Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    11-09-2024 06:42

General

  • Target

    9bfa2dd417b91950744e8037196965546d11adb4ed41ce4eef7a60bb57a99464.exe

  • Size

    1.8MB

  • MD5

    430fbb946370ff955dae5e717d188413

  • SHA1

    0e50738a179534126da1721597e22719cb9d0734

  • SHA256

    9bfa2dd417b91950744e8037196965546d11adb4ed41ce4eef7a60bb57a99464

  • SHA512

    b581d4bd81c8922e10c59fd51dc3250c5cb1a53e959f4a65684e748c52c80510da6dfa2e71f58712ab0c8217b4e1c5e6597a7671632c53de78a968fe827a901d

  • SSDEEP

    49152:st0b7Uk2XIwaVqnHkj1+vMBjNbsjvA0EWh:st0b7JuaVqijBjNYAdW

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

c7817d

C2

http://31.41.244.10

Attributes
  • install_dir

    0e8d0864aa

  • install_file

    svoutse.exe

  • strings_key

    5481b88a6ef75bcf21333988a4e47048

  • url_paths

    /Dem7kTu/index.php

rc4.plain

Extracted

Family

stealc

Botnet

rave

C2

http://185.215.113.103

Attributes
  • url_path

    /e2b1563c6670f193.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Stealc

    Stealc is an infostealer written in C++.

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 12 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 6 IoCs
  • Identifies Wine through registry keys 2 TTPs 7 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 2 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 16 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 23 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 21 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\9bfa2dd417b91950744e8037196965546d11adb4ed41ce4eef7a60bb57a99464.exe
    "C:\Users\Admin\AppData\Local\Temp\9bfa2dd417b91950744e8037196965546d11adb4ed41ce4eef7a60bb57a99464.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:420
    • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
      "C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3848
      • C:\Users\Admin\AppData\Roaming\1000026000\304d008d67.exe
        "C:\Users\Admin\AppData\Roaming\1000026000\304d008d67.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Loads dropped DLL
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        PID:2832
      • C:\Users\Admin\AppData\Local\Temp\1000030001\762c22f572.exe
        "C:\Users\Admin\AppData\Local\Temp\1000030001\762c22f572.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:3992
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\Admin\AppData\Local\Temp\1000039041\do.ps1"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3380
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /c start msedge https://www.youtube.com/account
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1352
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /c start msedge https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2768
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2864
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
            5⤵
            • Checks processor information in registry
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:944
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1940 -parentBuildID 20240401114208 -prefsHandle 1828 -prefMapHandle 1856 -prefsLen 23678 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a0b7e2a2-cbe5-462d-baca-be7c057e9b1b} 944 "\\.\pipe\gecko-crash-server-pipe.944" gpu
              6⤵
                PID:4764
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2348 -parentBuildID 20240401114208 -prefsHandle 2332 -prefMapHandle 2308 -prefsLen 24598 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c5fc9c4c-71f9-4447-a63d-8f8e933ef534} 944 "\\.\pipe\gecko-crash-server-pipe.944" socket
                6⤵
                  PID:3652
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3140 -childID 1 -isForBrowser -prefsHandle 3428 -prefMapHandle 3196 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2fe2bd43-44e0-4bc2-bc5c-6902f7099d46} 944 "\\.\pipe\gecko-crash-server-pipe.944" tab
                  6⤵
                    PID:2516
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3628 -childID 2 -isForBrowser -prefsHandle 2528 -prefMapHandle 3308 -prefsLen 22693 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {88848ed2-c063-4080-8622-5260846a9d92} 944 "\\.\pipe\gecko-crash-server-pipe.944" tab
                    6⤵
                      PID:2508
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4192 -childID 3 -isForBrowser -prefsHandle 4184 -prefMapHandle 4180 -prefsLen 29088 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bbc1e08f-f4ef-40d6-952a-434938a8db2c} 944 "\\.\pipe\gecko-crash-server-pipe.944" tab
                      6⤵
                        PID:1384
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5068 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 5048 -prefMapHandle 5036 -prefsLen 29088 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {35a3d85c-7c90-4dd5-9703-83895a5b49f2} 944 "\\.\pipe\gecko-crash-server-pipe.944" utility
                        6⤵
                        • Checks processor information in registry
                        PID:5156
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5932 -childID 4 -isForBrowser -prefsHandle 5924 -prefMapHandle 5920 -prefsLen 27182 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {010f0f8f-4285-4de5-bf5b-16c1fb2857b7} 944 "\\.\pipe\gecko-crash-server-pipe.944" tab
                        6⤵
                          PID:2056
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6064 -childID 5 -isForBrowser -prefsHandle 6072 -prefMapHandle 6076 -prefsLen 27182 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5bc7fe24-a288-4101-ab3f-5ebd9bd0cfb3} 944 "\\.\pipe\gecko-crash-server-pipe.944" tab
                          6⤵
                            PID:240
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6348 -childID 6 -isForBrowser -prefsHandle 6268 -prefMapHandle 6272 -prefsLen 27182 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {caa89736-bfe0-4434-b45e-ac9b51231e1d} 944 "\\.\pipe\gecko-crash-server-pipe.944" tab
                            6⤵
                              PID:1948
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
                          4⤵
                          • Suspicious use of WriteProcessMemory
                          PID:2836
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
                            5⤵
                            • Checks processor information in registry
                            PID:5000
                  • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                    C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                    1⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Identifies Wine through registry keys
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • Suspicious behavior: EnumeratesProcesses
                    PID:5572
                  • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                    C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                    1⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Identifies Wine through registry keys
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • Suspicious behavior: EnumeratesProcesses
                    PID:4380
                  • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                    C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                    1⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Executes dropped EXE
                    • Identifies Wine through registry keys
                    PID:6060

                  Network

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\ProgramData\mozglue.dll

                    Filesize

                    593KB

                    MD5

                    c8fd9be83bc728cc04beffafc2907fe9

                    SHA1

                    95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                    SHA256

                    ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                    SHA512

                    fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                  • C:\ProgramData\nss3.dll

                    Filesize

                    2.0MB

                    MD5

                    1cc453cdf74f31e4d913ff9c10acdde2

                    SHA1

                    6e85eae544d6e965f15fa5c39700fa7202f3aafe

                    SHA256

                    ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                    SHA512

                    dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                  • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\r5m741b5.default-release\activity-stream.discovery_stream.json

                    Filesize

                    29KB

                    MD5

                    5a9bc42f2b9bd1d199db0e559913f333

                    SHA1

                    26ad67c762b7a7c4ed30e89795d1e0d99e1d5e68

                    SHA256

                    b85e967d29365d5bb0d971dba39cfb0bea612a717e3d537b1a03daff7db9856d

                    SHA512

                    636f848d100b3ab0e2a48c6158b80f4167b2fddb9e1afef29d4ce8c47f90620ce3ec65ddae6d28711b8f6e9b99c2a1dd99b464e2f4744161a47179a4c70f8445

                  • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\r5m741b5.default-release\cache2\entries\58EFA56DB4BFFECB0EDA547894BC9A057159E22F

                    Filesize

                    13KB

                    MD5

                    f36fb97ad3a373523f8357c983a25ce3

                    SHA1

                    bf8c066449907373d139e7241ca4ef2d7caa520b

                    SHA256

                    ef49ad21b32e16d836889a6ce4499f25ab45391ffa3f6db97095efa9cce92ed0

                    SHA512

                    20a06c75f218507375f89b45b68b7d649799c7cbe8acbcf83c1a36054bcc139dbc34baa1376bd00d2c3f424dc15b2d7cb6ec3f91c200fceb0151cd4f74e1441a

                  • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe

                    Filesize

                    1.8MB

                    MD5

                    430fbb946370ff955dae5e717d188413

                    SHA1

                    0e50738a179534126da1721597e22719cb9d0734

                    SHA256

                    9bfa2dd417b91950744e8037196965546d11adb4ed41ce4eef7a60bb57a99464

                    SHA512

                    b581d4bd81c8922e10c59fd51dc3250c5cb1a53e959f4a65684e748c52c80510da6dfa2e71f58712ab0c8217b4e1c5e6597a7671632c53de78a968fe827a901d

                  • C:\Users\Admin\AppData\Local\Temp\1000039041\do.ps1

                    Filesize

                    2KB

                    MD5

                    e05e8f072b373beafe27cc11d85f947c

                    SHA1

                    1d6daeb98893e8122b8b69287ebd9d43f3c6138e

                    SHA256

                    717c09427fa5754ba92f92961545534048d0a76528c2e95c4d5ec6cef47c612f

                    SHA512

                    b3e34162e5ee43bb01f289eebc45fd3ea3e07f30be40dcf6635606540f912fe5c84d301e9f78e97dfe3ffe53e72547e50f3bcd7d4ebe5ab8da451a1989c469a0

                  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_udh20jvg.y3p.ps1

                    Filesize

                    60B

                    MD5

                    d17fe0a3f47be24a6453e9ef58c94641

                    SHA1

                    6ab83620379fc69f80c0242105ddffd7d98d5d9d

                    SHA256

                    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                    SHA512

                    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                  • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                    Filesize

                    479KB

                    MD5

                    09372174e83dbbf696ee732fd2e875bb

                    SHA1

                    ba360186ba650a769f9303f48b7200fb5eaccee1

                    SHA256

                    c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                    SHA512

                    b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                  • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                    Filesize

                    13.8MB

                    MD5

                    0a8747a2ac9ac08ae9508f36c6d75692

                    SHA1

                    b287a96fd6cc12433adb42193dfe06111c38eaf0

                    SHA256

                    32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                    SHA512

                    59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                  • C:\Users\Admin\AppData\Roaming\1000026000\304d008d67.exe

                    Filesize

                    1.7MB

                    MD5

                    6ec533d4b68b9b65f45160ba3bfc9422

                    SHA1

                    488be541bd2b2e42770c9e2bae875f6f97f51cfb

                    SHA256

                    dbe5d0f7237469a486de479008f1abca3d06a8a2b0ad64f26453d00e63000258

                    SHA512

                    99ceac7775eb344221dbba859cc37834e9b553b9b6eb27fa6dc807b5b4fac8016b2802a66cfba6a4f092feb05443c6642cb3fcb400befacdaad3747c6ce46cfc

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\AlternateServices.bin

                    Filesize

                    6KB

                    MD5

                    124a38f1d3b96f5170408c9e9ba616d8

                    SHA1

                    178ef403791012ade7ee6d317789959e530f08b2

                    SHA256

                    f93b58c6e656e7316472cd7cd0d10e506382e9610d145e8071b21e6bf9b3f877

                    SHA512

                    670aafe91ebaf7ca30db889f58a682b870b3ebe8a475ca919ba6618718dd6ea008b9db5779d7850118c5f9edc7332f466f5c9d4a0e5b43fa8e82dcca9a527740

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\AlternateServices.bin

                    Filesize

                    25KB

                    MD5

                    5832eba772466e91ca8d34650c1c4b24

                    SHA1

                    30a55dfc55913ec6c3219621386b8ed3b1cc70c4

                    SHA256

                    0fc23773f06d891107d5a589264e71e006510555f17140731e1bf76afa791c8f

                    SHA512

                    b4163cc313d9f939f14188ea62b82866a431704da15a879593123a54994f91ca6f7adb4cdf5b509a5f73734962d608dde8a72476bd4a530c3af94776d7343dc1

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\AlternateServices.bin

                    Filesize

                    10KB

                    MD5

                    321dea9190903a45bc69421ac398fa3e

                    SHA1

                    dbea9157a664661abe3d8d54edfc6990eaa993fc

                    SHA256

                    baf695b4fcb23a5f9594111866b97233b2b8e0cfeeee100f0bc8ba49e6b7a2c0

                    SHA512

                    930a1c95292d26f02dcae7d48e2dd41ee1ee11d2ad74098e07fb99d388db2f4295f543b1595b171826a29a4776d18336f90eb5575a765fbf910a62b42625fcae

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\AlternateServices.bin

                    Filesize

                    17KB

                    MD5

                    faa702a5d49d1adf14d8bf1297e8d9db

                    SHA1

                    aea7bd3a64e6c7878f09085613b09097b3fc1b4e

                    SHA256

                    066d096eb4545f6f2cefb78aa9fd1022aaa18574fbb6376ef9d53d3d04b30889

                    SHA512

                    466981a6d509e5e203f640d1c53ff35d023964f2b3a9770180bc60e4b731f5d0d8ee6d523fe15b594405aaf97feb2aab8f47b5b440b96b3ae81ca6b18133b458

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\AlternateServices.bin

                    Filesize

                    22KB

                    MD5

                    194366b5ee10db576b9a115eb10d56b0

                    SHA1

                    77f5bb6790f44e82b6105a3f7688088a41076137

                    SHA256

                    302ce8950b876e201194e3d777800b6906ff405292dfb3480c48d1d71a012e0c

                    SHA512

                    a0702e4c43f9609aaa640eb4119ee422a36c5341f86c3be2359f380d85ee592da4bede9c556bf9b899326990885f2c07b2f23dd8e8410f17fe34dd89da5726d2

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\cookies.sqlite

                    Filesize

                    512KB

                    MD5

                    46fff05e6fd524ae300b934ca7b70cd5

                    SHA1

                    f0b7cbed57224249826ccecdffd157d390fedfba

                    SHA256

                    bfbfc2cc74372f98fb757996ee9bc80fabe664103e6cdb641337455e59f63359

                    SHA512

                    59768df05a2a036690b520a39689317691c9e5ff7ace7ea537797bfb63607c90e4d0dbbc186417d8fe94a4e2e72e6ef1d3bda6c554ed2e3b044557d4e64863ca

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\cookies.sqlite-wal

                    Filesize

                    512KB

                    MD5

                    9df385f404d7d688c37b5dbc7a4d1f16

                    SHA1

                    50068969fc18763b60352077d24b02b7eda8bfcb

                    SHA256

                    3172e0b724637e17e312fd69a3edfe1b09f92e340b32c55eab8f3465b78869b2

                    SHA512

                    27466e7a1db840fb97d1b1ba458f0b7d484e69df94aec73a1ee9365eac8a14700bb67cd84751236e10a01023aa9e4c2453730164fd69289b19a545340c0290dc

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\datareporting\glean\db\data.safe.tmp

                    Filesize

                    5KB

                    MD5

                    f054b03d91e52431d59bceb4c37375eb

                    SHA1

                    c3af569ef208cd0c585e124d408fbfe418272b2f

                    SHA256

                    b0f58da2f6b5167c8dbfafd3d11c79fcb1bbaf85d7b7ad92dbc6f8034bf7ce92

                    SHA512

                    8696325082b7bb5430ed734ac7b2304b9c6fa3662ef392757a0b89b7acfa387e49744118c8a0feed7f8d02b658510f0ec78d8f1819feb7f2df1bf92aee660daf

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\datareporting\glean\db\data.safe.tmp

                    Filesize

                    6KB

                    MD5

                    34a2d6c8e86959a051e55f702986f66e

                    SHA1

                    73f9e7f8b755cc11d927f79ad9fc0fd5e123f6f0

                    SHA256

                    885d4948b787c805967a30708a392d11ae1d1c515fb1339c9b8f8cae9621eff9

                    SHA512

                    d807f665c141b5022e1503f5d412b96286de75d44c8cace24c7b2c9f4b8df61f46af3f9ad7ef2c15db29585c3b4399014cba6f3c72f106ec18d4981624611cfc

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\datareporting\glean\db\data.safe.tmp

                    Filesize

                    6KB

                    MD5

                    c7a72df9bf790bc12820cc18e5d3275e

                    SHA1

                    beb52ff1eceab34a902c67354f2936f8bedd7cd4

                    SHA256

                    7e8319f1aa61b87e5519fb2ee5337e8443f2d56d437696a953b10770700acdec

                    SHA512

                    40c35c141550a601178c14cfb5ed17a4942b09ba13a5695be4fd8d4ee276acea32069cd25bf4eb235fef8d53c5e6204cacc872d385ce8628e8f6fc00acad238c

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\datareporting\glean\db\data.safe.tmp

                    Filesize

                    16KB

                    MD5

                    6707c3c57e6ea865f7257b5788b19643

                    SHA1

                    3195c1ddd283269feafab2cafb4f78dd0f4c1c91

                    SHA256

                    a25f2a56155465c09b98b1cb25d7bfcba1bd0c8559fda50177820f8180301dc7

                    SHA512

                    303ebb7c9277e3449fc21ff4a237660bf4f3c66052b01c103de28ba474c5163ec5edcf3054108fb6a3f345114de0ef34ee6a153c5a5d0460431fed5949a3d3dd

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\datareporting\glean\pending_pings\34b1cc94-74ee-4a1e-a872-8950fb16d2d8

                    Filesize

                    982B

                    MD5

                    df508076909f64a58d42f7347537a937

                    SHA1

                    cddb0d0e65c23b22f0a7047732d858bbb0472d3e

                    SHA256

                    63039b1ab9e746d61249d02ae0fc6f78a70e537158b7c578f67cb493c3a2a5fe

                    SHA512

                    8b01c245f7b94e32bfb705ad32b9f817eedda5d327f4bfdab2cfd4a3c76a285598890dd01c5ff15582c80366e23996677d84576ff9aa08a588911602ebf9bfa2

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\datareporting\glean\pending_pings\6aabeca2-4158-4d4c-a5a9-bae2d9d14d5d

                    Filesize

                    671B

                    MD5

                    04c5aaa62a31de33c7d3a6bd7b9cb8bc

                    SHA1

                    0397150308f6d8d646d6d71c4adfde4368e9fc2b

                    SHA256

                    f61c6e15e1661146e5aa8f222cb1e6e33514a5ae5c86d1646e45ad0124fb9378

                    SHA512

                    6c7d0a347f13c5c9f988cc94cd1cc1dadf786d18a9ff9e3c21d97c44b1d650441ca258c413ebb18ff51424ff9a9de0c091e56860e83c2e8f049d70db18c29f5e

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\datareporting\glean\pending_pings\e4afcc82-0612-4d37-908e-1f2291f61bdc

                    Filesize

                    25KB

                    MD5

                    b539ad5a59d5e5eafd5def542ae74bed

                    SHA1

                    9df232546537f5d94da647c895cd6ce5ab00a3d5

                    SHA256

                    524b4fbc7ec4021ff6a1657b8fae09eb4f7b1544c324e4059e59d33df947fccd

                    SHA512

                    d1b3f601f4601b8100e29904892b17e055e872e61408906287da8948ec121d56f20b2dd9082d82f7e695137b9dd0632532c9aad8861e455c1923cfcab37843a9

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

                    Filesize

                    1.1MB

                    MD5

                    842039753bf41fa5e11b3a1383061a87

                    SHA1

                    3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                    SHA256

                    d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                    SHA512

                    d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

                    Filesize

                    116B

                    MD5

                    2a461e9eb87fd1955cea740a3444ee7a

                    SHA1

                    b10755914c713f5a4677494dbe8a686ed458c3c5

                    SHA256

                    4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                    SHA512

                    34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

                    Filesize

                    372B

                    MD5

                    bf957ad58b55f64219ab3f793e374316

                    SHA1

                    a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                    SHA256

                    bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                    SHA512

                    79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

                    Filesize

                    17.8MB

                    MD5

                    daf7ef3acccab478aaa7d6dc1c60f865

                    SHA1

                    f8246162b97ce4a945feced27b6ea114366ff2ad

                    SHA256

                    bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                    SHA512

                    5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\places.sqlite

                    Filesize

                    5.0MB

                    MD5

                    f21e00a24e4b159468cfefd4a2658a2a

                    SHA1

                    255728355b77041e70c9e6efa2d6f356207380ae

                    SHA256

                    dc34ff651984902103b614f06b4a4ff51ae7873c3fc56c03f4bfdd6930fef4ee

                    SHA512

                    3a9b3b8c851edacc5aeffedf8853239c0b589461730cdcae1a6d15674c6374621369625eb9d3537bdbfee614c7ad42300603b9a19099e19c3cd0ede0902b2fb4

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\places.sqlite-wal

                    Filesize

                    2.2MB

                    MD5

                    62a92f0f8b225ef06a646dae31d0ecf5

                    SHA1

                    14311b6f3fef1aa1da192b09d8d28dab00311d43

                    SHA256

                    a81d637d1516e9a093f7f96bda7f338551a8e32c6f35a96df8f76ef056f6bc09

                    SHA512

                    20d7389c82ad53ec3c9f626689475c082961321514a001240418ef58bcd3dc3ea6e29f05774c1d902e821e3bd16dea54ec2edf151940091167f6e8f0e30e3fce

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\prefs-1.js

                    Filesize

                    16KB

                    MD5

                    bee1d8ffae8f813d5d8aa82701cc2deb

                    SHA1

                    bc6328ca6fdac1d5ffd69ee8293eb5164e67f603

                    SHA256

                    07054e2466b89640895f9a1785abb61a76770610740e803038841f336718d65f

                    SHA512

                    1e8d6826f88d3c1b8e612054b53c392bfc8247aa7815f32311c9aaeaea525a1495323e49010e71fc09f15b672d2ffca6398414c96e4941829a518d1295521ae7

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\prefs-1.js

                    Filesize

                    12KB

                    MD5

                    eb8c37c91fa0ff5e11633fe799656343

                    SHA1

                    a548a17d3982a8cf957f38320508e723270bd615

                    SHA256

                    943fb0a2f625f8f05751cc188031f2f63bc69191ed7f5797ba1c7831175a5adf

                    SHA512

                    fa55ccb8aef2cb3cb896147f9d871dd99ed6da32b7932be6c50925fac511eb0494fd5b2cc5201978379c301f0599b0bd0a1f44a462280c47f0cf4cbc45601ab8

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\prefs.js

                    Filesize

                    11KB

                    MD5

                    0d6e8689827fdb26591c39a78847cd89

                    SHA1

                    4914c5a6a334f53afd5ae055685674c210c54921

                    SHA256

                    6f1a00255106287086a02c0afd61e7ed49ec7c163e18d773e4f4d4ef7aa347bc

                    SHA512

                    82dfcbad8268395a9e0444a541820b12d263d026214ff44cc7611be07d72e0315b227aeb330bc4fba0a404b3d1b249abee31741c461438213bc704085db31843

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\prefs.js

                    Filesize

                    11KB

                    MD5

                    42879555f6acf9cefc40640a1eadd447

                    SHA1

                    85338ad73bfaaced71986e7e56bd231f992742d8

                    SHA256

                    c717e224913d3823ebf3826cf24769fa17ac28ac7c215eb71a9be65a76dda206

                    SHA512

                    37d65f5536be55a65e2a14e12ee3e795785bf8f3ac2d0030cf1d66016c9197f9da1955baa9cb62d4878368876c541c294b33bf9ae491991a4cd7de72b29d2790

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\sessionstore-backups\recovery.baklz4

                    Filesize

                    1KB

                    MD5

                    78d610ce4636f42850b5c852fa0266b7

                    SHA1

                    c57ed29ebbd7693a0c18dc157d46959b8af45261

                    SHA256

                    ee5614179d4fc44754691166bbcec4eba86f96a0684069ce72c9a8813ff7afd1

                    SHA512

                    17bda80aa76668579d723ba71a49aa7514e0d094b07ffa578a0cc53e2d345f6ef9078c68298fc83bad14220e25990a89b6f0f801392001202f1e171c8df63716

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

                    Filesize

                    1.4MB

                    MD5

                    76a1ab5423e2620694d99935330239bb

                    SHA1

                    3c74a7eadc9e19245d6d3ff9ed70b985fec1a773

                    SHA256

                    0da2ce4972a23e24e5b80f93be0e01fe71a3a3fcde3d67229949002cb9103329

                    SHA512

                    e102693e06ced74c03e9d7ad8690dd801d98aa0a88bc880226f294ab7bb7b4bc14890b6f0472f313e54b08a6aa50bcd21377c5e9b529cc5b1a91b4f6ac1da8d1

                  • memory/420-0-0x0000000000780000-0x0000000000C3D000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/420-1-0x0000000077966000-0x0000000077968000-memory.dmp

                    Filesize

                    8KB

                  • memory/420-2-0x0000000000781000-0x00000000007AF000-memory.dmp

                    Filesize

                    184KB

                  • memory/420-3-0x0000000000780000-0x0000000000C3D000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/420-5-0x0000000000780000-0x0000000000C3D000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/420-16-0x0000000000780000-0x0000000000C3D000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/2832-37-0x0000000000210000-0x000000000089D000-memory.dmp

                    Filesize

                    6.6MB

                  • memory/2832-555-0x0000000000210000-0x000000000089D000-memory.dmp

                    Filesize

                    6.6MB

                  • memory/2832-38-0x0000000000210000-0x000000000089D000-memory.dmp

                    Filesize

                    6.6MB

                  • memory/2832-39-0x0000000000210000-0x000000000089D000-memory.dmp

                    Filesize

                    6.6MB

                  • memory/2832-526-0x0000000000210000-0x000000000089D000-memory.dmp

                    Filesize

                    6.6MB

                  • memory/2832-82-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                    Filesize

                    972KB

                  • memory/2832-576-0x0000000000210000-0x000000000089D000-memory.dmp

                    Filesize

                    6.6MB

                  • memory/2832-573-0x0000000000210000-0x000000000089D000-memory.dmp

                    Filesize

                    6.6MB

                  • memory/2832-572-0x0000000000210000-0x000000000089D000-memory.dmp

                    Filesize

                    6.6MB

                  • memory/3380-67-0x00000000059F0000-0x0000000005A56000-memory.dmp

                    Filesize

                    408KB

                  • memory/3380-77-0x0000000005F00000-0x0000000005F1E000-memory.dmp

                    Filesize

                    120KB

                  • memory/3380-63-0x0000000004A80000-0x0000000004AB6000-memory.dmp

                    Filesize

                    216KB

                  • memory/3380-100-0x00000000075E0000-0x0000000007B86000-memory.dmp

                    Filesize

                    5.6MB

                  • memory/3380-65-0x0000000005060000-0x0000000005082000-memory.dmp

                    Filesize

                    136KB

                  • memory/3380-66-0x0000000005790000-0x00000000057F6000-memory.dmp

                    Filesize

                    408KB

                  • memory/3380-97-0x0000000006F20000-0x0000000006FB6000-memory.dmp

                    Filesize

                    600KB

                  • memory/3380-98-0x0000000006490000-0x00000000064AA000-memory.dmp

                    Filesize

                    104KB

                  • memory/3380-99-0x00000000064F0000-0x0000000006512000-memory.dmp

                    Filesize

                    136KB

                  • memory/3380-64-0x00000000050F0000-0x000000000571A000-memory.dmp

                    Filesize

                    6.2MB

                  • memory/3380-78-0x0000000005F40000-0x0000000005F8C000-memory.dmp

                    Filesize

                    304KB

                  • memory/3380-76-0x0000000005B50000-0x0000000005EA7000-memory.dmp

                    Filesize

                    3.3MB

                  • memory/3848-19-0x0000000000650000-0x0000000000B0D000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/3848-118-0x0000000000650000-0x0000000000B0D000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/3848-523-0x0000000000650000-0x0000000000B0D000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/3848-2779-0x0000000000650000-0x0000000000B0D000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/3848-588-0x0000000000650000-0x0000000000B0D000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/3848-21-0x0000000000650000-0x0000000000B0D000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/3848-20-0x0000000000650000-0x0000000000B0D000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/3848-597-0x0000000000650000-0x0000000000B0D000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/3848-80-0x0000000000650000-0x0000000000B0D000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/3848-405-0x0000000000650000-0x0000000000B0D000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/3848-17-0x0000000000650000-0x0000000000B0D000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/3848-2768-0x0000000000650000-0x0000000000B0D000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/3848-2772-0x0000000000650000-0x0000000000B0D000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/3848-2771-0x0000000000650000-0x0000000000B0D000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/3848-1435-0x0000000000650000-0x0000000000B0D000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/3848-2770-0x0000000000650000-0x0000000000B0D000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/3848-2685-0x0000000000650000-0x0000000000B0D000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/3848-2756-0x0000000000650000-0x0000000000B0D000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/3848-2762-0x0000000000650000-0x0000000000B0D000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/3848-2765-0x0000000000650000-0x0000000000B0D000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/3848-2769-0x0000000000650000-0x0000000000B0D000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/3992-579-0x0000000000860000-0x0000000000EED000-memory.dmp

                    Filesize

                    6.6MB

                  • memory/3992-55-0x0000000000860000-0x0000000000EED000-memory.dmp

                    Filesize

                    6.6MB

                  • memory/3992-574-0x0000000000860000-0x0000000000EED000-memory.dmp

                    Filesize

                    6.6MB

                  • memory/3992-575-0x0000000000860000-0x0000000000EED000-memory.dmp

                    Filesize

                    6.6MB

                  • memory/4380-2767-0x0000000000650000-0x0000000000B0D000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/5572-596-0x0000000000650000-0x0000000000B0D000-memory.dmp

                    Filesize

                    4.7MB