Analysis

  • max time kernel
    143s
  • max time network
    152s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    11-09-2024 20:02

General

  • Target

    b653aa8a63c1a7b1545618939c165fcf6a996e8fc45e1a6442f77e37b672a117.exe

  • Size

    1.8MB

  • MD5

    28fc680cd7ce04804903263844ab3fec

  • SHA1

    74dbf07bf5be88466023076f1b5a8192e5fb7e65

  • SHA256

    b653aa8a63c1a7b1545618939c165fcf6a996e8fc45e1a6442f77e37b672a117

  • SHA512

    6c7130922b5c21ffaa99b855ea6416f649b3dd91313c6d76b4273eb74281b9cb18ca806a68c34f9ed908c846983576a27b8a4d811277017e3fe4dc78d40696ba

  • SSDEEP

    49152:KI4oWqTQFp2YFGSVHqCrlqgB0obxDJMefD5:KlDNFRHEgDmYD

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

c7817d

C2

http://31.41.244.10

Attributes
  • install_dir

    0e8d0864aa

  • install_file

    svoutse.exe

  • strings_key

    5481b88a6ef75bcf21333988a4e47048

  • url_paths

    /Dem7kTu/index.php

rc4.plain

Extracted

Family

stealc

Botnet

rave

C2

http://185.215.113.103

Attributes
  • url_path

    /e2b1563c6670f193.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Stealc

    Stealc is an infostealer written in C++.

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 12 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 5 IoCs
  • Identifies Wine through registry keys 2 TTPs 6 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 2 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 16 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 23 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 22 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\b653aa8a63c1a7b1545618939c165fcf6a996e8fc45e1a6442f77e37b672a117.exe
    "C:\Users\Admin\AppData\Local\Temp\b653aa8a63c1a7b1545618939c165fcf6a996e8fc45e1a6442f77e37b672a117.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:2172
    • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
      "C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3376
      • C:\Users\Admin\AppData\Roaming\1000026000\2c6f07f57d.exe
        "C:\Users\Admin\AppData\Roaming\1000026000\2c6f07f57d.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Loads dropped DLL
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        PID:2584
      • C:\Users\Admin\AppData\Local\Temp\1000030001\a9e6e6f344.exe
        "C:\Users\Admin\AppData\Local\Temp\1000030001\a9e6e6f344.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:1340
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\Admin\AppData\Local\Temp\1000039041\do.ps1"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2228
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /c start msedge https://www.youtube.com/account
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2932
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /c start msedge https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2608
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3728
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
            5⤵
            • Checks processor information in registry
            PID:1380
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
          4⤵
          • Checks processor information in registry
          • Modifies registry class
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1792
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1944 -parentBuildID 20240401114208 -prefsHandle 1520 -prefMapHandle 1700 -prefsLen 23678 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1c11553f-0637-41b4-9a41-d0d5ccd16501} 1792 "\\.\pipe\gecko-crash-server-pipe.1792" gpu
            5⤵
              PID:3276
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2408 -parentBuildID 20240401114208 -prefsHandle 2384 -prefMapHandle 2372 -prefsLen 24598 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {218d4882-52c7-41e3-aac7-34b55b89e892} 1792 "\\.\pipe\gecko-crash-server-pipe.1792" socket
              5⤵
                PID:1644
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3240 -childID 1 -isForBrowser -prefsHandle 3228 -prefMapHandle 3224 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1048 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8033b0b0-cd8a-43c8-8aa2-c1eebaf488a8} 1792 "\\.\pipe\gecko-crash-server-pipe.1792" tab
                5⤵
                  PID:3484
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3024 -childID 2 -isForBrowser -prefsHandle 2976 -prefMapHandle 2768 -prefsLen 22693 -prefMapSize 244658 -jsInitHandle 1048 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4474f73f-59c8-411c-9260-8abd2fbaab00} 1792 "\\.\pipe\gecko-crash-server-pipe.1792" tab
                  5⤵
                    PID:4072
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4440 -childID 3 -isForBrowser -prefsHandle 2976 -prefMapHandle 2768 -prefsLen 29088 -prefMapSize 244658 -jsInitHandle 1048 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0ca96c45-91f8-445e-a0db-aa676201f937} 1792 "\\.\pipe\gecko-crash-server-pipe.1792" tab
                    5⤵
                      PID:3956
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5168 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 5164 -prefMapHandle 5136 -prefsLen 29088 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2ab57904-ddab-4d23-b59b-dbf14079c64a} 1792 "\\.\pipe\gecko-crash-server-pipe.1792" utility
                      5⤵
                      • Checks processor information in registry
                      PID:124
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5840 -childID 4 -isForBrowser -prefsHandle 5848 -prefMapHandle 5808 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1048 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {827290b3-1ca5-45c9-bf58-48e3a8d696bb} 1792 "\\.\pipe\gecko-crash-server-pipe.1792" tab
                      5⤵
                        PID:2604
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6028 -childID 5 -isForBrowser -prefsHandle 5948 -prefMapHandle 5952 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1048 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e39f639c-874c-438c-a4a8-78a08d710932} 1792 "\\.\pipe\gecko-crash-server-pipe.1792" tab
                        5⤵
                          PID:996
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6136 -childID 6 -isForBrowser -prefsHandle 6148 -prefMapHandle 6152 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1048 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d28e4f19-67f9-4879-a14a-a0fdbb5e9320} 1792 "\\.\pipe\gecko-crash-server-pipe.1792" tab
                          5⤵
                            PID:2284
                  • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                    C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                    1⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Identifies Wine through registry keys
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • Suspicious behavior: EnumeratesProcesses
                    PID:5264
                  • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                    C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                    1⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Identifies Wine through registry keys
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • Suspicious behavior: EnumeratesProcesses
                    PID:1500

                  Network

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\ProgramData\mozglue.dll

                    Filesize

                    593KB

                    MD5

                    c8fd9be83bc728cc04beffafc2907fe9

                    SHA1

                    95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                    SHA256

                    ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                    SHA512

                    fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                  • C:\ProgramData\nss3.dll

                    Filesize

                    2.0MB

                    MD5

                    1cc453cdf74f31e4d913ff9c10acdde2

                    SHA1

                    6e85eae544d6e965f15fa5c39700fa7202f3aafe

                    SHA256

                    ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                    SHA512

                    dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                  • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\r5m741b5.default-release\activity-stream.discovery_stream.json

                    Filesize

                    18KB

                    MD5

                    a4829227b4da98b1e900cfd785d5b73f

                    SHA1

                    8506052a8bd9f67ddbe401302c8a77c92a2d77c6

                    SHA256

                    70411fe15ee64b22bba18bf7638cc837e2087f02ef39ef3d57d40b331317c35d

                    SHA512

                    1af1a59149290e8145cae15effac56af06427e0133a5ed62bf5094da4641100eccc6c5672674f70bdf1f6ef0eb499022b9b4d6af803793003839fe943873d19e

                  • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\r5m741b5.default-release\cache2\entries\58EFA56DB4BFFECB0EDA547894BC9A057159E22F

                    Filesize

                    13KB

                    MD5

                    d3a2a3b79232ebd9697e6a7fead8cc9e

                    SHA1

                    2d7902efb24532b633f759b10a49f866f12c167e

                    SHA256

                    7bd9e110de27e299bedc48ed988329d37ed0ab3f96d8114af13a589665ef41cc

                    SHA512

                    4ca4498e833a581e298a53d30a0886e4fe1690665c146dd0a5d66eb47ab5d07e5ba8d70db309f6e8787bb9bb987805b998dc7dcc70a12baf56bd5ebe598f109a

                  • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe

                    Filesize

                    1.8MB

                    MD5

                    28fc680cd7ce04804903263844ab3fec

                    SHA1

                    74dbf07bf5be88466023076f1b5a8192e5fb7e65

                    SHA256

                    b653aa8a63c1a7b1545618939c165fcf6a996e8fc45e1a6442f77e37b672a117

                    SHA512

                    6c7130922b5c21ffaa99b855ea6416f649b3dd91313c6d76b4273eb74281b9cb18ca806a68c34f9ed908c846983576a27b8a4d811277017e3fe4dc78d40696ba

                  • C:\Users\Admin\AppData\Local\Temp\1000039041\do.ps1

                    Filesize

                    2KB

                    MD5

                    e05e8f072b373beafe27cc11d85f947c

                    SHA1

                    1d6daeb98893e8122b8b69287ebd9d43f3c6138e

                    SHA256

                    717c09427fa5754ba92f92961545534048d0a76528c2e95c4d5ec6cef47c612f

                    SHA512

                    b3e34162e5ee43bb01f289eebc45fd3ea3e07f30be40dcf6635606540f912fe5c84d301e9f78e97dfe3ffe53e72547e50f3bcd7d4ebe5ab8da451a1989c469a0

                  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0g3qqzum.odv.ps1

                    Filesize

                    60B

                    MD5

                    d17fe0a3f47be24a6453e9ef58c94641

                    SHA1

                    6ab83620379fc69f80c0242105ddffd7d98d5d9d

                    SHA256

                    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                    SHA512

                    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                  • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                    Filesize

                    479KB

                    MD5

                    09372174e83dbbf696ee732fd2e875bb

                    SHA1

                    ba360186ba650a769f9303f48b7200fb5eaccee1

                    SHA256

                    c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                    SHA512

                    b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                  • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                    Filesize

                    13.8MB

                    MD5

                    0a8747a2ac9ac08ae9508f36c6d75692

                    SHA1

                    b287a96fd6cc12433adb42193dfe06111c38eaf0

                    SHA256

                    32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                    SHA512

                    59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                  • C:\Users\Admin\AppData\Roaming\1000026000\2c6f07f57d.exe

                    Filesize

                    1.7MB

                    MD5

                    0f0ef1482985e6cf9403f782e6ba6d10

                    SHA1

                    d7b44e16fc1eb2845b3db09a4fec9ba66dfcebe4

                    SHA256

                    cc65a55c66501ede8db7f899410180caa449102982130e4ed48a45909156e3c1

                    SHA512

                    6b484bcbba919e8c2dfc86f703196adbe065c04b93d74d47cc63f7df2e1224a62c854b5b5c03b235c48f4db3a9449d59c9a6dbed832f2e0c0f0fccf739b0a794

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\AlternateServices.bin

                    Filesize

                    6KB

                    MD5

                    b96949003f65386b6e25962aa7f9954b

                    SHA1

                    593da29ca8dad2be0945b0db07df56106e9c8494

                    SHA256

                    1205e4174ffa96a2ad64f08895eeb6b150971d5cabe1b1bbd8e2786166198a43

                    SHA512

                    df2a3d3485190c19856246121a67dc1b52def16a5563d57db88a5af657c3cb1728ec163c8cdd1322079970c9aa06cc1a5d442c7720806b91e5726b5267d8fc31

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\AlternateServices.bin

                    Filesize

                    25KB

                    MD5

                    3c3560b67bb2787da95cc641e5639e6b

                    SHA1

                    9e1cbaa33b569ef52797febc7e14ae8eeb4bad31

                    SHA256

                    f8acd6f06c435ce0660d22b5c6dacbe85ba7c7d06fd57b67f3c1c1edb9aae15b

                    SHA512

                    4a66f3cf342bd2d4637dd4d0903026873d6716d5033926fece04fa42604bae2e1ccbf556a6ad96253032c625653d3d1706d3596b7aaf0f3d1293dfcadabea398

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\AlternateServices.bin

                    Filesize

                    10KB

                    MD5

                    14c5d26a8db3f2d4fbd587b045aeaa97

                    SHA1

                    8a879bfc592b2c783820f9e99219666b08abe9ef

                    SHA256

                    c5859618adc5de7166948928041117d3976f7479b910349c53c8fbf5fad6835f

                    SHA512

                    3564d466467ed36267e0e5925dac0ce6a852e2d4ad12264ec150e9f4c2475a6f546b74eb9c0598c058b33a280d9f27cd607b85901763ab7080426fd781a74896

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\AlternateServices.bin

                    Filesize

                    23KB

                    MD5

                    f2efb404dbb4465bb87e51b4f93edf61

                    SHA1

                    a301ad661dd50e914bc4cce6246f13f15cc49c7e

                    SHA256

                    5b1ef0c799b2ad72cd2bc6da50b4145115772c1bcc8d8451338b0b7184a0ec74

                    SHA512

                    35ccd0e989158528f60494a13741fcd34bf0b96982e49d1a7343b76ee1250b1099dfce81f0dc18a2ccbf1d7d9eb71aaf873f4af1a823f11c4f54f2034721730e

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\cookies.sqlite

                    Filesize

                    512KB

                    MD5

                    f1b7f826d6fa51b896dd324afda07379

                    SHA1

                    e3c10e7481e7a55c6c55f233c64798bee514cea1

                    SHA256

                    7d9d56f4aefeffb82ff8969cce9ecbe9e96974e9788b9e2d8c56d811e204c235

                    SHA512

                    d4306adab198e07d596341eb29dec18da37d91504e8d129ee507d8cdea0f6f1f5f127530f30ad58d6617537fa63e95035878a51b38e419ece881b86eddca0f84

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\cookies.sqlite-wal

                    Filesize

                    512KB

                    MD5

                    e37dfd6a1a7eb2963506c926c2ae026b

                    SHA1

                    feea3d6cd427c3caef35c96a8359b7a94ca0ed35

                    SHA256

                    e9b8606b6fad2124eee2aaa280b16245ed9bd367616aa2a21779823d87c94243

                    SHA512

                    bb78c09402a946dbc3fef0d61fe55baba1c2c94ec085caee977fa23ffa548aa97bb6b731a09c19251c78641c185aa3ab44c5b1e7870857cc4c5ebdd161703641

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\datareporting\glean\db\data.safe.tmp

                    Filesize

                    6KB

                    MD5

                    d4ca65c262e39767c9ca08d488556b60

                    SHA1

                    a6824401546038eb7ea44c0133783c051ccece8a

                    SHA256

                    55bcc1af94c23eff45dd1be0b5e6b426ccf21878de1b8495a8de9808f6287ffa

                    SHA512

                    1eaa6f6d9f31ec466327e9246ed0f1292000a52af23b6d73406d89b56ddaa4fa9f8af06d6c55db53d20c4b3247415c60ee1ca2a9d3269ffeb8f337cf0bef27cc

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\datareporting\glean\db\data.safe.tmp

                    Filesize

                    6KB

                    MD5

                    eaa759d3555d0e0f8cabcdde34195ea6

                    SHA1

                    af1d467d742243043936dd94a9e06249b7d5a338

                    SHA256

                    974e962fe49ebef86d960c9b5b96ac6987de433584e8c147887ca6dac3539b27

                    SHA512

                    ddf09d5933239ce2a5a32d5d17c459010b74a3b48eb164919fe1c4841bd66b05866e7bf162ad77b888d45cde210735ee12bab9e09aa6457ca8e6ac59f6ce5ee3

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\datareporting\glean\db\data.safe.tmp

                    Filesize

                    5KB

                    MD5

                    6ee0d9d4440e4443eb552a38e34052e1

                    SHA1

                    1a084ac0d876c468de32311debfab5be5507675c

                    SHA256

                    46afd0f88ac02652ee7419bc1fb84760e5966171fccadb9affb41a242e438b01

                    SHA512

                    086579e604f1edb472f14ee6f1311d66b07e9afae090ec8ab0a2548a197bb02d60ba36ce533ce1602466b9c6afa93f40ee8a146f37c97a83340099cc82736a9c

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\datareporting\glean\db\data.safe.tmp

                    Filesize

                    5KB

                    MD5

                    2ba9d063661e9d64d4c329c52973f913

                    SHA1

                    8e94e50e3a0f00c245d291c57abc017ccc39e140

                    SHA256

                    6653a0bb0dbd5e9ea6e25d2c611307959f20e93a8845abaf8a1e48bfff25c16b

                    SHA512

                    c94866c66e4f94dba2c571777582667c8ca459f5837f46818d7ceaf3122fa6c0ae84d618e8d7731328b39e0d83b4405c640691663b4e3e452ec508afa7476192

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\datareporting\glean\db\data.safe.tmp

                    Filesize

                    15KB

                    MD5

                    043c930474049f4b73ccb58a6cdced75

                    SHA1

                    bff5ea0f1e3ed124d8c773abbaaf02122129d9da

                    SHA256

                    b03978370627c72848cffc21f69bd9dc966870daae431e305664a613ac07a646

                    SHA512

                    de75a5b3e9d76c52a1c08a963411b340feebe250c6a19a1ab64ca194dab76de32bb4b46d177bd8cb98d85c3a28795d64fb74a1d01268da138112a074351c448a

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\datareporting\glean\pending_pings\5144c841-7bc1-4123-a1ea-530f504eacdc

                    Filesize

                    671B

                    MD5

                    985d28001ac9069ab5eb632dec545f8b

                    SHA1

                    7bbf7089fb6c1788c6ced675889ecb097723d3b6

                    SHA256

                    cb29eba31fa785e1e3c9252e1435e908fa9a230e0a10e5f3f9941fa66e2bd447

                    SHA512

                    5b66d5a48c45339ee85065f257927ef130623096a57fa728486886fc5e0a6ebee808adfc0a80fdd2101cf78b238908810a21b5baa645dd9938a400115f0b6b25

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\datareporting\glean\pending_pings\5b8bc7e1-1a88-4730-9aa1-189ac8ff97e6

                    Filesize

                    25KB

                    MD5

                    df4b21aec8b417e41a160a36d1c57938

                    SHA1

                    45c3ef1b8b96558aff9fab3e0a135573431be1c7

                    SHA256

                    b0054e05de686b789be23362ca6a4ff94cd3671f26299d2475a99f0473fd0be4

                    SHA512

                    eb60614812e38f54c5e068191380ae4dd6694fdb5fd18d3bcaa28ed19bf139292005a3738b7a6181a7c5543ad565764b6209663b925f7a97c6c12b4fdf79c4e2

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\datareporting\glean\pending_pings\c55f6f82-2d6d-4f90-8503-5620fef73df1

                    Filesize

                    982B

                    MD5

                    6fb3614335250b7e76b582443c4654da

                    SHA1

                    411a7f0883310055b75f72e97ae5934781a7cba2

                    SHA256

                    b298e932dfc3c4385feb266fc5f8935c607613ed5ca2a5b8e8172c79a4a47fde

                    SHA512

                    6491a13d7b9d5701f13f73a0ea0521fa075f7223b74dc4e3330c71e56696ecabc3c9ed22cb33aac2a57b9c39f00802ca71fecbac0f152a546624796c8bf88b44

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

                    Filesize

                    1.1MB

                    MD5

                    842039753bf41fa5e11b3a1383061a87

                    SHA1

                    3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                    SHA256

                    d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                    SHA512

                    d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

                    Filesize

                    116B

                    MD5

                    2a461e9eb87fd1955cea740a3444ee7a

                    SHA1

                    b10755914c713f5a4677494dbe8a686ed458c3c5

                    SHA256

                    4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                    SHA512

                    34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

                    Filesize

                    372B

                    MD5

                    bf957ad58b55f64219ab3f793e374316

                    SHA1

                    a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                    SHA256

                    bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                    SHA512

                    79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

                    Filesize

                    17.8MB

                    MD5

                    daf7ef3acccab478aaa7d6dc1c60f865

                    SHA1

                    f8246162b97ce4a945feced27b6ea114366ff2ad

                    SHA256

                    bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                    SHA512

                    5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\places.sqlite

                    Filesize

                    5.0MB

                    MD5

                    097fa9abb2bfcfd3f3bff3f649cdaf7a

                    SHA1

                    f45ec3311f60a7efdfd2d6ce0f4b31be349f4214

                    SHA256

                    a66336e1e7a05f1becdfd0514c2b3d257c7d1564f838fc60dc5cbd158606b7c4

                    SHA512

                    19cfb100a9b39ccf12f4c072571cb467f34621808cc3337badf827791a031c53765256356475865cfdd42561f92ec28b358da5723f8795e127798a43da97109c

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\places.sqlite-wal

                    Filesize

                    2.2MB

                    MD5

                    b40497c02e9b997b6b6163beb8c83a40

                    SHA1

                    5e9e288afc396f6150ddc81f05a03cd5b79155b7

                    SHA256

                    06d740e419fd7b0e5f4ed0c2693afa00ea98d54656793ab98aa315f58ab21608

                    SHA512

                    37618bd00ae8ff33faa1c79891e0ae086b1fe995b8d0914e47532b75cd06a4afc166da15cfee5dd7e257971c2985596a38998dbc8d22e1e810aedf242c512ec3

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\prefs-1.js

                    Filesize

                    12KB

                    MD5

                    1025cf4d28410cc741751dfd3f8f17ba

                    SHA1

                    182fa4e9efbb73ab6956ea6ce00db4ca06a977d1

                    SHA256

                    84fcd3dae6e1ed2a74c7402085ad1f019f2ff53e8cc5d84f72b92fdc173f4ea2

                    SHA512

                    cebb8fc0b2b7bd3a999d872c6744741fe33721747178e0cbe48363ec7e80ca3d71ffbd2c2cf519f86a2b16dc7968292d01de80e0c192af1f5d7ceb43533352ee

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\prefs-1.js

                    Filesize

                    15KB

                    MD5

                    3864d5fb535368c4e7743cbc048b0f40

                    SHA1

                    9b520e75f5cbda0dc7d8045ada87a8b9210d4fe1

                    SHA256

                    69200ae689a1b292ab19bb5d7a83117061daadc6e677e613d70a704ac9c962af

                    SHA512

                    52266c5f30277befcde1990ea8017ec2231f404578419a4b26d4ecb36efcd8f1ad3a4c6f776aa704cc9a6bc763c1e3d8f02ce24ab0c4694d73f61ee2c6c0d0e9

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\prefs.js

                    Filesize

                    16KB

                    MD5

                    d6ee2b8dd5e8e42bf6527280dd7d2a60

                    SHA1

                    2cbf42793d305640e6c7f3add5a388f6a5205819

                    SHA256

                    22205bd2ce4051dbc157bf144b897ce9c00ad1be88cfe6896d08c64f88bb12ba

                    SHA512

                    a666ad9990602d352f766361042fccb74a56c169f35318d22a94f83d9f5a822eec69cc25869aa97a4d648800e22cecb23fdbf3e4abba3ee711fa06a66c9a80df

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\sessionstore-backups\recovery.baklz4

                    Filesize

                    1KB

                    MD5

                    71ddbd674a4d9b91d70c6cde7cf6bbe7

                    SHA1

                    af1735f3c72b4f7da1e939ce9fff83534e88f27e

                    SHA256

                    2b56d0bab27cfdf417ecef9830e833a4201ee09a98149f60f84107131b4f36e6

                    SHA512

                    b17bf522a9c14d838a4cbd5a97ee70f98c898b9bd618652f6e80df8fae8d65e2bfe71fef60fb17a7dd9c884dcfde763e8684d458bc4cbc11706288f0eb46391b

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\sessionstore-backups\recovery.baklz4

                    Filesize

                    5KB

                    MD5

                    16303917d19dfee1416c415707713d76

                    SHA1

                    0e373ecc9142c77b5673efb6a0bdc016b8583642

                    SHA256

                    5319caba13770ff597ee615b59f4b7b2071da2f4727d7085dad2b417a16c8745

                    SHA512

                    58b6362f1af110e1b0b2fcf1dfbef8723b29110984ca9fb71becee344c51942abd42621081a0c2db923641c76335b4ae1e0e03eb14e22cbaddf01b37ef7af410

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r5m741b5.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

                    Filesize

                    1.4MB

                    MD5

                    76a1ab5423e2620694d99935330239bb

                    SHA1

                    3c74a7eadc9e19245d6d3ff9ed70b985fec1a773

                    SHA256

                    0da2ce4972a23e24e5b80f93be0e01fe71a3a3fcde3d67229949002cb9103329

                    SHA512

                    e102693e06ced74c03e9d7ad8690dd801d98aa0a88bc880226f294ab7bb7b4bc14890b6f0472f313e54b08a6aa50bcd21377c5e9b529cc5b1a91b4f6ac1da8d1

                  • memory/1340-491-0x0000000000CD0000-0x0000000001346000-memory.dmp

                    Filesize

                    6.5MB

                  • memory/1340-1384-0x0000000000CD0000-0x0000000001346000-memory.dmp

                    Filesize

                    6.5MB

                  • memory/1340-2643-0x0000000000CD0000-0x0000000001346000-memory.dmp

                    Filesize

                    6.5MB

                  • memory/1340-2012-0x0000000000CD0000-0x0000000001346000-memory.dmp

                    Filesize

                    6.5MB

                  • memory/1340-513-0x0000000000CD0000-0x0000000001346000-memory.dmp

                    Filesize

                    6.5MB

                  • memory/1340-2763-0x0000000000CD0000-0x0000000001346000-memory.dmp

                    Filesize

                    6.5MB

                  • memory/1340-2779-0x0000000000CD0000-0x0000000001346000-memory.dmp

                    Filesize

                    6.5MB

                  • memory/1340-665-0x0000000000CD0000-0x0000000001346000-memory.dmp

                    Filesize

                    6.5MB

                  • memory/1340-2028-0x0000000000CD0000-0x0000000001346000-memory.dmp

                    Filesize

                    6.5MB

                  • memory/1340-58-0x0000000000CD0000-0x0000000001346000-memory.dmp

                    Filesize

                    6.5MB

                  • memory/1340-1057-0x0000000000CD0000-0x0000000001346000-memory.dmp

                    Filesize

                    6.5MB

                  • memory/1500-2742-0x0000000000400000-0x00000000008AC000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/2172-4-0x0000000000950000-0x0000000000DFC000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/2172-0-0x0000000000950000-0x0000000000DFC000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/2172-18-0x0000000000950000-0x0000000000DFC000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/2172-1-0x0000000077DF6000-0x0000000077DF8000-memory.dmp

                    Filesize

                    8KB

                  • memory/2172-2-0x0000000000951000-0x000000000097F000-memory.dmp

                    Filesize

                    184KB

                  • memory/2172-3-0x0000000000950000-0x0000000000DFC000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/2228-71-0x0000000005530000-0x0000000005596000-memory.dmp

                    Filesize

                    408KB

                  • memory/2228-86-0x0000000006050000-0x0000000006072000-memory.dmp

                    Filesize

                    136KB

                  • memory/2228-67-0x0000000002260000-0x0000000002296000-memory.dmp

                    Filesize

                    216KB

                  • memory/2228-68-0x0000000004D90000-0x00000000053BA000-memory.dmp

                    Filesize

                    6.2MB

                  • memory/2228-69-0x00000000053F0000-0x0000000005412000-memory.dmp

                    Filesize

                    136KB

                  • memory/2228-70-0x00000000054B0000-0x0000000005516000-memory.dmp

                    Filesize

                    408KB

                  • memory/2228-80-0x00000000055A0000-0x00000000058F7000-memory.dmp

                    Filesize

                    3.3MB

                  • memory/2228-81-0x0000000005A90000-0x0000000005AAE000-memory.dmp

                    Filesize

                    120KB

                  • memory/2228-82-0x0000000005AB0000-0x0000000005AFC000-memory.dmp

                    Filesize

                    304KB

                  • memory/2228-84-0x0000000006B60000-0x0000000006BF6000-memory.dmp

                    Filesize

                    600KB

                  • memory/2228-87-0x00000000071B0000-0x0000000007756000-memory.dmp

                    Filesize

                    5.6MB

                  • memory/2228-85-0x0000000005FC0000-0x0000000005FDA000-memory.dmp

                    Filesize

                    104KB

                  • memory/2584-1968-0x0000000000330000-0x00000000009A6000-memory.dmp

                    Filesize

                    6.5MB

                  • memory/2584-2578-0x0000000000330000-0x00000000009A6000-memory.dmp

                    Filesize

                    6.5MB

                  • memory/2584-2775-0x0000000000330000-0x00000000009A6000-memory.dmp

                    Filesize

                    6.5MB

                  • memory/2584-660-0x0000000000330000-0x00000000009A6000-memory.dmp

                    Filesize

                    6.5MB

                  • memory/2584-460-0x0000000000330000-0x00000000009A6000-memory.dmp

                    Filesize

                    6.5MB

                  • memory/2584-1008-0x0000000000330000-0x00000000009A6000-memory.dmp

                    Filesize

                    6.5MB

                  • memory/2584-483-0x0000000000330000-0x00000000009A6000-memory.dmp

                    Filesize

                    6.5MB

                  • memory/2584-38-0x0000000000330000-0x00000000009A6000-memory.dmp

                    Filesize

                    6.5MB

                  • memory/2584-1370-0x0000000000330000-0x00000000009A6000-memory.dmp

                    Filesize

                    6.5MB

                  • memory/2584-47-0x0000000000330000-0x00000000009A6000-memory.dmp

                    Filesize

                    6.5MB

                  • memory/2584-48-0x0000000000330000-0x00000000009A6000-memory.dmp

                    Filesize

                    6.5MB

                  • memory/2584-1731-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                    Filesize

                    972KB

                  • memory/2584-2746-0x0000000000330000-0x00000000009A6000-memory.dmp

                    Filesize

                    6.5MB

                  • memory/2584-512-0x0000000000330000-0x00000000009A6000-memory.dmp

                    Filesize

                    6.5MB

                  • memory/2584-57-0x0000000000330000-0x00000000009A6000-memory.dmp

                    Filesize

                    6.5MB

                  • memory/2584-2025-0x0000000000330000-0x00000000009A6000-memory.dmp

                    Filesize

                    6.5MB

                  • memory/3376-1541-0x0000000000400000-0x00000000008AC000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/3376-1214-0x0000000000400000-0x00000000008AC000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/3376-2171-0x0000000000400000-0x00000000008AC000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/3376-520-0x0000000000400000-0x00000000008AC000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/3376-59-0x0000000000400000-0x00000000008AC000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/3376-2739-0x0000000000400000-0x00000000008AC000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/3376-2016-0x0000000000400000-0x00000000008AC000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/3376-2794-0x0000000000400000-0x00000000008AC000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/3376-49-0x0000000000400000-0x00000000008AC000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/3376-697-0x0000000000400000-0x00000000008AC000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/3376-499-0x0000000000400000-0x00000000008AC000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/3376-2782-0x0000000000400000-0x00000000008AC000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/3376-22-0x0000000000400000-0x00000000008AC000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/3376-21-0x0000000000400000-0x00000000008AC000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/3376-20-0x0000000000400000-0x00000000008AC000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/3376-19-0x0000000000401000-0x000000000042F000-memory.dmp

                    Filesize

                    184KB

                  • memory/3376-91-0x0000000000400000-0x00000000008AC000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/3376-2776-0x0000000000400000-0x00000000008AC000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/3376-16-0x0000000000400000-0x00000000008AC000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/3376-2780-0x0000000000400000-0x00000000008AC000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/3376-2781-0x0000000000400000-0x00000000008AC000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/5264-541-0x0000000000400000-0x00000000008AC000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/5264-544-0x0000000000400000-0x00000000008AC000-memory.dmp

                    Filesize

                    4.7MB