Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    10-09-2024 19:11

General

  • Target

    1c3a4f586345aa8bb07fdf7def83b40026080b1af777cdf82f00909282ea87b8.exe

  • Size

    1.8MB

  • MD5

    bef90e67c56413d8e7a94cbd45f9b9a1

  • SHA1

    dfc9e49ea097f1955e5830055a7c685d76c6d0d1

  • SHA256

    1c3a4f586345aa8bb07fdf7def83b40026080b1af777cdf82f00909282ea87b8

  • SHA512

    ae647a17eafe300f4a465eeda4de2e3b936f39cbbf44a01b1036e5c18c3b40a2cc89e55a4ee0fbc880bafacca1f8781d10b317f187303076038a237aa85bc07d

  • SSDEEP

    49152:35PdZAEA9WhDIYXzwQhkeJQxyPE1aCJbz:35FZAP6pzwQ/QtoCJ3

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

c7817d

C2

http://31.41.244.10

Attributes
  • install_dir

    0e8d0864aa

  • install_file

    svoutse.exe

  • strings_key

    5481b88a6ef75bcf21333988a4e47048

  • url_paths

    /Dem7kTu/index.php

rc4.plain

Extracted

Family

stealc

Botnet

rave

C2

http://185.215.113.103

Attributes
  • url_path

    /e2b1563c6670f193.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Stealc

    Stealc is an infostealer written in C++.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 14 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 6 IoCs
  • Identifies Wine through registry keys 2 TTPs 7 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
  • Drops file in Windows directory 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 14 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 21 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 22 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\1c3a4f586345aa8bb07fdf7def83b40026080b1af777cdf82f00909282ea87b8.exe
    "C:\Users\Admin\AppData\Local\Temp\1c3a4f586345aa8bb07fdf7def83b40026080b1af777cdf82f00909282ea87b8.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:2312
    • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
      "C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3588
      • C:\Users\Admin\AppData\Roaming\1000026000\49b245a537.exe
        "C:\Users\Admin\AppData\Roaming\1000026000\49b245a537.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:1756
      • C:\Users\Admin\AppData\Local\Temp\1000030001\3db70fd349.exe
        "C:\Users\Admin\AppData\Local\Temp\1000030001\3db70fd349.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:852
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\Admin\AppData\Local\Temp\1000039041\do.ps1"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1692
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /c start msedge https://www.youtube.com/account
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4072
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /c start msedge https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
          4⤵
          • System Location Discovery: System Language Discovery
          PID:3696
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1896
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
            5⤵
            • Checks processor information in registry
            PID:5048
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1936
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
            5⤵
            • Checks processor information in registry
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:4576
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1920 -parentBuildID 20240401114208 -prefsHandle 1836 -prefMapHandle 1828 -prefsLen 23678 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {788fdbcb-6d7f-45e0-831a-836d0bbc5d89} 4576 "\\.\pipe\gecko-crash-server-pipe.4576" gpu
              6⤵
                PID:2676
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2380 -parentBuildID 20240401114208 -prefsHandle 2356 -prefMapHandle 2352 -prefsLen 24598 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {12083145-2161-420a-ab55-4b326ca44865} 4576 "\\.\pipe\gecko-crash-server-pipe.4576" socket
                6⤵
                  PID:4640
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2960 -childID 1 -isForBrowser -prefsHandle 3204 -prefMapHandle 3200 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5dce25cd-17ed-48ed-879b-84aa0d912ec9} 4576 "\\.\pipe\gecko-crash-server-pipe.4576" tab
                  6⤵
                    PID:5044
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3064 -childID 2 -isForBrowser -prefsHandle 2816 -prefMapHandle 2900 -prefsLen 22693 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fd2f74c5-98d4-4c5e-814f-bbdfcb6a3d17} 4576 "\\.\pipe\gecko-crash-server-pipe.4576" tab
                    6⤵
                      PID:3624
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3684 -childID 3 -isForBrowser -prefsHandle 892 -prefMapHandle 3524 -prefsLen 29088 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9e1bc13b-9911-478d-9e87-7fdb8baafd7b} 4576 "\\.\pipe\gecko-crash-server-pipe.4576" tab
                      6⤵
                        PID:2020
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4924 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4932 -prefMapHandle 5020 -prefsLen 29088 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4618f2bf-5085-451b-8ea5-93ca8da26014} 4576 "\\.\pipe\gecko-crash-server-pipe.4576" utility
                        6⤵
                        • Checks processor information in registry
                        PID:5236
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5000 -childID 4 -isForBrowser -prefsHandle 5836 -prefMapHandle 5832 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2c6b2244-9fdc-4023-88b1-953a4b354703} 4576 "\\.\pipe\gecko-crash-server-pipe.4576" tab
                        6⤵
                          PID:6040
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5972 -childID 5 -isForBrowser -prefsHandle 6052 -prefMapHandle 6048 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3efa2763-6c3d-4c3e-849f-0babd90e69f4} 4576 "\\.\pipe\gecko-crash-server-pipe.4576" tab
                          6⤵
                            PID:6052
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6156 -childID 6 -isForBrowser -prefsHandle 6164 -prefMapHandle 6168 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3169ee0a-7584-4619-af7f-0a5b8506abe8} 4576 "\\.\pipe\gecko-crash-server-pipe.4576" tab
                            6⤵
                              PID:6064
                  • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                    C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                    1⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Identifies Wine through registry keys
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • Suspicious behavior: EnumeratesProcesses
                    PID:3096
                  • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                    C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                    1⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Identifies Wine through registry keys
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • Suspicious behavior: EnumeratesProcesses
                    PID:5756
                  • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                    C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                    1⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Identifies Wine through registry keys
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • Suspicious behavior: EnumeratesProcesses
                    PID:5196

                  Network

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yel8o60i.default-release\activity-stream.discovery_stream.json

                    Filesize

                    24KB

                    MD5

                    2f23e27773e0968bb633e6c8c0b0f895

                    SHA1

                    f9dfe8ea42089f25ccd3470ed3f1d77bb4f605db

                    SHA256

                    415cf015373550cc17cfafc4fce45148d5829a3b582f75c13d71cad8f63ad376

                    SHA512

                    2b08ba933216993fd1b0248e3f8a47bf2106cfc4016e7db5b96a538a4b5e372ac936b5a8071bcfb0081d76a392520220476ba8692f77529d34a29d0f91cdeb2a

                  • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yel8o60i.default-release\cache2\entries\58EFA56DB4BFFECB0EDA547894BC9A057159E22F

                    Filesize

                    13KB

                    MD5

                    b059d95c1c125c6a886c6082bb45610b

                    SHA1

                    97ead074e7e83628f5071b34e67219bf8730f1f4

                    SHA256

                    57e8b17b2bf23fb4c3fc2eb7c21ca123602291984f4186e1f65c27530a64fb2e

                    SHA512

                    044fd70256884edbaa56092bd7c68c7c1f082eaebbf7d749a66966af85b3a07c3f01385b501668d335f9ef788a57b31ca5e94740221f0614bc7c3c7cd86b3cd8

                  • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe

                    Filesize

                    1.8MB

                    MD5

                    bef90e67c56413d8e7a94cbd45f9b9a1

                    SHA1

                    dfc9e49ea097f1955e5830055a7c685d76c6d0d1

                    SHA256

                    1c3a4f586345aa8bb07fdf7def83b40026080b1af777cdf82f00909282ea87b8

                    SHA512

                    ae647a17eafe300f4a465eeda4de2e3b936f39cbbf44a01b1036e5c18c3b40a2cc89e55a4ee0fbc880bafacca1f8781d10b317f187303076038a237aa85bc07d

                  • C:\Users\Admin\AppData\Local\Temp\1000039041\do.ps1

                    Filesize

                    2KB

                    MD5

                    e05e8f072b373beafe27cc11d85f947c

                    SHA1

                    1d6daeb98893e8122b8b69287ebd9d43f3c6138e

                    SHA256

                    717c09427fa5754ba92f92961545534048d0a76528c2e95c4d5ec6cef47c612f

                    SHA512

                    b3e34162e5ee43bb01f289eebc45fd3ea3e07f30be40dcf6635606540f912fe5c84d301e9f78e97dfe3ffe53e72547e50f3bcd7d4ebe5ab8da451a1989c469a0

                  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_u5f1gkz0.way.ps1

                    Filesize

                    60B

                    MD5

                    d17fe0a3f47be24a6453e9ef58c94641

                    SHA1

                    6ab83620379fc69f80c0242105ddffd7d98d5d9d

                    SHA256

                    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                    SHA512

                    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                  • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                    Filesize

                    479KB

                    MD5

                    09372174e83dbbf696ee732fd2e875bb

                    SHA1

                    ba360186ba650a769f9303f48b7200fb5eaccee1

                    SHA256

                    c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                    SHA512

                    b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                  • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                    Filesize

                    13.8MB

                    MD5

                    0a8747a2ac9ac08ae9508f36c6d75692

                    SHA1

                    b287a96fd6cc12433adb42193dfe06111c38eaf0

                    SHA256

                    32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                    SHA512

                    59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                  • C:\Users\Admin\AppData\Roaming\1000026000\49b245a537.exe

                    Filesize

                    1.7MB

                    MD5

                    b568ff86da616dd1a46d9fbfa9415f72

                    SHA1

                    1f0a299ee6349d54d18b5147ff957544501b66fd

                    SHA256

                    8e6e5197c7542613f4fcf6dedfdd6a774f1464876cdd2defcfc05d092d169180

                    SHA512

                    b1e3c0703d317973c6bfda8bcab2c5bc97de12062d0ac908bb9b3e651892244630df1f07076b43d3a4b0da8a0ff7ec10bbaafb1931377542c9c812494b067b29

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yel8o60i.default-release\AlternateServices.bin

                    Filesize

                    6KB

                    MD5

                    efe6be126ca36f4a6a3559c2d34b7028

                    SHA1

                    a4770321504f5366888166e92853916893f16fc1

                    SHA256

                    f7934123470d3566ab280b15d90ea9d17565807c8aebb270701bff32ecee8351

                    SHA512

                    5d37a676fa9d921c06a71efb1738a5e83aa74c122166b874dfde6549e84a557c8e19be516807dac279e20e04776d96daf4fc44252f17b08780521d9ae3c3a11b

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yel8o60i.default-release\AlternateServices.bin

                    Filesize

                    8KB

                    MD5

                    a86759aa1a9cb846dc4eef4c7b396f8f

                    SHA1

                    0e5c1af6ba1a802085c8a461501cb76748f5f5ef

                    SHA256

                    bbbd9da2ff3e66851376b02cdee689ca380bbfccd4b53ea0c3402260221bbebb

                    SHA512

                    6b4a6fa171012501d8614ecf5d1dc5b824ad0009e906e679ba74235167c3fd9c3c9a00cc59ae68ba257e504321bfdc2145ff390584c306e929bd76585a1856df

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yel8o60i.default-release\AlternateServices.bin

                    Filesize

                    12KB

                    MD5

                    064c00df633e3aba3744413f3bc6cd15

                    SHA1

                    38f51296e2032e08bdc1e3a998b72984b384e018

                    SHA256

                    60e280c7a2b7d11da31b44192f51374d25a36c84a4729a60cf2b9bc5d8958031

                    SHA512

                    2b0c930c2e8c001da6e4ec7812baba097496b9529acfe0b275e994a8f1dab0529799f602dac002bf83e23ab2ba92f40d320ce568a291692417f4bf0b8f458a81

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yel8o60i.default-release\AlternateServices.bin

                    Filesize

                    23KB

                    MD5

                    c55f4c921f8f9325e92326cdf9087956

                    SHA1

                    7cb1e3b1c5cf9aa5cbeab88139ac348167da9925

                    SHA256

                    537f202214fffc4a1cc4410c57ff5380bdb802baa317944eed7d03768944607d

                    SHA512

                    04516ed4d410d06063c9b0ddca94232c18ade3b7784b3b055cb2d8fee5a02670ea3c0b6a34945cebf2a3a26c0736092aa676b669de613a3128527ca4ac428d9b

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yel8o60i.default-release\datareporting\glean\db\data.safe.tmp

                    Filesize

                    5KB

                    MD5

                    dd5459cfcec9f81d5b7d49455c073b38

                    SHA1

                    7536434b741a75e018e244c6e8e78ae1e0a4e3bb

                    SHA256

                    a272854ccaad071172d0c7dcea077a6c4fed9e429019a1a116c60a5b9960c386

                    SHA512

                    87a3b5fb773fb742316d9c0127e1f3fb8ff053cea626b65b8c6694a4eeb09ac24f012d8eb0716ab1e641b688907221b6819eac00ea1136ba8cf4aa72768951d8

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yel8o60i.default-release\datareporting\glean\db\data.safe.tmp

                    Filesize

                    15KB

                    MD5

                    ddc2e039d510d522ecbbb679958173f5

                    SHA1

                    ca7bd703d6b7315621f6d6566ecf1194023adcc7

                    SHA256

                    2c00f4e712b8e226e8a1095146b42c19d53bde8720175f0d7a7ee04df1c86512

                    SHA512

                    7bfe31788bae7f425ff33f31731deeacb8849c54d60b5ed81369dbc922f588c2b2b811f041d238cd721fb236ef69cbcf065b210aadd066242e2825745eb03782

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yel8o60i.default-release\datareporting\glean\db\data.safe.tmp

                    Filesize

                    15KB

                    MD5

                    89ef187f9646f366349a5b751455fe59

                    SHA1

                    874129bd9ec1247118737c6ee24f0b6ebabad61a

                    SHA256

                    a00e2f11c954f6ccc7b0263f09ae7cc8b2059c2425c4b80e8f0f89004c267647

                    SHA512

                    0e53a22c663fcb2819a2032b0cd9f1ffc22ec2eed59158acfece19b8e21687166e8d7e9d7347738a11d0798a494a2f245b1d0b41e3aefd52ec37ee361cae6b3c

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yel8o60i.default-release\datareporting\glean\pending_pings\1aab1e06-7e9b-4326-9736-f2f996a5fee2

                    Filesize

                    982B

                    MD5

                    a85bd15f860e1e36633e546b7d10fdce

                    SHA1

                    eb8ced4937c97aaee51c16afb8f6b37692f6eb64

                    SHA256

                    cdb4f93cac0daf3ca10e5aa5f765410fe7a65a4802d68d698a84acd40e64250c

                    SHA512

                    14c4dcae814e36f1ca122e5c844d20a3f37998c24f238b8a00d1e5926522d69358a7508128d809c55d9a0e53d02248eee181f69fd746b6539070a66ae4987d05

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yel8o60i.default-release\datareporting\glean\pending_pings\34761bea-cdb6-4e9a-a4b2-f909b6461c0e

                    Filesize

                    25KB

                    MD5

                    27cf698b09e7469d64e3d9420881d760

                    SHA1

                    b93d1310928af3168a46aed8d32e660779599e09

                    SHA256

                    8444d9b4f4e25c3559fe11528e7137fecffbf72691921eb0f26ec020125b815f

                    SHA512

                    cc30a08daf52066fe97fbd29c876c265438358c26e97f074af28a65bde9db6b0a8dfbe589dca9faf1825c3816556a69cb3fd112ce82b1db6455eed3a13c7388a

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yel8o60i.default-release\datareporting\glean\pending_pings\7ebcc57e-dfa7-4ca9-a7ce-4eacb5811652

                    Filesize

                    671B

                    MD5

                    a612afbeaca74dae2fe9a69b934c3ba2

                    SHA1

                    63dec12c5067f1659a4de99688fe5a7b785b2d91

                    SHA256

                    2c4b6b920ef2b5d63ea9ce4e29895200269fb780bee5e2aec194b756fe8a5233

                    SHA512

                    c3a8881c807c056d6fa0c40492e4619855873371278953cf4998434f4d07d71cdfc6b4c22d40ba109234afda73d9c0a3f61217cc06b530c918c734aaf556f2ef

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yel8o60i.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

                    Filesize

                    1.1MB

                    MD5

                    842039753bf41fa5e11b3a1383061a87

                    SHA1

                    3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                    SHA256

                    d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                    SHA512

                    d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yel8o60i.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

                    Filesize

                    116B

                    MD5

                    2a461e9eb87fd1955cea740a3444ee7a

                    SHA1

                    b10755914c713f5a4677494dbe8a686ed458c3c5

                    SHA256

                    4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                    SHA512

                    34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yel8o60i.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

                    Filesize

                    372B

                    MD5

                    bf957ad58b55f64219ab3f793e374316

                    SHA1

                    a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                    SHA256

                    bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                    SHA512

                    79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yel8o60i.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

                    Filesize

                    17.8MB

                    MD5

                    daf7ef3acccab478aaa7d6dc1c60f865

                    SHA1

                    f8246162b97ce4a945feced27b6ea114366ff2ad

                    SHA256

                    bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                    SHA512

                    5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yel8o60i.default-release\prefs-1.js

                    Filesize

                    12KB

                    MD5

                    3a2b0173a4c1188be87595f3ca2acd45

                    SHA1

                    18d1f9ab5ef51ad3f1a17ab9eac654dc018b7f12

                    SHA256

                    7e9763448c66b4b70572ce3435c10be127ce492051c3df517609f47aac0c1af6

                    SHA512

                    47e1e07f4faa44863b8fee58f5b04c29f395d4bcd1449c99eccb04fff5b424f58a03d9513a640f9f872b0f3bd47785a67e76a9829f209396e05952485729da49

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yel8o60i.default-release\prefs-1.js

                    Filesize

                    11KB

                    MD5

                    4b2b436a972cb6d4965a587ec49756d9

                    SHA1

                    eb08c04ef23aeb6bf645210a78959728c4298aec

                    SHA256

                    631ec6bc898ab8ab5b892982d2535dea1e12256140c8048a5c1a372c3375c488

                    SHA512

                    c4a9a48c5ca13589f9966e37ac29522f48c2410a340d5ed6bb5a1de8a7721ab2ae1d101b831cf54f3c4f63e96c6b675e7daf48b175fbddef66bb3277983e91ef

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yel8o60i.default-release\prefs-1.js

                    Filesize

                    11KB

                    MD5

                    6ec4c671921f7099d75b77d0814c7397

                    SHA1

                    d6f6e907697ba8b987c5d03d13490533388933a6

                    SHA256

                    803a5a5cd9f7710f037dc55fd8ff1203ff209215492d92b38975abd88145f24e

                    SHA512

                    7a764ff55b09fbc5af53dd3054f903c004fc606c9be2f7420e467bca08d6d6aba1b83872578d2a7ccc3c1b8afd5cdadeab4e3f03c77eaca49091cbb24a5b5721

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yel8o60i.default-release\prefs-1.js

                    Filesize

                    11KB

                    MD5

                    1c48715ee2e570487ced8207590cb8cd

                    SHA1

                    08810ae3608bbc7ae977f99f9ae634731459eabc

                    SHA256

                    d6e752b4ea593e3e40ed79b68d1e20b8d892f8c96a5b7246aa8c843beec3948d

                    SHA512

                    b2e04e242a3512d3d0e26755539e1447c74822fe1ecde6191d13aee3128faa057c94a2317c184f220253e48e5ba1b60399c19de57d7768923bc1fd2cc2c6c60e

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yel8o60i.default-release\prefs.js

                    Filesize

                    10KB

                    MD5

                    2bd21c6eb5811960b0608f260417c6b4

                    SHA1

                    817c68c3f223017ce8041ac020557926c85e2efe

                    SHA256

                    930158857fedd823e1acfbab41ec97d0db741c127657992059dc4ff704194c35

                    SHA512

                    c03666d0d9f4381c8b014dc24003ec947aac96cfd5e1ad1ec32b054c461e0ad4dce84c4f0ee0b4e9b6de3a3438aaec3aebf0be6cb1f2686e360e1b93035bffeb

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yel8o60i.default-release\sessionstore-backups\recovery.baklz4

                    Filesize

                    1KB

                    MD5

                    6dead8d56f44a7d5766909d7caaf689d

                    SHA1

                    5275c8c92ab31c5fee7e9d148e4704589ef8c728

                    SHA256

                    3c855cb3d37c9689e8d7972f928b071fe19b6d1be827a99c5a9e71d22dd8dd53

                    SHA512

                    12c531cd320f7d39d18fb2e3a532527ede3df1aed496c51371e41e82dc42044ac83bec93f5b08392cfeaae5d3d3096a56a846fa0d9514a6b14961066726f9b02

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yel8o60i.default-release\sessionstore-backups\recovery.baklz4

                    Filesize

                    5KB

                    MD5

                    4d199b89055732ea0d3435eb2307ed64

                    SHA1

                    604564a4ae7e31efb544ec34c978b156b1797f5e

                    SHA256

                    63f70e0b6ff30b6a1b9f6fe0f01f80ff793f887f5f22c5d34817ec2a362d15db

                    SHA512

                    07a650995305cba6bcd726c81d782d61a179be419115354eef94aa4b883eb42527e86a4250222825e9a332fdb068391a593ede68827e4aa8da7f5e2ed936810e

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yel8o60i.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

                    Filesize

                    1.1MB

                    MD5

                    02aaa90cdd0bf01d95bead39f1f55e6c

                    SHA1

                    b07e5898799aed8f0968cc501fca501e083b7918

                    SHA256

                    a23421264c4a13a5fd97d4d41fb3a6e69d02f196ace39c6ae834e9d0eeaf95ec

                    SHA512

                    c0bebfff20707590643791ad4e584b9134c6a9b773f5224a3378ddf13c62bf7a82f438f96d627fcfcfca9219e15e5b640f5a7a15a3b14f38bf94e7a7ab5dfdd4

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yel8o60i.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

                    Filesize

                    2.0MB

                    MD5

                    05d0428dca5ce2721a054d73af2fc03e

                    SHA1

                    73714f833e9f601ea38930b93e873724bdee7ac6

                    SHA256

                    7b61f2e7ffc1b76a0d957c41ca45b1af47267fc579c38206169c603d9ec50cc1

                    SHA512

                    408dd35778102fac2d6aff5ecec7c43959e4668c32c03c53a7fc6cc608b50767869bd1aacec6436384f612a189f6c0c8b58c61b284a02f93f81a35af87b31a79

                  • memory/852-463-0x0000000000790000-0x0000000000E23000-memory.dmp

                    Filesize

                    6.6MB

                  • memory/852-63-0x0000000000790000-0x0000000000E23000-memory.dmp

                    Filesize

                    6.6MB

                  • memory/1692-74-0x0000000006350000-0x00000000063B6000-memory.dmp

                    Filesize

                    408KB

                  • memory/1692-90-0x0000000007B30000-0x0000000007BC6000-memory.dmp

                    Filesize

                    600KB

                  • memory/1692-92-0x0000000007A90000-0x0000000007AB2000-memory.dmp

                    Filesize

                    136KB

                  • memory/1692-93-0x00000000081B0000-0x0000000008756000-memory.dmp

                    Filesize

                    5.6MB

                  • memory/1692-88-0x0000000006920000-0x000000000696C000-memory.dmp

                    Filesize

                    304KB

                  • memory/1692-87-0x0000000006900000-0x000000000691E000-memory.dmp

                    Filesize

                    120KB

                  • memory/1692-73-0x0000000005B70000-0x0000000005B92000-memory.dmp

                    Filesize

                    136KB

                  • memory/1692-75-0x00000000063C0000-0x0000000006426000-memory.dmp

                    Filesize

                    408KB

                  • memory/1692-91-0x0000000006E50000-0x0000000006E6A000-memory.dmp

                    Filesize

                    104KB

                  • memory/1692-72-0x0000000005D20000-0x000000000634A000-memory.dmp

                    Filesize

                    6.2MB

                  • memory/1692-71-0x00000000030E0000-0x0000000003116000-memory.dmp

                    Filesize

                    216KB

                  • memory/1692-83-0x0000000006430000-0x0000000006787000-memory.dmp

                    Filesize

                    3.3MB

                  • memory/1756-77-0x00000000002B0000-0x0000000000943000-memory.dmp

                    Filesize

                    6.6MB

                  • memory/1756-47-0x00000000002B0000-0x0000000000943000-memory.dmp

                    Filesize

                    6.6MB

                  • memory/2312-4-0x0000000000C70000-0x0000000001115000-memory.dmp

                    Filesize

                    4.6MB

                  • memory/2312-3-0x0000000000C70000-0x0000000001115000-memory.dmp

                    Filesize

                    4.6MB

                  • memory/2312-2-0x0000000000C71000-0x0000000000C9F000-memory.dmp

                    Filesize

                    184KB

                  • memory/2312-18-0x0000000000C70000-0x0000000001115000-memory.dmp

                    Filesize

                    4.6MB

                  • memory/2312-1-0x0000000077606000-0x0000000077608000-memory.dmp

                    Filesize

                    8KB

                  • memory/2312-0-0x0000000000C70000-0x0000000001115000-memory.dmp

                    Filesize

                    4.6MB

                  • memory/3096-30-0x0000000000CD0000-0x0000000001175000-memory.dmp

                    Filesize

                    4.6MB

                  • memory/3096-28-0x0000000000CD0000-0x0000000001175000-memory.dmp

                    Filesize

                    4.6MB

                  • memory/3096-29-0x0000000000CD0000-0x0000000001175000-memory.dmp

                    Filesize

                    4.6MB

                  • memory/3096-26-0x0000000000CD0000-0x0000000001175000-memory.dmp

                    Filesize

                    4.6MB

                  • memory/3588-19-0x0000000000CD1000-0x0000000000CFF000-memory.dmp

                    Filesize

                    184KB

                  • memory/3588-25-0x0000000000CD0000-0x0000000001175000-memory.dmp

                    Filesize

                    4.6MB

                  • memory/3588-548-0x0000000000CD0000-0x0000000001175000-memory.dmp

                    Filesize

                    4.6MB

                  • memory/3588-521-0x0000000000CD0000-0x0000000001175000-memory.dmp

                    Filesize

                    4.6MB

                  • memory/3588-499-0x0000000000CD0000-0x0000000001175000-memory.dmp

                    Filesize

                    4.6MB

                  • memory/3588-626-0x0000000000CD0000-0x0000000001175000-memory.dmp

                    Filesize

                    4.6MB

                  • memory/3588-20-0x0000000000CD0000-0x0000000001175000-memory.dmp

                    Filesize

                    4.6MB

                  • memory/3588-21-0x0000000000CD0000-0x0000000001175000-memory.dmp

                    Filesize

                    4.6MB

                  • memory/3588-15-0x0000000000CD0000-0x0000000001175000-memory.dmp

                    Filesize

                    4.6MB

                  • memory/3588-22-0x0000000000CD0000-0x0000000001175000-memory.dmp

                    Filesize

                    4.6MB

                  • memory/3588-23-0x0000000000CD0000-0x0000000001175000-memory.dmp

                    Filesize

                    4.6MB

                  • memory/3588-2749-0x0000000000CD0000-0x0000000001175000-memory.dmp

                    Filesize

                    4.6MB

                  • memory/3588-27-0x0000000000CD0000-0x0000000001175000-memory.dmp

                    Filesize

                    4.6MB

                  • memory/3588-871-0x0000000000CD0000-0x0000000001175000-memory.dmp

                    Filesize

                    4.6MB

                  • memory/3588-2758-0x0000000000CD0000-0x0000000001175000-memory.dmp

                    Filesize

                    4.6MB

                  • memory/3588-1387-0x0000000000CD0000-0x0000000001175000-memory.dmp

                    Filesize

                    4.6MB

                  • memory/3588-1859-0x0000000000CD0000-0x0000000001175000-memory.dmp

                    Filesize

                    4.6MB

                  • memory/3588-2101-0x0000000000CD0000-0x0000000001175000-memory.dmp

                    Filesize

                    4.6MB

                  • memory/3588-101-0x0000000000CD0000-0x0000000001175000-memory.dmp

                    Filesize

                    4.6MB

                  • memory/3588-2751-0x0000000000CD0000-0x0000000001175000-memory.dmp

                    Filesize

                    4.6MB

                  • memory/3588-2755-0x0000000000CD0000-0x0000000001175000-memory.dmp

                    Filesize

                    4.6MB

                  • memory/5196-2756-0x0000000000CD0000-0x0000000001175000-memory.dmp

                    Filesize

                    4.6MB

                  • memory/5196-2757-0x0000000000CD0000-0x0000000001175000-memory.dmp

                    Filesize

                    4.6MB

                  • memory/5756-877-0x0000000000CD0000-0x0000000001175000-memory.dmp

                    Filesize

                    4.6MB