Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    10-09-2024 21:16

General

  • Target

    3a5bba257d06af78b46d980fc2a285026c354056c4cbaaa5a4aa477d96a13712.exe

  • Size

    1.8MB

  • MD5

    260bb7213697b9eab79cfff7cd5bebe1

  • SHA1

    350b664626ee1dcf9fd7bca4cd04a87a4c11adf4

  • SHA256

    3a5bba257d06af78b46d980fc2a285026c354056c4cbaaa5a4aa477d96a13712

  • SHA512

    2d8bb03f5b4ed992902aefa7535add761f74e981791bc9058d30bda43b53f92dc86d6e84e0703add200ba2987aa15de188f9eb493d4c8ecc1058094efbbaed99

  • SSDEEP

    24576:Od3g80i4dff2KOXpXPqQw6hs37gIQmMYhdY5eGFvsG7C7TwbQgYhLe+XEM:OKvfzgp7wEkggMYhEvzswbQgIB9

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

c7817d

C2

http://31.41.244.10

Attributes
  • install_dir

    0e8d0864aa

  • install_file

    svoutse.exe

  • strings_key

    5481b88a6ef75bcf21333988a4e47048

  • url_paths

    /Dem7kTu/index.php

rc4.plain

Extracted

Family

stealc

Botnet

rave

C2

http://185.215.113.103

Attributes
  • url_path

    /e2b1563c6670f193.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Stealc

    Stealc is an infostealer written in C++.

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 12 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 5 IoCs
  • Identifies Wine through registry keys 2 TTPs 6 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 14 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 19 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 22 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\3a5bba257d06af78b46d980fc2a285026c354056c4cbaaa5a4aa477d96a13712.exe
    "C:\Users\Admin\AppData\Local\Temp\3a5bba257d06af78b46d980fc2a285026c354056c4cbaaa5a4aa477d96a13712.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:3792
    • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
      "C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2064
      • C:\Users\Admin\AppData\Roaming\1000026000\dd9f190bfa.exe
        "C:\Users\Admin\AppData\Roaming\1000026000\dd9f190bfa.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:2072
      • C:\Users\Admin\AppData\Local\Temp\1000030001\7c342b0567.exe
        "C:\Users\Admin\AppData\Local\Temp\1000030001\7c342b0567.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:1132
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\Admin\AppData\Local\Temp\1000039041\do.ps1"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2200
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /c start msedge https://www.youtube.com/account
          4⤵
          • System Location Discovery: System Language Discovery
          PID:3640
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /c start msedge https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
          4⤵
          • System Location Discovery: System Language Discovery
          PID:820
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2408
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
            5⤵
            • Checks processor information in registry
            PID:1448
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2824
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
            5⤵
            • Checks processor information in registry
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:3788
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2000 -parentBuildID 20240401114208 -prefsHandle 1916 -prefMapHandle 1908 -prefsLen 23678 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {930ddc86-e6a5-42db-9593-c4a708de71ea} 3788 "\\.\pipe\gecko-crash-server-pipe.3788" gpu
              6⤵
                PID:1960
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2416 -parentBuildID 20240401114208 -prefsHandle 2408 -prefMapHandle 2404 -prefsLen 24598 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {76eccefa-2153-4a22-aca3-815cab0845e9} 3788 "\\.\pipe\gecko-crash-server-pipe.3788" socket
                6⤵
                  PID:4040
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3060 -childID 1 -isForBrowser -prefsHandle 3128 -prefMapHandle 3084 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1292 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3bf77422-489d-4aaa-ad03-3c0cbbfa3a37} 3788 "\\.\pipe\gecko-crash-server-pipe.3788" tab
                  6⤵
                    PID:2688
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3476 -childID 2 -isForBrowser -prefsHandle 3468 -prefMapHandle 3460 -prefsLen 22693 -prefMapSize 244658 -jsInitHandle 1292 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f9ef9ece-e9c9-46e2-b737-9e8748aaafd4} 3788 "\\.\pipe\gecko-crash-server-pipe.3788" tab
                    6⤵
                      PID:3532
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4380 -childID 3 -isForBrowser -prefsHandle 4372 -prefMapHandle 2584 -prefsLen 29088 -prefMapSize 244658 -jsInitHandle 1292 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {806ff89e-6306-48fe-8c74-54af50807196} 3788 "\\.\pipe\gecko-crash-server-pipe.3788" tab
                      6⤵
                        PID:4056
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5048 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4944 -prefMapHandle 5060 -prefsLen 29088 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {54d41f8d-be4a-41c1-9c69-0f5062bc2a71} 3788 "\\.\pipe\gecko-crash-server-pipe.3788" utility
                        6⤵
                        • Checks processor information in registry
                        PID:3652
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5864 -childID 4 -isForBrowser -prefsHandle 6020 -prefMapHandle 6016 -prefsLen 27182 -prefMapSize 244658 -jsInitHandle 1292 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2714bdbd-2280-4b22-9f4f-c9f7228bfa0a} 3788 "\\.\pipe\gecko-crash-server-pipe.3788" tab
                        6⤵
                          PID:1624
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5944 -childID 5 -isForBrowser -prefsHandle 6152 -prefMapHandle 6156 -prefsLen 27182 -prefMapSize 244658 -jsInitHandle 1292 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {54ff1a86-cf57-450d-97ea-17937fc69187} 3788 "\\.\pipe\gecko-crash-server-pipe.3788" tab
                          6⤵
                            PID:1800
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6428 -childID 6 -isForBrowser -prefsHandle 6344 -prefMapHandle 6348 -prefsLen 27182 -prefMapSize 244658 -jsInitHandle 1292 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b3e4788d-c697-4eaf-a797-72c2b52cdda7} 3788 "\\.\pipe\gecko-crash-server-pipe.3788" tab
                            6⤵
                              PID:4900
                  • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                    C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                    1⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Identifies Wine through registry keys
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • Suspicious behavior: EnumeratesProcesses
                    PID:2080
                  • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                    C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                    1⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Identifies Wine through registry keys
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • Suspicious behavior: EnumeratesProcesses
                    PID:2756

                  Network

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\activity-stream.discovery_stream.json

                    Filesize

                    20KB

                    MD5

                    4ff863e7e635f1e4555492fcd2d14952

                    SHA1

                    2386452435b972ccde589231d7e82c05dea00b6b

                    SHA256

                    87e6f60cae3c4014caef25924360d3c4529bca9c49a045d697561e7b538904eb

                    SHA512

                    7b2db2df5a0a2ad844e2f089010327b78366519adbcf04164d0d71bfb0b3930009de978f4d4f7f0890a16ee959ee5024a0506333e58e841809763e29ad9db0e2

                  • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\cache2\entries\58EFA56DB4BFFECB0EDA547894BC9A057159E22F

                    Filesize

                    13KB

                    MD5

                    79879e98c1529a4807e757461e26ae9c

                    SHA1

                    14f08571dda34244ab29f38fb9a4ddff172b902c

                    SHA256

                    0e8031c5338658cbe4f7572e6c5ad2004c9777fa74f239e63ef20c8a372e8fad

                    SHA512

                    ed1ec1bb66cf7e4ded81c7136f1969c843ad0785070a31d925ff85058dc767bdf346910ba6cd4126999b2db53eb4b588fea24d49ed7a1bd43502e2fce90bce8e

                  • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe

                    Filesize

                    1.8MB

                    MD5

                    260bb7213697b9eab79cfff7cd5bebe1

                    SHA1

                    350b664626ee1dcf9fd7bca4cd04a87a4c11adf4

                    SHA256

                    3a5bba257d06af78b46d980fc2a285026c354056c4cbaaa5a4aa477d96a13712

                    SHA512

                    2d8bb03f5b4ed992902aefa7535add761f74e981791bc9058d30bda43b53f92dc86d6e84e0703add200ba2987aa15de188f9eb493d4c8ecc1058094efbbaed99

                  • C:\Users\Admin\AppData\Local\Temp\1000039041\do.ps1

                    Filesize

                    2KB

                    MD5

                    e05e8f072b373beafe27cc11d85f947c

                    SHA1

                    1d6daeb98893e8122b8b69287ebd9d43f3c6138e

                    SHA256

                    717c09427fa5754ba92f92961545534048d0a76528c2e95c4d5ec6cef47c612f

                    SHA512

                    b3e34162e5ee43bb01f289eebc45fd3ea3e07f30be40dcf6635606540f912fe5c84d301e9f78e97dfe3ffe53e72547e50f3bcd7d4ebe5ab8da451a1989c469a0

                  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1hzh14xf.omd.ps1

                    Filesize

                    60B

                    MD5

                    d17fe0a3f47be24a6453e9ef58c94641

                    SHA1

                    6ab83620379fc69f80c0242105ddffd7d98d5d9d

                    SHA256

                    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                    SHA512

                    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                  • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                    Filesize

                    479KB

                    MD5

                    09372174e83dbbf696ee732fd2e875bb

                    SHA1

                    ba360186ba650a769f9303f48b7200fb5eaccee1

                    SHA256

                    c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                    SHA512

                    b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                  • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                    Filesize

                    13.8MB

                    MD5

                    0a8747a2ac9ac08ae9508f36c6d75692

                    SHA1

                    b287a96fd6cc12433adb42193dfe06111c38eaf0

                    SHA256

                    32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                    SHA512

                    59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                  • C:\Users\Admin\AppData\Roaming\1000026000\dd9f190bfa.exe

                    Filesize

                    1.7MB

                    MD5

                    ac12bb478b2ae055df15787d43a8dd61

                    SHA1

                    78b92499be7174aff470707436ee99eb5e1306f1

                    SHA256

                    7c4160768d4c205ed30a845b211a04a53f870d55ab8276f0c6de420a0345025c

                    SHA512

                    22b786889143f6886972ba6dad0d8617ef8f54536db514dfc5d9de8c74c22b7429fd0b4feea31fed1d928db46752d64615e94d56b856c1681dccc52f2f8e4aca

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\AlternateServices.bin

                    Filesize

                    6KB

                    MD5

                    e75060d4fb9e59c63251b0b8787a7611

                    SHA1

                    483a611a1801d8df5228faaebfb5e980da2ff5ab

                    SHA256

                    1f5cde8286eb4051900392024aa6621417e7e4711b70dd4a3d73a519bc303232

                    SHA512

                    683d92dfbcfc80569d4df881f5a121e1aa8b1795975b3e7b2c194f177ada85a915972bfbd75940dfe8d5d2e04dfe09decd999e9d7f4f740d9c4599abd39daf3f

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\AlternateServices.bin

                    Filesize

                    25KB

                    MD5

                    2afdce0480d7ad8c287beb0dad6ca9ac

                    SHA1

                    144e4f0999ff1a83edd94b192cf6de33891cdf5f

                    SHA256

                    c9321b1d1e27d45cd4b7401790937506cd3e79a40bdc3f0bf87650fd08c68463

                    SHA512

                    6955bc2671dd4e8eb4962488eb6c97a3c6fe40cc154aed17958831cf79328f970f35fe1ee438c07e226a6f0fcb612601c7c8dad6b1f30649a520660cc9fe8ed6

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\AlternateServices.bin

                    Filesize

                    10KB

                    MD5

                    b43971a6e1e2796f4a4eff482187786d

                    SHA1

                    b0bf63eb0f517b99850e3c1c2f26bf6177994a53

                    SHA256

                    7a3f2f846e56ad465733b76fa5909738211b4a29ae618b535b7f3650492005fe

                    SHA512

                    b0307d7ec1da01515d80cd49b700ce0de682034f4d4d0657cfd196c6f9b2e3788d6b638e65580a3fcfed49880e5638b37aa318f615fd1fdebb129e3a73e32624

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\AlternateServices.bin

                    Filesize

                    10KB

                    MD5

                    ceca88367dfbd656805c9af0468ba96e

                    SHA1

                    0cab80d06894b3c7daff476c647b7cd508b307f1

                    SHA256

                    ee11a2e54723061c801fc72156b3162b4b23b98f928d04cba3f2a043b6cb4f30

                    SHA512

                    c1f65c856e04171feae86c7239f3133e9ea387374646777dcbaf5beba4db3a76253b9a6e711d2f68389c2224db60b1b0f0b0597014226187db8800f34ce9debf

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\AlternateServices.bin

                    Filesize

                    13KB

                    MD5

                    b01a81397bf070863adc8abcaf664286

                    SHA1

                    1055f9d6b2d36cdd278ffe54593730a6f9fcf7b3

                    SHA256

                    4038a813514720e740baa30dca5c1ad9482dbf2494f2deea6a56a6b3ddaa0473

                    SHA512

                    5972d8c6c231109a87f88781f37c075c3100f9a7c0b9489ae0478322a66fbd88aa5abed458a277fb7dc71371156f91c09a301ecab9b6bb15ff32a1274b91e322

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\AlternateServices.bin

                    Filesize

                    20KB

                    MD5

                    ba4dc9b651697e03de19c6c72e5fde56

                    SHA1

                    d114673c9436ee7a0bf195778557250d31644e45

                    SHA256

                    5eb0933bd1380eb7e5a8f62858576596b6474169410ac8c286b954b4fec638bc

                    SHA512

                    d2dccb2753eda6cc95bfda63d6193111acbad55c8297a4f42e3c7aef4252c79996b656223fc4d97d7571dd7986ca927f046b260d8ce9c6d8753702f23598fe4b

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\AlternateServices.bin

                    Filesize

                    23KB

                    MD5

                    9e512f6a6c1032836569f497a38a86a2

                    SHA1

                    a7382713397d4ffa1250b289fcb5994d21c253df

                    SHA256

                    0dc1306763de4e4dd539adb7922f9b2417f88a9ab1fbfbfee335101824db0cc4

                    SHA512

                    5684c1f854b2d00011d0f870500aa7a9b373bf6f80737a0ef780f3ae42d57e88171453d542b068032da6bd603686598b6759772ef91799d3f32b72e1c9702912

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\datareporting\glean\db\data.safe.tmp

                    Filesize

                    5KB

                    MD5

                    20b543acb728a97c2a3756ae60343663

                    SHA1

                    b54980b3ba14bb231f18acf05ec3b1486f1b8125

                    SHA256

                    1a33cb2e4d18e38c4860245aeb731ad49bfbb530524e710ca166dca54b554377

                    SHA512

                    dacc75c0624ce1ff026f38e97388d772293bf32911c682e1128c7c141ac0ecd73a41c97e951014c29768ca25d00bad0a5b8658ca28c2ab6a2854f118a908f345

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\datareporting\glean\db\data.safe.tmp

                    Filesize

                    6KB

                    MD5

                    800c76e7526bcebb4400adfde150be6c

                    SHA1

                    6a4f863e721eb778bc27da83c1bc2471dfb2f1fa

                    SHA256

                    3764705cd38c04bc75a722dbef61f7df135f0e3b2cb97b59ca567fb0a0b86865

                    SHA512

                    f1b85c41f8729ac54e6094129be0a82b42eaf6d48e62035efb4067bb3266e2ccf0e1264843e0dfe8511007cce5c2b85b92a79400ec9a4d434883571d31134d85

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\datareporting\glean\db\data.safe.tmp

                    Filesize

                    16KB

                    MD5

                    68e55823f4d2a3cfbdad4b84f7cd0347

                    SHA1

                    d8fea4d9fa94944602b3e96924e651aaade06abd

                    SHA256

                    29b71881ac9d1f28b6319f5ffd7077a9e3bb1e67f5a22c057041d4db009a03c8

                    SHA512

                    501536decde2838ae8d92d64e1e02b9da66353122f81b87d643dab2aba4191d6235813bde58fe2cf65821ca23c1755b933d53234f5dbf424e992dbba5cad24cb

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\datareporting\glean\db\data.safe.tmp

                    Filesize

                    16KB

                    MD5

                    ddffad26f1510988bd835a979a33e40f

                    SHA1

                    66732bc3a929492e9f1db596d856d1d3abb4a2e1

                    SHA256

                    7f1414d10b52c685e4cc76650ace6c85a4d5fa80c18f170bfd9882fd34674032

                    SHA512

                    3c7451db7591162693c14e8fa841442d47a4037336067bc861da1094e59930d089d21b677af22e2de6b4030b0835f7f353479df1977e1e3b37a97904cf73186b

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\datareporting\glean\pending_pings\99f3afaf-ab69-4381-96f5-12ab53c973d1

                    Filesize

                    982B

                    MD5

                    e7bbedb6c98e388c1df2b012ab3cd65c

                    SHA1

                    9cfdad227d54d8eda696e1aa749a637b5f479f1e

                    SHA256

                    a0b3ce3d8e45e6cf02e0b9481b0813b344a239dfb44ad73f3bb0360412128118

                    SHA512

                    b61917e3ccd50dcb7931fe80e75cce8f5726bc5a107ef19dbee9663b06c4cf1f8663303666042a4079a24e618539dc640f057a0a2e8cbb1bd06e58fab3ebaf91

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\datareporting\glean\pending_pings\bbbc9cf2-30ef-4bf7-b143-851182dd9e09

                    Filesize

                    27KB

                    MD5

                    e5f47d37c97ef367c5e93dc50ca01e50

                    SHA1

                    eb2eccac7ae5bb3cc4488e1abc4711e1702c65c2

                    SHA256

                    85bc21c0fca66140941391435f12de685512c0fd885777ac782ef9153ca80158

                    SHA512

                    753414f1742f22c48359d5ed314efd03b6db6c42a9fd386436fb8c85729d5f455888ab83a1985fe314a59720e9ce9daece8e586c96f1981e61e26b210fa00565

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\datareporting\glean\pending_pings\c20d304b-6977-4b66-a862-2a195157f70b

                    Filesize

                    671B

                    MD5

                    19a291235d45d2b7dd8c38f9f2a4633d

                    SHA1

                    758b495dd3c4e8f5791a9a189f196e2698c43660

                    SHA256

                    444b905cba4e6bdd92d0475c43b069873e04da66679179f392042e1d8f3e7ce7

                    SHA512

                    fc5f7166bc7ca6a1121b01be3989cb70eecfbeda27c6c0bd0daad7831aa3e97269984b8d26a7a4c2ac58261f54e2c62523f8df405567f901f9759fe4ac8cb425

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

                    Filesize

                    1.1MB

                    MD5

                    842039753bf41fa5e11b3a1383061a87

                    SHA1

                    3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                    SHA256

                    d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                    SHA512

                    d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

                    Filesize

                    116B

                    MD5

                    2a461e9eb87fd1955cea740a3444ee7a

                    SHA1

                    b10755914c713f5a4677494dbe8a686ed458c3c5

                    SHA256

                    4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                    SHA512

                    34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

                    Filesize

                    372B

                    MD5

                    bf957ad58b55f64219ab3f793e374316

                    SHA1

                    a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                    SHA256

                    bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                    SHA512

                    79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

                    Filesize

                    17.8MB

                    MD5

                    daf7ef3acccab478aaa7d6dc1c60f865

                    SHA1

                    f8246162b97ce4a945feced27b6ea114366ff2ad

                    SHA256

                    bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                    SHA512

                    5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\prefs-1.js

                    Filesize

                    12KB

                    MD5

                    d505587a41713ea1de6eb35fd82d14b4

                    SHA1

                    d675fa61a3d3d13c34908941ef0dd9a55bb5d801

                    SHA256

                    a16f76d32717aad550075ef404fae73664a9a5d05ccf28bd73e6aed6f425cbce

                    SHA512

                    94b9b5b959b5e102a294b6c606ed537a263ee822c8ae9bb90abe3afe6fa4b2e7fa195289c0a5b181dc53f5fe7821b68486dff3708afa5903253faccea0c8dd05

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\prefs.js

                    Filesize

                    10KB

                    MD5

                    ef832732eb65aade7aee4060121771c4

                    SHA1

                    8685383da4db251551ef335d96e2e7ddf5247672

                    SHA256

                    ed884db582e57b810401afd76a99e2d3b4c5f2c6951e9f1580597467bc8bf8d9

                    SHA512

                    3e1f1fca3834ee178530a895e9d3b7797c60a38577126b95a25829b6ff50c3c525fa19416be576d2985265ea9864cabcb820fe2c4312e49174c47fcc2f5bdf45

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\sessionstore-backups\recovery.baklz4

                    Filesize

                    1KB

                    MD5

                    9c290386b07fdb684133ec1be1c2d800

                    SHA1

                    eb63d127fd1dc49440cb639b916dfa6446c95755

                    SHA256

                    91a91f6a2392c84bfefb720e414b3225a1ff702a6b738b53ff6eba7ca29dfb81

                    SHA512

                    c11eaa12ea4ba51deb01e7be654807d1ecf783b9d4d0f6f1ca4ba7835ab8b399c1cbbe97d618b08c6a142696cb71cf7797ad1b3065acb47847734987067c0528

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\sessionstore-backups\recovery.baklz4

                    Filesize

                    5KB

                    MD5

                    b3dacf023e3328aa533d621b4337a503

                    SHA1

                    02e9677c5059f77d5f92ddc8d03ab4f7eee589c3

                    SHA256

                    d3f4fa404d8e60c0fb2a572e910da2c62e5fd7185c97c114f5269a2171e93ee7

                    SHA512

                    c6dbb344e7b44c1e9ded831781b87fbf7a639154b92cba5e6e4375ea03c33f370d2219f61579a4fbda19dc000d7462765b4bd8effc6450ca28d3a91e5afedc7e

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

                    Filesize

                    376KB

                    MD5

                    f62d5f10fa6c604324723654cc13ef39

                    SHA1

                    5cd1e9f0364099ee32d783a731a47912c9716577

                    SHA256

                    643c64596269c9d4d3ab1eca336abe1b5c974ae563942892b74ae7563c0b4815

                    SHA512

                    1900ec3eff09a4ef085e56df1703734446240318fe30cdefe4c18edcd40ab4598b9943cb24915612c92f3c6fcd3a1d90e4334ec5aec4ac0a8242be254e6b29f2

                  • memory/1132-74-0x0000000000D90000-0x0000000001402000-memory.dmp

                    Filesize

                    6.4MB

                  • memory/1132-55-0x0000000000D90000-0x0000000001402000-memory.dmp

                    Filesize

                    6.4MB

                  • memory/2064-86-0x00000000006A0000-0x0000000000B62000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/2064-2916-0x00000000006A0000-0x0000000000B62000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/2064-2945-0x00000000006A0000-0x0000000000B62000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/2064-2942-0x00000000006A0000-0x0000000000B62000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/2064-2932-0x00000000006A0000-0x0000000000B62000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/2064-2931-0x00000000006A0000-0x0000000000B62000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/2064-2928-0x00000000006A0000-0x0000000000B62000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/2064-2927-0x00000000006A0000-0x0000000000B62000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/2064-2926-0x00000000006A0000-0x0000000000B62000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/2064-21-0x00000000006A0000-0x0000000000B62000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/2064-108-0x00000000006A0000-0x0000000000B62000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/2064-2923-0x00000000006A0000-0x0000000000B62000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/2064-20-0x00000000006A0000-0x0000000000B62000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/2064-465-0x00000000006A0000-0x0000000000B62000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/2064-19-0x00000000006A0000-0x0000000000B62000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/2064-511-0x00000000006A0000-0x0000000000B62000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/2064-2914-0x00000000006A0000-0x0000000000B62000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/2064-16-0x00000000006A0000-0x0000000000B62000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/2064-518-0x00000000006A0000-0x0000000000B62000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/2064-1633-0x00000000006A0000-0x0000000000B62000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/2072-39-0x0000000000080000-0x00000000006F2000-memory.dmp

                    Filesize

                    6.4MB

                  • memory/2072-38-0x0000000000080000-0x00000000006F2000-memory.dmp

                    Filesize

                    6.4MB

                  • memory/2072-37-0x0000000000080000-0x00000000006F2000-memory.dmp

                    Filesize

                    6.4MB

                  • memory/2072-56-0x0000000000080000-0x00000000006F2000-memory.dmp

                    Filesize

                    6.4MB

                  • memory/2080-2563-0x00000000006A0000-0x0000000000B62000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/2080-2634-0x00000000006A0000-0x0000000000B62000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/2200-84-0x0000000006EB0000-0x0000000006ED2000-memory.dmp

                    Filesize

                    136KB

                  • memory/2200-64-0x0000000004AC0000-0x0000000004AF6000-memory.dmp

                    Filesize

                    216KB

                  • memory/2200-67-0x0000000005220000-0x0000000005286000-memory.dmp

                    Filesize

                    408KB

                  • memory/2200-65-0x00000000052A0000-0x00000000058CA000-memory.dmp

                    Filesize

                    6.2MB

                  • memory/2200-66-0x0000000005080000-0x00000000050A2000-memory.dmp

                    Filesize

                    136KB

                  • memory/2200-68-0x00000000059D0000-0x0000000005A36000-memory.dmp

                    Filesize

                    408KB

                  • memory/2200-85-0x00000000077C0000-0x0000000007D66000-memory.dmp

                    Filesize

                    5.6MB

                  • memory/2200-80-0x0000000005FA0000-0x0000000005FEC000-memory.dmp

                    Filesize

                    304KB

                  • memory/2200-78-0x0000000005A40000-0x0000000005D97000-memory.dmp

                    Filesize

                    3.3MB

                  • memory/2200-82-0x0000000006F50000-0x0000000006FE6000-memory.dmp

                    Filesize

                    600KB

                  • memory/2200-83-0x0000000006450000-0x000000000646A000-memory.dmp

                    Filesize

                    104KB

                  • memory/2200-79-0x0000000005F10000-0x0000000005F2E000-memory.dmp

                    Filesize

                    120KB

                  • memory/2756-2930-0x00000000006A0000-0x0000000000B62000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/3792-2-0x00000000008A1000-0x00000000008CF000-memory.dmp

                    Filesize

                    184KB

                  • memory/3792-1-0x00000000771B6000-0x00000000771B8000-memory.dmp

                    Filesize

                    8KB

                  • memory/3792-5-0x00000000008A0000-0x0000000000D62000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/3792-3-0x00000000008A0000-0x0000000000D62000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/3792-0-0x00000000008A0000-0x0000000000D62000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/3792-18-0x00000000008A0000-0x0000000000D62000-memory.dmp

                    Filesize

                    4.8MB