Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-09-2024 20:02

General

  • Target

    b653aa8a63c1a7b1545618939c165fcf6a996e8fc45e1a6442f77e37b672a117.exe

  • Size

    1.8MB

  • MD5

    28fc680cd7ce04804903263844ab3fec

  • SHA1

    74dbf07bf5be88466023076f1b5a8192e5fb7e65

  • SHA256

    b653aa8a63c1a7b1545618939c165fcf6a996e8fc45e1a6442f77e37b672a117

  • SHA512

    6c7130922b5c21ffaa99b855ea6416f649b3dd91313c6d76b4273eb74281b9cb18ca806a68c34f9ed908c846983576a27b8a4d811277017e3fe4dc78d40696ba

  • SSDEEP

    49152:KI4oWqTQFp2YFGSVHqCrlqgB0obxDJMefD5:KlDNFRHEgDmYD

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

c7817d

C2

http://31.41.244.10

Attributes
  • install_dir

    0e8d0864aa

  • install_file

    svoutse.exe

  • strings_key

    5481b88a6ef75bcf21333988a4e47048

  • url_paths

    /Dem7kTu/index.php

rc4.plain

Extracted

Family

stealc

Botnet

rave

C2

http://185.215.113.103

Attributes
  • url_path

    /e2b1563c6670f193.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Stealc

    Stealc is an infostealer written in C++.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 12 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Identifies Wine through registry keys 2 TTPs 6 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 14 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 27 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 46 IoCs
  • Suspicious use of SendNotifyMessage 44 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\b653aa8a63c1a7b1545618939c165fcf6a996e8fc45e1a6442f77e37b672a117.exe
    "C:\Users\Admin\AppData\Local\Temp\b653aa8a63c1a7b1545618939c165fcf6a996e8fc45e1a6442f77e37b672a117.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1028
    • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
      "C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2928
      • C:\Users\Admin\AppData\Roaming\1000026000\b1dccd851b.exe
        "C:\Users\Admin\AppData\Roaming\1000026000\b1dccd851b.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:1772
      • C:\Users\Admin\AppData\Local\Temp\1000030001\751c886948.exe
        "C:\Users\Admin\AppData\Local\Temp\1000030001\751c886948.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:3228
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\Admin\AppData\Local\Temp\1000039041\do.ps1"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:908
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /c start msedge https://www.youtube.com/account
          4⤵
          • Checks computer location settings
          • System Location Discovery: System Language Discovery
          PID:3076
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.youtube.com/account
            5⤵
              PID:1048
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffe546d46f8,0x7ffe546d4708,0x7ffe546d4718
                6⤵
                  PID:1280
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1872,2552745120519263686,6333956797771475480,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1980 /prefetch:2
                  6⤵
                    PID:5608
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1872,2552745120519263686,6333956797771475480,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2512 /prefetch:3
                    6⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:5624
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\system32\cmd.exe" /c start msedge https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
                4⤵
                • Checks computer location settings
                • System Location Discovery: System Language Discovery
                PID:4568
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://accounts.google.com/ServiceLogin?service=accountsettings
                  5⤵
                  • Enumerates system info in registry
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  PID:3988
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffe546d46f8,0x7ffe546d4708,0x7ffe546d4718
                    6⤵
                      PID:4348
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2276,9592864110814555347,315275473301748606,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2288 /prefetch:2
                      6⤵
                        PID:5676
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2276,9592864110814555347,315275473301748606,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2332 /prefetch:3
                        6⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:5684
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2276,9592864110814555347,315275473301748606,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2664 /prefetch:8
                        6⤵
                          PID:5708
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2276,9592864110814555347,315275473301748606,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
                          6⤵
                            PID:364
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2276,9592864110814555347,315275473301748606,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
                            6⤵
                              PID:3924
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2276,9592864110814555347,315275473301748606,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3920 /prefetch:1
                              6⤵
                                PID:1684
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2276,9592864110814555347,315275473301748606,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4836 /prefetch:1
                                6⤵
                                  PID:5816
                                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2276,9592864110814555347,315275473301748606,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5508 /prefetch:8
                                  6⤵
                                    PID:224
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2276,9592864110814555347,315275473301748606,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5508 /prefetch:8
                                    6⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:4216
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2276,9592864110814555347,315275473301748606,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1
                                    6⤵
                                      PID:5356
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2276,9592864110814555347,315275473301748606,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5604 /prefetch:1
                                      6⤵
                                        PID:1188
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2276,9592864110814555347,315275473301748606,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1
                                        6⤵
                                          PID:1676
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2276,9592864110814555347,315275473301748606,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4152 /prefetch:1
                                          6⤵
                                            PID:4472
                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                        "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
                                        4⤵
                                        • Suspicious use of WriteProcessMemory
                                        PID:3352
                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                          "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
                                          5⤵
                                          • Checks processor information in registry
                                          • Modifies registry class
                                          • Suspicious use of AdjustPrivilegeToken
                                          • Suspicious use of FindShellTrayWindow
                                          • Suspicious use of SendNotifyMessage
                                          • Suspicious use of SetWindowsHookEx
                                          • Suspicious use of WriteProcessMemory
                                          PID:2536
                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1944 -parentBuildID 20240401114208 -prefsHandle 1860 -prefMapHandle 1840 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {90d3de47-7a1f-4d30-937d-676bf3fed4e3} 2536 "\\.\pipe\gecko-crash-server-pipe.2536" gpu
                                            6⤵
                                              PID:4860
                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2436 -parentBuildID 20240401114208 -prefsHandle 2404 -prefMapHandle 2400 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2431a85c-fa86-411a-b30c-ecd3f285814a} 2536 "\\.\pipe\gecko-crash-server-pipe.2536" socket
                                              6⤵
                                                PID:4304
                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3104 -childID 1 -isForBrowser -prefsHandle 3188 -prefMapHandle 3252 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1196 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dc0f4b0d-08d8-401c-afec-637c6d186d54} 2536 "\\.\pipe\gecko-crash-server-pipe.2536" tab
                                                6⤵
                                                  PID:4508
                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3556 -childID 2 -isForBrowser -prefsHandle 3552 -prefMapHandle 3544 -prefsLen 22693 -prefMapSize 244658 -jsInitHandle 1196 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3c93eba7-4e7e-41b5-9333-aa1c600f8003} 2536 "\\.\pipe\gecko-crash-server-pipe.2536" tab
                                                  6⤵
                                                    PID:2704
                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4164 -childID 3 -isForBrowser -prefsHandle 4148 -prefMapHandle 4144 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1196 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c999a951-e8ad-4de1-aaef-eb755c0ab223} 2536 "\\.\pipe\gecko-crash-server-pipe.2536" tab
                                                    6⤵
                                                      PID:1044
                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4784 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4692 -prefMapHandle 4608 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e28ac3c2-b488-4674-8705-e2a87ec458dc} 2536 "\\.\pipe\gecko-crash-server-pipe.2536" utility
                                                      6⤵
                                                      • Checks processor information in registry
                                                      PID:5144
                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5948 -childID 4 -isForBrowser -prefsHandle 5964 -prefMapHandle 5960 -prefsLen 27182 -prefMapSize 244658 -jsInitHandle 1196 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b4604738-a7c2-436b-95e1-a6e4bb5b11df} 2536 "\\.\pipe\gecko-crash-server-pipe.2536" tab
                                                      6⤵
                                                        PID:5212
                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6080 -childID 5 -isForBrowser -prefsHandle 6088 -prefMapHandle 6092 -prefsLen 27182 -prefMapSize 244658 -jsInitHandle 1196 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4ff3a0cc-6a8b-42f3-a618-8a8b50881440} 2536 "\\.\pipe\gecko-crash-server-pipe.2536" tab
                                                        6⤵
                                                          PID:5512
                                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6364 -childID 6 -isForBrowser -prefsHandle 6284 -prefMapHandle 6288 -prefsLen 27182 -prefMapSize 244658 -jsInitHandle 1196 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bcce8d1e-34fc-495a-ab2f-27ac60126e73} 2536 "\\.\pipe\gecko-crash-server-pipe.2536" tab
                                                          6⤵
                                                            PID:5564
                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
                                                        4⤵
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:1992
                                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                                          "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
                                                          5⤵
                                                          • Checks processor information in registry
                                                          PID:4088
                                                • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                                                  C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                                                  1⤵
                                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                  • Checks BIOS information in registry
                                                  • Executes dropped EXE
                                                  • Identifies Wine through registry keys
                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:3924
                                                • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                                                  C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                                                  1⤵
                                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                  • Checks BIOS information in registry
                                                  • Executes dropped EXE
                                                  • Identifies Wine through registry keys
                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:2844
                                                • C:\Windows\System32\CompPkgSrv.exe
                                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                  1⤵
                                                    PID:1988
                                                  • C:\Windows\System32\CompPkgSrv.exe
                                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                    1⤵
                                                      PID:4148

                                                    Network

                                                    MITRE ATT&CK Enterprise v15

                                                    Replay Monitor

                                                    Loading Replay Monitor...

                                                    Downloads

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                      Filesize

                                                      152B

                                                      MD5

                                                      4dd2754d1bea40445984d65abee82b21

                                                      SHA1

                                                      4b6a5658bae9a784a370a115fbb4a12e92bd3390

                                                      SHA256

                                                      183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d

                                                      SHA512

                                                      92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                      Filesize

                                                      152B

                                                      MD5

                                                      ecf7ca53c80b5245e35839009d12f866

                                                      SHA1

                                                      a7af77cf31d410708ebd35a232a80bddfb0615bb

                                                      SHA256

                                                      882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687

                                                      SHA512

                                                      706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                      Filesize

                                                      528B

                                                      MD5

                                                      0eb46896b6d2e593ec98097c2cb1c1ae

                                                      SHA1

                                                      e916a2afc61426906b716cfdda75ee2fc25b4dc0

                                                      SHA256

                                                      10505731be129118ffbb53a5ac863820ab570083119701afa6385e8dec6dab0a

                                                      SHA512

                                                      f7c5345cdeb8a073d8d5cabb6918e5b9fe4410b3947fbc1c17b6898b9d9cf374c10334e3e50593f3d597cd87237bacc9662f6bb4c7f68698f9916508365a5793

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                      Filesize

                                                      5KB

                                                      MD5

                                                      7acdb58ef05788d5696b0e9920c745d8

                                                      SHA1

                                                      4f2f17bc15a2626af78b147993b5f24f2222cb0f

                                                      SHA256

                                                      c375cc69d9bbd2057ec39625a34b71fe740dcf64afcb91e023026de4c80fbada

                                                      SHA512

                                                      ff675e439c60f3bcab925288d878c2e51e27c07b83260e72ef54369daf3a16c7540c8d9075d55fcef1506b17151161aa36299b4c9ec84c4c2ee21781aebde1a5

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                      Filesize

                                                      7KB

                                                      MD5

                                                      8aec82ebb636cae12d61497b489216dd

                                                      SHA1

                                                      71050435636124983d184145720eb43d59a7ab25

                                                      SHA256

                                                      b1384afb6eef8ac4cdf3473719f0517e8161756ac1b2987f092477983aacf909

                                                      SHA512

                                                      7af65df7bf2a48f0e1fb2b7fc80720bc58d876948ff3c8a99113c10ac00378fb52be3ec884bef0e3934419de1c2c31c97dcebde629220637eab7763f697f8e9e

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                      Filesize

                                                      16B

                                                      MD5

                                                      6752a1d65b201c13b62ea44016eb221f

                                                      SHA1

                                                      58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                      SHA256

                                                      0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                      SHA512

                                                      9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                      Filesize

                                                      8KB

                                                      MD5

                                                      f44eec241e1f16d98f1ba0a0ca9e1a06

                                                      SHA1

                                                      a52e74b4d88b10a85175d6fd7ffbc10a8dd3b388

                                                      SHA256

                                                      4396aba024431369d31559f0666f41f6b5d0fda80bb92a768cf424293e7f0833

                                                      SHA512

                                                      20e2ee1f70e74714c6fb4c31cf393cedff45ff2d0e0c2c8e1ac938a780ebdba5cb636de6f7c14f7bf20eb654f79c0ffa00a552c907307d85f6752cfd6469b3e9

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                      Filesize

                                                      10KB

                                                      MD5

                                                      ac8704c99005df3b68a37146817e81ae

                                                      SHA1

                                                      b6525da7ad5fc65c871a4d4699c075b5530a3b84

                                                      SHA256

                                                      80aee9236a465e3d29dcb67bdbb08bd3608cf2d28febb5298ea69c0eb028816d

                                                      SHA512

                                                      7281c58ef912f15a94c98f2b2615582bca67d1326821321efa33fae835e1e121e42b62222475f961e8f9bed8a7abc73cc257fd9e864bb2501c148cb5968cb656

                                                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\activity-stream.discovery_stream.json.tmp

                                                      Filesize

                                                      18KB

                                                      MD5

                                                      7173b9b94515f90e0122599768de9af3

                                                      SHA1

                                                      9a926f25d25673f0368b9be0d20cb9fcfab18ac9

                                                      SHA256

                                                      beac6cd8a4130a0782c2abeb29e0cec3626b32c5abbbce4cf9215d0dcbe76ec8

                                                      SHA512

                                                      9f31e2785a053b94ea99a239e49b45010b018143213857fc3eb8db38779a30f69b871ff976753d349ba5fd52ce938e3e89587cecf5c7fecaa9846504c4a61cf6

                                                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\cache2\entries\58EFA56DB4BFFECB0EDA547894BC9A057159E22F

                                                      Filesize

                                                      13KB

                                                      MD5

                                                      a7862d8a18cc4309315ec30d448ac0de

                                                      SHA1

                                                      f5db73896dfc68117cc6304f8e8d794492965f54

                                                      SHA256

                                                      7c4526ae749c933adfb761004fa55700c3cdd5560243db5da830016788a14870

                                                      SHA512

                                                      892bfd252ac427961079cc86f217e0d46bb3b90647d9b61efb9457087563853f65802f38ad2185fe5f97bcf6ddf16ae065a30008cd7053ea23dc4c7405c4f09a

                                                    • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe

                                                      Filesize

                                                      1.8MB

                                                      MD5

                                                      28fc680cd7ce04804903263844ab3fec

                                                      SHA1

                                                      74dbf07bf5be88466023076f1b5a8192e5fb7e65

                                                      SHA256

                                                      b653aa8a63c1a7b1545618939c165fcf6a996e8fc45e1a6442f77e37b672a117

                                                      SHA512

                                                      6c7130922b5c21ffaa99b855ea6416f649b3dd91313c6d76b4273eb74281b9cb18ca806a68c34f9ed908c846983576a27b8a4d811277017e3fe4dc78d40696ba

                                                    • C:\Users\Admin\AppData\Local\Temp\1000039041\do.ps1

                                                      Filesize

                                                      2KB

                                                      MD5

                                                      e05e8f072b373beafe27cc11d85f947c

                                                      SHA1

                                                      1d6daeb98893e8122b8b69287ebd9d43f3c6138e

                                                      SHA256

                                                      717c09427fa5754ba92f92961545534048d0a76528c2e95c4d5ec6cef47c612f

                                                      SHA512

                                                      b3e34162e5ee43bb01f289eebc45fd3ea3e07f30be40dcf6635606540f912fe5c84d301e9f78e97dfe3ffe53e72547e50f3bcd7d4ebe5ab8da451a1989c469a0

                                                    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bfut0bny.5la.ps1

                                                      Filesize

                                                      60B

                                                      MD5

                                                      d17fe0a3f47be24a6453e9ef58c94641

                                                      SHA1

                                                      6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                      SHA256

                                                      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                      SHA512

                                                      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                    • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                                                      Filesize

                                                      479KB

                                                      MD5

                                                      09372174e83dbbf696ee732fd2e875bb

                                                      SHA1

                                                      ba360186ba650a769f9303f48b7200fb5eaccee1

                                                      SHA256

                                                      c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                                                      SHA512

                                                      b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                                                    • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                                                      Filesize

                                                      13.8MB

                                                      MD5

                                                      0a8747a2ac9ac08ae9508f36c6d75692

                                                      SHA1

                                                      b287a96fd6cc12433adb42193dfe06111c38eaf0

                                                      SHA256

                                                      32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                                                      SHA512

                                                      59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                                                    • C:\Users\Admin\AppData\Roaming\1000026000\b1dccd851b.exe

                                                      Filesize

                                                      1.7MB

                                                      MD5

                                                      0f0ef1482985e6cf9403f782e6ba6d10

                                                      SHA1

                                                      d7b44e16fc1eb2845b3db09a4fec9ba66dfcebe4

                                                      SHA256

                                                      cc65a55c66501ede8db7f899410180caa449102982130e4ed48a45909156e3c1

                                                      SHA512

                                                      6b484bcbba919e8c2dfc86f703196adbe065c04b93d74d47cc63f7df2e1224a62c854b5b5c03b235c48f4db3a9449d59c9a6dbed832f2e0c0f0fccf739b0a794

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\AlternateServices.bin

                                                      Filesize

                                                      6KB

                                                      MD5

                                                      955fbfde8413274c2b9af7b2b4eb912c

                                                      SHA1

                                                      9a70fd50905ecc747b41f7a5db4f3779b9a63bdc

                                                      SHA256

                                                      310847471446577b76ec5af05b36112b2c2bed4ff773d470f5d6a0b95e1ce3fb

                                                      SHA512

                                                      af4f22f737a978943580dfa41df2756a305b2c5d23b3efd1ffb2e3428172894e669c64a1f721b5a2b5f42943435364bfcd9bb26327f71125701caaacbd498ffa

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\AlternateServices.bin

                                                      Filesize

                                                      8KB

                                                      MD5

                                                      4bd94104912fbbf4b6c7dfffe7c36f35

                                                      SHA1

                                                      413acf63951fef4fac7b6409c95e043e77ffc148

                                                      SHA256

                                                      f33d4e3e3fb050ae914a9780c0cefcf24d67df56b1883c832a6a3af61129deb8

                                                      SHA512

                                                      90d30a1f53ca019f1709fd3fc9c128e2d70092cee19ab75fa40e0b85ad8d7b30f5b0eb7d6113fa3133128fcd3015fc8bbe3d29537e4fea8fe807a567bcc90781

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\AlternateServices.bin

                                                      Filesize

                                                      10KB

                                                      MD5

                                                      28506df1e6cd0caab9b559e86a49a143

                                                      SHA1

                                                      16488967702937cc91247db8c6b2ff3a5459f3bd

                                                      SHA256

                                                      481a3b84d85391694dfa863b6f7a0167719d3d4e9cf39a1005637efdeaa386cc

                                                      SHA512

                                                      91d2e9e95ffa526cf1d952bcf4cd8531a340f48299bc73d2fc6b8c33486ae22390b67c5af3b17cde24b12a5a45cf189694c6ff26d9749e4e7c03d022b6b42d14

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\datareporting\glean\db\data.safe.tmp

                                                      Filesize

                                                      5KB

                                                      MD5

                                                      096adbdaf739051c76c50a4f84bfece6

                                                      SHA1

                                                      90d328bd9b18c37e6a125999711a7e0fe63b5f86

                                                      SHA256

                                                      facc3d2fd0cc251be1140ec86e85777251239edc4715a2219d37833614ee272f

                                                      SHA512

                                                      70f8735a9afacbe9998b20ebed32d9dcadb12ddafb5c5aadc5d85abb2870ef31b4b32cf372449a0a7caeecb2d2180393a515d4f499f6227d9bb4195d9e98d938

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\datareporting\glean\db\data.safe.tmp

                                                      Filesize

                                                      15KB

                                                      MD5

                                                      426cccac498958126e8025d479fcf04b

                                                      SHA1

                                                      9ba809a104bc832f6acfed82b906d992b5f223ab

                                                      SHA256

                                                      049282d314f0ccfc8f24d48fb223db852d1b320e5f4642911fdb63c6f49a42aa

                                                      SHA512

                                                      d6b593ddc7982bf8d7db44eb9857d35ed5b362ac158f8af0e144ece26316447ac7137c4c289fa91fcce8102e00a73538a8d90ad3cb9dae70ee3e98df7f166009

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\datareporting\glean\db\data.safe.tmp

                                                      Filesize

                                                      6KB

                                                      MD5

                                                      2360b42a279be5e61291c16c7931e918

                                                      SHA1

                                                      bdca6d42221bb8e2a1587901b95d30f6ca20ab19

                                                      SHA256

                                                      9f91a2ee21add28e2310e3d57a6e6d9eced331b5e7417f8ca898870b1cebef43

                                                      SHA512

                                                      6a58642057218ffb62ad0ef906aaaa67163648ef37f89787d6305c6c752559a32d176220123e3b1aa7f8ad7639c04535ad5deae398b4050d4e24a6217c33224a

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\datareporting\glean\pending_pings\1bafa25c-6f07-4a03-a37d-08313f3691a7

                                                      Filesize

                                                      982B

                                                      MD5

                                                      48ef8f955796cde1a9603f3462d029f3

                                                      SHA1

                                                      b9e8a422ed152cfa13679ba28f79b9fece7a5ec7

                                                      SHA256

                                                      92b200ae6b090f6ab7af2d735c6a3dc79e354191adcd003ee79061e2c9ec0cae

                                                      SHA512

                                                      47fcada2db04e885e520e06039063de8c01a8df44ff8b089bea1d03d8c156483b0d86158af555f26152099d4f8ef875fbd44599248defedd33ff7cce2724ef51

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\datareporting\glean\pending_pings\3d5307c8-1be1-476e-9b6f-64ab53724da6

                                                      Filesize

                                                      28KB

                                                      MD5

                                                      4cbca958ff90e996b92540c128917329

                                                      SHA1

                                                      8baf0bbaac3841c3db356ea457f1ffb1e8fad113

                                                      SHA256

                                                      582ed0a6e3ed7f44d15d1a2a686a9db7470faad3c344497353726bbd3c0805e5

                                                      SHA512

                                                      39f28bf6c69c334f3d7c8697468e0ab0472752ac60b764bb9701bd7bad299be70a82e7d9de0d52496e3c057893927193e28eae357de687751cf561396d6a6471

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\datareporting\glean\pending_pings\41fe9a31-6f70-41d1-81a6-a453e48ad279

                                                      Filesize

                                                      671B

                                                      MD5

                                                      0152c391bd1aef6d9bb2db697a66cfff

                                                      SHA1

                                                      8bf756deb4c175304259ad3ddba9bbe00ac45412

                                                      SHA256

                                                      a765cbbb2ed7a2aaa3d49a0de10e41e4a03db54c773526f9377a841a1a4b68bc

                                                      SHA512

                                                      b07d8336d90248894d9762dc8227fe2faf39b584b9989fa7783e99c8a54f5ef1d231b2ab58ea7e71a5cd5b4c0910e7d8cfb7a4ebab030c4a3b5aaefee66637b2

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

                                                      Filesize

                                                      1.1MB

                                                      MD5

                                                      842039753bf41fa5e11b3a1383061a87

                                                      SHA1

                                                      3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                                                      SHA256

                                                      d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                                                      SHA512

                                                      d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

                                                      Filesize

                                                      116B

                                                      MD5

                                                      2a461e9eb87fd1955cea740a3444ee7a

                                                      SHA1

                                                      b10755914c713f5a4677494dbe8a686ed458c3c5

                                                      SHA256

                                                      4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                                                      SHA512

                                                      34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

                                                      Filesize

                                                      372B

                                                      MD5

                                                      bf957ad58b55f64219ab3f793e374316

                                                      SHA1

                                                      a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                                                      SHA256

                                                      bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                                                      SHA512

                                                      79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

                                                      Filesize

                                                      17.8MB

                                                      MD5

                                                      daf7ef3acccab478aaa7d6dc1c60f865

                                                      SHA1

                                                      f8246162b97ce4a945feced27b6ea114366ff2ad

                                                      SHA256

                                                      bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                                                      SHA512

                                                      5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\prefs-1.js

                                                      Filesize

                                                      14KB

                                                      MD5

                                                      956a959ac2ffd51a0cb1728d67997a24

                                                      SHA1

                                                      bad83cae8e6e973d41b53c82ad984bdc45e02c70

                                                      SHA256

                                                      01818e8385f2c36420bd69102588c5788588e639484eccd9b23ae8d25fef5f71

                                                      SHA512

                                                      fe161dd4cd55e8685e61286e842d4c4ed073f8ddb47436f44d5c494a5903023ee59f39adfb77e182a3ef34ede36d9cfbca57152c4efceb7897f8fcf78b0b2855

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\prefs-1.js

                                                      Filesize

                                                      11KB

                                                      MD5

                                                      fafb42de64abffc79a771143cce89a23

                                                      SHA1

                                                      ed53f0b20204c6ed6a620ec87a6ee4f41ed49bcc

                                                      SHA256

                                                      9444e8d13c9051fbe3a7c2614eaa8166794be1309fd963339c5d6a76bb21422a

                                                      SHA512

                                                      0f5fceba23c6b4f6ebd518a6976a766344f5689a321fb647a939fa7fed9e4528960d63e63f93ed53459b2ab1ac5f913467e933d8c3d81e0b7b5c59bb9f2aef7c

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\prefs.js

                                                      Filesize

                                                      11KB

                                                      MD5

                                                      a59f49ff2bab9c8009234db07d3b0a01

                                                      SHA1

                                                      b8016a839818be751b3006f31ca2ecbcfb18117e

                                                      SHA256

                                                      5f274926620e89182e855af42e01dc0d190a2b66cb42a3f5ecbcf3bd26a60461

                                                      SHA512

                                                      9238352349b4aa22fc3f4c7e0317ca8ee9825fab9038de95411ddeeb16cd23d6438ce64f813bf6dc7d4b042542e375bb15536831f254f38846edffafa4556696

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\prefs.js

                                                      Filesize

                                                      11KB

                                                      MD5

                                                      c9d8335d3d7a051d22f992192ffadfbd

                                                      SHA1

                                                      f20c4225ced3692ef5cf21c4e2b3890ce85f656c

                                                      SHA256

                                                      c9a1883251106158e3ad1cfbb09941f86c45b0bb0aac2f4e17b6ebc496de55b9

                                                      SHA512

                                                      0a8cae921e3a9222f7f97c2c9b17d267c8ee2996ec4f9a59bb6b9d28993515322d4c99c2b62f218d363510440a68a3cbea6215965e305b09187f8ce4d16d2c93

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\sessionstore-backups\recovery.baklz4

                                                      Filesize

                                                      1KB

                                                      MD5

                                                      db2600aa23a2acbb6dc66f33121bd3ac

                                                      SHA1

                                                      ab4c9f7d373bbbe05b6c259c26dce85825f95468

                                                      SHA256

                                                      e4246d0e0314921024de8d4e77b8664c9db4e98f46a9b7f5b6ed7b9cec4cd0aa

                                                      SHA512

                                                      7c8ed22f76de85e437c803d7e386635cc09fcb77e556f91ef081f55befc724b83087d44526d09584460bc7230781be9fc3b0d6351042db84e6251b3190c4eed4

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\sessionstore-backups\recovery.baklz4

                                                      Filesize

                                                      5KB

                                                      MD5

                                                      6088041a1c6ff2d2b55d156aebcea428

                                                      SHA1

                                                      1b6bb2b874d13776e73f646ebfae9cca598bf79f

                                                      SHA256

                                                      b560831c5390202fbe4dd5d82477a391171f6d803504139061cc6b74907d357e

                                                      SHA512

                                                      522fd971f239df847cc516a717c3b33401f0ba0bef3f3aa4410e8d04296851d87c09c9517ad6ac3b25840650be0f95a1eb76652afde81ced22f89377b256e92f

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

                                                      Filesize

                                                      376KB

                                                      MD5

                                                      5bef36aee869e915d57334ded9610ad0

                                                      SHA1

                                                      1636c31672ef76ca2e2d9f86f7bd121613d86d9c

                                                      SHA256

                                                      18295cf05b35de3e48ca83356cb26f0ca38140b35cbeed0ceab6ddac8e189eac

                                                      SHA512

                                                      56500ad410dac891d61cc889f9b59ce7bb3db19d34d26fb87c26239b6d6ca3bb2046761870038009554930a1ad5af41de5a2698ed892dbb97f8ae59f8ff6121b

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

                                                      Filesize

                                                      1.4MB

                                                      MD5

                                                      b814b92fed102b9ec510a56114d666a4

                                                      SHA1

                                                      baac462ada8a6cb34a6760e35a7e2c0d8e833f80

                                                      SHA256

                                                      f819950bd20c957c3ea704e2c37a650bf83d71f470f236a53b3aa6f81e898452

                                                      SHA512

                                                      37b0197326ba1196e05540ef18fe79e3d8090773721df1208c0cc526498fd3b20245d6927c4a9662d1797e189179bea4aea790bc6819f5d413f072a8a8a56433

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

                                                      Filesize

                                                      2.1MB

                                                      MD5

                                                      95cc9b1f787d742cb6a9f474886e4828

                                                      SHA1

                                                      b6ccab407a61582ba787289ed3f05e323d892491

                                                      SHA256

                                                      e6043a9b77dabd1165dee7a02a3759014b6302537547119958d8f6bc52ee42b0

                                                      SHA512

                                                      59281c952515e36b5e671d2e4791d92a1620293ca209698a3b3bc3c1951ea8a76c4fbf8b383263cd12535381775c8b0f96067d616e963ce75b8ae73d124f6515

                                                    • \??\pipe\LOCAL\crashpad_1048_QQKANMETRFURHMKR

                                                      MD5

                                                      d41d8cd98f00b204e9800998ecf8427e

                                                      SHA1

                                                      da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                      SHA256

                                                      e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                      SHA512

                                                      cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                    • memory/908-104-0x00000000062C0000-0x00000000062DA000-memory.dmp

                                                      Filesize

                                                      104KB

                                                    • memory/908-87-0x0000000004EE0000-0x0000000004F02000-memory.dmp

                                                      Filesize

                                                      136KB

                                                    • memory/908-101-0x0000000005DB0000-0x0000000005DFC000-memory.dmp

                                                      Filesize

                                                      304KB

                                                    • memory/908-83-0x00000000024A0000-0x00000000024D6000-memory.dmp

                                                      Filesize

                                                      216KB

                                                    • memory/908-103-0x0000000006E80000-0x0000000006F16000-memory.dmp

                                                      Filesize

                                                      600KB

                                                    • memory/908-105-0x0000000006330000-0x0000000006352000-memory.dmp

                                                      Filesize

                                                      136KB

                                                    • memory/908-106-0x00000000074D0000-0x0000000007A74000-memory.dmp

                                                      Filesize

                                                      5.6MB

                                                    • memory/908-86-0x0000000004F40000-0x0000000005568000-memory.dmp

                                                      Filesize

                                                      6.2MB

                                                    • memory/908-95-0x00000000057C0000-0x0000000005B14000-memory.dmp

                                                      Filesize

                                                      3.3MB

                                                    • memory/908-89-0x0000000005750000-0x00000000057B6000-memory.dmp

                                                      Filesize

                                                      408KB

                                                    • memory/908-88-0x00000000056E0000-0x0000000005746000-memory.dmp

                                                      Filesize

                                                      408KB

                                                    • memory/908-100-0x0000000005D80000-0x0000000005D9E000-memory.dmp

                                                      Filesize

                                                      120KB

                                                    • memory/1028-1-0x0000000076F14000-0x0000000076F16000-memory.dmp

                                                      Filesize

                                                      8KB

                                                    • memory/1028-2-0x0000000000771000-0x000000000079F000-memory.dmp

                                                      Filesize

                                                      184KB

                                                    • memory/1028-0-0x0000000000770000-0x0000000000C1C000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/1028-3-0x0000000000770000-0x0000000000C1C000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/1028-5-0x0000000000770000-0x0000000000C1C000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/1028-16-0x0000000000770000-0x0000000000C1C000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/1772-71-0x0000000000610000-0x0000000000C86000-memory.dmp

                                                      Filesize

                                                      6.5MB

                                                    • memory/1772-57-0x0000000000610000-0x0000000000C86000-memory.dmp

                                                      Filesize

                                                      6.5MB

                                                    • memory/2844-41-0x0000000000300000-0x00000000007AC000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/2844-40-0x0000000000300000-0x00000000007AC000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/2928-35-0x0000000000300000-0x00000000007AC000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/2928-22-0x0000000000300000-0x00000000007AC000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/2928-34-0x0000000000300000-0x00000000007AC000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/2928-622-0x0000000000300000-0x00000000007AC000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/2928-33-0x0000000000300000-0x00000000007AC000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/2928-1309-0x0000000000300000-0x00000000007AC000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/2928-110-0x0000000000300000-0x00000000007AC000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/2928-656-0x0000000000300000-0x00000000007AC000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/2928-39-0x0000000000300000-0x00000000007AC000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/2928-27-0x0000000000300000-0x00000000007AC000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/2928-26-0x0000000000300000-0x00000000007AC000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/2928-24-0x0000000000300000-0x00000000007AC000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/2928-23-0x0000000000300000-0x00000000007AC000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/2928-36-0x0000000000300000-0x00000000007AC000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/2928-21-0x0000000000300000-0x00000000007AC000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/2928-20-0x0000000000300000-0x00000000007AC000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/2928-19-0x0000000000300000-0x00000000007AC000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/2928-867-0x0000000000300000-0x00000000007AC000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/2928-37-0x0000000000300000-0x00000000007AC000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/2928-17-0x0000000000300000-0x00000000007AC000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/3228-75-0x00000000003B0000-0x0000000000A26000-memory.dmp

                                                      Filesize

                                                      6.5MB

                                                    • memory/3228-85-0x00000000003B0000-0x0000000000A26000-memory.dmp

                                                      Filesize

                                                      6.5MB

                                                    • memory/3924-29-0x0000000000300000-0x00000000007AC000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/3924-30-0x0000000000300000-0x00000000007AC000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/3924-32-0x0000000000300000-0x00000000007AC000-memory.dmp

                                                      Filesize

                                                      4.7MB