Analysis

  • max time kernel
    147s
  • max time network
    151s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    11-09-2024 02:34

General

  • Target

    263c5c85871db56cb3438b6b38aff70fb2447ab02c7bdf2598a40e778ab1191f.exe

  • Size

    1.8MB

  • MD5

    656dad33ed55f336051883f756e7d041

  • SHA1

    83ff37e0f8badb060900511002fb14e8c4deade8

  • SHA256

    263c5c85871db56cb3438b6b38aff70fb2447ab02c7bdf2598a40e778ab1191f

  • SHA512

    ba950f704229070f0515b163630d59fbb9b2ba1b8b775259d84d3828713ab879880a1ee9baa4796898a29a941943868ec8ae111ba38c006fdefb9e12af81316c

  • SSDEEP

    49152:ceMiOEiw+JG001x6xaEQtgCnNSjQ7t1xphS80IHY4LVx:cA9+J/awxaDAjQ9pw80IHY4LV

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

c7817d

C2

http://31.41.244.10

Attributes
  • install_dir

    0e8d0864aa

  • install_file

    svoutse.exe

  • strings_key

    5481b88a6ef75bcf21333988a4e47048

  • url_paths

    /Dem7kTu/index.php

rc4.plain

Extracted

Family

stealc

Botnet

rave

C2

http://185.215.113.103

Attributes
  • url_path

    /e2b1563c6670f193.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Stealc

    Stealc is an infostealer written in C++.

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 12 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 5 IoCs
  • Identifies Wine through registry keys 2 TTPs 6 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 14 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 19 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 21 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\263c5c85871db56cb3438b6b38aff70fb2447ab02c7bdf2598a40e778ab1191f.exe
    "C:\Users\Admin\AppData\Local\Temp\263c5c85871db56cb3438b6b38aff70fb2447ab02c7bdf2598a40e778ab1191f.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:420
    • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
      "C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3848
      • C:\Users\Admin\AppData\Roaming\1000026000\d109cc0999.exe
        "C:\Users\Admin\AppData\Roaming\1000026000\d109cc0999.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:3052
      • C:\Users\Admin\AppData\Local\Temp\1000030001\23d6aedebc.exe
        "C:\Users\Admin\AppData\Local\Temp\1000030001\23d6aedebc.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:248
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\Admin\AppData\Local\Temp\1000039041\do.ps1"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4792
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /c start msedge https://www.youtube.com/account
          4⤵
          • System Location Discovery: System Language Discovery
          PID:828
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /c start msedge https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
          4⤵
          • System Location Discovery: System Language Discovery
          PID:784
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:492
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
            5⤵
            • Checks processor information in registry
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:1484
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1936 -parentBuildID 20240401114208 -prefsHandle 1852 -prefMapHandle 1844 -prefsLen 23678 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {93f7725b-a337-48b8-9198-940eac4cef66} 1484 "\\.\pipe\gecko-crash-server-pipe.1484" gpu
              6⤵
                PID:4808
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2400 -parentBuildID 20240401114208 -prefsHandle 2376 -prefMapHandle 2364 -prefsLen 24598 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b953d106-5a56-4038-b709-c92b080add90} 1484 "\\.\pipe\gecko-crash-server-pipe.1484" socket
                6⤵
                  PID:2756
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3360 -childID 1 -isForBrowser -prefsHandle 3448 -prefMapHandle 3368 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b4b9d563-b535-4c37-acfd-f9a7a0dc759f} 1484 "\\.\pipe\gecko-crash-server-pipe.1484" tab
                  6⤵
                    PID:4092
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3528 -childID 2 -isForBrowser -prefsHandle 3516 -prefMapHandle 3520 -prefsLen 22693 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {013a029e-f83d-4413-b5a5-413f0cfb8f2a} 1484 "\\.\pipe\gecko-crash-server-pipe.1484" tab
                    6⤵
                      PID:3312
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3744 -childID 3 -isForBrowser -prefsHandle 4404 -prefMapHandle 4400 -prefsLen 29088 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c9364c73-a1ed-4ea1-ab0a-1a14194b9e42} 1484 "\\.\pipe\gecko-crash-server-pipe.1484" tab
                      6⤵
                        PID:4788
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5088 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 5052 -prefMapHandle 5044 -prefsLen 29088 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {adf6b4ed-c597-472a-82e1-c3157acf613b} 1484 "\\.\pipe\gecko-crash-server-pipe.1484" utility
                        6⤵
                        • Checks processor information in registry
                        PID:3384
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5928 -childID 4 -isForBrowser -prefsHandle 5844 -prefMapHandle 5888 -prefsLen 27182 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {10c2688a-b9be-4eb4-a4a0-e9d34e6fb8d2} 1484 "\\.\pipe\gecko-crash-server-pipe.1484" tab
                        6⤵
                          PID:2084
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6060 -childID 5 -isForBrowser -prefsHandle 6068 -prefMapHandle 6076 -prefsLen 27182 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4e15bfab-714c-44c1-baa1-43cfcc92479f} 1484 "\\.\pipe\gecko-crash-server-pipe.1484" tab
                          6⤵
                            PID:3520
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6248 -childID 6 -isForBrowser -prefsHandle 6256 -prefMapHandle 6260 -prefsLen 27182 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {19716d84-1369-4106-8f40-319b3a419e25} 1484 "\\.\pipe\gecko-crash-server-pipe.1484" tab
                            6⤵
                              PID:1680
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
                          4⤵
                          • Suspicious use of WriteProcessMemory
                          PID:1208
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
                            5⤵
                            • Checks processor information in registry
                            PID:4580
                  • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                    C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                    1⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Identifies Wine through registry keys
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • Suspicious behavior: EnumeratesProcesses
                    PID:1776
                  • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                    C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                    1⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Identifies Wine through registry keys
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • Suspicious behavior: EnumeratesProcesses
                    PID:572

                  Network

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\r5m741b5.default-release\activity-stream.discovery_stream.json

                    Filesize

                    26KB

                    MD5

                    0f443e6872312afc7ec08e6b50a60a97

                    SHA1

                    160b8dad861717bef829efc7b26d6c5d41274b9d

                    SHA256

                    4a3cd96b11b42adb69a764d5baac309072096e46f92072b5ff0747737b8bdc1e

                    SHA512

                    39aef4324c2d34ae224fd1a25a01c706d412a9b68e25793984377faf0ad656d68298f4224b82988b23602d7f14341486a5fe5057880bd876ed6b94f9cd6a78d2

                  • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\r5m741b5.default-release\cache2\entries\58EFA56DB4BFFECB0EDA547894BC9A057159E22F

                    Filesize

                    13KB

                    MD5

                    2233c3d379c94190e839304f0aeab9cc

                    SHA1

                    b6ff2c9e08888478e92035dd6cd124eec50872a4

                    SHA256

                    890f05040254fe7b3f91c577016433981361086f37be112677a49a004b6cfdf6

                    SHA512

                    3c0b7eb5aed1ac1c31e64410b32182359ea3deb2ae7b3c049457816002932be362f8fbaedc8081a113a2e7b5506853a5263bace22ec87f5e70aaf6207262c486

                  • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe

                    Filesize

                    1.8MB

                    MD5

                    656dad33ed55f336051883f756e7d041

                    SHA1

                    83ff37e0f8badb060900511002fb14e8c4deade8

                    SHA256

                    263c5c85871db56cb3438b6b38aff70fb2447ab02c7bdf2598a40e778ab1191f

                    SHA512

                    ba950f704229070f0515b163630d59fbb9b2ba1b8b775259d84d3828713ab879880a1ee9baa4796898a29a941943868ec8ae111ba38c006fdefb9e12af81316c

                  • C:\Users\Admin\AppData\Local\Temp\1000039041\do.ps1

                    Filesize

                    2KB

                    MD5

                    e05e8f072b373beafe27cc11d85f947c

                    SHA1

                    1d6daeb98893e8122b8b69287ebd9d43f3c6138e

                    SHA256

                    717c09427fa5754ba92f92961545534048d0a76528c2e95c4d5ec6cef47c612f

                    SHA512

                    b3e34162e5ee43bb01f289eebc45fd3ea3e07f30be40dcf6635606540f912fe5c84d301e9f78e97dfe3ffe53e72547e50f3bcd7d4ebe5ab8da451a1989c469a0

                  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hzhxnols.cpl.ps1

                    Filesize

                    60B

                    MD5

                    d17fe0a3f47be24a6453e9ef58c94641

                    SHA1

                    6ab83620379fc69f80c0242105ddffd7d98d5d9d

                    SHA256

                    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                    SHA512

                    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                  • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                    Filesize

                    479KB

                    MD5

                    09372174e83dbbf696ee732fd2e875bb

                    SHA1

                    ba360186ba650a769f9303f48b7200fb5eaccee1

                    SHA256

                    c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                    SHA512

                    b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                  • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                    Filesize

                    13.8MB

                    MD5

                    0a8747a2ac9ac08ae9508f36c6d75692

                    SHA1

                    b287a96fd6cc12433adb42193dfe06111c38eaf0

                    SHA256

                    32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                    SHA512

                    59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                  • C:\Users\Admin\AppData\Roaming\1000026000\d109cc0999.exe

                    Filesize

                    1.7MB

                    MD5

                    6ec533d4b68b9b65f45160ba3bfc9422

                    SHA1

                    488be541bd2b2e42770c9e2bae875f6f97f51cfb

                    SHA256

                    dbe5d0f7237469a486de479008f1abca3d06a8a2b0ad64f26453d00e63000258

                    SHA512

                    99ceac7775eb344221dbba859cc37834e9b553b9b6eb27fa6dc807b5b4fac8016b2802a66cfba6a4f092feb05443c6642cb3fcb400befacdaad3747c6ce46cfc

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\AlternateServices.bin

                    Filesize

                    6KB

                    MD5

                    3990ece8196e7f93e84fcde7e6b4debd

                    SHA1

                    5e28c9c6f7c75601b6a9bcf45142c48ad1019827

                    SHA256

                    27d55963bd21d024a21c14a9eec34b18c9b80f6c60433d3e73f4d88e459e7403

                    SHA512

                    e0bfce15c10e937d6e6dcb1eb51c504450565fe9fdc046c534d9839d5d49310f75fe51f805a097ae4e67a3c660c1b75732dd133d1035994a62dcd692a7f1721d

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\AlternateServices.bin

                    Filesize

                    11KB

                    MD5

                    0b51b2a7dc7b471a59dd3b90e9b4a8e6

                    SHA1

                    f8a47a0d7f28ebd8c024916bc3ab49e024da97f7

                    SHA256

                    f212c199df12689438c2a7184c7cba224c425f848ab37fd5d97a268362828221

                    SHA512

                    72bc94f61131b062fd3df5de14884396793c997aa943405e763075114efc97878b07efee2943597b1b95e7676def249038aa8b7fd66b74bbf56fdd27c6e431d7

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\AlternateServices.bin

                    Filesize

                    18KB

                    MD5

                    2ca14d6e6b2aaac1e42513d213ba0f42

                    SHA1

                    bdde748fba33b0abfae8bd7b96e38033fd127c0e

                    SHA256

                    d2e270ef453b8055c25705950069a12435933e9315106854cbc12271b700d339

                    SHA512

                    1f11add4dea87a75e3652be29573cac50f607443f3e5feca96d5294846b08493a6b33af43eb6e0bb2fc6aced81ecffd3d4dc380c9346657978d46f74caac3c0d

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\AlternateServices.bin

                    Filesize

                    22KB

                    MD5

                    303150e2f552422067ce5ab012289145

                    SHA1

                    db1777e2cad9da419196bc27ca22ef97d42045d5

                    SHA256

                    4e860ecdc518a8da4fdb760832d2f2437b337d438ea7cfb26c103d4b17dd0fd3

                    SHA512

                    073bfd99abecfd9da2349116b2ecde7f1b009f985b9eb68d09c9dca95f61c926e353d20dc86ecb9a591ec22b2bc692defd4879dee45cf85944f35bdb1946889e

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\datareporting\glean\db\data.safe.tmp

                    Filesize

                    22KB

                    MD5

                    e708c210acd73491e9222f3334636ad0

                    SHA1

                    1db0c0068cef07a061a491f91a0d1f3e54f23632

                    SHA256

                    a61279762b0337a259f129949a591440ba271277df4e9502d787bb6c4b3f0c57

                    SHA512

                    d91150e0ace835880d5880b35a86dd1c8a97639f98a7de9ac463952a404b3cb3052b025ff6a79d8f36d55f42592c839131b9cf04b3526f1205eda0585bc771fe

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\datareporting\glean\db\data.safe.tmp

                    Filesize

                    26KB

                    MD5

                    6fd1490a0837052759b539544e4ad806

                    SHA1

                    7b633808eb19cc1ca51aa18495c6b6be15f2a9f2

                    SHA256

                    de9985e380b8bb45f2e2dff98be9899b2e0b634de525f3e7dd9784e964d57c88

                    SHA512

                    3c2fee23ef143faa482a540ef99b902278a4e7497a35a9ce457ba5d0c44532b90e9c3dfad78389793a97da68f32a615028c0bd317d879f1bbec07152e1f19413

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\datareporting\glean\db\data.safe.tmp

                    Filesize

                    23KB

                    MD5

                    2f57377371fd7bbf68ae4e2eb6399be0

                    SHA1

                    6c97bae6ec323c046a8288e012224f9e2adf9caa

                    SHA256

                    43dae3e59b42b256a843e1df6a58405919d56f70813419cf515a9544ad526711

                    SHA512

                    5b6d8b8f2a553acce0b563f6408481cd2b1f81597635f6cb55ce5e38ae641dbb3368592775b9d50fa44a8f2f3388b53c9323bab93ed81cec018f708ccba3482a

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\datareporting\glean\pending_pings\5c82dc28-f771-4af1-b75a-fe872656b42a

                    Filesize

                    982B

                    MD5

                    8867cbd4f627f1ed9474cb58da3098a9

                    SHA1

                    57daa9e7e61432a45d98737c9f5bd2231628ad31

                    SHA256

                    8d0f4bc4d2b542ce37a9d50b73e9c314fb198c9e3f987391a619d8ca1bc26c7d

                    SHA512

                    bd15caefc7c5ee522231358c2b746a7cb01ff1798b3e589b7e12e352dc80993e12415e7bc374488431ec64221a1474602499ec603120cb3e11b2a4331baf398c

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\datareporting\glean\pending_pings\a9004521-e400-4416-8c6d-8b02f7f9bf77

                    Filesize

                    659B

                    MD5

                    212e317c9917558501bb3794de32df82

                    SHA1

                    b08dcba6f9ee26e3cc2ea9a41a75c1441355c7c1

                    SHA256

                    f57901873eef49dfdf99e959d738beb146e9bd7b276feb5599503dc6bf92049d

                    SHA512

                    c7457f4607b3ff5ffbe2e6630787d87f24490df2c00baa6851429146092582f17448c041789f02dff80068af996a858aeb4c94b2839a29b19935ffe9d7cd506c

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

                    Filesize

                    1.1MB

                    MD5

                    842039753bf41fa5e11b3a1383061a87

                    SHA1

                    3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                    SHA256

                    d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                    SHA512

                    d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

                    Filesize

                    116B

                    MD5

                    2a461e9eb87fd1955cea740a3444ee7a

                    SHA1

                    b10755914c713f5a4677494dbe8a686ed458c3c5

                    SHA256

                    4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                    SHA512

                    34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

                    Filesize

                    372B

                    MD5

                    bf957ad58b55f64219ab3f793e374316

                    SHA1

                    a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                    SHA256

                    bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                    SHA512

                    79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

                    Filesize

                    17.8MB

                    MD5

                    daf7ef3acccab478aaa7d6dc1c60f865

                    SHA1

                    f8246162b97ce4a945feced27b6ea114366ff2ad

                    SHA256

                    bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                    SHA512

                    5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\prefs-1.js

                    Filesize

                    15KB

                    MD5

                    20e1c10296ba39cbc199527686030c7a

                    SHA1

                    406e16a32b4cc310b9b6ecaa64add9883b11f728

                    SHA256

                    c8d7dbb410d9d9d19739d6d83dc8776d37a4c6566d89f5a2c6466cffe6e5397b

                    SHA512

                    a1730f880df31fe622583a19a7bf97d7ed60bb201586df1e48b8a42e4af1a211ce982e1541c3cdd28fa3e60396748a1fe7e234181b9cbfdd989910ddbbb3bc74

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\prefs-1.js

                    Filesize

                    11KB

                    MD5

                    1beeb004bcf2e887dc5611f7307bb564

                    SHA1

                    13397b6220fc57d3b6ef0fcfb24ebb64d42017ec

                    SHA256

                    31683d83b05cb90d38b27944fbc598799a5d40b5947412057460119aae3df25b

                    SHA512

                    1f4d947a00d4f251d806fa5150c6b1bc14f8d4eb24265b7775672633c5df088986fdd85d237009e026569d3b64d3279ac4926820963cddb6ca60585bafe8898e

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\prefs-1.js

                    Filesize

                    15KB

                    MD5

                    044b65ec6bfc2908781eabc4a68aeb62

                    SHA1

                    320f3e57aebe71cdb371b311cb624e9b9cd6dcbb

                    SHA256

                    49e85c41808470f867d08afbe0ebe6977f8a7fdb9fd58cc27c718520f01980b2

                    SHA512

                    c821c20d9f1e771d1159897a45d2b31f01d28f7c41e35d2e1ba36002b9c2867740167816c6981d00221f78fa6adaf514732e98f8af27f1b4ff636d1cf19ef4c9

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\prefs.js

                    Filesize

                    10KB

                    MD5

                    e8febfb2a365363aa10401cf7c481e47

                    SHA1

                    950b48fe9ca666a2525da620377c1022d537ef13

                    SHA256

                    58db33686914031dc943dbcdbb9aaadf0d519f648052805845b1a59961ab8717

                    SHA512

                    f0bf72dc046a6dc49a692bca80596b20970734af33c3098b3b801d2dc14e5d12162e2e800906e69b5ee2222f9205c744c34993357a48eca4740216ad44bbac50

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\prefs.js

                    Filesize

                    11KB

                    MD5

                    d8b052549f6889d35bb34dd905a29f8d

                    SHA1

                    25a5c1bf4faeb72a764a4edef78057490abe95c3

                    SHA256

                    55cb84151fbe50d59bc46c083cd6db488533f020b056216692ed1c5536f821c1

                    SHA512

                    ff9c2c32ee6bc8014dacbc1bc19688b6833332bf1be65ee046493b878ca3c981a70170836d2c0ba1e18ea5aa0e287573f2eecd8c9ef0f2f2ba04b68abb75fbca

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\sessionstore-backups\recovery.baklz4

                    Filesize

                    1KB

                    MD5

                    154f7a181c78d4f68f168579f9f19977

                    SHA1

                    ee42e234796650aeb3d1ad880035762c3958ddb8

                    SHA256

                    bfd5a870ce7ed4b82f84f9256f579e38a459d1aa98be9d9e21b0cc3b10b77155

                    SHA512

                    e3e2ffc0553ce5ba3bcc983391200f7942e56a5faf1d40f6967749582b85afb852924d4ad48c00cd802fbb6030a4c5e5fd143a113a1c3d0763566e6a746958dc

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\sessionstore-backups\recovery.baklz4

                    Filesize

                    5KB

                    MD5

                    b0b0e4b71f3ebe304ece16c8b3dedb42

                    SHA1

                    97952b35686dc66dd20bb0cc9ed8448cb42ccde9

                    SHA256

                    91d8754b08531e90f409a07eb613b4ec1fcadb7174bf4cdb6316fb11219b446b

                    SHA512

                    6e0b54dd07151e1f6743fe70eabe591b3f886c1c62942341dda0051592a0a550ea4021af19bb06cfd437f8eef9849fbf66210fe192eae26d26cb2144bd525467

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

                    Filesize

                    1.4MB

                    MD5

                    76a1ab5423e2620694d99935330239bb

                    SHA1

                    3c74a7eadc9e19245d6d3ff9ed70b985fec1a773

                    SHA256

                    0da2ce4972a23e24e5b80f93be0e01fe71a3a3fcde3d67229949002cb9103329

                    SHA512

                    e102693e06ced74c03e9d7ad8690dd801d98aa0a88bc880226f294ab7bb7b4bc14890b6f0472f313e54b08a6aa50bcd21377c5e9b529cc5b1a91b4f6ac1da8d1

                  • memory/248-60-0x0000000000CC0000-0x000000000134D000-memory.dmp

                    Filesize

                    6.6MB

                  • memory/248-56-0x0000000000CC0000-0x000000000134D000-memory.dmp

                    Filesize

                    6.6MB

                  • memory/420-1-0x0000000077966000-0x0000000077968000-memory.dmp

                    Filesize

                    8KB

                  • memory/420-0-0x0000000000D80000-0x000000000123A000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/420-3-0x0000000000D80000-0x000000000123A000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/420-5-0x0000000000D80000-0x000000000123A000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/420-2-0x0000000000D81000-0x0000000000DAF000-memory.dmp

                    Filesize

                    184KB

                  • memory/420-17-0x0000000000D80000-0x000000000123A000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/572-2647-0x0000000000830000-0x0000000000CEA000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/572-2648-0x0000000000830000-0x0000000000CEA000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/1776-494-0x0000000000830000-0x0000000000CEA000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/1776-495-0x0000000000830000-0x0000000000CEA000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/3052-54-0x00000000006D0000-0x0000000000D5D000-memory.dmp

                    Filesize

                    6.6MB

                  • memory/3052-37-0x00000000006D0000-0x0000000000D5D000-memory.dmp

                    Filesize

                    6.6MB

                  • memory/3052-48-0x00000000006D0000-0x0000000000D5D000-memory.dmp

                    Filesize

                    6.6MB

                  • memory/3052-58-0x00000000006D0000-0x0000000000D5D000-memory.dmp

                    Filesize

                    6.6MB

                  • memory/3052-55-0x00000000006D0000-0x0000000000D5D000-memory.dmp

                    Filesize

                    6.6MB

                  • memory/3848-64-0x0000000000830000-0x0000000000CEA000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/3848-2640-0x0000000000830000-0x0000000000CEA000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/3848-482-0x0000000000830000-0x0000000000CEA000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/3848-59-0x0000000000830000-0x0000000000CEA000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/3848-19-0x0000000000831000-0x000000000085F000-memory.dmp

                    Filesize

                    184KB

                  • memory/3848-2652-0x0000000000830000-0x0000000000CEA000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/3848-502-0x0000000000830000-0x0000000000CEA000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/3848-18-0x0000000000830000-0x0000000000CEA000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/3848-2651-0x0000000000830000-0x0000000000CEA000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/3848-2650-0x0000000000830000-0x0000000000CEA000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/3848-2649-0x0000000000830000-0x0000000000CEA000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/3848-61-0x0000000000830000-0x0000000000CEA000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/3848-62-0x0000000000830000-0x0000000000CEA000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/3848-2645-0x0000000000830000-0x0000000000CEA000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/3848-367-0x0000000000830000-0x0000000000CEA000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/3848-2636-0x0000000000830000-0x0000000000CEA000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/3848-1781-0x0000000000830000-0x0000000000CEA000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/3848-763-0x0000000000830000-0x0000000000CEA000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/3848-63-0x0000000000830000-0x0000000000CEA000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/3848-21-0x0000000000830000-0x0000000000CEA000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/3848-20-0x0000000000830000-0x0000000000CEA000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/4792-72-0x0000000002C40000-0x0000000002C76000-memory.dmp

                    Filesize

                    216KB

                  • memory/4792-73-0x00000000058E0000-0x0000000005F0A000-memory.dmp

                    Filesize

                    6.2MB

                  • memory/4792-74-0x00000000055B0000-0x00000000055D2000-memory.dmp

                    Filesize

                    136KB

                  • memory/4792-75-0x0000000005850000-0x00000000058B6000-memory.dmp

                    Filesize

                    408KB

                  • memory/4792-76-0x0000000005F10000-0x0000000005F76000-memory.dmp

                    Filesize

                    408KB

                  • memory/4792-85-0x0000000005F80000-0x00000000062D7000-memory.dmp

                    Filesize

                    3.3MB

                  • memory/4792-86-0x0000000006440000-0x000000000645E000-memory.dmp

                    Filesize

                    120KB

                  • memory/4792-87-0x0000000006490000-0x00000000064DC000-memory.dmp

                    Filesize

                    304KB

                  • memory/4792-89-0x00000000074A0000-0x0000000007536000-memory.dmp

                    Filesize

                    600KB

                  • memory/4792-90-0x00000000069D0000-0x00000000069EA000-memory.dmp

                    Filesize

                    104KB

                  • memory/4792-91-0x0000000007400000-0x0000000007422000-memory.dmp

                    Filesize

                    136KB

                  • memory/4792-92-0x0000000007B00000-0x00000000080A6000-memory.dmp

                    Filesize

                    5.6MB