Analysis

  • max time kernel
    147s
  • max time network
    153s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    11-09-2024 12:21

General

  • Target

    77bb28459e7ff70cdcaf060e93a1479dd6b90278564beb083384b4ba8b542911.exe

  • Size

    1.8MB

  • MD5

    092ee2fd910b7750ce6ab2a25281d078

  • SHA1

    6ca5cf489e2db521001ebd9644fa3e87433ad280

  • SHA256

    77bb28459e7ff70cdcaf060e93a1479dd6b90278564beb083384b4ba8b542911

  • SHA512

    2c0c78544a70ccdf3595eda755e0b8b70b6e2232665653728f312bdcdb75d4ca05e4a12cd35cfd19076e910978124887c1a6f990a451f076d318934a4c35e75a

  • SSDEEP

    49152:YL0Bu3HQgr2izp4Wt1EDCEXM/giYojF48jWtEW:az3HQAFhgCCY/G8jE

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

c7817d

C2

http://31.41.244.10

Attributes
  • install_dir

    0e8d0864aa

  • install_file

    svoutse.exe

  • strings_key

    5481b88a6ef75bcf21333988a4e47048

  • url_paths

    /Dem7kTu/index.php

rc4.plain

Extracted

Family

stealc

Botnet

rave

C2

http://185.215.113.103

Attributes
  • url_path

    /e2b1563c6670f193.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Stealc

    Stealc is an infostealer written in C++.

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 14 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 6 IoCs
  • Identifies Wine through registry keys 2 TTPs 7 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 14 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 21 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 21 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\77bb28459e7ff70cdcaf060e93a1479dd6b90278564beb083384b4ba8b542911.exe
    "C:\Users\Admin\AppData\Local\Temp\77bb28459e7ff70cdcaf060e93a1479dd6b90278564beb083384b4ba8b542911.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3596
    • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
      "C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3876
      • C:\Users\Admin\AppData\Roaming\1000026000\8d93ce80da.exe
        "C:\Users\Admin\AppData\Roaming\1000026000\8d93ce80da.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:3476
      • C:\Users\Admin\AppData\Local\Temp\1000030001\8870dcc797.exe
        "C:\Users\Admin\AppData\Local\Temp\1000030001\8870dcc797.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:1264
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\Admin\AppData\Local\Temp\1000039041\do.ps1"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4568
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /c start msedge https://www.youtube.com/account
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4628
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /c start msedge https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4804
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1388
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
            5⤵
            • Checks processor information in registry
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:924
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1932 -parentBuildID 20240401114208 -prefsHandle 1836 -prefMapHandle 1852 -prefsLen 23678 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e57bc0df-b612-478d-b968-228aca6ac5b9} 924 "\\.\pipe\gecko-crash-server-pipe.924" gpu
              6⤵
                PID:132
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2396 -parentBuildID 20240401114208 -prefsHandle 2372 -prefMapHandle 2340 -prefsLen 24598 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bce45854-bf36-4981-9441-b85157bdd3ee} 924 "\\.\pipe\gecko-crash-server-pipe.924" socket
                6⤵
                  PID:1968
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2912 -childID 1 -isForBrowser -prefsHandle 3428 -prefMapHandle 3064 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b4b8118f-6b46-4d21-b5c7-ad03656e5a40} 924 "\\.\pipe\gecko-crash-server-pipe.924" tab
                  6⤵
                    PID:2948
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3552 -childID 2 -isForBrowser -prefsHandle 2840 -prefMapHandle 2836 -prefsLen 22693 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ef6f5036-1895-4a6c-8c1a-2177e5e9f6f5} 924 "\\.\pipe\gecko-crash-server-pipe.924" tab
                    6⤵
                      PID:2976
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3664 -childID 3 -isForBrowser -prefsHandle 4252 -prefMapHandle 2840 -prefsLen 29088 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d92d8251-4cb1-4b4b-9d62-3633f02268a9} 924 "\\.\pipe\gecko-crash-server-pipe.924" tab
                      6⤵
                        PID:4984
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4928 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 5056 -prefMapHandle 5052 -prefsLen 29088 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {15d697aa-c979-4505-901a-91a5d581c92c} 924 "\\.\pipe\gecko-crash-server-pipe.924" utility
                        6⤵
                        • Checks processor information in registry
                        PID:5300
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5896 -childID 4 -isForBrowser -prefsHandle 5876 -prefMapHandle 5872 -prefsLen 27182 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {00c450ec-577d-4cd7-95da-fda0fc55ea88} 924 "\\.\pipe\gecko-crash-server-pipe.924" tab
                        6⤵
                          PID:5176
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5904 -childID 5 -isForBrowser -prefsHandle 5888 -prefMapHandle 5884 -prefsLen 27182 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9b7a5351-6777-4b07-8e6c-b357e9845def} 924 "\\.\pipe\gecko-crash-server-pipe.924" tab
                          6⤵
                            PID:5184
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6332 -childID 6 -isForBrowser -prefsHandle 6324 -prefMapHandle 6320 -prefsLen 27182 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e9e5decc-e9b8-49d0-acde-34be51ed3240} 924 "\\.\pipe\gecko-crash-server-pipe.924" tab
                            6⤵
                              PID:5200
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
                          4⤵
                          • Suspicious use of WriteProcessMemory
                          PID:2084
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
                            5⤵
                            • Checks processor information in registry
                            PID:1864
                  • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                    C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                    1⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Identifies Wine through registry keys
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • Suspicious behavior: EnumeratesProcesses
                    PID:1324
                  • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                    C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                    1⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Identifies Wine through registry keys
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • Suspicious behavior: EnumeratesProcesses
                    PID:1908
                  • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                    C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                    1⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Identifies Wine through registry keys
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • Suspicious behavior: EnumeratesProcesses
                    PID:980

                  Network

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\activity-stream.discovery_stream.json

                    Filesize

                    26KB

                    MD5

                    e91a39d06bc21f94b1caccadee17e9ff

                    SHA1

                    2cb39663050db760f968e6a30b61ae34170976db

                    SHA256

                    a287dfd2de4a4a1645b20e5f1ab4513be52f178dd2d4533f948579081b40f174

                    SHA512

                    4be557cc49047304f701d114dda087da19f591c539c4a5a5bda2249be4b7c4d9ac442b1dee8314222e6305f19bc53afbe8818fd5271b2ee8d1b1ef1450b8e62b

                  • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\cache2\entries\58EFA56DB4BFFECB0EDA547894BC9A057159E22F

                    Filesize

                    13KB

                    MD5

                    e39a7c7f48e549144e605655e382e6fc

                    SHA1

                    d96750af1c4cc2298436011312981916d55db2e4

                    SHA256

                    8404809a9faed586586cb8701bbda1943e0b2eb21cdf5b1e4516865439615b1b

                    SHA512

                    bc2940a87648024043bb0d68fdcbafdcd428160efd2b6047fc0954526fa52637dbb9f94b9a83ab44c1802d7ba566167bb7d31cae862274127c95487187323166

                  • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe

                    Filesize

                    1.8MB

                    MD5

                    092ee2fd910b7750ce6ab2a25281d078

                    SHA1

                    6ca5cf489e2db521001ebd9644fa3e87433ad280

                    SHA256

                    77bb28459e7ff70cdcaf060e93a1479dd6b90278564beb083384b4ba8b542911

                    SHA512

                    2c0c78544a70ccdf3595eda755e0b8b70b6e2232665653728f312bdcdb75d4ca05e4a12cd35cfd19076e910978124887c1a6f990a451f076d318934a4c35e75a

                  • C:\Users\Admin\AppData\Local\Temp\1000039041\do.ps1

                    Filesize

                    2KB

                    MD5

                    e05e8f072b373beafe27cc11d85f947c

                    SHA1

                    1d6daeb98893e8122b8b69287ebd9d43f3c6138e

                    SHA256

                    717c09427fa5754ba92f92961545534048d0a76528c2e95c4d5ec6cef47c612f

                    SHA512

                    b3e34162e5ee43bb01f289eebc45fd3ea3e07f30be40dcf6635606540f912fe5c84d301e9f78e97dfe3ffe53e72547e50f3bcd7d4ebe5ab8da451a1989c469a0

                  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_v32g5pky.4a0.ps1

                    Filesize

                    60B

                    MD5

                    d17fe0a3f47be24a6453e9ef58c94641

                    SHA1

                    6ab83620379fc69f80c0242105ddffd7d98d5d9d

                    SHA256

                    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                    SHA512

                    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                  • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                    Filesize

                    479KB

                    MD5

                    09372174e83dbbf696ee732fd2e875bb

                    SHA1

                    ba360186ba650a769f9303f48b7200fb5eaccee1

                    SHA256

                    c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                    SHA512

                    b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                  • C:\Users\Admin\AppData\Local\Temp\tmpaddon-2

                    Filesize

                    13.8MB

                    MD5

                    0a8747a2ac9ac08ae9508f36c6d75692

                    SHA1

                    b287a96fd6cc12433adb42193dfe06111c38eaf0

                    SHA256

                    32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                    SHA512

                    59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                  • C:\Users\Admin\AppData\Roaming\1000026000\8d93ce80da.exe

                    Filesize

                    1.7MB

                    MD5

                    250051046eae3713ed1af118169d9227

                    SHA1

                    66ecbbeffdbb6bae912fc9f21b52faeac7b73d49

                    SHA256

                    c1d2816e557482077a88b8e23581cd82a92dfca70fd1e7ceaec4ba3adbd7d136

                    SHA512

                    a9a49aaf7e56466ec9cbdf86564ba5ad875d8233f12b26c718dc163dfb7d9e139891e5a422eca933e41c3bc19d5dc62d47606e23019fb0cce8f281a981a82d1e

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\AlternateServices.bin

                    Filesize

                    6KB

                    MD5

                    c65a327af92ac864518a42b6dd4d9e23

                    SHA1

                    5388ab08b01150c8fba866372f179e739d603477

                    SHA256

                    6b800b08cc98ae3a2ce33e83987281e9b901a7797ed5af756ce9fa0b9a985042

                    SHA512

                    a861df1c482e7fe71c0dd7e1b6a386bd60b22e3c98f203965e068b834209695a8528d6f3c0667b7c34683662dd6d9e00938a23a7db7ab2399fd12aa98c99277b

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\AlternateServices.bin

                    Filesize

                    11KB

                    MD5

                    5a15a6a94ecfe50a7b15ce1adf48515d

                    SHA1

                    b1016348e620535f182abd18f4b26a98e0a710a1

                    SHA256

                    3fbb8fd99c8ac1c632748d0c4a5bde81a0156edaacbab67a9fe336aae98839a7

                    SHA512

                    3824e016acdf713b74e9e9755c066adb3a5b683f50980f413a4f927574b6dce197ab5da0bf66f87228a9aa9f14ac40a1d382a643a2de2b8dab08cd71522a7e92

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\AlternateServices.bin

                    Filesize

                    15KB

                    MD5

                    a800fd45406ee41ea01ddb7fb1544546

                    SHA1

                    64fc8947868ca3ad5ecdbea6c703e5376a976cb8

                    SHA256

                    72c3b72cadfa601983899678b012a730af8793917c07a52d83b8d8d3a09492fc

                    SHA512

                    662d804f38509d79eca96aee64bcf97dc95514e9d1c2d0e0c62d143f404270abc56d8fbc9b724a09fc4fe0864ce183843f26e857fb914ab72a444f500026773b

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\AlternateServices.bin

                    Filesize

                    18KB

                    MD5

                    0c53981aaf4d4ecae28ab30c27f5bb75

                    SHA1

                    3e1659fbc721ce659046444a0c4da10ec54d2da3

                    SHA256

                    47f3e7cb9e901e3c68cd781df88d85dbc0fe13e176446a5bfdb306a3b37816bb

                    SHA512

                    51a767b37e4d7d6252010906fbd366befab6b14979a60d2ac9503946cc22599601aca683d9c9952fe7608f19fc47fbed92976287df6e88304f6a878b399618eb

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\AlternateServices.bin

                    Filesize

                    21KB

                    MD5

                    9fce0e92a69bcc88a0d7516f189c1a59

                    SHA1

                    a9e1d85b19e3b744c67ec46aaa0c63b83a653194

                    SHA256

                    037856d7f7b11b7d9b2196c50811b9f71d975cc3f25069d4519f158cda1e5a1a

                    SHA512

                    56ca04864dd0653385fcd83af631760b98df84636ff8301184682eb02fa184a67b697eeedded25e1547f8f3b2efbdf045fdd253df2254bf395bb1bfea27aa56a

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\AlternateServices.bin

                    Filesize

                    23KB

                    MD5

                    5b4827babae45ece5a6ea6a92a369362

                    SHA1

                    a7bb344fe39feda8e07b568c5f0ad072d94b7f49

                    SHA256

                    3b4a164105f49792301fb486c9706136221d5dce662f01c093b0dd7f13188d2f

                    SHA512

                    84a564c96a68d8235d325c4f3f8766238310620c710912d9f00287b2c395ed6a5bfcc3782769c57351718987a3bb5d3c872b71fb1419d9c280a68889429fb627

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\datareporting\glean\db\data.safe.tmp

                    Filesize

                    5KB

                    MD5

                    ee641718a24ced68927e62b858d21840

                    SHA1

                    4a90dab689cc2cc2acdaa08e7294536524abc1c5

                    SHA256

                    19a292d2b1c008418cf1f8a2af690b9f4e276fe84151e73f6b4c4154db9bfe90

                    SHA512

                    8ab849a76afae17f0083fe3e0018c22125674bf8b95c99f6850242fa3e6754d0049bebab75f16d068aff9959fd1578f90e31ffc500fb35e5dc2ac8690c32a886

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\datareporting\glean\db\data.safe.tmp

                    Filesize

                    5KB

                    MD5

                    511f9c765a4cccc15079ccb25138414a

                    SHA1

                    493dbd4c4be515e6de932958653afeb0cbc68edb

                    SHA256

                    d7c038f98e7eeaffc563886f251d95a086529080bfacd403286395ae4e8da501

                    SHA512

                    80f4e5e692e666bae5e5b8feb4d95c4a7f157c927cc46b69bafd732af39a0c0d3fa8d0a06328b6b3b0a8a556eae6aeaee23a80b333584f887435d320df7eb7df

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\datareporting\glean\db\data.safe.tmp

                    Filesize

                    32KB

                    MD5

                    0eadd2cb54c84997ecb2bc032002cd07

                    SHA1

                    9e1aa45c6b0689e6b76ad6cdac2f211583c8283a

                    SHA256

                    c0d0f7288a203587967ff97b138b4de80958c16e3601c6478b34c1b1d76709f9

                    SHA512

                    dbf2b9f381b17589f5d47ddc9691e008de8f5fbca2b9fa67b42c4489fa4709e0da422291937f45608a38906d2a71d1667708d451472806bb2f1012d8a18043b4

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\datareporting\glean\pending_pings\1e3956b2-a1c3-4e5f-aaf4-e3168c47dddd

                    Filesize

                    982B

                    MD5

                    05c308ab473d5e77dd30457be604f9be

                    SHA1

                    5a5088852f03fe932645779b4efc2de96cbd315c

                    SHA256

                    377934dad38f80ccd827496727391da18cb3c09e271f7af2edb14ee114878a58

                    SHA512

                    f24fd6c785f9b12899e768ab5a693274b1b86c44d44be66f608470225ddfcfffe48312f9ab453777903d9e096992304ff7f629db39531e1d60a98c4b87ac83a6

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\datareporting\glean\pending_pings\892f65b0-c39b-45ed-b075-a77f4d3a68ea

                    Filesize

                    27KB

                    MD5

                    218eed372f590b26d822feb1e39b6076

                    SHA1

                    ea3f282059af2e9d0f416bda3eaaf6f5531ca7f4

                    SHA256

                    b803d6fa3fd4a597b9c61a077bac54510c8abe6085088a1d7080baa1f976d53e

                    SHA512

                    fe8657214b6e273a4c90b668901a6babaa3b24d0db42e7d790998413723162099832f2121baf378ac3d662177700d160482315ef77b4e569dd0e7dc2f5136145

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\datareporting\glean\pending_pings\9c3577a1-3f11-462c-bfbb-0c533467c07e

                    Filesize

                    671B

                    MD5

                    c2da0401708767c2566d087b7fef9573

                    SHA1

                    0772d2a1363dd10052818f073f2dbb9ea689e119

                    SHA256

                    adc2642d7bd76d624d4065a5be4d1aae9d6b56e631f03036b728fd74634730cd

                    SHA512

                    539879d3a506dab65276a61d976bad706d1d7608048c5886aa155d7d7b403b2308b8494d2e7fd1b7490ee80f5e05a6cdc38e994aef0d3014d71e0f7992e3ccda

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

                    Filesize

                    1.1MB

                    MD5

                    842039753bf41fa5e11b3a1383061a87

                    SHA1

                    3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                    SHA256

                    d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                    SHA512

                    d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

                    Filesize

                    116B

                    MD5

                    2a461e9eb87fd1955cea740a3444ee7a

                    SHA1

                    b10755914c713f5a4677494dbe8a686ed458c3c5

                    SHA256

                    4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                    SHA512

                    34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\gmp-widevinecdm\4.10.2710.0\LICENSE.txt.tmp

                    Filesize

                    479B

                    MD5

                    49ddb419d96dceb9069018535fb2e2fc

                    SHA1

                    62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

                    SHA256

                    2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

                    SHA512

                    48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

                    Filesize

                    372B

                    MD5

                    bf957ad58b55f64219ab3f793e374316

                    SHA1

                    a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                    SHA256

                    bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                    SHA512

                    79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

                    Filesize

                    17.8MB

                    MD5

                    daf7ef3acccab478aaa7d6dc1c60f865

                    SHA1

                    f8246162b97ce4a945feced27b6ea114366ff2ad

                    SHA256

                    bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                    SHA512

                    5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\prefs-1.js

                    Filesize

                    12KB

                    MD5

                    4399bd9a684fd3ee95efd5b9f0cb934b

                    SHA1

                    c2051dc06ebb73a050ec044a56b4b938a6273da3

                    SHA256

                    b96f01a46d3d31b58563524178c8bb227a513c1122f50d9e54b232fb8cbe69e5

                    SHA512

                    eb77e1b40822ed7cb07e93d223c96c5959ee060c9c1ace126edc556ff14698d87276cc04853f1c594c8e12c835a7941f8688a227d64202a9456f4e7b63898abd

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\prefs.js

                    Filesize

                    11KB

                    MD5

                    5203902df9cd53d6187e9ea1f2d231bd

                    SHA1

                    a4ac2f901a42299f09ba5250b137e3f66f8ecd8c

                    SHA256

                    bd6d81e880cfe6083d0cbe330f96732b95f67054ae57fd992b46b61c9bacbcf1

                    SHA512

                    c64868136c32a69a29a0c79b3e8a179d8ad12f72471485c0dfd60d72c16b9e072b6cf506efd565b2fc785e71c06192d7771e63856e2cf81921f19ef66e44d23c

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\sessionstore-backups\recovery.baklz4

                    Filesize

                    1KB

                    MD5

                    abfea65898faab0ea25304987c8986f6

                    SHA1

                    c3831807fb43aa1cc60485019f65bc1386ff4777

                    SHA256

                    decf7b766693ff786222431ed99ef9a7eca8b17e4972b29e64a0b3df2012b9aa

                    SHA512

                    caf6cfb33259bde6a2e02192815ebc8b7cb12b2f00d747bac7012c69799e7ce158761b017f098ae320f1129c1876adf9a4af3dc9df15d25dee05ecf4e67e0b35

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

                    Filesize

                    376KB

                    MD5

                    f62d5f10fa6c604324723654cc13ef39

                    SHA1

                    5cd1e9f0364099ee32d783a731a47912c9716577

                    SHA256

                    643c64596269c9d4d3ab1eca336abe1b5c974ae563942892b74ae7563c0b4815

                    SHA512

                    1900ec3eff09a4ef085e56df1703734446240318fe30cdefe4c18edcd40ab4598b9943cb24915612c92f3c6fcd3a1d90e4334ec5aec4ac0a8242be254e6b29f2

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

                    Filesize

                    1.1MB

                    MD5

                    34c11a2a9020664531aa8f28eba32565

                    SHA1

                    bc78ba99b41533eee88844af7a82c499bb90a084

                    SHA256

                    23ee8051e2a19f8956807f40a012f8c036f0b14197090e86d385a30732529e3e

                    SHA512

                    697311a6138bccde43354fc9f5c23f5a5066b478c6b93fce25cd7c3799a78261c47b483b3c3e72e7656bacf94b9d7b4af7d14e091d9c2e5457dfc39ca7470fc6

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

                    Filesize

                    1.4MB

                    MD5

                    93cf1e0b00a2404d621fccd52610e289

                    SHA1

                    8a9f37e9bbd291b052e38eaa8cb9835582ceabd5

                    SHA256

                    fd0aef99a78847076bbc07ed89ea9edc3bc93f4fee0dda4c6d6935711d26f021

                    SHA512

                    b27ecb8071aeed547fa50f99320c251a6708c07556546fcfe40d4aa2163320aeb79b9d18fb0c183a43a7e03b996d243b6dff8d7c257aeb07511af769a67bd411

                  • memory/980-2771-0x0000000000160000-0x000000000061C000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/1264-474-0x0000000000D70000-0x00000000013EF000-memory.dmp

                    Filesize

                    6.5MB

                  • memory/1264-57-0x0000000000D70000-0x00000000013EF000-memory.dmp

                    Filesize

                    6.5MB

                  • memory/1324-408-0x0000000000160000-0x000000000061C000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/1324-425-0x0000000000160000-0x000000000061C000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/1908-1587-0x0000000000160000-0x000000000061C000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/1908-1588-0x0000000000160000-0x000000000061C000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/3476-65-0x00000000008D0000-0x0000000000F4F000-memory.dmp

                    Filesize

                    6.5MB

                  • memory/3476-41-0x00000000008D0000-0x0000000000F4F000-memory.dmp

                    Filesize

                    6.5MB

                  • memory/3596-2-0x0000000000981000-0x00000000009AF000-memory.dmp

                    Filesize

                    184KB

                  • memory/3596-0-0x0000000000980000-0x0000000000E3C000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/3596-1-0x0000000077E46000-0x0000000077E48000-memory.dmp

                    Filesize

                    8KB

                  • memory/3596-3-0x0000000000980000-0x0000000000E3C000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/3596-5-0x0000000000980000-0x0000000000E3C000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/3596-17-0x0000000000980000-0x0000000000E3C000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/3876-1271-0x0000000000160000-0x000000000061C000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/3876-1016-0x0000000000160000-0x000000000061C000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/3876-2772-0x0000000000160000-0x000000000061C000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/3876-500-0x0000000000160000-0x000000000061C000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/3876-2759-0x0000000000160000-0x000000000061C000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/3876-507-0x0000000000160000-0x000000000061C000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/3876-23-0x0000000000160000-0x000000000061C000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/3876-22-0x0000000000160000-0x000000000061C000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/3876-21-0x0000000000160000-0x000000000061C000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/3876-20-0x0000000000160000-0x000000000061C000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/3876-24-0x0000000000160000-0x000000000061C000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/3876-19-0x0000000000161000-0x000000000018F000-memory.dmp

                    Filesize

                    184KB

                  • memory/3876-624-0x0000000000160000-0x000000000061C000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/3876-25-0x0000000000160000-0x000000000061C000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/3876-2758-0x0000000000160000-0x000000000061C000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/3876-2755-0x0000000000160000-0x000000000061C000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/3876-18-0x0000000000160000-0x000000000061C000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/3876-473-0x0000000000160000-0x000000000061C000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/3876-2629-0x0000000000160000-0x000000000061C000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/3876-2074-0x0000000000160000-0x000000000061C000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/3876-1632-0x0000000000160000-0x000000000061C000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/4568-67-0x0000000005630000-0x0000000005C5A000-memory.dmp

                    Filesize

                    6.2MB

                  • memory/4568-66-0x0000000004EF0000-0x0000000004F26000-memory.dmp

                    Filesize

                    216KB

                  • memory/4568-84-0x00000000068D0000-0x00000000068EA000-memory.dmp

                    Filesize

                    104KB

                  • memory/4568-83-0x00000000073D0000-0x0000000007466000-memory.dmp

                    Filesize

                    600KB

                  • memory/4568-80-0x0000000006390000-0x00000000063AE000-memory.dmp

                    Filesize

                    120KB

                  • memory/4568-68-0x0000000005510000-0x0000000005532000-memory.dmp

                    Filesize

                    136KB

                  • memory/4568-69-0x0000000005E10000-0x0000000005E76000-memory.dmp

                    Filesize

                    408KB

                  • memory/4568-85-0x0000000007330000-0x0000000007352000-memory.dmp

                    Filesize

                    136KB

                  • memory/4568-86-0x0000000007A40000-0x0000000007FE6000-memory.dmp

                    Filesize

                    5.6MB

                  • memory/4568-79-0x0000000005FE0000-0x0000000006337000-memory.dmp

                    Filesize

                    3.3MB

                  • memory/4568-81-0x00000000063D0000-0x000000000641C000-memory.dmp

                    Filesize

                    304KB

                  • memory/4568-70-0x0000000005E80000-0x0000000005EE6000-memory.dmp

                    Filesize

                    408KB