snakekeylogger | 0953d0c4e072d76d4161488b3b769f924bc79f61c2b4b806fcdaf1dde610d9d4

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231127-en
resource tags

arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
submitted
29-11-2023 09:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

contract.exe
Size

567KB
MD5

abe2321abf51ddcc3052ea95463cf075
SHA1

76eab53aa77073470e852fec6994132adf3fe238
SHA256

0953d0c4e072d76d4161488b3b769f924bc79f61c2b4b806fcdaf1dde610d9d4
SHA512

538309d100d80f9fccc47adc967e07b31f0c6713add0f8b081d153fccbd174376859a479624bc0f04faf4ef435c71adb69fc22f63929b4934281a7034c0a6e2f
SSDEEP

12288:5zcopox4BitDWifAXA/n7xkhGzSVv1B61dLCg92oUb:GelaWfCePVYdLC60

Score

10^/10

snakekeylogger collection keylogger spyware stealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
mail.mct2.co.za
Port:
587
Username:
[email protected]
Password:
00000

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1580-11-0x0000000000400000-0x0000000000424000-memory.dmp	family_snakekeylogger

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

contract.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2598572287-1024438387-935107970-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	contract.exe
Key opened	\REGISTRY\USER\S-1-5-21-2598572287-1024438387-935107970-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	contract.exe
Key opened	\REGISTRY\USER\S-1-5-21-2598572287-1024438387-935107970-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	contract.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

32 checkip.dyndns.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

contract.exe

description pid process target process

PID 3600 set thread context of 1580 3600 contract.exe contract.exe

flow	ioc
32	checkip.dyndns.org

description	pid	process	target process
PID 3600 set thread context of 1580	3600	contract.exe	contract.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

firefox.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies registry class 1 IoCs

Processes:

firefox.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-2598572287-1024438387-935107970-1000_Classes\Local Settings firefox.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

contract.execontract.exe

pid process

3600 contract.exe
3600 contract.exe
1580 contract.exe
1580 contract.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2598572287-1024438387-935107970-1000_Classes\Local Settings	firefox.exe

pid	process
3600	contract.exe
3600	contract.exe
1580	contract.exe
1580	contract.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

contract.execontract.exefirefox.exe

description	pid	process
Token: SeDebugPrivilege	3600	contract.exe
Token: SeDebugPrivilege	1580	contract.exe
Token: SeDebugPrivilege	3968	firefox.exe
Token: SeDebugPrivilege	3968	firefox.exe

Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

firefox.exe

pid process

3968 firefox.exe
3968 firefox.exe
3968 firefox.exe
3968 firefox.exe
Suspicious use of SendNotifyMessage 3 IoCs

Processes:

firefox.exe

pid process

3968 firefox.exe
3968 firefox.exe
3968 firefox.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

firefox.exe

pid process

3968 firefox.exe

pid	process
3968	firefox.exe
3968	firefox.exe
3968	firefox.exe
3968	firefox.exe

pid	process
3968	firefox.exe
3968	firefox.exe
3968	firefox.exe

pid	process
3968	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

contract.exefirefox.exefirefox.exe

description	pid	process	target process
PID 3600 wrote to memory of 3392	3600	contract.exe	contract.exe
PID 3600 wrote to memory of 3392	3600	contract.exe	contract.exe
PID 3600 wrote to memory of 3392	3600	contract.exe	contract.exe
PID 3600 wrote to memory of 1580	3600	contract.exe	contract.exe
PID 3600 wrote to memory of 1580	3600	contract.exe	contract.exe
PID 3600 wrote to memory of 1580	3600	contract.exe	contract.exe
PID 3600 wrote to memory of 1580	3600	contract.exe	contract.exe
PID 3600 wrote to memory of 1580	3600	contract.exe	contract.exe
PID 3600 wrote to memory of 1580	3600	contract.exe	contract.exe
PID 3600 wrote to memory of 1580	3600	contract.exe	contract.exe
PID 3600 wrote to memory of 1580	3600	contract.exe	contract.exe
PID 4976 wrote to memory of 3968	4976	firefox.exe	firefox.exe
PID 4976 wrote to memory of 3968	4976	firefox.exe	firefox.exe
PID 4976 wrote to memory of 3968	4976	firefox.exe	firefox.exe
PID 4976 wrote to memory of 3968	4976	firefox.exe	firefox.exe
PID 4976 wrote to memory of 3968	4976	firefox.exe	firefox.exe
PID 4976 wrote to memory of 3968	4976	firefox.exe	firefox.exe
PID 4976 wrote to memory of 3968	4976	firefox.exe	firefox.exe
PID 4976 wrote to memory of 3968	4976	firefox.exe	firefox.exe
PID 4976 wrote to memory of 3968	4976	firefox.exe	firefox.exe
PID 4976 wrote to memory of 3968	4976	firefox.exe	firefox.exe
PID 4976 wrote to memory of 3968	4976	firefox.exe	firefox.exe
PID 3968 wrote to memory of 1604	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 1604	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 2208	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 2208	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 2208	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 2208	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 2208	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 2208	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 2208	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 2208	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 2208	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 2208	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 2208	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 2208	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 2208	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 2208	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 2208	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 2208	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 2208	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 2208	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 2208	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 2208	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 2208	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 2208	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 2208	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 2208	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 2208	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 2208	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 2208	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 2208	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 2208	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 2208	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 2208	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 2208	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 2208	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 2208	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 2208	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 2208	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 2208	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 2208	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 2208	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 2208	3968	firefox.exe	firefox.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

Processes:

contract.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2598572287-1024438387-935107970-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	contract.exe

outlook_win_path 1 IoCs

Processes:

contract.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2598572287-1024438387-935107970-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	contract.exe

C:\Users\Admin\AppData\Local\Temp\contract.exe
"C:\Users\Admin\AppData\Local\Temp\contract.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3600

C:\Users\Admin\AppData\Local\Temp\contract.exe
"C:\Users\Admin\AppData\Local\Temp\contract.exe"
2⤵
PID:3392

C:\Users\Admin\AppData\Local\Temp\contract.exe
"C:\Users\Admin\AppData\Local\Temp\contract.exe"
2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:1580

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4976

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
2⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3968

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3968.0.965742753\1129942969" -parentBuildID 20221007134813 -prefsHandle 1896 -prefMapHandle 1888 -prefsLen 20808 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f27a87f2-4c84-491c-b66a-73e994335f1b} 3968 "\\.\pipe\gecko-crash-server-pipe.3968" 1976 271697f7458 gpu
3⤵
PID:1604

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3968.1.51057507\1198455754" -parentBuildID 20221007134813 -prefsHandle 2364 -prefMapHandle 2356 -prefsLen 20844 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {59818518-7155-42fd-aae1-4ec0dbaaa037} 3968 "\\.\pipe\gecko-crash-server-pipe.3968" 2376 271692e3e58 socket
3⤵
PID:2208

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3968.2.1295822453\1056008029" -childID 1 -isForBrowser -prefsHandle 2964 -prefMapHandle 3296 -prefsLen 20947 -prefMapSize 233444 -jsInitHandle 1092 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8583a142-838f-43e1-98a1-b7f7c4d92104} 3968 "\\.\pipe\gecko-crash-server-pipe.3968" 2900 2716d60bb58 tab
3⤵
PID:3420

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3968.3.1040714925\1070746559" -childID 2 -isForBrowser -prefsHandle 3520 -prefMapHandle 3208 -prefsLen 26126 -prefMapSize 233444 -jsInitHandle 1092 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5c700431-1f52-4175-aa74-60142c72c575} 3968 "\\.\pipe\gecko-crash-server-pipe.3968" 1668 2716be4e658 tab
3⤵
PID:3280

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3968.4.760330952\303565598" -childID 3 -isForBrowser -prefsHandle 4156 -prefMapHandle 4152 -prefsLen 26185 -prefMapSize 233444 -jsInitHandle 1092 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a513fd87-1904-4b8c-8cd3-4e88960d590c} 3968 "\\.\pipe\gecko-crash-server-pipe.3968" 4080 2716e378158 tab
3⤵
PID:2364

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3968.7.448267652\1794075054" -childID 6 -isForBrowser -prefsHandle 5700 -prefMapHandle 5696 -prefsLen 26345 -prefMapSize 233444 -jsInitHandle 1092 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4b6ab2e4-d21f-4aca-a202-f27ee48ced21} 3968 "\\.\pipe\gecko-crash-server-pipe.3968" 5616 2717060be58 tab
3⤵
PID:3640

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3968.6.2088735473\84438969" -childID 5 -isForBrowser -prefsHandle 5224 -prefMapHandle 5220 -prefsLen 26345 -prefMapSize 233444 -jsInitHandle 1092 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {27d3f062-8dda-4637-a2c9-1895e9858341} 3968 "\\.\pipe\gecko-crash-server-pipe.3968" 2916 2716f96ff58 tab
3⤵
PID:1220

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3968.5.2040521587\1999665811" -childID 4 -isForBrowser -prefsHandle 2744 -prefMapHandle 5336 -prefsLen 26345 -prefMapSize 233444 -jsInitHandle 1092 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3e3717c6-4166-4189-8006-e8b494d8049e} 3968 "\\.\pipe\gecko-crash-server-pipe.3968" 5356 2716f96e458 tab
3⤵
PID:4980

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3968.8.1190434756\539167600" -childID 7 -isForBrowser -prefsHandle 6012 -prefMapHandle 6008 -prefsLen 26345 -prefMapSize 233444 -jsInitHandle 1092 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {868fe9e7-bd22-4914-95d8-2a6ae99f5692} 3968 "\\.\pipe\gecko-crash-server-pipe.3968" 6000 27171a4e958 tab
3⤵
PID:5168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\contract.exe.log

Filesize
1KB

MD5
8ec831f3e3a3f77e4a7b9cd32b48384c

SHA1
d83f09fd87c5bd86e045873c231c14836e76a05c

SHA256
7667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982

SHA512
26bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4cx5l6t9.default-release\activity-stream.discovery_stream.json.tmp

Filesize
22KB

MD5
786e4994a785ec7cb6177a8f2bf970d9

SHA1
72ea7f300e3199223487d7847f46903ae1adc4f8

SHA256
34f62437acccbb290fdc10b0efdd37a6f283db020ea244319d83944d838d0ffa

SHA512
af0b430d76739a47e43d6776294a94367e1f8c364863c642c00c172d3891725c20e2b06a0c29fa2898f0a7f0be43d06c12017d3b7dc7944db711390261f5198f

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
8.0MB

MD5
a01c5ecd6108350ae23d2cddf0e77c17

SHA1
c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

SHA256
345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

SHA512
b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4cx5l6t9.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
e48251df949b50c9b21401949fcc3435

SHA1
fc654e40bab85115d91226ce3e13416e9e404e3f

SHA256
758615e527eeb3eb3c2107392e74df433ae63cce8efe0c0db3707baa60370fef

SHA512
12b5e244cc0c722e109453525fb82350efe6d565706230b8e903f36d8f56fe806eeb27ffdadbee43551615477bc1b85397f7664ad30d76bf84d178b5b671d434

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4cx5l6t9.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
e48251df949b50c9b21401949fcc3435

SHA1
fc654e40bab85115d91226ce3e13416e9e404e3f

SHA256
758615e527eeb3eb3c2107392e74df433ae63cce8efe0c0db3707baa60370fef

SHA512
12b5e244cc0c722e109453525fb82350efe6d565706230b8e903f36d8f56fe806eeb27ffdadbee43551615477bc1b85397f7664ad30d76bf84d178b5b671d434

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4cx5l6t9.default-release\datareporting\glean\pending_pings\14046af7-ed18-47f8-915b-29ba11118954

Filesize
11KB

MD5
20102d167096160817da9a3c3e27624d

SHA1
34f65037ef9d7cc2e13a7b2b0483d546b00bca40

SHA256
2b3a98b8394f573f5d53d60ea62fe8b86f53ff70d234d65a251f751076ed16f0

SHA512
87f018f7629eda686330a9903e8415bbe88a5dfd1ae2a44b2acddf622e0257459861ed02a37fa0148da5420a3560e74267af6a931798afb0334a2899578d68f1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4cx5l6t9.default-release\datareporting\glean\pending_pings\75008094-707d-499e-8a22-9376d8a7c56a

Filesize
746B

MD5
45e3d090bead11390c9be4da9be2fde8

SHA1
22deaa0e0b638570addb9c5f1d8ed2a283a59a71

SHA256
aa20f1d91934ab96b52688ec2403b3895640e2a22f6255a500b9d692f06e1e7e

SHA512
e5fc6d16746ce0010dc222f0757efe7d8e1d105b0a47dd3eaacfe533d1f7304b39831b7410327ce907a48318fa2c6d8147369bfadc82d012e7b4664349939d72

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4cx5l6t9.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4cx5l6t9.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4cx5l6t9.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4cx5l6t9.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4cx5l6t9.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

Filesize
11.8MB

MD5
33bf7b0439480effb9fb212efce87b13

SHA1
cee50f2745edc6dc291887b6075ca64d716f495a

SHA256
8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

SHA512
d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4cx5l6t9.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4cx5l6t9.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4cx5l6t9.default-release\prefs-1.js

Filesize
6KB

MD5
585fe7b60e72ca9f7dc16402c29581f0

SHA1
4c15b178d63a7a357da12c27d6c5b7f595fed49f

SHA256
26921a1e8e6db53c851d51fbe1133ff50830d9b9bfea9ee0bfdbe72739d82ac5

SHA512
7fee3468a9284cc88de8e5363a0ee1fdd3cd5a363469c77dc0c994a0cc4bfdd60e2ed36d839bf32407b4dc7e9a23ef4918e95e80532b6b558105cd7f7847be8d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4cx5l6t9.default-release\prefs-1.js

Filesize
7KB

MD5
31c295e08d61959c9f45b5c18e462d7e

SHA1
4bb819ec49216ebdd96789d57213ffe66a486cb0

SHA256
c2d5fdb6068edc6781768edcb597ccb7d4bb33e7d413c410212413638cebcf64

SHA512
135c3a4f80a6fef2e6c64af9d5ca1eccfb2de99f0d85acd0caf0ba2743ab9d5ad2da38d86c179f65cdf599b504a37305ed39ea18083d8569cc070e9f73cb0f09

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4cx5l6t9.default-release\prefs.js

Filesize
6KB

MD5
5edcd15f6eff71b3e79a3d2ae2d8372d

SHA1
05ed0d0f4ccfb6639a2eec21b6c27f2f974adf42

SHA256
ad3b511fbea79cfd943708714629266e7ea6e594bb6ab267842b6f04e3f013e8

SHA512
103bc22738f40d76d09ea9143555ccc0542f95e23198df95b181cfe2825a0a95ded2a6cc482c72c2abdf9e6b98710ce6f38cf4e8dc092942fb916db180b3c011

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4cx5l6t9.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
e6cc45799411c230a41cb7660ee54df0

SHA1
d8be44a8205c5b5c5254c3fd6ba0c4b49be83ff0

SHA256
d321823e3d2e89acb356a2d9c3180c9c4143f60534013ec66fa654772099b2d4

SHA512
7be8fce4aebb09c7d9adc7c075c58553b974433b3bdd43a71cb2d8673dcc8e3c4e50b8965c19bcdaf1077432e74cd5cfd246513cdeb49f63f4473cd77d49f8b9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4cx5l6t9.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
adc5fb08c5cc94d6cf3c49ad2b1e5352

SHA1
e76430271a72586be2582905e3f65d5b48574ff6

SHA256
fad0adb83c34c576c3f65ee904299ca8ede1939e44a8fab0d1618545e80b2269

SHA512
62f7bbe1d0e76ab67a6c441efa463a0ac4d9fad280916c6cda26f7464755ca198e801ed29f4dd862ae9de3f9a6b697341223f0e5ff18adc33d7b0521b5287d26

Download Submit
memory/1580-19-0x0000000074460000-0x0000000074C10000-memory.dmp

Filesize
7.7MB

Download
memory/1580-11-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1580-20-0x0000000005690000-0x00000000056A0000-memory.dmp

Filesize
64KB

Download
memory/1580-18-0x0000000006990000-0x0000000006B52000-memory.dmp

Filesize
1.8MB

Download
memory/1580-17-0x0000000006770000-0x00000000067C0000-memory.dmp

Filesize
320KB

Download
memory/1580-16-0x0000000005690000-0x00000000056A0000-memory.dmp

Filesize
64KB

Download
memory/1580-15-0x0000000074460000-0x0000000074C10000-memory.dmp

Filesize
7.7MB

Download
memory/3600-10-0x0000000006250000-0x00000000062EC000-memory.dmp

Filesize
624KB

Download
memory/3600-14-0x0000000074460000-0x0000000074C10000-memory.dmp

Filesize
7.7MB

Download
memory/3600-1-0x0000000074460000-0x0000000074C10000-memory.dmp

Filesize
7.7MB

Download
memory/3600-9-0x0000000006150000-0x00000000061AE000-memory.dmp

Filesize
376KB

Download
memory/3600-8-0x00000000046A0000-0x00000000046AA000-memory.dmp

Filesize
40KB

Download
memory/3600-7-0x0000000004FC0000-0x0000000004FC6000-memory.dmp

Filesize
24KB

Download
memory/3600-6-0x0000000004FE0000-0x0000000004FF8000-memory.dmp

Filesize
96KB

Download
memory/3600-5-0x0000000004E90000-0x0000000004E9A000-memory.dmp

Filesize
40KB

Download
memory/3600-4-0x0000000004ED0000-0x0000000004EE0000-memory.dmp

Filesize
64KB

Download
memory/3600-3-0x0000000004CF0000-0x0000000004D82000-memory.dmp

Filesize
584KB

Download
memory/3600-2-0x0000000005200000-0x00000000057A4000-memory.dmp

Filesize
5.6MB

Download
memory/3600-0-0x0000000000260000-0x00000000002F2000-memory.dmp

Filesize
584KB

Download