Analysis

  • max time kernel
    142s
  • max time network
    143s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    11-09-2024 22:41

General

  • Target

    81b5f40971d374ae5981d3c04542894150965a32869bc9bf6ef365a4ad9058a3.exe

  • Size

    1.8MB

  • MD5

    8a6d5c4cf637fca72f9848f455fe0a9b

  • SHA1

    471adfe441a7e1a9ec6448b8751ec0540a44567d

  • SHA256

    81b5f40971d374ae5981d3c04542894150965a32869bc9bf6ef365a4ad9058a3

  • SHA512

    465969676d8c89b7d01599fddba9f4975bad4ec21a5e040b6f4b0c0f532156c69736bea609195b824bb8b05f5cc3272060cf7517878ca0061bb7a53c12ab223c

  • SSDEEP

    49152:CtcC0ebiDQ74Yh6SS2AWADDGEbtmWszU0:hCr7sSS2CDDGEZnszL

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

c7817d

C2

http://31.41.244.10

Attributes
  • install_dir

    0e8d0864aa

  • install_file

    svoutse.exe

  • strings_key

    5481b88a6ef75bcf21333988a4e47048

  • url_paths

    /Dem7kTu/index.php

rc4.plain

Extracted

Family

stealc

Botnet

rave

C2

http://185.215.113.103

Attributes
  • url_path

    /e2b1563c6670f193.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Stealc

    Stealc is an infostealer written in C++.

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 12 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 5 IoCs
  • Identifies Wine through registry keys 2 TTPs 6 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 14 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 19 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 22 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\81b5f40971d374ae5981d3c04542894150965a32869bc9bf6ef365a4ad9058a3.exe
    "C:\Users\Admin\AppData\Local\Temp\81b5f40971d374ae5981d3c04542894150965a32869bc9bf6ef365a4ad9058a3.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:5020
    • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
      "C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3404
      • C:\Users\Admin\AppData\Roaming\1000026000\a6ea0911c7.exe
        "C:\Users\Admin\AppData\Roaming\1000026000\a6ea0911c7.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:1288
      • C:\Users\Admin\AppData\Local\Temp\1000030001\f932e8b3e5.exe
        "C:\Users\Admin\AppData\Local\Temp\1000030001\f932e8b3e5.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:2852
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\Admin\AppData\Local\Temp\1000039041\do.ps1"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:200
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /c start msedge https://www.youtube.com/account
          4⤵
          • System Location Discovery: System Language Discovery
          PID:3772
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /c start msedge https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1608
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3708
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
            5⤵
            • Checks processor information in registry
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:3496
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1928 -parentBuildID 20240401114208 -prefsHandle 1844 -prefMapHandle 1388 -prefsLen 23678 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {53fae060-91c8-4140-99b8-c5c21200f7da} 3496 "\\.\pipe\gecko-crash-server-pipe.3496" gpu
              6⤵
                PID:4708
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2348 -parentBuildID 20240401114208 -prefsHandle 2340 -prefMapHandle 2336 -prefsLen 24598 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3174231d-63df-4eae-9c9e-55d7d4e24ae0} 3496 "\\.\pipe\gecko-crash-server-pipe.3496" socket
                6⤵
                  PID:2092
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3392 -childID 1 -isForBrowser -prefsHandle 3088 -prefMapHandle 3376 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1340 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3ae12f0c-83a5-428d-8f93-97491cf70f0a} 3496 "\\.\pipe\gecko-crash-server-pipe.3496" tab
                  6⤵
                    PID:2020
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3544 -childID 2 -isForBrowser -prefsHandle 3528 -prefMapHandle 3536 -prefsLen 22693 -prefMapSize 244658 -jsInitHandle 1340 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cb5246e9-5569-4ed1-b730-3e6c8dc68fc2} 3496 "\\.\pipe\gecko-crash-server-pipe.3496" tab
                    6⤵
                      PID:2912
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4340 -childID 3 -isForBrowser -prefsHandle 4324 -prefMapHandle 4320 -prefsLen 29088 -prefMapSize 244658 -jsInitHandle 1340 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {083656fa-a752-4304-affd-7ba78c029d89} 3496 "\\.\pipe\gecko-crash-server-pipe.3496" tab
                      6⤵
                        PID:2492
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5152 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 5136 -prefMapHandle 5124 -prefsLen 29088 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ac4e2083-f407-455d-9f4d-d04df5420bbd} 3496 "\\.\pipe\gecko-crash-server-pipe.3496" utility
                        6⤵
                        • Checks processor information in registry
                        PID:5260
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5880 -childID 4 -isForBrowser -prefsHandle 5692 -prefMapHandle 5864 -prefsLen 26944 -prefMapSize 244658 -jsInitHandle 1340 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9f494c07-e705-4486-bb56-4fcfbe5e5731} 3496 "\\.\pipe\gecko-crash-server-pipe.3496" tab
                        6⤵
                          PID:4264
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6012 -childID 5 -isForBrowser -prefsHandle 6020 -prefMapHandle 6024 -prefsLen 26944 -prefMapSize 244658 -jsInitHandle 1340 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {15928e48-b075-4fe8-983c-e557cfb43d0d} 3496 "\\.\pipe\gecko-crash-server-pipe.3496" tab
                          6⤵
                            PID:3296
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6308 -childID 6 -isForBrowser -prefsHandle 6300 -prefMapHandle 6296 -prefsLen 26944 -prefMapSize 244658 -jsInitHandle 1340 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {52242fdd-7b2d-46eb-9f3b-e404e19e7e68} 3496 "\\.\pipe\gecko-crash-server-pipe.3496" tab
                            6⤵
                              PID:3044
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
                          4⤵
                          • Suspicious use of WriteProcessMemory
                          PID:3664
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
                            5⤵
                            • Checks processor information in registry
                            PID:3768
                  • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                    C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                    1⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Identifies Wine through registry keys
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • Suspicious behavior: EnumeratesProcesses
                    PID:5780
                  • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                    C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                    1⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Identifies Wine through registry keys
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • Suspicious behavior: EnumeratesProcesses
                    PID:3280

                  Network

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\activity-stream.discovery_stream.json

                    Filesize

                    23KB

                    MD5

                    f59a3af4e8d2836ddf018c3f48c35d89

                    SHA1

                    585407144eb76181ad1b81a0677566423ab2912b

                    SHA256

                    254635857672557c3f2ba365689474e03630300dd8ec9b8a36ee3084347737d6

                    SHA512

                    e1be8a876c3c6d09ba5edd362c4ba1456f81b767d005e8798826bc4b953ddfd038f9c82119a44823632f023c381fa7f3b82e7bc08e11561cfeef090bfd350755

                  • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\cache2\entries\58EFA56DB4BFFECB0EDA547894BC9A057159E22F

                    Filesize

                    13KB

                    MD5

                    2b2625ea7d96d091e823b39a9f2c34b6

                    SHA1

                    f3157407472909c232b5617f7a21c86e66e92842

                    SHA256

                    f575a0c75cef32cf1ca768feaa410ec44efddff1a408bbf50b7687bfaac3001e

                    SHA512

                    30d47c5bcc05c170b3ce715519202a4d50bd2aac53ec535cda929b334bc21eadbcb13df46b10dd3229fb71353a6ed01733fcc1bfead681d3719ec0184a81f32c

                  • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe

                    Filesize

                    1.8MB

                    MD5

                    8a6d5c4cf637fca72f9848f455fe0a9b

                    SHA1

                    471adfe441a7e1a9ec6448b8751ec0540a44567d

                    SHA256

                    81b5f40971d374ae5981d3c04542894150965a32869bc9bf6ef365a4ad9058a3

                    SHA512

                    465969676d8c89b7d01599fddba9f4975bad4ec21a5e040b6f4b0c0f532156c69736bea609195b824bb8b05f5cc3272060cf7517878ca0061bb7a53c12ab223c

                  • C:\Users\Admin\AppData\Local\Temp\1000039041\do.ps1

                    Filesize

                    2KB

                    MD5

                    e05e8f072b373beafe27cc11d85f947c

                    SHA1

                    1d6daeb98893e8122b8b69287ebd9d43f3c6138e

                    SHA256

                    717c09427fa5754ba92f92961545534048d0a76528c2e95c4d5ec6cef47c612f

                    SHA512

                    b3e34162e5ee43bb01f289eebc45fd3ea3e07f30be40dcf6635606540f912fe5c84d301e9f78e97dfe3ffe53e72547e50f3bcd7d4ebe5ab8da451a1989c469a0

                  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_q1qfofss.0sb.ps1

                    Filesize

                    60B

                    MD5

                    d17fe0a3f47be24a6453e9ef58c94641

                    SHA1

                    6ab83620379fc69f80c0242105ddffd7d98d5d9d

                    SHA256

                    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                    SHA512

                    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                  • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                    Filesize

                    479KB

                    MD5

                    09372174e83dbbf696ee732fd2e875bb

                    SHA1

                    ba360186ba650a769f9303f48b7200fb5eaccee1

                    SHA256

                    c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                    SHA512

                    b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                  • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                    Filesize

                    13.8MB

                    MD5

                    0a8747a2ac9ac08ae9508f36c6d75692

                    SHA1

                    b287a96fd6cc12433adb42193dfe06111c38eaf0

                    SHA256

                    32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                    SHA512

                    59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                  • C:\Users\Admin\AppData\Roaming\1000026000\a6ea0911c7.exe

                    Filesize

                    1.6MB

                    MD5

                    50d7b4ddde987f738f29064556b31177

                    SHA1

                    8665b718cf44194c50d2eed8981b8e643debb98b

                    SHA256

                    0c38ce400b5a99c4d0350fc0e3a5c8f7bb366d73ba850ead3bd63dcc709941c8

                    SHA512

                    4cd03621fea07ca785792fae5fd4ac36281ab0718c1db0c4b6d0bd63a57ff1bf45ce5852b6c84782f2eb153fb7c5acde8096fe407dd5acf454bf0b9aad0a21f5

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\AlternateServices.bin

                    Filesize

                    6KB

                    MD5

                    499a28e73aaed8acda53fa8adb19d2e9

                    SHA1

                    aa01b08cd7dd69a571e192bd4fb83007190ca480

                    SHA256

                    29c7891f8e9497f97e79cdbdcfbbc926c12349264854d3cae1f7600d34e82ee5

                    SHA512

                    c1b6c5e1d72efdd5b257eb97fd5a7a34f8d39524fa6540ce3d5bbd73992d44199533ef9348fad5db78a5e84613fa4d168153d682869b47375bd2b5625cc43ff8

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\AlternateServices.bin

                    Filesize

                    10KB

                    MD5

                    6b36552466a2b66034686ad72277165a

                    SHA1

                    f98e1006290b1dff1cfcc972fbf6d7ce0212b968

                    SHA256

                    81e6aabf536f62139b343892df8653e753b277d99be808446ccaba9aa3436371

                    SHA512

                    6c15c4b977696e496ae07a22dc8b00037cc5c66ccb55988ebd9534953f6b4ea7b626e7a81877f878b412e4611de9d6abcff3d2ce7baec22fc203b908861dc910

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\AlternateServices.bin

                    Filesize

                    16KB

                    MD5

                    27d4ccc9fa3af78b42336a4d6a87252e

                    SHA1

                    8f79769668121cfcbd0b6ffd181e12cf198384de

                    SHA256

                    ebf525f580a2624bb86c9a5ad1e8fe1775d45a6118f85ddafeb835173861179b

                    SHA512

                    e78997099576d49e7d6b1a5758edab70f0eabc0a834f8e2327185c494f58d709194b24396785c637cb9a40e9c79546a9c0f2c849b54e56f86e78b4780b84b80c

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\AlternateServices.bin

                    Filesize

                    20KB

                    MD5

                    d338f218341b5c6d43c2768a78933ab7

                    SHA1

                    5281a6988bcd57ebb27cf90de4cc731491b5d96d

                    SHA256

                    e417d932960507ada468f3bb5023f746aebed1d313c6babaa8e5490f2589b115

                    SHA512

                    28201c413c50811a508a866158db19d50a4f3ba18640f6db8b5e121aa8600b5b6a51f16feaef53b1d95e8477b65308b34b420fda6c610d86772853118c174f36

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\AlternateServices.bin

                    Filesize

                    22KB

                    MD5

                    39766baba52b33554f6e25446786a0b5

                    SHA1

                    d96fa10ee74856748f8bd1ba17357aa4e43a7e7c

                    SHA256

                    e8ddb9f535233c9cbec608531091fecdc108c5d6e92cffb30b6fb74f7a2ec266

                    SHA512

                    04e6684306f5fd2554c99edf7e15eac5709420257e9297bd5fdd6f0532843bab56392d785163ccff9b93cea7ee971719c1ec235611ff0cf92c995e944a1acd86

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\datareporting\glean\db\data.safe.tmp

                    Filesize

                    5KB

                    MD5

                    e19c4105f07580c170a5ef25b66eeb4b

                    SHA1

                    c90b505a81c2ebbf855275c407eff001c63a68b9

                    SHA256

                    793ba5c67da2d81deaff1d5d50a52c635b0abf674550c0a92a34563b7414b677

                    SHA512

                    788fed5c1d4a03b23f3316fa9b39454bd1f41b08edcc599d8539d428383e9c52b6247286b07c8fdf23f4fb938bbd83a7559143ec7849ecb51349620fd8b35ce7

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\datareporting\glean\db\data.safe.tmp

                    Filesize

                    5KB

                    MD5

                    18e052aca19b3e4f04bfed6c346c6666

                    SHA1

                    def87e19f5e6a6c3a8ba156c8bef896be5e39808

                    SHA256

                    d8c2c75aac7baf3240d2e43b42f8229a7badbbc4d375e6358357e7923f1cec40

                    SHA512

                    bc5083f23e5a4cbada9ef68d3480840d9a35e74530d8a0c3ea10bcceef59809482ef698fde8fd682e13a32742d07056b3a21d8b7552a0ae8d2a4e68401cfc362

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\datareporting\glean\db\data.safe.tmp

                    Filesize

                    5KB

                    MD5

                    529679006ebb725e24c57719f1d77c66

                    SHA1

                    ce38d6d65e43575514cd8ef62add1522a773a306

                    SHA256

                    ab586a68c1fb7a83f4313662a8fe55f26fd012ab0b309124591498cdcd428982

                    SHA512

                    34849d5e17b6f447f008c26119b59572ba6b833e7f6c78dae6f11024c34dbc86b2799d94e5633f695daf56d464d963ea409849e46e02875e87e02fe741a7f4d8

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\datareporting\glean\db\data.safe.tmp

                    Filesize

                    32KB

                    MD5

                    c8af1fdbe0ab290321a6d1e4eda09bb6

                    SHA1

                    d902706b825efa9c3d19d70994af90742b3f1e56

                    SHA256

                    a41120218fb354f852879964352024f73794e882cfbb57b7884f5e2d6dcd3413

                    SHA512

                    2164d0e7ea62a70efb931a2d638db05aef15655dadff9099a1c63e9e238ae1b056a81428e2a813c39ebd0094ca617b55d99752a275ce7d6bbdf7a937701bb493

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\datareporting\glean\pending_pings\476f739b-8ae8-4d7a-aae8-f4797253dae2

                    Filesize

                    671B

                    MD5

                    96aba329efd666569774575f73b66e72

                    SHA1

                    7d9b1b7185a697a108dcb6a09eeaf131115c28b4

                    SHA256

                    691d5e00bae9164520b8ec4d67ff4549f2699de076c295a967523d0ca3fdd0a8

                    SHA512

                    37a4469dda2ee4cc42d48381d246095b15a844bae0a5c1b4e8918314000cd533078af737f848c7e2df04181d8d3f6665e77f6d6985ff7b6d7b10627d9febf902

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\datareporting\glean\pending_pings\e89b09cb-bacd-4577-8ff0-c3bde591ece2

                    Filesize

                    982B

                    MD5

                    f90a94b201480688f25233de05835163

                    SHA1

                    a3ed8f659dda650398689ed5723faabbd1a48692

                    SHA256

                    e1179868384c3ea18c25e3691f14e705deba4dacf01b0ce4746108aca4c1ee25

                    SHA512

                    830557aa0d943e2a1fa6c3baa679250711a620569addcfd44f965bba3a704c7950204009fa7ce5b63ac2fdcb7ff35f07e3790ec80a572bc99b9176371dfa0381

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\datareporting\glean\pending_pings\f8a258ec-221c-4893-be9b-45e409675ad9

                    Filesize

                    27KB

                    MD5

                    35362ea242a037a52faf3544ec7f7c09

                    SHA1

                    a2a08a77e39bc106bcf9fe5a055f0a444ea490ee

                    SHA256

                    434bb306f3ca6469e7125cf20b1b9026583f575639939c505ec41892e0203514

                    SHA512

                    1458deb668d7e51127d5f97defda450482d657337401b86197b166ae316654211d350622af2f3b49004ff59dcc0dfd1a920334b9a7ef7e272eef6a57ddf5dcc5

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

                    Filesize

                    1.1MB

                    MD5

                    842039753bf41fa5e11b3a1383061a87

                    SHA1

                    3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                    SHA256

                    d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                    SHA512

                    d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

                    Filesize

                    116B

                    MD5

                    2a461e9eb87fd1955cea740a3444ee7a

                    SHA1

                    b10755914c713f5a4677494dbe8a686ed458c3c5

                    SHA256

                    4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                    SHA512

                    34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

                    Filesize

                    372B

                    MD5

                    bf957ad58b55f64219ab3f793e374316

                    SHA1

                    a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                    SHA256

                    bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                    SHA512

                    79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

                    Filesize

                    17.8MB

                    MD5

                    daf7ef3acccab478aaa7d6dc1c60f865

                    SHA1

                    f8246162b97ce4a945feced27b6ea114366ff2ad

                    SHA256

                    bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                    SHA512

                    5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\prefs-1.js

                    Filesize

                    12KB

                    MD5

                    340320e4202cce2c21dedae94737b0c7

                    SHA1

                    6d175e9465e4b00e63786ae31cb7cab98bc72cb7

                    SHA256

                    6e94c76313437983592894eb6321433efeac996a97e59c6c6091c547ec3aeca7

                    SHA512

                    974d9139bfb460158a27ae257d7b38d6bcf579d3dc805c0766443f3ee8c8119f1bdf37a97ebd75c84076295e762c3682d5a4e0da76b306bcd6ac474787c6d1cf

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\prefs-1.js

                    Filesize

                    13KB

                    MD5

                    fbdcc7105fdccbe5ecdaa117d7fab641

                    SHA1

                    aaaccc84e84694ef4b1ebb25093868eeba2b7df0

                    SHA256

                    1393ede02a7bc4f81eab00cf85b2dd9be32729812181a1c5de67203c3ddfae45

                    SHA512

                    97e9978b301c06e5b56678c813cdc89d558a3704c763f93b6d5f810613e93e99933b6d5fb1f8a29972368187d4b21df7dfdf6c39691646ae9ece4696ba972f78

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\prefs-1.js

                    Filesize

                    10KB

                    MD5

                    48e7d5b0ea28add1c9ccd1bc3a7b2c50

                    SHA1

                    5a109b4d82881854fe32d7a819cfb5930cc44a5f

                    SHA256

                    19c8bace1db2fdf8d4c3fa659b16d2a34b54983bb8f602dd70109a99152ed314

                    SHA512

                    3cec8ece4c53dd44f2af2077003f9e275de6a8f23c67fef36a1f9a16d92d662ed7bd0cbf7c9d2ede8bca9ca7358daaf1aed5acc1fb56636c2fe59347cb204622

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\prefs.js

                    Filesize

                    10KB

                    MD5

                    3b35bd8245fb0565f1f380943bf658f9

                    SHA1

                    69a968264c95e90ab6953537e462b296c50b2919

                    SHA256

                    a3d2815bbfe06870f8edb95d5ccd77b5b9a5287fddc4ceae143221c94b35fa5d

                    SHA512

                    d4e999091b937e87e595fb4ea3cc5983bacb82be0ba8ebb5bd3872dc36899dbc3029df99aaafbbd92993b468e22c4f8184a806a756baa9e829bd166b9a86a11b

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\sessionstore-backups\recovery.baklz4

                    Filesize

                    1KB

                    MD5

                    4cccf83d40dd562a7ba2be098aa70956

                    SHA1

                    318fe51c826c1a5f032711695b16266ea97e3fb4

                    SHA256

                    b7dd905ff6ef786478da2c6a4e5bb6afbff05b853b79e5cafefc528b70d47299

                    SHA512

                    becb3992d8f72c9681e3453bd63ea8b7401fa6a6975ac4078946a5b571454db4ead9179abff99402e4cb19018ff37c3a93dfc34ae51f7e39042cbaf079de4010

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\sessionstore-backups\recovery.baklz4

                    Filesize

                    5KB

                    MD5

                    85e39915ff57a16c6c36c8ea0305d2fa

                    SHA1

                    90f3b85cf9e9ab2fcf61ee473c6073e5bf58d56d

                    SHA256

                    e98bbb05e86a6e0d7bb5a7f5080b721c9f8959945a0a9685a8e1751042bf9f24

                    SHA512

                    9990beff72e6acf639a68ed216ec881fd23061b236ab49a3b4dfd2efb53ca07c484a45fb9d01965c4e39f9750955ea2dedbd479f17e61c5d6d513712c8dafda6

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

                    Filesize

                    376KB

                    MD5

                    f62d5f10fa6c604324723654cc13ef39

                    SHA1

                    5cd1e9f0364099ee32d783a731a47912c9716577

                    SHA256

                    643c64596269c9d4d3ab1eca336abe1b5c974ae563942892b74ae7563c0b4815

                    SHA512

                    1900ec3eff09a4ef085e56df1703734446240318fe30cdefe4c18edcd40ab4598b9943cb24915612c92f3c6fcd3a1d90e4334ec5aec4ac0a8242be254e6b29f2

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

                    Filesize

                    1.2MB

                    MD5

                    640ba43093fa284840d32863af9cb1c1

                    SHA1

                    509cb1c65fecdf2363341d57c3af43876c68a29c

                    SHA256

                    680b7e33f068b504b3b7c893bb3b642ec92f4b89057668f20f1de09bf8f1edea

                    SHA512

                    6766f3f15b694c787162b7f13d67a38e64f93ac40ce9cf4583ca27681377459bbc5166fa75b7e63850c6d3ff648b29793500c3e51b3ac4546454971abc6f17b0

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

                    Filesize

                    1.4MB

                    MD5

                    19d02954905ad23772eb2d6d33182ae8

                    SHA1

                    ec0478365f23cb7e65d9115576f3e120d189bd8a

                    SHA256

                    7d7d2f60c7e2eee465b8a8e0cbed4baa559744d5b2218200477434b752fb05c4

                    SHA512

                    1b72936c69e9b5956d1817ad1709e234f1247a80beb01f03ad11a3bdf61849db973d1cc26dfede4adacf4c28dfb8f9d51e6222cf42ccf8103d4ab019ac11181b

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

                    Filesize

                    1.4MB

                    MD5

                    625337a61b9ab0dbd91ec82ecfb996ae

                    SHA1

                    b90fe4fa0880890f0c70408f5afa5efe80460d4b

                    SHA256

                    1fcde980e8e7207a4ed7e09e987337dc3c160d0c1621f449c59c8a39295f177e

                    SHA512

                    987c73b9d4f9a03d7118a1bc9c48c10260a82c8eac3ca58fe31d3d30aeff49fc1e3f8f694805947b88826e84cd1b2d8778f3e3e47a0ea87fdacdef883987011d

                  • memory/200-85-0x0000000006B80000-0x0000000006C16000-memory.dmp

                    Filesize

                    600KB

                  • memory/200-88-0x0000000007440000-0x00000000079E6000-memory.dmp

                    Filesize

                    5.6MB

                  • memory/200-70-0x0000000004E00000-0x0000000004E22000-memory.dmp

                    Filesize

                    136KB

                  • memory/200-69-0x0000000005050000-0x000000000567A000-memory.dmp

                    Filesize

                    6.2MB

                  • memory/200-68-0x0000000002370000-0x00000000023A6000-memory.dmp

                    Filesize

                    216KB

                  • memory/200-87-0x0000000006150000-0x0000000006172000-memory.dmp

                    Filesize

                    136KB

                  • memory/200-86-0x00000000060F0000-0x000000000610A000-memory.dmp

                    Filesize

                    104KB

                  • memory/200-83-0x0000000005C20000-0x0000000005C6C000-memory.dmp

                    Filesize

                    304KB

                  • memory/200-82-0x0000000005B90000-0x0000000005BAE000-memory.dmp

                    Filesize

                    120KB

                  • memory/200-81-0x00000000056F0000-0x0000000005A47000-memory.dmp

                    Filesize

                    3.3MB

                  • memory/200-72-0x0000000005680000-0x00000000056E6000-memory.dmp

                    Filesize

                    408KB

                  • memory/200-71-0x0000000004FA0000-0x0000000005006000-memory.dmp

                    Filesize

                    408KB

                  • memory/1288-50-0x0000000005A10000-0x0000000005A11000-memory.dmp

                    Filesize

                    4KB

                  • memory/1288-56-0x0000000000FF1000-0x0000000001005000-memory.dmp

                    Filesize

                    80KB

                  • memory/1288-37-0x0000000000FF0000-0x0000000001647000-memory.dmp

                    Filesize

                    6.3MB

                  • memory/1288-296-0x0000000000FF0000-0x0000000001647000-memory.dmp

                    Filesize

                    6.3MB

                  • memory/2852-60-0x0000000000300000-0x0000000000957000-memory.dmp

                    Filesize

                    6.3MB

                  • memory/2852-473-0x0000000000300000-0x0000000000957000-memory.dmp

                    Filesize

                    6.3MB

                  • memory/3280-2751-0x0000000000030000-0x00000000004DC000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/3280-2752-0x0000000000030000-0x00000000004DC000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/3404-525-0x0000000000030000-0x00000000004DC000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/3404-47-0x0000000000030000-0x00000000004DC000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/3404-21-0x0000000000030000-0x00000000004DC000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/3404-20-0x0000000000030000-0x00000000004DC000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/3404-19-0x0000000000031000-0x000000000005F000-memory.dmp

                    Filesize

                    184KB

                  • memory/3404-2762-0x0000000000030000-0x00000000004DC000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/3404-590-0x0000000000030000-0x00000000004DC000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/3404-16-0x0000000000030000-0x00000000004DC000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/3404-22-0x0000000000030000-0x00000000004DC000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/3404-2754-0x0000000000030000-0x00000000004DC000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/3404-495-0x0000000000030000-0x00000000004DC000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/3404-2745-0x0000000000030000-0x00000000004DC000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/3404-58-0x0000000000030000-0x00000000004DC000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/3404-59-0x0000000000030000-0x00000000004DC000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/3404-2753-0x0000000000030000-0x00000000004DC000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/3404-91-0x0000000000030000-0x00000000004DC000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/3404-857-0x0000000000030000-0x00000000004DC000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/3404-54-0x0000000000030000-0x00000000004DC000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/3404-2749-0x0000000000030000-0x00000000004DC000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/3404-2748-0x0000000000030000-0x00000000004DC000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/3404-1474-0x0000000000030000-0x00000000004DC000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/3404-2205-0x0000000000030000-0x00000000004DC000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/3404-2707-0x0000000000030000-0x00000000004DC000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/5020-4-0x0000000000760000-0x0000000000C0C000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/5020-1-0x00000000773D6000-0x00000000773D8000-memory.dmp

                    Filesize

                    8KB

                  • memory/5020-2-0x0000000000761000-0x000000000078F000-memory.dmp

                    Filesize

                    184KB

                  • memory/5020-3-0x0000000000760000-0x0000000000C0C000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/5020-0-0x0000000000760000-0x0000000000C0C000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/5020-18-0x0000000000760000-0x0000000000C0C000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/5780-825-0x0000000000030000-0x00000000004DC000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/5780-810-0x0000000000030000-0x00000000004DC000-memory.dmp

                    Filesize

                    4.7MB