Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    10-09-2024 20:01

General

  • Target

    de43f53aa96dac7458f3131343e076429ed33b4eb29c65af41e6a0275b50ea32.exe

  • Size

    1.8MB

  • MD5

    0178074bff7cac97ce00f5e4048c530e

  • SHA1

    c500242fba88b0b8e4a4ff0fc0821fdd5f64d97a

  • SHA256

    de43f53aa96dac7458f3131343e076429ed33b4eb29c65af41e6a0275b50ea32

  • SHA512

    5ba88657414f55b79bd93dcf248979fb3a726e7b2e0ec259eea495d2954a5d1f5c3b9bb9223325d17babaa15bfd8ebe247cd4a3f2a761e4538632486eb0b5bc9

  • SSDEEP

    49152:eGWo+p9tDSYNHO1Tu/MWS/UBFArbz+3YsbF:eGWoStDpNHNxs8yre3PR

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

c7817d

C2

http://31.41.244.10

Attributes
  • install_dir

    0e8d0864aa

  • install_file

    svoutse.exe

  • strings_key

    5481b88a6ef75bcf21333988a4e47048

  • url_paths

    /Dem7kTu/index.php

rc4.plain

Extracted

Family

stealc

Botnet

rave

C2

http://185.215.113.103

Attributes
  • url_path

    /e2b1563c6670f193.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Stealc

    Stealc is an infostealer written in C++.

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 14 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 6 IoCs
  • Identifies Wine through registry keys 2 TTPs 7 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 14 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 21 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 21 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\de43f53aa96dac7458f3131343e076429ed33b4eb29c65af41e6a0275b50ea32.exe
    "C:\Users\Admin\AppData\Local\Temp\de43f53aa96dac7458f3131343e076429ed33b4eb29c65af41e6a0275b50ea32.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4616
    • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
      "C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1312
      • C:\Users\Admin\AppData\Roaming\1000026000\59a1596abb.exe
        "C:\Users\Admin\AppData\Roaming\1000026000\59a1596abb.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:1728
      • C:\Users\Admin\AppData\Local\Temp\1000030001\edf877e35e.exe
        "C:\Users\Admin\AppData\Local\Temp\1000030001\edf877e35e.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:2564
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\Admin\AppData\Local\Temp\1000039041\do.ps1"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:5108
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /c start msedge https://www.youtube.com/account
          4⤵
          • System Location Discovery: System Language Discovery
          PID:3096
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /c start msedge https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1500
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2796
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
            5⤵
            • Checks processor information in registry
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:924
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1940 -parentBuildID 20240401114208 -prefsHandle 1836 -prefMapHandle 1828 -prefsLen 23678 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a6e2142c-a2db-4efd-a4a5-f5c5e476809a} 924 "\\.\pipe\gecko-crash-server-pipe.924" gpu
              6⤵
                PID:2228
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2396 -parentBuildID 20240401114208 -prefsHandle 2372 -prefMapHandle 2368 -prefsLen 24598 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {37aa6149-649f-40e2-a787-3296c5744d68} 924 "\\.\pipe\gecko-crash-server-pipe.924" socket
                6⤵
                  PID:3400
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3224 -childID 1 -isForBrowser -prefsHandle 3180 -prefMapHandle 3048 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1328 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {56acacd9-6da6-4e4d-9aa8-fab24f363a90} 924 "\\.\pipe\gecko-crash-server-pipe.924" tab
                  6⤵
                    PID:4464
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3568 -childID 2 -isForBrowser -prefsHandle 3560 -prefMapHandle 3544 -prefsLen 22693 -prefMapSize 244658 -jsInitHandle 1328 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7a9bc336-1293-4640-807a-6d834c61b139} 924 "\\.\pipe\gecko-crash-server-pipe.924" tab
                    6⤵
                      PID:2268
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4380 -childID 3 -isForBrowser -prefsHandle 4372 -prefMapHandle 4368 -prefsLen 29088 -prefMapSize 244658 -jsInitHandle 1328 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9d25631e-ad96-4e9d-a2e4-0868a965036a} 924 "\\.\pipe\gecko-crash-server-pipe.924" tab
                      6⤵
                        PID:5088
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5176 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 5036 -prefMapHandle 4980 -prefsLen 29088 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f63f8524-9e7e-43e9-853a-da90d60441b8} 924 "\\.\pipe\gecko-crash-server-pipe.924" utility
                        6⤵
                        • Checks processor information in registry
                        PID:4652
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5688 -childID 4 -isForBrowser -prefsHandle 5540 -prefMapHandle 5640 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1328 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {72cb63db-a76e-45ff-8bac-c03484e57d63} 924 "\\.\pipe\gecko-crash-server-pipe.924" tab
                        6⤵
                          PID:6080
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5908 -childID 5 -isForBrowser -prefsHandle 5912 -prefMapHandle 5916 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1328 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {10f47c36-21f6-4b61-bdcc-316d538f6f30} 924 "\\.\pipe\gecko-crash-server-pipe.924" tab
                          6⤵
                            PID:6092
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5908 -childID 6 -isForBrowser -prefsHandle 6076 -prefMapHandle 6080 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1328 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {680ee8b7-c68f-407d-8369-37875a06f2db} 924 "\\.\pipe\gecko-crash-server-pipe.924" tab
                            6⤵
                              PID:6112
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
                          4⤵
                          • Suspicious use of WriteProcessMemory
                          PID:580
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
                            5⤵
                            • Checks processor information in registry
                            PID:4696
                  • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                    C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                    1⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Identifies Wine through registry keys
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • Suspicious behavior: EnumeratesProcesses
                    PID:4768
                  • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                    C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                    1⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Identifies Wine through registry keys
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • Suspicious behavior: EnumeratesProcesses
                    PID:3152
                  • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                    C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                    1⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Identifies Wine through registry keys
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • Suspicious behavior: EnumeratesProcesses
                    PID:228

                  Network

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\activity-stream.discovery_stream.json

                    Filesize

                    23KB

                    MD5

                    1f5b8a083fb419a2030999d6a6f1fc25

                    SHA1

                    2292c6acb96945a1abe832725faef33c03c6a8af

                    SHA256

                    15351c0b8f32a0c5c734e8abb3ca288889e2962c40ae087ad2f697ac4ff2c0df

                    SHA512

                    54c08f9583d48bb2af413fb1640c23262e4ae193734ef797ec65cf68fe932a0a53a1395b43a28ee251275ad0ba2f9bf125d9a75f5340d5022ded87a09d4bbe04

                  • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\cache2\entries\58EFA56DB4BFFECB0EDA547894BC9A057159E22F

                    Filesize

                    13KB

                    MD5

                    4a1c2b684e30d77d8d3c22819ce0ec17

                    SHA1

                    b1481d20326906ec95e198788c1ac5500f47e35b

                    SHA256

                    adaced54575484016a3de8e215352b22d4f94234d3fabdf82b16433ca10a4e37

                    SHA512

                    df3d37e582bd15a01beea539ec330c8238309e56bdde5eaf065578e49a3a1523cf5e45ad08b8d1383d17950fde38023d2018a99e57dd331858e21710416f3b99

                  • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe

                    Filesize

                    1.8MB

                    MD5

                    0178074bff7cac97ce00f5e4048c530e

                    SHA1

                    c500242fba88b0b8e4a4ff0fc0821fdd5f64d97a

                    SHA256

                    de43f53aa96dac7458f3131343e076429ed33b4eb29c65af41e6a0275b50ea32

                    SHA512

                    5ba88657414f55b79bd93dcf248979fb3a726e7b2e0ec259eea495d2954a5d1f5c3b9bb9223325d17babaa15bfd8ebe247cd4a3f2a761e4538632486eb0b5bc9

                  • C:\Users\Admin\AppData\Local\Temp\1000039041\do.ps1

                    Filesize

                    2KB

                    MD5

                    e05e8f072b373beafe27cc11d85f947c

                    SHA1

                    1d6daeb98893e8122b8b69287ebd9d43f3c6138e

                    SHA256

                    717c09427fa5754ba92f92961545534048d0a76528c2e95c4d5ec6cef47c612f

                    SHA512

                    b3e34162e5ee43bb01f289eebc45fd3ea3e07f30be40dcf6635606540f912fe5c84d301e9f78e97dfe3ffe53e72547e50f3bcd7d4ebe5ab8da451a1989c469a0

                  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lfhkruef.msc.ps1

                    Filesize

                    60B

                    MD5

                    d17fe0a3f47be24a6453e9ef58c94641

                    SHA1

                    6ab83620379fc69f80c0242105ddffd7d98d5d9d

                    SHA256

                    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                    SHA512

                    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                  • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                    Filesize

                    479KB

                    MD5

                    09372174e83dbbf696ee732fd2e875bb

                    SHA1

                    ba360186ba650a769f9303f48b7200fb5eaccee1

                    SHA256

                    c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                    SHA512

                    b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                  • C:\Users\Admin\AppData\Local\Temp\tmpaddon-2

                    Filesize

                    13.8MB

                    MD5

                    0a8747a2ac9ac08ae9508f36c6d75692

                    SHA1

                    b287a96fd6cc12433adb42193dfe06111c38eaf0

                    SHA256

                    32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                    SHA512

                    59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                  • C:\Users\Admin\AppData\Roaming\1000026000\59a1596abb.exe

                    Filesize

                    1.7MB

                    MD5

                    ac12bb478b2ae055df15787d43a8dd61

                    SHA1

                    78b92499be7174aff470707436ee99eb5e1306f1

                    SHA256

                    7c4160768d4c205ed30a845b211a04a53f870d55ab8276f0c6de420a0345025c

                    SHA512

                    22b786889143f6886972ba6dad0d8617ef8f54536db514dfc5d9de8c74c22b7429fd0b4feea31fed1d928db46752d64615e94d56b856c1681dccc52f2f8e4aca

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\AlternateServices.bin

                    Filesize

                    8KB

                    MD5

                    3a06f5191880e435239bb81600531304

                    SHA1

                    046f87beab3f70d8300cbd57ffbe585878dcb8c4

                    SHA256

                    8b078344f1d8d3f96003d090e1b994195027e7259df926b76d628a86caaa65f2

                    SHA512

                    15ee6bff7031a6346215877f0de826f1fe7f8e721940cad294a1ed2cd6d9335b4d8d9295bced7129a94b8f641cb6bb848c09a5a977a63b404797afd23338a163

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\AlternateServices.bin

                    Filesize

                    11KB

                    MD5

                    c02b758ba7d2fc62b996a0b4ea54bd71

                    SHA1

                    91fe0a7046ccec6c1152a42763d699a329e42950

                    SHA256

                    0e5737b192b0e429672e4252bc5615c87c6a9a613741664ec85c408f206994d7

                    SHA512

                    a79faca2f67636740e731cab40942d4e5993ae631bc98e53966671542dc90bc06e3b8c5664a963f6e635b8c80d6cb5066e0a5c98cc2e14bf668096cb208cc46b

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\AlternateServices.bin

                    Filesize

                    12KB

                    MD5

                    d683a6b609f7da883e010b8593676d90

                    SHA1

                    294fcecc62ce4937b994518e9ce559e3e00c28da

                    SHA256

                    fd2e0994d7ec0941a60464d32e906f5163c75e6252cb81fa5cf966f5fe248343

                    SHA512

                    367909c1290b09cd47fe7a870e094bcb5ce9119c4e539785ab3a6592864b84e5cd490be7b762e3eadf34cb54dc48a7317d04d6274f50639a1b0822287f13d491

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\AlternateServices.bin

                    Filesize

                    18KB

                    MD5

                    9911903de9dd4ce55d46f7d30628ffa2

                    SHA1

                    fa5a9d26c81964be050e8169e61297fbc76b2e01

                    SHA256

                    3ad101b0d599730d3cf00c578248b0ccd4c147e6ebfa88e45a0d949c0897408f

                    SHA512

                    364a5304d442d2dc19c65ddafe529d439e5d7084a9eb637b28dc1f3833464e9437434d6ae8463bb1abbdf7f1e5f1f64563755460a1facaad830a3458f08b3455

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\AlternateServices.bin

                    Filesize

                    23KB

                    MD5

                    297ae6d8d796ff9e7571576b57f0220c

                    SHA1

                    bbeac7e0da19e15aa289923f33a3ffe95e23c995

                    SHA256

                    83669941e3a00ddde4e672acd19a7b86e752b347ffddb7d803e405d3296b1832

                    SHA512

                    b1d0062c5198fa3af685304c388f2a0e395657c7765d52dbf51a6f8b2f79fc37c1ece4edc35ca783d22a386b877e135a894e8dce7dee4926b8cb7ee57f1761c1

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\datareporting\glean\db\data.safe.tmp

                    Filesize

                    6KB

                    MD5

                    a45a64c55d68ade0cee20d2af1975176

                    SHA1

                    aa1f062c9da6132f4ae64242b45d40f31ae77e3d

                    SHA256

                    f6e2610bc59b9b8423d9bc6180e18001b217dbda5d60a2fb5c88d222f4c87a84

                    SHA512

                    de57f80029a3cec8a48a736214cdedbcc44badb9414e714cb749defe563526be73736f6b7ddabc90e883f58daea68937e894839bc1c86153c05843a7aa96c78f

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\datareporting\glean\db\data.safe.tmp

                    Filesize

                    32KB

                    MD5

                    166eedd151ce8dd2a862e27794c09e1a

                    SHA1

                    db70d011deb33baa2daa8f32c1ed4e2801ec999a

                    SHA256

                    4a60e96a38a36fca78cea47bb4ba27b6fdd28adacda8f69c0483754854d9aa04

                    SHA512

                    9fd8da3a6e55a95fdbeb50165bb06d6f35d6734907aaeaf93d9536376d6dbe2a69e505544b4989838deae493f67546e22b2923ebd5832e9fd07b2afba222f830

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\datareporting\glean\db\data.safe.tmp

                    Filesize

                    5KB

                    MD5

                    69246be1385244714a57e170df27cbbd

                    SHA1

                    6941a98437088f1bf9609c9823c9eb9deb0626fd

                    SHA256

                    933c48dba49e5a3c64dc7ae89e9e1c412fdc26f824c866b806c854ab2be5f7c1

                    SHA512

                    b626282c6182039f4b86e914449068f05442dc8fb8b927623c717e9e71fdf5924766e8babf5a1b44861919b6c83b98ae1765c617ab8195643e360729528e49e5

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\datareporting\glean\db\data.safe.tmp

                    Filesize

                    5KB

                    MD5

                    6f7c048095405e67ad562ea6321cf706

                    SHA1

                    9f4c18e8457742f21eadd8ab62ad12f6bb374bb9

                    SHA256

                    a56ca3097fbc361778d63a46c921caf082b65b3a61fcb598add9e23c3ffdaa86

                    SHA512

                    b3a99627787dd006c301ac9dde25d5629b8345c579124f0d0b542e8baa0d67fff389a763f8c4bde5caf1487bf256ca9b0af5e1acbe35ea208f5bf7f87037d854

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\datareporting\glean\db\data.safe.tmp

                    Filesize

                    32KB

                    MD5

                    5d0f70963d6002572e0cf609f41617e8

                    SHA1

                    7bb2ee26b54d7be76caeb05f73e11fdffb09c4ec

                    SHA256

                    4de69e1d7dd101b8494035fd6467f9158cc379ad42fa2dfcc3757d9bc5b0e49b

                    SHA512

                    0e6377d4afa2d61e5ce30f6b59a9238d95d93399b297e015046a3f5ec7f38bed92759cefed50c7d3e56a2c8f6e162281e33596dad643bf07a514b151628c1957

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\datareporting\glean\db\data.safe.tmp

                    Filesize

                    6KB

                    MD5

                    573f96a321b649a5fcc2ca362566000a

                    SHA1

                    23ec9722ee37f89b496fb1989117dd0836347744

                    SHA256

                    a04a6c9c3e82ad4185f5d0ee586af3bf73727ad11e05a3b346bdbfd8d998aa3e

                    SHA512

                    41ee76d5416c507adcef90a01d6f7a569ff36650ab712b4f55ed88bb07e4f9db006c6592cb7e8521f58436e08f52565320ecf461aaca7ab3c416ef2939a174da

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\datareporting\glean\pending_pings\30036c7e-eaa7-49d9-a019-0d7a3defec49

                    Filesize

                    671B

                    MD5

                    9c79cc4c309fe8529e8c425eb53b453f

                    SHA1

                    568b7c09566407a6526c28b06675ba8c3fb80960

                    SHA256

                    381b04d540bbfb8e030c4f69b3cd8a4fb338883970f2c1919fc852bb2cd8fc7d

                    SHA512

                    8b5348ed1559d402ffec62926784c2dea7951c143834d5f8a1f64f18792643c52e186074e59d5c0809ac67bc162ed86e34540368d995eef0db7e8d8364c4de05

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\datareporting\glean\pending_pings\6ef78e87-0830-414f-a0e7-5ed623d3606c

                    Filesize

                    982B

                    MD5

                    642f78e8b200bdeb0439577f462feb57

                    SHA1

                    2f1c3e39dd93372fadedb09500ca554747f1a7ac

                    SHA256

                    035a759cbebb04657e3d3129653abcc266cc1dbab8b5af30c9647f42cb778ad7

                    SHA512

                    97c10499e961fe2ad6d81e3149c6dd016fd76cdfd7505ae0a27fd58f8645a38bb0799d56f1af9b95d16ad7328a8711cff34cce9c7b132dfc1b43203ced9c82cc

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\datareporting\glean\pending_pings\e04fcd76-3a20-4f32-ad51-e92b85896062

                    Filesize

                    27KB

                    MD5

                    a1a05f90dc8a1193d085b1e105e99133

                    SHA1

                    d7a0410842e9662fe113990c9001669d049515d5

                    SHA256

                    fc8103f97dce8a9fdf49385c3c381a1e971c4b6fe4cc7270652a5987c1d15b1d

                    SHA512

                    54d07e3a8e2717500409304fa33f197057e8e58f6f641bd054031d1f4eb06183d7270e062b3af940eeac86a6563ba319ad076956804d0ecb1c4f37a21f3061e5

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll.tmp

                    Filesize

                    1.1MB

                    MD5

                    842039753bf41fa5e11b3a1383061a87

                    SHA1

                    3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                    SHA256

                    d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                    SHA512

                    d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

                    Filesize

                    116B

                    MD5

                    2a461e9eb87fd1955cea740a3444ee7a

                    SHA1

                    b10755914c713f5a4677494dbe8a686ed458c3c5

                    SHA256

                    4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                    SHA512

                    34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\gmp-widevinecdm\4.10.2710.0\LICENSE.txt.tmp

                    Filesize

                    479B

                    MD5

                    49ddb419d96dceb9069018535fb2e2fc

                    SHA1

                    62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

                    SHA256

                    2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

                    SHA512

                    48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

                    Filesize

                    372B

                    MD5

                    bf957ad58b55f64219ab3f793e374316

                    SHA1

                    a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                    SHA256

                    bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                    SHA512

                    79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

                    Filesize

                    17.8MB

                    MD5

                    daf7ef3acccab478aaa7d6dc1c60f865

                    SHA1

                    f8246162b97ce4a945feced27b6ea114366ff2ad

                    SHA256

                    bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                    SHA512

                    5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll.lib.tmp

                    Filesize

                    1KB

                    MD5

                    688bed3676d2104e7f17ae1cd2c59404

                    SHA1

                    952b2cdf783ac72fcb98338723e9afd38d47ad8e

                    SHA256

                    33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

                    SHA512

                    7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll.sig.tmp

                    Filesize

                    1KB

                    MD5

                    36e5ee071a6f2f03c5d3889de80b0f0d

                    SHA1

                    cf6e8ddb87660ef1ef84ae36f97548a2351ac604

                    SHA256

                    6be809d16e0944386e45cf605eae0cd2cf46f111d1a6fe999fec813d2c378683

                    SHA512

                    99b61896659e558a79f0e9be95286ebf01d31d13b71df6db4923406e88b3ba72584ef2b62e073b2f5e06901af2c7d1b92d3d12187fe5b4b29c9dd2678444f34e

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\prefs-1.js

                    Filesize

                    12KB

                    MD5

                    859961e08633f4f62c777e6d36f5d460

                    SHA1

                    449bfc756e647b856de4af5b10d84c44693985c5

                    SHA256

                    bf1ef14b23c159975d18e06133fdf549b0013f3042609aabd5dc14738f67e89f

                    SHA512

                    2066a345d78172061949f5fcd857e922bfd34163e618a4ca169c5f580c46773d0fcf67b121c61ce9e5841c66dad34552f88b133c713b9b4bd708720966e57a08

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\prefs.js

                    Filesize

                    11KB

                    MD5

                    6f9cb078b97fb6438392065e2fe8220c

                    SHA1

                    24e48a6b4c86c65fbe8d0bff61560f85a7db40f5

                    SHA256

                    e21f92e8d5c3743dd419f824facf426adb0b029342a7afbb46557c065667b357

                    SHA512

                    2586a9e8fbaff5f4eece765cf6a590abc50f04f98cd5239c67fc7a66b2e2705cc7347c3244b833e5f3da550c9ebb9954e24cde498a7367cc23160c8dc39dfb82

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\prefs.js

                    Filesize

                    11KB

                    MD5

                    81923ec5546f117ab8f6061e0de206ec

                    SHA1

                    9b4e5ca0807898edb51aef73e7fcf005c3d5f5aa

                    SHA256

                    1bbaa00f7acd4d98029311958adb1d8f923b531f227947c37e40db26049e3c87

                    SHA512

                    9b2453dcde6f1552b21894103df99f792d576801a9b07ad87bccefd012ef2587375127e5c9943523679f5a80b22f151b3bc3cdf47151e0ca547fdb7462f0d0a9

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\prefs.js

                    Filesize

                    10KB

                    MD5

                    4cb0f54c5bd19441662e12e36ea50034

                    SHA1

                    146b1a5b7a3fdecf729186949b763587d7fbb7cc

                    SHA256

                    e0ab57a93bb48ab33a35aa7e6d58f250e52a80ac271673e2741d33524ef330ac

                    SHA512

                    a087b9dc2c7cfe39dd945cb7fc064aed300be0887cf5132780fd8f84a0fdfb7af148161e7ac99912f51e5f81d898d16f13dc563ddc047ba116845d56d1dfd0ec

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\sessionstore-backups\recovery.baklz4

                    Filesize

                    1KB

                    MD5

                    3c74582c15ab95b91f209390f9bf3db0

                    SHA1

                    bdaf4bca9fe0e6bf05ece450a0165e5a222e9c67

                    SHA256

                    416527441c5bbd8cc6846647091256f08a3d6f5c1da215c3bd85cdf2d58df2fd

                    SHA512

                    9970e9cbd3e11a578c36a71de9f946fc737c01161b54057d3080bc0a75c131217dc4ac9264bd3cae6b55d2aa238b4f586d379c14c84fb1c0b06ec20d2caed1f2

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\sessionstore-backups\recovery.baklz4

                    Filesize

                    5KB

                    MD5

                    4e8cc7380598322b5bd53b712719e811

                    SHA1

                    0f6cb3c4faf60e8f40d985719f814c9d5bf5eb9b

                    SHA256

                    b3867372df06eeebf3ad7ad620879e7953f401f4b896bc21b6ab3327932fcb75

                    SHA512

                    ca175d539df2a24160d6d82bd54a95b00c9ef0a868d3314ade9d7e53b4fb25c4c9a54c6c61b2c533f246a4eecf22a1a4a49873ff0eb46cf32bc43b6e5b1a2476

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

                    Filesize

                    376KB

                    MD5

                    f62d5f10fa6c604324723654cc13ef39

                    SHA1

                    5cd1e9f0364099ee32d783a731a47912c9716577

                    SHA256

                    643c64596269c9d4d3ab1eca336abe1b5c974ae563942892b74ae7563c0b4815

                    SHA512

                    1900ec3eff09a4ef085e56df1703734446240318fe30cdefe4c18edcd40ab4598b9943cb24915612c92f3c6fcd3a1d90e4334ec5aec4ac0a8242be254e6b29f2

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

                    Filesize

                    1.1MB

                    MD5

                    4837bbea0f176e1ea19214ba990f9968

                    SHA1

                    546e62c43d25edd539f4eb6c05bd86fa42365a31

                    SHA256

                    a7783d3209f385c1384012c7213f283183be6a9b8bf31b7316190f2398512c0e

                    SHA512

                    7f7f0f10c7f84ee3ed5eabe6a3a9bf66568478b4b0a61e8a42ab56d99757c3c1602b659ed004eb047b9e764be31e96cacc22b22f90c28b6c13c70b2590ef11ee

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

                    Filesize

                    2.0MB

                    MD5

                    a4748435170fbc651235737f646725f5

                    SHA1

                    2782cedb8e010df3f6e93f6e226d7c039025cab1

                    SHA256

                    90b6e3b7d521877caa3d9ab7046f3f923ecfd72a207d44f6f71e635e73a3f722

                    SHA512

                    8598fffb1e7f0968e4ef92930695cb80b505014b426bde090c26d1bbf60bd5b0274355684cd535c780f5d07489287c01c417ad629b573fbc26a12bfbbc9c79c7

                  • memory/228-1267-0x00000000006B0000-0x0000000000B69000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/228-1316-0x00000000006B0000-0x0000000000B69000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/1312-20-0x00000000006B0000-0x0000000000B69000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/1312-17-0x00000000006B0000-0x0000000000B69000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/1312-32-0x00000000006B0000-0x0000000000B69000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/1312-31-0x00000000006B0000-0x0000000000B69000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/1312-30-0x00000000006B0000-0x0000000000B69000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/1312-29-0x00000000006B0000-0x0000000000B69000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/1312-2308-0x00000000006B0000-0x0000000000B69000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/1312-98-0x00000000006B0000-0x0000000000B69000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/1312-1627-0x00000000006B0000-0x0000000000B69000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/1312-1055-0x00000000006B0000-0x0000000000B69000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/1312-820-0x00000000006B0000-0x0000000000B69000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/1312-818-0x00000000006B0000-0x0000000000B69000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/1312-782-0x00000000006B0000-0x0000000000B69000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/1312-21-0x00000000006B0000-0x0000000000B69000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/1312-746-0x00000000006B0000-0x0000000000B69000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/1312-743-0x00000000006B0000-0x0000000000B69000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/1312-505-0x00000000006B0000-0x0000000000B69000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/1312-33-0x00000000006B0000-0x0000000000B69000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/1312-523-0x00000000006B0000-0x0000000000B69000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/1312-524-0x00000000006B0000-0x0000000000B69000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/1312-19-0x00000000006B0000-0x0000000000B69000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/1728-67-0x0000000000390000-0x0000000000A02000-memory.dmp

                    Filesize

                    6.4MB

                  • memory/1728-49-0x0000000000390000-0x0000000000A02000-memory.dmp

                    Filesize

                    6.4MB

                  • memory/2564-65-0x0000000000A10000-0x0000000001082000-memory.dmp

                    Filesize

                    6.4MB

                  • memory/2564-77-0x0000000000A10000-0x0000000001082000-memory.dmp

                    Filesize

                    6.4MB

                  • memory/3152-704-0x00000000006B0000-0x0000000000B69000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/4616-1-0x0000000077E46000-0x0000000077E48000-memory.dmp

                    Filesize

                    8KB

                  • memory/4616-0-0x0000000000A40000-0x0000000000EF9000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/4616-5-0x0000000000A40000-0x0000000000EF9000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/4616-3-0x0000000000A40000-0x0000000000EF9000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/4616-2-0x0000000000A41000-0x0000000000A6F000-memory.dmp

                    Filesize

                    184KB

                  • memory/4616-16-0x0000000000A40000-0x0000000000EF9000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/4768-27-0x00000000006B0000-0x0000000000B69000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/4768-28-0x00000000006B1000-0x00000000006DF000-memory.dmp

                    Filesize

                    184KB

                  • memory/4768-25-0x00000000006B0000-0x0000000000B69000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/4768-24-0x00000000006B0000-0x0000000000B69000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/4768-23-0x00000000006B0000-0x0000000000B69000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/5108-81-0x0000000005730000-0x0000000005796000-memory.dmp

                    Filesize

                    408KB

                  • memory/5108-80-0x00000000056C0000-0x0000000005726000-memory.dmp

                    Filesize

                    408KB

                  • memory/5108-79-0x0000000004DF0000-0x0000000004E12000-memory.dmp

                    Filesize

                    136KB

                  • memory/5108-78-0x0000000005090000-0x00000000056BA000-memory.dmp

                    Filesize

                    6.2MB

                  • memory/5108-94-0x0000000006F70000-0x0000000007006000-memory.dmp

                    Filesize

                    600KB

                  • memory/5108-97-0x00000000075C0000-0x0000000007B66000-memory.dmp

                    Filesize

                    5.6MB

                  • memory/5108-96-0x0000000006250000-0x0000000006272000-memory.dmp

                    Filesize

                    136KB

                  • memory/5108-91-0x0000000005C70000-0x0000000005C8E000-memory.dmp

                    Filesize

                    120KB

                  • memory/5108-75-0x0000000002480000-0x00000000024B6000-memory.dmp

                    Filesize

                    216KB

                  • memory/5108-92-0x0000000005CB0000-0x0000000005CFC000-memory.dmp

                    Filesize

                    304KB

                  • memory/5108-95-0x00000000061D0000-0x00000000061EA000-memory.dmp

                    Filesize

                    104KB

                  • memory/5108-90-0x0000000005850000-0x0000000005BA7000-memory.dmp

                    Filesize

                    3.3MB