesize

                                                        12KB

                                                        MD5

                                                        06644960000300b20e132c4a20abbd36

                                                        SHA1

                                                        e28f5b51c4eb5d2c22911c2ff7a37065573a159f

                                                        SHA256

                                                        2e7ce215da98f9c62bc5dea4da9dcf0d39335f8dea979cdc20ca2a5ae501e705

                                                        SHA512

                                                        084e4e76f579f4afbb33d8e4590dc90013346d064292e515bb5101aa3b8982e28775e64c1da23912aec1080fe40ac728f9164c702809619a08d201df284b7480

                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\prefs-1.js

                                                        Filesize

                                                        12KB

                                                        MD5

                                                        5e27460e505cefcf1652edc22e1e5bfc

                                                        SHA1

                                                        75d3b853fe8c4b5b351284a9e3b495aee0c6bd32

                                                        SHA256

                                                        0ee8eb12c37da93c0610d8f7e3d9eb79f8da5a7011058ce2fd7310bc189de1b3

                                                        SHA512

                                                        b158d61afc2fd51adde52533cb904eb3ec92d8ad021a22a2e87518988a92e1f77631620e6d9183546056c0cbf74df5e2f621159b44e404e20a2debb2d30d6b19

                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\prefs.js

                                                        Filesize

                                                        11KB

                                                        MD5

                                                        9c37a1af40e62b3ba0165dc43e7b3350

                                                        SHA1

                                                        b3a6c400e95fd5cb20f8358fb45d5a56cb090d44

                                                        SHA256

                                                        2aa1458c94c9222f662e94f2e28b31e7c6e739cafa2a0bfc9cd04bd73000a93f

                                                        SHA512

                                                        81cf9149cfbcaecc95c40a65a23c8b17014a984e6f2e51b1207a387c2ce0d16fad5be56cfdf334b9dfeea75aa0207c2c5dbd9dd1de77f8cde415f5b02133d91e

                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\sessionstore-backups\recovery.baklz4

                                                        Filesize

                                                        1KB

                                                        MD5

                                                        3485c78562c781d7d98c1f6b43ff4683

                                                        SHA1

                                                        d82a35eb6cd5e6b5d00afa3087657df6f955fef2

                                                        SHA256

                                                        46f1a2057f7248a47118f5c6d225d5dde5924a7ae443bfd073c2872862594f3a

                                                        SHA512

                                                        1bb3e83104a235e05ed7eb78358d845308b389cfe48ca2c7ea829ed8676d424e462d7daf49a5c160e5d202835e2cf4b1ca6fb52e5719465f4bd110141bf501da

                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\sessionstore-backups\recovery.baklz4

                                                        Filesize

                                                        5KB

                                                        MD5

                                                        5b27cca4d21d930f9d0d59f66a0e93d2

                                                        SHA1

                                                        ecbc9e43e97ec887cec4c89ad6a81b3d018559f4

                                                        SHA256

                                                        f717727667ab8ea30235b9537c8f0d010017c600e2566998c48de0ac919beca9

                                                        SHA512

                                                        b75cc11480bdb918d4816c4bd76ebcf9bf9e8201a1cf190f591b094ebdc062ceab9cc7d772567e9067e5ad2d95a9e59f2e455a7d81e614631ff21e38156436f0

                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

                                                        Filesize

                                                        376KB

                                                        MD5

                                                        97e39a3bde05fdd6bd0194817342e49e

                                                        SHA1

                                                        75f63d9005f5ca6dd2ccbaed4003284b073b9497

                                                        SHA256

                                                        e8a7fb3c47a05f71f63d027f626df3bb597c7dc1bf96ec246ee5847b82b1f1d4

                                                        SHA512

                                                        4e634a745322274a29ed14f7176de1aef6d913b37c9f1ebf71e673c219b9572717d196a3c75bd485d458d8005c4e8d74eb61afe4d4efeed4947fc7073d546055

                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

                                                        Filesize

                                                        1.2MB

                                                        MD5

                                                        7aa4e0e8e8f83f6b71e68c5651896877

                                                        SHA1

                                                        7984bee17e3d682e3a0e3f6fc02d1f2ef0fdc0af

                                                        SHA256

                                                        e96eed82440f88636464dd3bcb4751a7eb3b5c29c2e00c09b283dc4a2f92b53c

                                                        SHA512

                                                        f9be2fe9e7148bdbbca204559e0f308011e0c4dec6cb9e2abf25005ffc209d4e7e153a8e2274021fb627cfa0142a8c48cc1601b13bd66ac5736e6619f4faa97a

                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

                                                        Filesize

                                                        2.0MB

                                                        MD5

                                                        b3bd4a9e0f8d735ff2ab34221fff2af5

                                                        SHA1

                                                        a342a2c74c7f129947fbaebd16b266e911ecaf32

                                                        SHA256

                                                        9fa184600f884c9a872b9063e6f2d1462d83d2ac396b2e227093ce0147b032b5

                                                        SHA512

                                                        d94f8b6c16d702a65e96ca8f192f3f6fa7a7deafdade0de4bd2da369c7a6b544767d1ca93cbb71ce79273a6f228cb573eb2d4329c81f2ff0f33fe1b13e321384

                                                      • \??\pipe\LOCAL\crashpad_4700_DFDLVXESYEYPKPVN

                                                        MD5

                                                        d41d8cd98f00b204e9800998ecf8427e

                                                        SHA1

                                                        da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                        SHA256

                                                        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                        SHA512

                                                        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                      • memory/448-38-0x0000000000EE0000-0x00000000013AD000-memory.dmp

                                                        Filesize

                                                        4.8MB

                                                      • memory/448-57-0x0000000000EE0000-0x00000000013AD000-memory.dmp

                                                        Filesize

                                                        4.8MB

                                                      • memory/448-2979-0x0000000000EE0000-0x00000000013AD000-memory.dmp

                                                        Filesize

                                                        4.8MB

                                                      • memory/448-2766-0x0000000000EE0000-0x00000000013AD000-memory.dmp

                                                        Filesize

                                                        4.8MB

                                                      • memory/448-18-0x0000000000EE1000-0x0000000000F0F000-memory.dmp

                                                        Filesize

                                                        184KB

                                                      • memory/448-809-0x0000000000EE0000-0x00000000013AD000-memory.dmp

                                                        Filesize

                                                        4.8MB

                                                      • memory/448-2316-0x0000000000EE0000-0x00000000013AD000-memory.dmp

                                                        Filesize

                                                        4.8MB

                                                      • memory/448-1839-0x0000000000EE0000-0x00000000013AD000-memory.dmp

                                                        Filesize

                                                        4.8MB

                                                      • memory/448-1507-0x0000000000EE0000-0x00000000013AD000-memory.dmp

                                                        Filesize

                                                        4.8MB

                                                      • memory/448-519-0x0000000000EE0000-0x00000000013AD000-memory.dmp

                                                        Filesize

                                                        4.8MB

                                                      • memory/448-1133-0x0000000000EE0000-0x00000000013AD000-memory.dmp

                                                        Filesize

                                                        4.8MB

                                                      • memory/448-1039-0x0000000000EE0000-0x00000000013AD000-memory.dmp

                                                        Filesize

                                                        4.8MB

                                                      • memory/448-2982-0x0000000000EE0000-0x00000000013AD000-memory.dmp

                                                        Filesize

                                                        4.8MB

                                                      • memory/448-19-0x0000000000EE0000-0x00000000013AD000-memory.dmp

                                                        Filesize

                                                        4.8MB

                                                      • memory/448-2991-0x0000000000EE0000-0x00000000013AD000-memory.dmp

                                                        Filesize

                                                        4.8MB

                                                      • memory/448-631-0x0000000000EE0000-0x00000000013AD000-memory.dmp

                                                        Filesize

                                                        4.8MB

                                                      • memory/448-20-0x0000000000EE0000-0x00000000013AD000-memory.dmp

                                                        Filesize

                                                        4.8MB

                                                      • memory/448-706-0x0000000000EE0000-0x00000000013AD000-memory.dmp

                                                        Filesize

                                                        4.8MB

                                                      • memory/448-40-0x0000000000EE0000-0x00000000013AD000-memory.dmp

                                                        Filesize

                                                        4.8MB

                                                      • memory/448-21-0x0000000000EE0000-0x00000000013AD000-memory.dmp

                                                        Filesize

                                                        4.8MB

                                                      • memory/448-17-0x0000000000EE0000-0x00000000013AD000-memory.dmp

                                                        Filesize

                                                        4.8MB

                                                      • memory/448-30-0x0000000000EE0000-0x00000000013AD000-memory.dmp

                                                        Filesize

                                                        4.8MB

                                                      • memory/1152-39-0x0000000000EF0000-0x000000000157F000-memory.dmp

                                                        Filesize

                                                        6.6MB

                                                      • memory/1152-42-0x0000000000EF0000-0x000000000157F000-memory.dmp

                                                        Filesize

                                                        6.6MB

                                                      • memory/1152-41-0x0000000000EF1000-0x0000000000F05000-memory.dmp

                                                        Filesize

                                                        80KB

                                                      • memory/1152-84-0x0000000000EF0000-0x000000000157F000-memory.dmp

                                                        Filesize

                                                        6.6MB

                                                      • memory/3496-2641-0x0000000000EE0000-0x00000000013AD000-memory.dmp

                                                        Filesize

                                                        4.8MB

                                                      • memory/3496-2673-0x0000000000EE0000-0x00000000013AD000-memory.dmp

                                                        Filesize

                                                        4.8MB

                                                      • memory/3628-3-0x0000000000320000-0x00000000007ED000-memory.dmp

                                                        Filesize

                                                        4.8MB

                                                      • memory/3628-2-0x0000000000321000-0x000000000034F000-memory.dmp

                                                        Filesize

                                                        184KB

                                                      • memory/3628-1-0x0000000077154000-0x0000000077156000-memory.dmp

                                                        Filesize

                                                        8KB

                                                      • memory/3628-0-0x0000000000320000-0x00000000007ED000-memory.dmp

                                                        Filesize

                                                        4.8MB

                                                      • memory/3628-15-0x0000000000320000-0x00000000007ED000-memory.dmp

                                                        Filesize

                                                        4.8MB

                                                      • memory/3628-4-0x0000000000320000-0x00000000007ED000-memory.dmp

                                                        Filesize

                                                        4.8MB

                                                      • memory/4532-69-0x0000000005AA0000-0x0000000005AC2000-memory.dmp

                                                        Filesize

                                                        136KB

                                                      • memory/4532-81-0x0000000005D20000-0x0000000006074000-memory.dmp

                                                        Filesize

                                                        3.3MB

                                                      • memory/4532-89-0x0000000007BC0000-0x0000000008164000-memory.dmp

                                                        Filesize

                                                        5.6MB

                                                      • memory/4532-67-0x0000000002A10000-0x0000000002A46000-memory.dmp

                                                        Filesize

                                                        216KB

                                                      • memory/4532-68-0x0000000005460000-0x0000000005A88000-memory.dmp

                                                        Filesize

                                                        6.2MB

                                                      • memory/4532-88-0x0000000007280000-0x00000000072A2000-memory.dmp

                                                        Filesize

                                                        136KB

                                                      • memory/4532-87-0x0000000006850000-0x000000000686A000-memory.dmp

                                                        Filesize

                                                        104KB

                                                      • memory/4532-86-0x0000000007320000-0x00000000073B6000-memory.dmp

                                                        Filesize

                                                        600KB

                                                      • memory/4532-71-0x0000000005CB0000-0x0000000005D16000-memory.dmp

                                                        Filesize

                                                        408KB

                                                      • memory/4532-70-0x0000000005C40000-0x0000000005CA6000-memory.dmp

                                                        Filesize

                                                        408KB

                                                      • memory/4532-83-0x0000000006330000-0x000000000637C000-memory.dmp

                                                        Filesize

                                                        304KB

                                                      • memory/4532-82-0x0000000006310000-0x000000000632E000-memory.dmp

                                                        Filesize

                                                        120KB

                                                      • memory/4892-59-0x0000000000B20000-0x00000000011AF000-memory.dmp

                                                        Filesize

                                                        6.6MB

                                                      • memory/4892-450-0x0000000000B20000-0x00000000011AF000-memory.dmp

                                                        Filesize

                                                        6.6MB

                                                      • memory/7164-787-0x0000000000EE0000-0x00000000013AD000-memory.dmp

                                                        Filesize

                                                        4.8MB

                                                      • memory/7164-794-0x0000000000EE0000-0x00000000013AD000-memory.dmp

                                                        Filesize

                                                        4.8MB