Analysis

  • max time kernel
    148s
  • max time network
    158s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    11-09-2024 22:10

General

  • Target

    e72c30dd2fef80237f6eee270269656dc0e2a525ae38c2df8fc95f77334f9e0d.exe

  • Size

    1.8MB

  • MD5

    7f8b4777a6921d7fe085191955d8f9e8

  • SHA1

    0157193e769423cc5073c6e0f48b2cd879c06497

  • SHA256

    e72c30dd2fef80237f6eee270269656dc0e2a525ae38c2df8fc95f77334f9e0d

  • SHA512

    1d9fae6f2289e3b4818d718d45860dbca8bbfd577ef9a082336be43782a280a54bd2ca038753ce19b1ea7cc9e2f56d3b3cd30aeda1a550cd06cddb071cf73964

  • SSDEEP

    49152:Xe/kzuTmV8R34t+ZJG/Kh/NKwDK3KFZa6UlHLQNJ:6kuzWQXX/NKD3ckG

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

c7817d

C2

http://31.41.244.10

Attributes
  • install_dir

    0e8d0864aa

  • install_file

    svoutse.exe

  • strings_key

    5481b88a6ef75bcf21333988a4e47048

  • url_paths

    /Dem7kTu/index.php

rc4.plain

Extracted

Family

stealc

Botnet

rave

C2

http://185.215.113.103

Attributes
  • url_path

    /e2b1563c6670f193.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Stealc

    Stealc is an infostealer written in C++.

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 14 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 6 IoCs
  • Identifies Wine through registry keys 2 TTPs 7 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 14 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 21 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 21 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\e72c30dd2fef80237f6eee270269656dc0e2a525ae38c2df8fc95f77334f9e0d.exe
    "C:\Users\Admin\AppData\Local\Temp\e72c30dd2fef80237f6eee270269656dc0e2a525ae38c2df8fc95f77334f9e0d.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4904
    • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
      "C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1476
      • C:\Users\Admin\AppData\Roaming\1000026000\04a6a77fb7.exe
        "C:\Users\Admin\AppData\Roaming\1000026000\04a6a77fb7.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:1496
      • C:\Users\Admin\AppData\Local\Temp\1000030001\a0bf0a3095.exe
        "C:\Users\Admin\AppData\Local\Temp\1000030001\a0bf0a3095.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:860
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\Admin\AppData\Local\Temp\1000039041\do.ps1"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3656
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /c start msedge https://www.youtube.com/account
          4⤵
          • System Location Discovery: System Language Discovery
          PID:3212
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /c start msedge https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4752
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2848
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
            5⤵
            • Checks processor information in registry
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2424
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1940 -parentBuildID 20240401114208 -prefsHandle 1868 -prefMapHandle 1852 -prefsLen 23678 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {134e2b8e-157a-4248-853f-f58a80911626} 2424 "\\.\pipe\gecko-crash-server-pipe.2424" gpu
              6⤵
                PID:1648
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2412 -parentBuildID 20240401114208 -prefsHandle 2396 -prefMapHandle 2392 -prefsLen 24598 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4fe0cab2-dd3c-42f3-bd7d-659b9903c82e} 2424 "\\.\pipe\gecko-crash-server-pipe.2424" socket
                6⤵
                  PID:1632
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3052 -childID 1 -isForBrowser -prefsHandle 2984 -prefMapHandle 3244 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a1eacf76-ba19-4977-8ae7-9c892c077799} 2424 "\\.\pipe\gecko-crash-server-pipe.2424" tab
                  6⤵
                    PID:3964
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3504 -childID 2 -isForBrowser -prefsHandle 3500 -prefMapHandle 3492 -prefsLen 22693 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {250f6a34-4e32-4d01-92d8-c95686f48b06} 2424 "\\.\pipe\gecko-crash-server-pipe.2424" tab
                    6⤵
                      PID:4804
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4152 -childID 3 -isForBrowser -prefsHandle 4144 -prefMapHandle 4140 -prefsLen 29088 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ce371d2f-6344-4cfb-b4c1-6fb4d8643a5b} 2424 "\\.\pipe\gecko-crash-server-pipe.2424" tab
                      6⤵
                        PID:2976
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4276 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 5136 -prefMapHandle 5100 -prefsLen 29088 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cbb69636-d268-4fb5-91dc-11c3cffcb760} 2424 "\\.\pipe\gecko-crash-server-pipe.2424" utility
                        6⤵
                        • Checks processor information in registry
                        PID:1912
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5948 -childID 4 -isForBrowser -prefsHandle 5876 -prefMapHandle 5928 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bd0ed4f0-1b19-4d15-9ce2-94cfba9ad98a} 2424 "\\.\pipe\gecko-crash-server-pipe.2424" tab
                        6⤵
                          PID:2608
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5812 -childID 5 -isForBrowser -prefsHandle 5564 -prefMapHandle 5856 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a7d891c2-147f-4239-bad1-4b8556d56b66} 2424 "\\.\pipe\gecko-crash-server-pipe.2424" tab
                          6⤵
                            PID:3244
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4424 -childID 6 -isForBrowser -prefsHandle 5780 -prefMapHandle 5792 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {34ce69de-0a3f-49e7-9bb8-f41a3da9ff69} 2424 "\\.\pipe\gecko-crash-server-pipe.2424" tab
                            6⤵
                              PID:1428
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
                          4⤵
                          • Checks processor information in registry
                          PID:2272
                  • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                    C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                    1⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Identifies Wine through registry keys
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • Suspicious behavior: EnumeratesProcesses
                    PID:1692
                  • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                    C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                    1⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Identifies Wine through registry keys
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • Suspicious behavior: EnumeratesProcesses
                    PID:1644
                  • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                    C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                    1⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Identifies Wine through registry keys
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • Suspicious behavior: EnumeratesProcesses
                    PID:668

                  Network

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\x698r3gu.default-release\activity-stream.discovery_stream.json

                    Filesize

                    20KB

                    MD5

                    b1578f8aad952fa4cf8dd9d47c67d9af

                    SHA1

                    56c7bb3d0e42f1e9eed17be29c15b9a8980b4a5f

                    SHA256

                    f300fe5aec674c76e1b60cc1bbdb6f2383cf77a8fb0950660e0de83085f2eb45

                    SHA512

                    fd84f7e29a26d5a589053df26a0c9c2b3a01833e62b40ac849d35470aa02b39edc1c3b820abd1e2c4877f966027ba4400cc818c4de8bf529afb13726b4ed7417

                  • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\x698r3gu.default-release\cache2\entries\0EA2E1AC3653A248EDE38E975FF2A4ADDA308244

                    Filesize

                    480KB

                    MD5

                    b81c1cb20b561da505a5c8bec815d816

                    SHA1

                    c77650f89fbe2d9d5316d831313c5829cf62ebdb

                    SHA256

                    1568280c9b4a0b316b38ea05d1a645d87879f299daee804a402e21334cc1c29a

                    SHA512

                    8ab9728feab9859097322dbf1eb482b66e38f0d21f2c2579c0f0466056e5f730fe09868e1f8690945c8225f02df119dd4f7480232ae9e8c03bf6b5156f3ff95a

                  • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\x698r3gu.default-release\cache2\entries\58EFA56DB4BFFECB0EDA547894BC9A057159E22F

                    Filesize

                    13KB

                    MD5

                    18f1f654a6f411f44bff0d22eb085181

                    SHA1

                    560e971d9a4f677c393c65967db174691027bf9d

                    SHA256

                    072b4ad4cea88d68801205bbbbdb72482be0581927a44f27b1e9c5fe2c84e53c

                    SHA512

                    a95b15f2822112d9467cb7690127959c8a8ce03370d85601b0ffd46071bec610da69997973f91ba271dd6e8db4b9aec82ab7fcf3c32a1a379702461545be3836

                  • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe

                    Filesize

                    1.8MB

                    MD5

                    7f8b4777a6921d7fe085191955d8f9e8

                    SHA1

                    0157193e769423cc5073c6e0f48b2cd879c06497

                    SHA256

                    e72c30dd2fef80237f6eee270269656dc0e2a525ae38c2df8fc95f77334f9e0d

                    SHA512

                    1d9fae6f2289e3b4818d718d45860dbca8bbfd577ef9a082336be43782a280a54bd2ca038753ce19b1ea7cc9e2f56d3b3cd30aeda1a550cd06cddb071cf73964

                  • C:\Users\Admin\AppData\Local\Temp\1000039041\do.ps1

                    Filesize

                    2KB

                    MD5

                    e05e8f072b373beafe27cc11d85f947c

                    SHA1

                    1d6daeb98893e8122b8b69287ebd9d43f3c6138e

                    SHA256

                    717c09427fa5754ba92f92961545534048d0a76528c2e95c4d5ec6cef47c612f

                    SHA512

                    b3e34162e5ee43bb01f289eebc45fd3ea3e07f30be40dcf6635606540f912fe5c84d301e9f78e97dfe3ffe53e72547e50f3bcd7d4ebe5ab8da451a1989c469a0

                  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mgyrpmam.xsr.ps1

                    Filesize

                    60B

                    MD5

                    d17fe0a3f47be24a6453e9ef58c94641

                    SHA1

                    6ab83620379fc69f80c0242105ddffd7d98d5d9d

                    SHA256

                    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                    SHA512

                    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                  • C:\Users\Admin\AppData\Local\Temp\tmpaddon-2

                    Filesize

                    13.8MB

                    MD5

                    0a8747a2ac9ac08ae9508f36c6d75692

                    SHA1

                    b287a96fd6cc12433adb42193dfe06111c38eaf0

                    SHA256

                    32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                    SHA512

                    59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                  • C:\Users\Admin\AppData\Roaming\1000026000\04a6a77fb7.exe

                    Filesize

                    1.6MB

                    MD5

                    50d7b4ddde987f738f29064556b31177

                    SHA1

                    8665b718cf44194c50d2eed8981b8e643debb98b

                    SHA256

                    0c38ce400b5a99c4d0350fc0e3a5c8f7bb366d73ba850ead3bd63dcc709941c8

                    SHA512

                    4cd03621fea07ca785792fae5fd4ac36281ab0718c1db0c4b6d0bd63a57ff1bf45ce5852b6c84782f2eb153fb7c5acde8096fe407dd5acf454bf0b9aad0a21f5

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x698r3gu.default-release\AlternateServices.bin

                    Filesize

                    6KB

                    MD5

                    96cc54f8f053a6a792346656729dd3ea

                    SHA1

                    df5d351413425b8898282be1394ae90c45c055b7

                    SHA256

                    ecdfb5370a42f2fed99879a703eb3fa25605d5444dde5d79ae223da7e69306b0

                    SHA512

                    75af16c0015eb51ca1122120f14f45a1feb2a9900585b339b6db9fdae7e1e91c6c48b64f3666570375ca25ee4d530122f5acfb4869e93d2242a3532b91913fb2

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x698r3gu.default-release\AlternateServices.bin

                    Filesize

                    10KB

                    MD5

                    c97d718fc56d6db01f573153bbd9f7df

                    SHA1

                    8201040be8f49df1820b3cd40fb4b5c99ded0bc8

                    SHA256

                    e5b66e72295d4e1fd0bffdb2a6a5e431fc9a5454a7ab2326523233bafe62430e

                    SHA512

                    1ac0f7752ec6060b0547303dc69eca2b0b07a050bda0994b5ff07b6013eec504763ccdf71fee291a4189acca8d61d88f72ea5e812d2698dcb21adc4b8656d1ad

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x698r3gu.default-release\AlternateServices.bin

                    Filesize

                    13KB

                    MD5

                    28c9269fa9ef055e916835e1ad9ba8f7

                    SHA1

                    5168ca2c334a081f5c24d17e12fe33278ff5c75d

                    SHA256

                    e15f6205157ce27e2c0bdc1a56bec4af856107ad64c1b2dbf1f1d17b891ce1d1

                    SHA512

                    95cf4a86d30d1b0e25b242d37d27ebe963821b8d47e29c0b913497640565c4cfa524de299265955d003cc39b6d01ca2b4c7bce7639fde786891717b34fedf101

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x698r3gu.default-release\AlternateServices.bin

                    Filesize

                    23KB

                    MD5

                    0d01b120ae461d75d6c87fdfbb9d9e04

                    SHA1

                    339c5aa4bbb5d6a8c7f9d45fd2fc7b2c75affc30

                    SHA256

                    c2992d4494da093fb37d5019ee4315c1a0abaae3176eb5de3e206cf076a159fb

                    SHA512

                    b54fbcfc60f4f3797659cd7c1d2e1ff00ff31f05f9a7f6c785e2057ccc47b36f2a77ca16617792687b7b821d134c9cc0d891c5a52726467cfde342aa247a2a88

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x698r3gu.default-release\datareporting\glean\db\data.safe.tmp

                    Filesize

                    6KB

                    MD5

                    87b9bed164226f029459fc2d94b8e32b

                    SHA1

                    1473d107d6646cc1c9d3ef708a0e7f5dc1da7e42

                    SHA256

                    7ae2bca0cfd9796a527fd2c01907f31b3b7070a965d3edaca2a40f5c9e54e6be

                    SHA512

                    886d534b8cae54f98ae6169a4ab9cf45b37ba7989a1ceabb67bdc7bfc2075d9a856b5627344406f8c1dde95e1d1c65f36184df5f7e2f85f9fed00ca66513662b

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x698r3gu.default-release\datareporting\glean\db\data.safe.tmp

                    Filesize

                    6KB

                    MD5

                    db4e8c09cd6092bb554addd0b6cb8071

                    SHA1

                    3fbcabacabfbdfcee82726a4ed21d34f431a7154

                    SHA256

                    7e15f191643a2170a8b599e1e3bd704de886dfb823a6ff1a8e83bcc36e25beb2

                    SHA512

                    aa01b31dd3b32241e4a85ab478de5ec8239ab510c1408a650dfc16b979a716033a87b0c7ebcc569ff27c2231d42110c34ece6619cf7f1337070f6d2db220c8ed

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x698r3gu.default-release\datareporting\glean\db\data.safe.tmp

                    Filesize

                    6KB

                    MD5

                    6e4cc98c6e54b65eda6dad99839890f7

                    SHA1

                    e0e6b6a6abe8936c13e2f2b2a4498889c3a34d18

                    SHA256

                    7837db1cd2d7007d7b327ad7e3b8bc3f08906e4d528a578bc80b648f9341a223

                    SHA512

                    a5911b0731fc572bc597f64e83c5216d357dd60c4f751f74e2d84447524aa2979987a830129cc82e10de3a77640c80ad977b701ebe54feef47d8c25ce4802f14

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x698r3gu.default-release\datareporting\glean\db\data.safe.tmp

                    Filesize

                    5KB

                    MD5

                    468656f9c538fc459ad4772b7f6ebcf6

                    SHA1

                    98d32d8226a3e90152e26bf997d5405546b1a4c8

                    SHA256

                    04ec27e4970a1f3a7272e76ffd1c0b52902e75044c88d50afd59b55746635dec

                    SHA512

                    2f2130c01573fa513886733ea889d248145550b036b8e87122c64897b3f06f0b259631c35f950887e68790ae8d321876c561d172e73796161820ef326227d8f0

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x698r3gu.default-release\datareporting\glean\db\data.safe.tmp

                    Filesize

                    5KB

                    MD5

                    2753315fe7dc4a8c896007ecc4cc3008

                    SHA1

                    55325e2aedd713034c28339d45c2008a9313e5c5

                    SHA256

                    68c2d91a834499d876bb3dd5c7f4fc5d3812831d80d41dc67ec53fe8cdc8d490

                    SHA512

                    375c6a14b5e12f7ac0cde2cb0a69a8600a98cc90097ac0adade3b2d3f6f5dbe33f62d94a50269a81ef42d9f136f108c7ece1f23b6491685ab8b1eb086e274ebb

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x698r3gu.default-release\datareporting\glean\db\data.safe.tmp

                    Filesize

                    32KB

                    MD5

                    5a976ec79badac0dec543f55fd235d11

                    SHA1

                    b211f7b81c3f8e36e4a5445ade25a0a3e35b327c

                    SHA256

                    373855c0c172a31610f85eb3987400fc3c056e0da50f10293d13e00d5c0382c6

                    SHA512

                    f906d5eb2fa64db077a8d779533cc847c71a1b27dc9a4788f60816144a45fe230fe415c56a5ba2f94b062bd088fcd218cc16faa0a7e37a6f89006cad7ea5bb0d

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x698r3gu.default-release\datareporting\glean\pending_pings\7ef2a909-3f40-43be-b26c-e00d2855d60e

                    Filesize

                    982B

                    MD5

                    e04e5c195ac0d81bfffb92b8b8dba903

                    SHA1

                    b3af8e495be231080fda64ecada816853e21afe7

                    SHA256

                    fd764fd7244b896a521c21ed7839c9c9583ecc477e302d86cdc543b216357689

                    SHA512

                    8775b92937af023d15ca2b7ecf2e937ff03f4d8dade8f212ccd50dc5dda1c2b9d6f138851eda9c67054682e01c4b8551032b4cbaae7e5db620e431d85865b7ac

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x698r3gu.default-release\datareporting\glean\pending_pings\f0587afd-c52e-4911-82ec-fbe463599001

                    Filesize

                    671B

                    MD5

                    a00541b3969ff72af3b89bbe2c738d7a

                    SHA1

                    71d88b4ceb6c7ec261606fee7a06bf7b86669a42

                    SHA256

                    2e033b55d32f29da70d5f2e756a028098c7d8d1c90e7843325e8c282f16c82ae

                    SHA512

                    616d0aed7b87f848e810884d4689b1216a7be36fb0f0d44ae99685009f4e9169f3d314d957f44b564fbd12b3598cd75891b426c6cc10ff9fe7ef4ceaf0461b83

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x698r3gu.default-release\datareporting\glean\pending_pings\f811f0e7-b390-46d2-81bc-aa12cba765e7

                    Filesize

                    25KB

                    MD5

                    5b1d4635f95fd6cd081a9b9f0a3593df

                    SHA1

                    8fa917a1856f9973ec8fa394a36269b08a91c01f

                    SHA256

                    02b7978421022c727cbf311f9c9af8bda4930e105af91c90abda16e527bf34e2

                    SHA512

                    8eb024796b5cd78c3287ac707191fe42865361f5ae791f950599a723b25a33c7fe93bbe041cf6ec61ab302fde6047da74d8fd6f2dab23e141ebd05372298a853

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x698r3gu.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

                    Filesize

                    1.1MB

                    MD5

                    842039753bf41fa5e11b3a1383061a87

                    SHA1

                    3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                    SHA256

                    d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                    SHA512

                    d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x698r3gu.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

                    Filesize

                    116B

                    MD5

                    2a461e9eb87fd1955cea740a3444ee7a

                    SHA1

                    b10755914c713f5a4677494dbe8a686ed458c3c5

                    SHA256

                    4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                    SHA512

                    34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x698r3gu.default-release\gmp-widevinecdm\4.10.2710.0\LICENSE.txt.tmp

                    Filesize

                    479B

                    MD5

                    49ddb419d96dceb9069018535fb2e2fc

                    SHA1

                    62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

                    SHA256

                    2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

                    SHA512

                    48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x698r3gu.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

                    Filesize

                    372B

                    MD5

                    bf957ad58b55f64219ab3f793e374316

                    SHA1

                    a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                    SHA256

                    bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                    SHA512

                    79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x698r3gu.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

                    Filesize

                    17.8MB

                    MD5

                    daf7ef3acccab478aaa7d6dc1c60f865

                    SHA1

                    f8246162b97ce4a945feced27b6ea114366ff2ad

                    SHA256

                    bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                    SHA512

                    5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x698r3gu.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll.lib.tmp

                    Filesize

                    1KB

                    MD5

                    688bed3676d2104e7f17ae1cd2c59404

                    SHA1

                    952b2cdf783ac72fcb98338723e9afd38d47ad8e

                    SHA256

                    33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

                    SHA512

                    7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x698r3gu.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll.sig.tmp

                    Filesize

                    1KB

                    MD5

                    36e5ee071a6f2f03c5d3889de80b0f0d

                    SHA1

                    cf6e8ddb87660ef1ef84ae36f97548a2351ac604

                    SHA256

                    6be809d16e0944386e45cf605eae0cd2cf46f111d1a6fe999fec813d2c378683

                    SHA512

                    99b61896659e558a79f0e9be95286ebf01d31d13b71df6db4923406e88b3ba72584ef2b62e073b2f5e06901af2c7d1b92d3d12187fe5b4b29c9dd2678444f34e

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x698r3gu.default-release\prefs-1.js

                    Filesize

                    12KB

                    MD5

                    e0cb57277877e6dfe723d3d44899c411

                    SHA1

                    bd7c74a403cc5a81601a08c59e38f03bca4ead85

                    SHA256

                    f97cf4a24e312c58e7208d1afaaa190ee94f1a1c377e8093f8df850f166070bb

                    SHA512

                    58317a12ad48567c4c60f00e0cd7824c304e1054c4d0c32311176bcedbba083fbc66b6bcd6d6a002ae60fdbca21434b69f3cd5a4b3ee0b41834687da17d4c6cd

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x698r3gu.default-release\prefs.js

                    Filesize

                    11KB

                    MD5

                    53e74ab7549f7d905ce0ae0d8e39b0da

                    SHA1

                    39f4f3f9f14abe38013d90e766d5d80d2e6828f6

                    SHA256

                    5de41a4433918eb2eff73ba11fd18eef330479ec4b33728b5b6609c655b18c11

                    SHA512

                    cdcce3cb48242f2d54c21d9a39595777f9c57adaeeee0e6fbf782e24ca226817002e62d603f2b942a9f0cfc5df7da782e6a3a4484703c07a03736e734f3999cf

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x698r3gu.default-release\prefs.js

                    Filesize

                    11KB

                    MD5

                    68a2b570df1c9507e9f2ca9d793e3987

                    SHA1

                    df9e9f2d3714d203f56d4ef73a35e476d55fac65

                    SHA256

                    6e397f06f624d77fb1b6ab2c40538e1d8254a640f7378c00cfea1c811030a209

                    SHA512

                    de0c17d6e1390403f8f99d225ae56df78f9983bc9e0180a986f67e431cc63bdb767734ec49dfb4563d872cd4fd7351e03681e3851177c621de192cebfd802450

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x698r3gu.default-release\sessionstore-backups\recovery.baklz4

                    Filesize

                    1KB

                    MD5

                    d0ba38eec8149ee9998a90cd4e6ae2b6

                    SHA1

                    e9921909ddb910557357ec6fb8967418cf1229fb

                    SHA256

                    63d8faf30669e7d385dbec1a37a71a55f65125628108e62b00570f230e43a615

                    SHA512

                    9182cd4a51dd308b59f6830d832de87d19a7664742ee705f53c4f9e735850def59636b44bc54fec8f856d8f2aae2f08d74ccec397a62a883c52255e226a855fe

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x698r3gu.default-release\sessionstore-backups\recovery.baklz4

                    Filesize

                    5KB

                    MD5

                    655d21f2597c42c2cc6c10a76ac400b8

                    SHA1

                    2c707fb77b4dc844b118ff052a0e466de0e272bd

                    SHA256

                    6ba3b2e659e0c808bcc0b333cbab796d5a93ae5650bbf8fd20a64c48e688ec1a

                    SHA512

                    f0e249e7f28fafa47d4ae97488f95660d3385825d4496a91c41efbafa0f9e45164c66774e5e011ba6359ec4be8b5d9829efac8d8d22fdecc79e4c73b06017761

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x698r3gu.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

                    Filesize

                    2.0MB

                    MD5

                    67d7f3b3d0b19ffe958529dbffdb91a4

                    SHA1

                    d3a9df4502e0e4fec07a133fa52dc9b0b78d5e64

                    SHA256

                    328e9672922d4b91a3e063a4c7c38cc2947afb879abe3aeaa89573fcf3b07cbb

                    SHA512

                    6c748f1da0668debac369f0efeb5613f873952a1ae143287e06d5d06985f62494ca0df1db4ba47a685cc7f09cf03605b1f521276775008a257b47e4ce00b3d4b

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x698r3gu.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

                    Filesize

                    2.3MB

                    MD5

                    f25a905dbb1aebe39ea64b8a40c64ce7

                    SHA1

                    d835e9440d11aa1f767849ee13ae90c88b1f56e1

                    SHA256

                    c461b29a7273aba5e0a0d9a45324430e2a6bc5730541f13bd7da211f83b75751

                    SHA512

                    ba04dbc152e32f5868ab33b3b9fc9704687d371fd77b819b2be229479964434ca497d21c4b86c8ede1a2b842bbd43c1678a3bf3e9a0753895d2a2c1dc093aa49

                  • memory/668-2319-0x0000000000360000-0x000000000081F000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/668-2318-0x0000000000360000-0x000000000081F000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/860-74-0x0000000000C90000-0x00000000012E7000-memory.dmp

                    Filesize

                    6.3MB

                  • memory/860-63-0x0000000000C90000-0x00000000012E7000-memory.dmp

                    Filesize

                    6.3MB

                  • memory/1476-676-0x0000000000360000-0x000000000081F000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/1476-20-0x0000000000360000-0x000000000081F000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/1476-2783-0x0000000000360000-0x000000000081F000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/1476-2619-0x0000000000360000-0x000000000081F000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/1476-1998-0x0000000000360000-0x000000000081F000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/1476-1441-0x0000000000360000-0x000000000081F000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/1476-39-0x0000000000360000-0x000000000081F000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/1476-30-0x0000000000360000-0x000000000081F000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/1476-29-0x0000000000360000-0x000000000081F000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/1476-27-0x0000000000360000-0x000000000081F000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/1476-1314-0x0000000000360000-0x000000000081F000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/1476-828-0x0000000000360000-0x000000000081F000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/1476-490-0x0000000000360000-0x000000000081F000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/1476-508-0x0000000000360000-0x000000000081F000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/1476-673-0x0000000000360000-0x000000000081F000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/1476-517-0x0000000000360000-0x000000000081F000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/1476-18-0x0000000000360000-0x000000000081F000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/1476-19-0x0000000000361000-0x000000000038F000-memory.dmp

                    Filesize

                    184KB

                  • memory/1476-625-0x0000000000360000-0x000000000081F000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/1476-21-0x0000000000360000-0x000000000081F000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/1496-65-0x0000000000080000-0x00000000006D7000-memory.dmp

                    Filesize

                    6.3MB

                  • memory/1496-47-0x0000000000080000-0x00000000006D7000-memory.dmp

                    Filesize

                    6.3MB

                  • memory/1644-654-0x0000000000360000-0x000000000081F000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/1644-667-0x0000000000360000-0x000000000081F000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/1692-25-0x0000000000360000-0x000000000081F000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/1692-23-0x0000000000360000-0x000000000081F000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/1692-28-0x0000000000361000-0x000000000038F000-memory.dmp

                    Filesize

                    184KB

                  • memory/1692-26-0x0000000000360000-0x000000000081F000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/1692-24-0x0000000000360000-0x000000000081F000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/3656-93-0x0000000006340000-0x000000000635A000-memory.dmp

                    Filesize

                    104KB

                  • memory/3656-95-0x0000000007710000-0x0000000007CB6000-memory.dmp

                    Filesize

                    5.6MB

                  • memory/3656-94-0x0000000006370000-0x0000000006392000-memory.dmp

                    Filesize

                    136KB

                  • memory/3656-78-0x0000000005810000-0x0000000005876000-memory.dmp

                    Filesize

                    408KB

                  • memory/3656-76-0x0000000004FF0000-0x000000000561A000-memory.dmp

                    Filesize

                    6.2MB

                  • memory/3656-89-0x0000000005DB0000-0x0000000005DCE000-memory.dmp

                    Filesize

                    120KB

                  • memory/3656-90-0x0000000005DF0000-0x0000000005E3C000-memory.dmp

                    Filesize

                    304KB

                  • memory/3656-79-0x0000000005880000-0x00000000058E6000-memory.dmp

                    Filesize

                    408KB

                  • memory/3656-77-0x0000000004F30000-0x0000000004F52000-memory.dmp

                    Filesize

                    136KB

                  • memory/3656-75-0x0000000004930000-0x0000000004966000-memory.dmp

                    Filesize

                    216KB

                  • memory/3656-88-0x00000000059D0000-0x0000000005D27000-memory.dmp

                    Filesize

                    3.3MB

                  • memory/3656-92-0x00000000070C0000-0x0000000007156000-memory.dmp

                    Filesize

                    600KB

                  • memory/4904-0-0x0000000000CB0000-0x000000000116F000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/4904-17-0x0000000000CB0000-0x000000000116F000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/4904-1-0x00000000775A6000-0x00000000775A8000-memory.dmp

                    Filesize

                    8KB

                  • memory/4904-2-0x0000000000CB1000-0x0000000000CDF000-memory.dmp

                    Filesize

                    184KB

                  • memory/4904-3-0x0000000000CB0000-0x000000000116F000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/4904-4-0x0000000000CB0000-0x000000000116F000-memory.dmp

                    Filesize

                    4.7MB