Analysis

  • max time kernel
    142s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-09-2024 20:31

General

  • Target

    3a5bba257d06af78b46d980fc2a285026c354056c4cbaaa5a4aa477d96a13712.exe

  • Size

    1.8MB

  • MD5

    260bb7213697b9eab79cfff7cd5bebe1

  • SHA1

    350b664626ee1dcf9fd7bca4cd04a87a4c11adf4

  • SHA256

    3a5bba257d06af78b46d980fc2a285026c354056c4cbaaa5a4aa477d96a13712

  • SHA512

    2d8bb03f5b4ed992902aefa7535add761f74e981791bc9058d30bda43b53f92dc86d6e84e0703add200ba2987aa15de188f9eb493d4c8ecc1058094efbbaed99

  • SSDEEP

    24576:Od3g80i4dff2KOXpXPqQw6hs37gIQmMYhdY5eGFvsG7C7TwbQgYhLe+XEM:OKvfzgp7wEkggMYhEvzswbQgIB9

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

c7817d

C2

http://31.41.244.10

Attributes
  • install_dir

    0e8d0864aa

  • install_file

    svoutse.exe

  • strings_key

    5481b88a6ef75bcf21333988a4e47048

  • url_paths

    /Dem7kTu/index.php

rc4.plain

Extracted

Family

stealc

Botnet

rave

C2

http://185.215.113.103

Attributes
  • url_path

    /e2b1563c6670f193.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Stealc

    Stealc is an infostealer written in C++.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 14 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 6 IoCs
  • Identifies Wine through registry keys 2 TTPs 7 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 14 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 33 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 46 IoCs
  • Suspicious use of SendNotifyMessage 44 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\3a5bba257d06af78b46d980fc2a285026c354056c4cbaaa5a4aa477d96a13712.exe
    "C:\Users\Admin\AppData\Local\Temp\3a5bba257d06af78b46d980fc2a285026c354056c4cbaaa5a4aa477d96a13712.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:5016
    • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
      "C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1704
      • C:\Users\Admin\AppData\Roaming\1000026000\40718b2438.exe
        "C:\Users\Admin\AppData\Roaming\1000026000\40718b2438.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:4148
      • C:\Users\Admin\AppData\Local\Temp\1000030001\3957298b06.exe
        "C:\Users\Admin\AppData\Local\Temp\1000030001\3957298b06.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:4164
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\Admin\AppData\Local\Temp\1000039041\do.ps1"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2172
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /c start msedge https://www.youtube.com/account
          4⤵
          • Checks computer location settings
          • System Location Discovery: System Language Discovery
          PID:2596
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.youtube.com/account
            5⤵
            • Enumerates system info in registry
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            PID:5064
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff8fda046f8,0x7ff8fda04708,0x7ff8fda04718
              6⤵
                PID:2896
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,17372495302740173562,3570831487299267582,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
                6⤵
                  PID:5444
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,17372495302740173562,3570831487299267582,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
                  6⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:5436
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,17372495302740173562,3570831487299267582,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3004 /prefetch:8
                  6⤵
                    PID:5392
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,17372495302740173562,3570831487299267582,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
                    6⤵
                      PID:5376
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,17372495302740173562,3570831487299267582,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
                      6⤵
                        PID:5364
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,17372495302740173562,3570831487299267582,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4012 /prefetch:1
                        6⤵
                          PID:2152
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,17372495302740173562,3570831487299267582,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4904 /prefetch:1
                          6⤵
                            PID:184
                          • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,17372495302740173562,3570831487299267582,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5856 /prefetch:8
                            6⤵
                              PID:6992
                            • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,17372495302740173562,3570831487299267582,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5856 /prefetch:8
                              6⤵
                              • Suspicious behavior: EnumeratesProcesses
                              PID:7152
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,17372495302740173562,3570831487299267582,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:1
                              6⤵
                                PID:6208
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,17372495302740173562,3570831487299267582,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:1
                                6⤵
                                  PID:5200
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,17372495302740173562,3570831487299267582,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:1
                                  6⤵
                                    PID:6516
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,17372495302740173562,3570831487299267582,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:1
                                    6⤵
                                      PID:6524
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,17372495302740173562,3570831487299267582,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4908 /prefetch:2
                                      6⤵
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:1496
                                • C:\Windows\SysWOW64\cmd.exe
                                  "C:\Windows\system32\cmd.exe" /c start msedge https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
                                  4⤵
                                  • Checks computer location settings
                                  • System Location Discovery: System Language Discovery
                                  PID:1244
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://accounts.google.com/ServiceLogin?service=accountsettings
                                    5⤵
                                      PID:4428
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff8fda046f8,0x7ff8fda04708,0x7ff8fda04718
                                        6⤵
                                          PID:1888
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,8754535944989630317,10934069172252746460,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
                                          6⤵
                                          • Suspicious behavior: EnumeratesProcesses
                                          PID:5640
                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                      "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
                                      4⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:4128
                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                        "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
                                        5⤵
                                        • Checks processor information in registry
                                        PID:3888
                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                      "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
                                      4⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:4172
                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                        "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
                                        5⤵
                                        • Checks processor information in registry
                                        • Modifies registry class
                                        • Suspicious use of AdjustPrivilegeToken
                                        • Suspicious use of FindShellTrayWindow
                                        • Suspicious use of SendNotifyMessage
                                        • Suspicious use of SetWindowsHookEx
                                        • Suspicious use of WriteProcessMemory
                                        PID:3840
                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2008 -parentBuildID 20240401114208 -prefsHandle 1924 -prefMapHandle 1868 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3fac0d40-9f3f-4540-a553-34d5c99930a9} 3840 "\\.\pipe\gecko-crash-server-pipe.3840" gpu
                                          6⤵
                                            PID:536
                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2432 -parentBuildID 20240401114208 -prefsHandle 2424 -prefMapHandle 2412 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d8c3c041-05af-4cad-8aa0-4c87e1d59d43} 3840 "\\.\pipe\gecko-crash-server-pipe.3840" socket
                                            6⤵
                                              PID:2472
                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3208 -childID 1 -isForBrowser -prefsHandle 2632 -prefMapHandle 2616 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a4386294-6afd-496d-aa02-658b810cab60} 3840 "\\.\pipe\gecko-crash-server-pipe.3840" tab
                                              6⤵
                                                PID:1552
                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3544 -childID 2 -isForBrowser -prefsHandle 3532 -prefMapHandle 3536 -prefsLen 22693 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {789700ec-177b-4683-af38-d1aba23a7d92} 3840 "\\.\pipe\gecko-crash-server-pipe.3840" tab
                                                6⤵
                                                  PID:2416
                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3972 -childID 3 -isForBrowser -prefsHandle 3964 -prefMapHandle 3660 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {440cbbef-31c4-4d4f-b314-29411ec7c3ae} 3840 "\\.\pipe\gecko-crash-server-pipe.3840" tab
                                                  6⤵
                                                    PID:3064
                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4568 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4448 -prefMapHandle 4436 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {54593843-240f-41b8-a735-d80b8fdbe105} 3840 "\\.\pipe\gecko-crash-server-pipe.3840" utility
                                                    6⤵
                                                    • Checks processor information in registry
                                                    PID:2548
                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4200 -childID 4 -isForBrowser -prefsHandle 4212 -prefMapHandle 5624 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0f1bd754-b0c7-46c7-b908-fd806724ae2a} 3840 "\\.\pipe\gecko-crash-server-pipe.3840" tab
                                                    6⤵
                                                      PID:2028
                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6040 -childID 5 -isForBrowser -prefsHandle 6048 -prefMapHandle 4200 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c4c97a13-5814-41c8-81d8-19254cbd9046} 3840 "\\.\pipe\gecko-crash-server-pipe.3840" tab
                                                      6⤵
                                                        PID:3424
                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6192 -childID 6 -isForBrowser -prefsHandle 6184 -prefMapHandle 6188 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {da4055e5-793d-47a4-b8a9-1fd39e4264be} 3840 "\\.\pipe\gecko-crash-server-pipe.3840" tab
                                                        6⤵
                                                          PID:3836
                                              • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                                                C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                                                1⤵
                                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                • Checks BIOS information in registry
                                                • Executes dropped EXE
                                                • Identifies Wine through registry keys
                                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:4772
                                              • C:\Windows\System32\CompPkgSrv.exe
                                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                1⤵
                                                  PID:2504
                                                • C:\Windows\System32\CompPkgSrv.exe
                                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                  1⤵
                                                    PID:3836
                                                  • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                                                    C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                                                    1⤵
                                                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                    • Checks BIOS information in registry
                                                    • Executes dropped EXE
                                                    • Identifies Wine through registry keys
                                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    PID:6692
                                                  • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                                                    C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                                                    1⤵
                                                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                    • Checks BIOS information in registry
                                                    • Executes dropped EXE
                                                    • Identifies Wine through registry keys
                                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    PID:6352

                                                  Network

                                                  MITRE ATT&CK Enterprise v15

                                                  Replay Monitor

                                                  Loading Replay Monitor...

                                                  Downloads

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                    Filesize

                                                    152B

                                                    MD5

                                                    e765f3d75e6b0e4a7119c8b14d47d8da

                                                    SHA1

                                                    cc9f7c7826c2e1a129e7d98884926076c3714fc0

                                                    SHA256

                                                    986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89

                                                    SHA512

                                                    a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                    Filesize

                                                    152B

                                                    MD5

                                                    53bc70ecb115bdbabe67620c416fe9b3

                                                    SHA1

                                                    af66ec51a13a59639eaf54d62ff3b4f092bb2fc1

                                                    SHA256

                                                    b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771

                                                    SHA512

                                                    cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0e01c9a5-2090-4480-8de9-f0be854bfc05.tmp

                                                    Filesize

                                                    1KB

                                                    MD5

                                                    6f58ae7d29543ff3dc571204775b9f55

                                                    SHA1

                                                    9ffc645c89953d7616cc0bd9602c46c4ccaecdc1

                                                    SHA256

                                                    f00d809f4abf32ee02b0c9a5bbb2462d7573bbf39bc592dcf79c0b5e3acdf69d

                                                    SHA512

                                                    5833eb61cee486c0ef39acfbed17818c6243f8d092bdfd0ec24b16bb582a1d17184706fa9067db3ddab0db7b35ee1e42a1d71286fe6303b7c4144bdb5db12138

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                    Filesize

                                                    504B

                                                    MD5

                                                    d538f872804acaa33f3e83575e798128

                                                    SHA1

                                                    79d02bb9fa113d0ce8d58776acd58a2da1cfb2e1

                                                    SHA256

                                                    e23fb619b84e36477b44273e00e5a896b8fb235dd156882ef6b902d982c0e2fe

                                                    SHA512

                                                    daac7fee88d19dc57a2db41c70747e8369da460472f9e97fec875426574765a263fd31a835f8dc5b3bd5c0231818247d78211c41be65fa06a1b5c2ac9b53fca0

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                    Filesize

                                                    5KB

                                                    MD5

                                                    0e0cc95cb6115c8c93190251a2daff36

                                                    SHA1

                                                    3aedba600f17ccb848627146ec105fc9008e65c7

                                                    SHA256

                                                    1e52a6ffd7d1bf670846eb994075519a1cc89f44e0cd99a658817b7ee0da930f

                                                    SHA512

                                                    e3d798f0882a9dfd656b274e6f2b57c6e49826bde63c505ea3fc6b6bc2b5104eaeac782dbae9f4a5b002de4151317b5eb10c9ebec219e61af81f74f5376e4363

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                    Filesize

                                                    7KB

                                                    MD5

                                                    baa28902c8963c56585384c8064d2807

                                                    SHA1

                                                    671a6929f49871e49077908e2335a1c519d98ce6

                                                    SHA256

                                                    5fed4d842386fddb3eed3cba5a19ec0714a3d4dc7c0f9403dfbcb1759c537805

                                                    SHA512

                                                    1ed9e9f5465edabcebde5a4ccb0dda04a401f90850c254356863646c78fbf2946b29d4a8f0741bacc85124af28c709b8154f74e371ceebef839e8c79a09ce97e

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                    Filesize

                                                    533B

                                                    MD5

                                                    86676d603e2ca9b799d64db5b1c8e058

                                                    SHA1

                                                    2a4ba8baf8daf54e6f2585702ec5d16b3ee5126d

                                                    SHA256

                                                    a6b25b90492e1dc54e71a17b9e75204f82108c947d6abd1cdb98c6ee8cb2518c

                                                    SHA512

                                                    411a48ac495afb917aa3b7cb12444f9c9f2335d040e891316a757cce6b3a3e81876202e7929ac010b1ffae9809aff632073a93e69977fb6cef3c9ee5ffa35ea2

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58f6af.TMP

                                                    Filesize

                                                    535B

                                                    MD5

                                                    5799904746e01c6b23c8be0ecf9765c2

                                                    SHA1

                                                    4603852d2ec949daa4f953e1c546c56a7638f139

                                                    SHA256

                                                    39640caa207a306f935519e1b1767613c6cd03ae44b65e7caa875d867ca192fd

                                                    SHA512

                                                    9f71a6c5e13d97ccfe8d01225f3cab22f179c8f23d537ee58b07eb4b986952ee4b7d72988dbdb152073b2b97283fa6799ccca426247ffd75ff37c61ef23942b8

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                    Filesize

                                                    16B

                                                    MD5

                                                    6752a1d65b201c13b62ea44016eb221f

                                                    SHA1

                                                    58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                    SHA256

                                                    0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                    SHA512

                                                    9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                    Filesize

                                                    8KB

                                                    MD5

                                                    2d7b1767e9da0ad1cc92e2e496446518

                                                    SHA1

                                                    5938270d59e0fedf5e919d7ff965fd493e9da80f

                                                    SHA256

                                                    c96b93008c305e501404d8351fa30bed3aa00bafcc2c7bff884b67554a26be10

                                                    SHA512

                                                    bdf27ac96916540928ae03bca08b61ed03188b959419e2fdce16d20e69f31df6cc32a08c6b4b2d4229204316bf5f2132f6700cc97823c3aeb36464fed840b159

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                    Filesize

                                                    10KB

                                                    MD5

                                                    c5d7d4235314ae8c5739bf76f05f7f18

                                                    SHA1

                                                    020e271bc40793fcf9dcad8fe21ea6321576156b

                                                    SHA256

                                                    ecef21da5120c10f5aa925ee4d95b5dfd17bab32c138ec9953fe5bc55f8f289a

                                                    SHA512

                                                    855edb46d7f5a57d80934e298d387025192c088e55423693b6274b32cfa899608a3883c358f0dc4af615cb10d6e16547ad096c9bf0a210997be79239e4c7d881

                                                  • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bxumog7h.default-release\activity-stream.discovery_stream.json

                                                    Filesize

                                                    23KB

                                                    MD5

                                                    07bffdf0ada55f03f8e848d8def34e0b

                                                    SHA1

                                                    ce5e3d463562c6cb7bad7bcc37f1fa8431b407fc

                                                    SHA256

                                                    c5e239470f703704d1fc8232f13112189a324b14b2579bf237eed8907f58a213

                                                    SHA512

                                                    2513dec97f6ded22cc1d9d3284e8c45d20d0ceadcd8abadc53ab1b208a6d4774a24bea184f2b86b2a6c7eeda46b25cd70d0e30d7a9daeeed0ec2d3f5bbbcbd7f

                                                  • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bxumog7h.default-release\cache2\entries\58EFA56DB4BFFECB0EDA547894BC9A057159E22F

                                                    Filesize

                                                    13KB

                                                    MD5

                                                    26a27ba0f00d27173c4a3d38d7bf45d0

                                                    SHA1

                                                    47c1a04c402a4805228568cf1c6d7aa9c588f702

                                                    SHA256

                                                    faa7c94168c82ac78a31ecdf85e3493a857bea8f908a1694f60f536b94436da6

                                                    SHA512

                                                    e3b5c18c2d83e393ba034196cdbe38efafbcd4b1dcc8967d2daaedfbf49537517fa641310123af49010242a9a6e4785946fe6f9b3d9623a94dd21654c4ad586a

                                                  • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe

                                                    Filesize

                                                    1.8MB

                                                    MD5

                                                    260bb7213697b9eab79cfff7cd5bebe1

                                                    SHA1

                                                    350b664626ee1dcf9fd7bca4cd04a87a4c11adf4

                                                    SHA256

                                                    3a5bba257d06af78b46d980fc2a285026c354056c4cbaaa5a4aa477d96a13712

                                                    SHA512

                                                    2d8bb03f5b4ed992902aefa7535add761f74e981791bc9058d30bda43b53f92dc86d6e84e0703add200ba2987aa15de188f9eb493d4c8ecc1058094efbbaed99

                                                  • C:\Users\Admin\AppData\Local\Temp\1000039041\do.ps1

                                                    Filesize

                                                    2KB

                                                    MD5

                                                    e05e8f072b373beafe27cc11d85f947c

                                                    SHA1

                                                    1d6daeb98893e8122b8b69287ebd9d43f3c6138e

                                                    SHA256

                                                    717c09427fa5754ba92f92961545534048d0a76528c2e95c4d5ec6cef47c612f

                                                    SHA512

                                                    b3e34162e5ee43bb01f289eebc45fd3ea3e07f30be40dcf6635606540f912fe5c84d301e9f78e97dfe3ffe53e72547e50f3bcd7d4ebe5ab8da451a1989c469a0

                                                  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1of3jbro.zfu.ps1

                                                    Filesize

                                                    60B

                                                    MD5

                                                    d17fe0a3f47be24a6453e9ef58c94641

                                                    SHA1

                                                    6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                    SHA256

                                                    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                    SHA512

                                                    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                  • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                                                    Filesize

                                                    479KB

                                                    MD5

                                                    09372174e83dbbf696ee732fd2e875bb

                                                    SHA1

                                                    ba360186ba650a769f9303f48b7200fb5eaccee1

                                                    SHA256

                                                    c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                                                    SHA512

                                                    b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                                                  • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                                                    Filesize

                                                    13.8MB

                                                    MD5

                                                    0a8747a2ac9ac08ae9508f36c6d75692

                                                    SHA1

                                                    b287a96fd6cc12433adb42193dfe06111c38eaf0

                                                    SHA256

                                                    32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                                                    SHA512

                                                    59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                                                  • C:\Users\Admin\AppData\Roaming\1000026000\40718b2438.exe

                                                    Filesize

                                                    1.7MB

                                                    MD5

                                                    0f0ef1482985e6cf9403f782e6ba6d10

                                                    SHA1

                                                    d7b44e16fc1eb2845b3db09a4fec9ba66dfcebe4

                                                    SHA256

                                                    cc65a55c66501ede8db7f899410180caa449102982130e4ed48a45909156e3c1

                                                    SHA512

                                                    6b484bcbba919e8c2dfc86f703196adbe065c04b93d74d47cc63f7df2e1224a62c854b5b5c03b235c48f4db3a9449d59c9a6dbed832f2e0c0f0fccf739b0a794

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\AlternateServices.bin

                                                    Filesize

                                                    25KB

                                                    MD5

                                                    3e7c0c451e160bbf71eb871e3f41c9ea

                                                    SHA1

                                                    19549074b143ba01e756aeb5c57fe3475a54b6b3

                                                    SHA256

                                                    eb443ca6a6343743ade31029baf4de6292c8e4368f549829a7e6b18a863222b6

                                                    SHA512

                                                    429570ffe3e73994be49bb0e28dd29cef3dd0a63bbf9833f7cdb204f859a46591ee71f5dd09a1d754e14847d802236e491015873465f702f1b1c13d893ea1029

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\AlternateServices.bin

                                                    Filesize

                                                    6KB

                                                    MD5

                                                    ab41d8cf679cb6dc557c2b6d3239308b

                                                    SHA1

                                                    70b37188f61a59fdeeda6532dca94421f6438653

                                                    SHA256

                                                    86d161b2cd15b6276242c97da2f546766e04fa85d707a822dc94809002361ca7

                                                    SHA512

                                                    8746a39ff257fb2681a749735280d7ec88c7229938eabbf1217c17e781c7065f11a8a23224713ed97bf050b14438d9551bbd679019cb55e381c49678894ce169

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\AlternateServices.bin

                                                    Filesize

                                                    8KB

                                                    MD5

                                                    a7c59648ed09bb96a09a52f87dd5d31e

                                                    SHA1

                                                    b56aee2beb75e6105f8686a3c297b6811d5c5193

                                                    SHA256

                                                    6e42ad2e40d5c445e16b889820814160aca8e6f6c4d9d28f470a388e58e0d7d5

                                                    SHA512

                                                    fb6239f886a16543bc086e97c8dc91867249f3b691f5ed89277a540166a5f5f4847ac2cb6db936f590fdab11aaaa692721d89bf89f2bda4be8158027deca2692

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\AlternateServices.bin

                                                    Filesize

                                                    22KB

                                                    MD5

                                                    831594f2ec6738c00f61f52a71b05e79

                                                    SHA1

                                                    1e9176933dd8c9edea221e622cbb1992042627d6

                                                    SHA256

                                                    b914bc55b715dee03eea7a28fe55d79b1ed0b80844c25d64c33d24aa2f6c48dc

                                                    SHA512

                                                    5c61a6dc42d86168ba34a1d801345b22f80b807e0c21d360e82adb981f43482d4e19105b00ecaffcb6a7f714c733e9e166dd442b8d7a6e3dd22aba5190b49089

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\datareporting\glean\db\data.safe.tmp

                                                    Filesize

                                                    5KB

                                                    MD5

                                                    b80d1b4d2262fd2b7cb5730220e34531

                                                    SHA1

                                                    7bae0fb8901ef3c47e8d19382919a88976e4482a

                                                    SHA256

                                                    d299435edc26ed34126c4fbd9136c00de12d0c0e5f9f1989737f8eaf4a7d24d7

                                                    SHA512

                                                    59086ae259e72be7f06f81486fa636d575277ac8ca503ef6f792bb36a38feb605be50dd927e53b21731bb16d974950966ccd4ff88b4126431b7b6d522c224d21

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\datareporting\glean\db\data.safe.tmp

                                                    Filesize

                                                    15KB

                                                    MD5

                                                    85fda07e1a2a8e6613b6917bf9b77c0a

                                                    SHA1

                                                    42968fa509da01e42b60a225fbbd87511a0c2e44

                                                    SHA256

                                                    23848db18c97ae6feb9d748fceab52875bcc135fb0a629a252a62742943658cc

                                                    SHA512

                                                    1d16d52875fb18f7710d8e3c6c5ab9fa8873117bedc35b8a0716f21a0af57677e63d654cb05ef21eb6c554bfb960bcb2c6b78b51d5e57e544fd7ef9d17a6d8a9

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\datareporting\glean\pending_pings\ac510e7b-b205-4104-99bc-41548c2e9f90

                                                    Filesize

                                                    26KB

                                                    MD5

                                                    7dca058fffb7af9796be7f5b1106ecee

                                                    SHA1

                                                    20758d96bdeeef5d73714e07bab01b7598abdeb8

                                                    SHA256

                                                    e68abea6a52ad732fb23c0d97323405ceacb1d521e00c8c15c638304937628e2

                                                    SHA512

                                                    df282b7bce56e52fec10d86989bdfb5b8dc721de4b0d22adcf39e07357879ae02a600e298f99a4094abed1be05a16005fa6cadb643d43eb6294a4471495da313

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\datareporting\glean\pending_pings\c52a2c60-eff4-4cbd-8c84-fd9d794beab0

                                                    Filesize

                                                    671B

                                                    MD5

                                                    326dc6956a7bd4c14ac89d7fe24a22e4

                                                    SHA1

                                                    e3dd00d9d76390f05e72a7e129eb98ad9deb2507

                                                    SHA256

                                                    279f1e06d80542fc9d596b223610fafaef024f29f4e04b93c99c97916f1a30ae

                                                    SHA512

                                                    464f83ac16f36d1ac211a063d9e4a064aa5d1da358d89288781b889daf3692aa7913d80a2ed7bdf8efd3eaf3519e4bc717801ea98591d4dd97435e696f3f7cfd

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\datareporting\glean\pending_pings\f66e2780-8a47-4787-be87-efab5fdaad29

                                                    Filesize

                                                    982B

                                                    MD5

                                                    683002a2158cd199cfcc4ea88cb9791b

                                                    SHA1

                                                    7747cc55e62533095eebdd9fba3f4bf67fe30c7d

                                                    SHA256

                                                    eb3763a504cf92b48ee8eedbe08957d80ee3321b238285775e3a06c1f5353e44

                                                    SHA512

                                                    bb61c43b5081253e1ba8a0d8a1f06522f41a896d569f686c778883c3d6aeb6c97aef7bb1263e5628a863981e59524d985c6732984b8ed974bc914deb3fd79f07

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

                                                    Filesize

                                                    1.1MB

                                                    MD5

                                                    842039753bf41fa5e11b3a1383061a87

                                                    SHA1

                                                    3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                                                    SHA256

                                                    d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                                                    SHA512

                                                    d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

                                                    Filesize

                                                    116B

                                                    MD5

                                                    2a461e9eb87fd1955cea740a3444ee7a

                                                    SHA1

                                                    b10755914c713f5a4677494dbe8a686ed458c3c5

                                                    SHA256

                                                    4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                                                    SHA512

                                                    34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

                                                    Filesize

                                                    372B

                                                    MD5

                                                    bf957ad58b55f64219ab3f793e374316

                                                    SHA1

                                                    a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                                                    SHA256

                                                    bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                                                    SHA512

                                                    79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

                                                    Filesize

                                                    17.8MB

                                                    MD5

                                                    daf7ef3acccab478aaa7d6dc1c60f865

                                                    SHA1

                                                    f8246162b97ce4a945feced27b6ea114366ff2ad

                                                    SHA256

                                                    bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                                                    SHA512

                                                    5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\prefs-1.js

                                                    Filesize

                                                    12KB

                                                    MD5

                                                    ad8d4cd9146442ef3e671e9ece58d032

                                                    SHA1

                                                    3fc33461fb257bd56035253a54b08701c5fa6ddb

                                                    SHA256

                                                    8c9176389433b93d0dd322da3525d1e6f0c7924f9f66b02009c4ace3d1c1eac0

                                                    SHA512

                                                    e22929be0e0689f77e3506de66282948ee539508b4b22a942aae8699aca032cb3587849edaa23169db3d0953326b904ea2e96cd79472c47e716dfd6fbc23b96e

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\prefs-1.js

                                                    Filesize

                                                    15KB

                                                    MD5

                                                    32bdb394eba7623381feee968dd4f129

                                                    SHA1

                                                    fab93da40e7eb49bf13f584eaa197f7d8cefc30b

                                                    SHA256

                                                    06ae6e7076a9288f6388442a49f6fd40516e62096b421a0d88ee892f226a1447

                                                    SHA512

                                                    7a608cee3854ef7f9313409f65a8eccb25b63423dd5e175418520866b52cc867ec50e82055d7d0b2b6f530b3e0247e59f8df66dc331b78268214b943eca1ae58

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\prefs-1.js

                                                    Filesize

                                                    11KB

                                                    MD5

                                                    0181c29883d8552523a4c049edaa2c1b

                                                    SHA1

                                                    98fcefc15ee6826b973fb0f05b61d13697f4dad5

                                                    SHA256

                                                    b6dad18c6bfa4b97a99b740a2716a2cc7a1fb69a4143eb1e77fd2927eafe7fc4

                                                    SHA512

                                                    0e25b7da4da1f6189ea94c8e714074df8d748e187a34c940f1f687eff11b0a2952a7a7e2b7e7d26afbdc6dcd208bf4c5d36fe5de5a72ae703c53a399d5d4a520

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\prefs.js

                                                    Filesize

                                                    15KB

                                                    MD5

                                                    48533b483a9c119ef35ba4a40ce278b4

                                                    SHA1

                                                    93475b5d06e628242af5d85a0e61e6bcf80f8e36

                                                    SHA256

                                                    0450225c0f6b7d13027ac836a2e7b087628b80d5a96c37cfda750bca1160ed38

                                                    SHA512

                                                    8bd9dc4a6dea50f9f9b98db32121b5593fd3d2192e7b6a1552bb0388fd5f9207791c5e00a80992ed93d064665011e33be8cce9736a87b050c7da942f9bb16070

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\sessionstore-backups\recovery.baklz4

                                                    Filesize

                                                    1KB

                                                    MD5

                                                    12d825478385adb514361e030d419648

                                                    SHA1

                                                    28e78ade647c52b812ce43df5c3fffcd228dec02

                                                    SHA256

                                                    8ce39c6bdbd5227fa4547751f10db243016a6e99ad9fcc5506bd7a20b927de04

                                                    SHA512

                                                    d7a2e582c8125f4d32ac125d759871b243727fc65a792f02c86261dfde241e6da90b82158c80ce3efcd8999c313458905495ed159cb7a580dbc1447781b1dd93

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\sessionstore-backups\recovery.baklz4

                                                    Filesize

                                                    5KB

                                                    MD5

                                                    510e8baa8fcb966688fdd76693ee8d76

                                                    SHA1

                                                    44b5b5a63ea0e6d2a4c315ea92ea1a33e443851c

                                                    SHA256

                                                    d47c546133e68a6b2101793a9eb2aba1bee8ba0d4f95fd5a5b88a26cf662bbae

                                                    SHA512

                                                    e610a59762d28fd71d242dc900547e664c7f8bb9590e89cba15f7a64a3ee25026a649cd0d48393e1ca6afc980772280a5a2b4894f98436edd53ea3f02276fa9f

                                                  • \??\pipe\LOCAL\crashpad_5064_USDHBHYZRQBBQPSZ

                                                    MD5

                                                    d41d8cd98f00b204e9800998ecf8427e

                                                    SHA1

                                                    da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                    SHA256

                                                    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                    SHA512

                                                    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                  • memory/1704-2927-0x0000000000370000-0x0000000000832000-memory.dmp

                                                    Filesize

                                                    4.8MB

                                                  • memory/1704-25-0x0000000000370000-0x0000000000832000-memory.dmp

                                                    Filesize

                                                    4.8MB

                                                  • memory/1704-3000-0x0000000000370000-0x0000000000832000-memory.dmp

                                                    Filesize

                                                    4.8MB

                                                  • memory/1704-20-0x0000000000370000-0x0000000000832000-memory.dmp

                                                    Filesize

                                                    4.8MB

                                                  • memory/1704-2987-0x0000000000370000-0x0000000000832000-memory.dmp

                                                    Filesize

                                                    4.8MB

                                                  • memory/1704-2986-0x0000000000370000-0x0000000000832000-memory.dmp

                                                    Filesize

                                                    4.8MB

                                                  • memory/1704-22-0x0000000000370000-0x0000000000832000-memory.dmp

                                                    Filesize

                                                    4.8MB

                                                  • memory/1704-2985-0x0000000000370000-0x0000000000832000-memory.dmp

                                                    Filesize

                                                    4.8MB

                                                  • memory/1704-2973-0x0000000000370000-0x0000000000832000-memory.dmp

                                                    Filesize

                                                    4.8MB

                                                  • memory/1704-2543-0x0000000000370000-0x0000000000832000-memory.dmp

                                                    Filesize

                                                    4.8MB

                                                  • memory/1704-1720-0x0000000000370000-0x0000000000832000-memory.dmp

                                                    Filesize

                                                    4.8MB

                                                  • memory/1704-1005-0x0000000000370000-0x0000000000832000-memory.dmp

                                                    Filesize

                                                    4.8MB

                                                  • memory/1704-522-0x0000000000370000-0x0000000000832000-memory.dmp

                                                    Filesize

                                                    4.8MB

                                                  • memory/1704-18-0x0000000000370000-0x0000000000832000-memory.dmp

                                                    Filesize

                                                    4.8MB

                                                  • memory/1704-31-0x0000000000370000-0x0000000000832000-memory.dmp

                                                    Filesize

                                                    4.8MB

                                                  • memory/1704-19-0x0000000000371000-0x000000000039F000-memory.dmp

                                                    Filesize

                                                    184KB

                                                  • memory/1704-640-0x0000000000370000-0x0000000000832000-memory.dmp

                                                    Filesize

                                                    4.8MB

                                                  • memory/1704-2991-0x0000000000370000-0x0000000000832000-memory.dmp

                                                    Filesize

                                                    4.8MB

                                                  • memory/1704-750-0x0000000000370000-0x0000000000832000-memory.dmp

                                                    Filesize

                                                    4.8MB

                                                  • memory/1704-21-0x0000000000370000-0x0000000000832000-memory.dmp

                                                    Filesize

                                                    4.8MB

                                                  • memory/1704-23-0x0000000000370000-0x0000000000832000-memory.dmp

                                                    Filesize

                                                    4.8MB

                                                  • memory/2172-90-0x00000000067D0000-0x00000000067EE000-memory.dmp

                                                    Filesize

                                                    120KB

                                                  • memory/2172-91-0x0000000006820000-0x000000000686C000-memory.dmp

                                                    Filesize

                                                    304KB

                                                  • memory/2172-75-0x0000000002EE0000-0x0000000002F16000-memory.dmp

                                                    Filesize

                                                    216KB

                                                  • memory/2172-93-0x0000000007AD0000-0x0000000007B66000-memory.dmp

                                                    Filesize

                                                    600KB

                                                  • memory/2172-89-0x00000000061F0000-0x0000000006544000-memory.dmp

                                                    Filesize

                                                    3.3MB

                                                  • memory/2172-96-0x0000000008120000-0x00000000086C4000-memory.dmp

                                                    Filesize

                                                    5.6MB

                                                  • memory/2172-95-0x0000000006D80000-0x0000000006DA2000-memory.dmp

                                                    Filesize

                                                    136KB

                                                  • memory/2172-79-0x0000000006180000-0x00000000061E6000-memory.dmp

                                                    Filesize

                                                    408KB

                                                  • memory/2172-94-0x0000000006D60000-0x0000000006D7A000-memory.dmp

                                                    Filesize

                                                    104KB

                                                  • memory/2172-76-0x0000000005AE0000-0x0000000006108000-memory.dmp

                                                    Filesize

                                                    6.2MB

                                                  • memory/2172-77-0x0000000005830000-0x0000000005852000-memory.dmp

                                                    Filesize

                                                    136KB

                                                  • memory/2172-78-0x0000000006110000-0x0000000006176000-memory.dmp

                                                    Filesize

                                                    408KB

                                                  • memory/4148-47-0x0000000000300000-0x0000000000976000-memory.dmp

                                                    Filesize

                                                    6.5MB

                                                  • memory/4148-65-0x0000000000300000-0x0000000000976000-memory.dmp

                                                    Filesize

                                                    6.5MB

                                                  • memory/4164-62-0x00000000007D0000-0x0000000000E46000-memory.dmp

                                                    Filesize

                                                    6.5MB

                                                  • memory/4164-74-0x00000000007D0000-0x0000000000E46000-memory.dmp

                                                    Filesize

                                                    6.5MB

                                                  • memory/4772-30-0x0000000000370000-0x0000000000832000-memory.dmp

                                                    Filesize

                                                    4.8MB

                                                  • memory/4772-28-0x0000000000370000-0x0000000000832000-memory.dmp

                                                    Filesize

                                                    4.8MB

                                                  • memory/4772-27-0x0000000000370000-0x0000000000832000-memory.dmp

                                                    Filesize

                                                    4.8MB

                                                  • memory/4772-26-0x0000000000370000-0x0000000000832000-memory.dmp

                                                    Filesize

                                                    4.8MB

                                                  • memory/5016-1-0x0000000077444000-0x0000000077446000-memory.dmp

                                                    Filesize

                                                    8KB

                                                  • memory/5016-2-0x0000000000341000-0x000000000036F000-memory.dmp

                                                    Filesize

                                                    184KB

                                                  • memory/5016-3-0x0000000000340000-0x0000000000802000-memory.dmp

                                                    Filesize

                                                    4.8MB

                                                  • memory/5016-4-0x0000000000340000-0x0000000000802000-memory.dmp

                                                    Filesize

                                                    4.8MB

                                                  • memory/5016-17-0x0000000000340000-0x0000000000802000-memory.dmp

                                                    Filesize

                                                    4.8MB

                                                  • memory/5016-0-0x0000000000340000-0x0000000000802000-memory.dmp

                                                    Filesize

                                                    4.8MB

                                                  • memory/6352-2989-0x0000000000370000-0x0000000000832000-memory.dmp

                                                    Filesize

                                                    4.8MB

                                                  • memory/6352-2990-0x0000000000370000-0x0000000000832000-memory.dmp

                                                    Filesize

                                                    4.8MB

                                                  • memory/6692-2308-0x0000000000370000-0x0000000000832000-memory.dmp

                                                    Filesize

                                                    4.8MB

                                                  • memory/6692-2258-0x0000000000370000-0x0000000000832000-memory.dmp

                                                    Filesize

                                                    4.8MB