Analysis

  • max time kernel
    298s
  • max time network
    305s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240221-en
  • resource tags

    arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    01-03-2024 05:20

General

  • Target

    AuroraV2/Aurora X.exe

  • Size

    1.2MB

  • MD5

    e05be86ba63e832615a317b86835a5b7

  • SHA1

    b49041b0fa9ac8befc69656488223b39175df8e9

  • SHA256

    3ca80cbf5989832dab19b1ad3ade16acfc6accecc0cc2a02bf94d39aedcc1e8d

  • SHA512

    886bb8eefbaf8b050455cdc032e57e47c8c96ebfd73fc05e68b6235b33fd666d75d666a5a8f36df44668d8fb5ae85f795a90b375faa690184003f496ca1c0b94

  • SSDEEP

    24576:ezb5WDTsy3Hi4lalYItHmy53anD6XWvLXzcnQveFWCe1v6Ltnq:ehUtClljK6mLzcnUeq6Ltq

Malware Config

Signatures

  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Drops startup file 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 5 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates processes with tasklist 1 TTPs 2 IoCs
  • Modifies registry class 1 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of FindShellTrayWindow 7 IoCs
  • Suspicious use of SendNotifyMessage 6 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3232
      • C:\Users\Admin\AppData\Local\Temp\AuroraV2\Aurora X.exe
        "C:\Users\Admin\AppData\Local\Temp\AuroraV2\Aurora X.exe"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4052
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /k move Approve Approve.bat & Approve.bat & exit
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2996
          • C:\Windows\SysWOW64\tasklist.exe
            tasklist
            4⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:3720
          • C:\Windows\SysWOW64\findstr.exe
            findstr /I "wrsa.exe opssvc.exe"
            4⤵
              PID:4540
            • C:\Windows\SysWOW64\tasklist.exe
              tasklist
              4⤵
              • Enumerates processes with tasklist
              • Suspicious use of AdjustPrivilegeToken
              PID:2408
            • C:\Windows\SysWOW64\findstr.exe
              findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"
              4⤵
                PID:756
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c md 24252
                4⤵
                  PID:3460
                • C:\Windows\SysWOW64\cmd.exe
                  cmd /c copy /b Nuclear + Plasma + Proper + Merger 24252\Expressions.pif
                  4⤵
                    PID:4200
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd /c copy /b Practice 24252\z
                    4⤵
                      PID:1316
                    • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\24252\Expressions.pif
                      24252\Expressions.pif 24252\z
                      4⤵
                      • Suspicious use of NtCreateUserProcessOtherParentProcess
                      • Executes dropped EXE
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious behavior: GetForegroundWindowSpam
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of SendNotifyMessage
                      • Suspicious use of WriteProcessMemory
                      PID:4292
                    • C:\Windows\SysWOW64\PING.EXE
                      ping -n 5 127.0.0.1
                      4⤵
                      • Runs ping.exe
                      PID:1384
                • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\24252\RegAsm.exe
                  C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\24252\RegAsm.exe
                  2⤵
                  • Drops startup file
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:4648
                  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exe
                    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exe"
                    3⤵
                    • Executes dropped EXE
                    PID:1108
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe"
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1256
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe"
                    3⤵
                    • Checks processor information in registry
                    • Modifies registry class
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of SendNotifyMessage
                    • Suspicious use of SetWindowsHookEx
                    • Suspicious use of WriteProcessMemory
                    PID:4172
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4172.0.1844635289\474230183" -parentBuildID 20221007134813 -prefsHandle 1760 -prefMapHandle 1752 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b4e563bb-9943-4061-a60a-01a67636896f} 4172 "\\.\pipe\gecko-crash-server-pipe.4172" 1840 24acf2d9358 gpu
                      4⤵
                        PID:3688
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4172.1.1281739237\157830156" -parentBuildID 20221007134813 -prefsHandle 2204 -prefMapHandle 2200 -prefsLen 20783 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {49923c68-8f3c-4d2e-83d7-81939f51777c} 4172 "\\.\pipe\gecko-crash-server-pipe.4172" 2216 24ac336e858 socket
                        4⤵
                          PID:1912
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4172.2.635755705\1958367633" -childID 1 -isForBrowser -prefsHandle 2956 -prefMapHandle 2816 -prefsLen 20886 -prefMapSize 233444 -jsInitHandle 1348 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4cede4a8-2419-406d-9d20-8bd4ced75c1a} 4172 "\\.\pipe\gecko-crash-server-pipe.4172" 3084 24ad467c858 tab
                          4⤵
                            PID:3912
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4172.3.1245031193\362683044" -childID 2 -isForBrowser -prefsHandle 3436 -prefMapHandle 3432 -prefsLen 26064 -prefMapSize 233444 -jsInitHandle 1348 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5a6fe025-2da7-40cf-9083-b0e3b5daf5bd} 4172 "\\.\pipe\gecko-crash-server-pipe.4172" 3448 24ac335e858 tab
                            4⤵
                              PID:1808
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4172.4.2035101338\1817017129" -childID 3 -isForBrowser -prefsHandle 4572 -prefMapHandle 4404 -prefsLen 26123 -prefMapSize 233444 -jsInitHandle 1348 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {942cfc6d-6144-446d-9c54-1099ea56d0dd} 4172 "\\.\pipe\gecko-crash-server-pipe.4172" 4520 24ad68ab258 tab
                              4⤵
                                PID:1832
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4172.5.1804937244\1747850425" -childID 4 -isForBrowser -prefsHandle 2944 -prefMapHandle 5100 -prefsLen 26283 -prefMapSize 233444 -jsInitHandle 1348 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f03e2c5d-66b0-421c-9071-217ced9eae7b} 4172 "\\.\pipe\gecko-crash-server-pipe.4172" 2720 24ad68ad058 tab
                                4⤵
                                  PID:2072
                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4172.6.280464918\214849193" -childID 5 -isForBrowser -prefsHandle 2588 -prefMapHandle 2572 -prefsLen 26283 -prefMapSize 233444 -jsInitHandle 1348 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f897f28d-853f-4f40-83d4-7f54a183296b} 4172 "\\.\pipe\gecko-crash-server-pipe.4172" 5140 24ad7ecab58 tab
                                  4⤵
                                    PID:2232
                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4172.7.2128142249\112814475" -childID 6 -isForBrowser -prefsHandle 5252 -prefMapHandle 5140 -prefsLen 26283 -prefMapSize 233444 -jsInitHandle 1348 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {209ad811-f4e9-42f1-8e50-bf4b2115328f} 4172 "\\.\pipe\gecko-crash-server-pipe.4172" 5356 24ad7eca558 tab
                                    4⤵
                                      PID:2968
                              • C:\Windows\System32\rundll32.exe
                                C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                1⤵
                                  PID:2440

                                Network

                                MITRE ATT&CK Enterprise v15

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\vkmkrhdv.default-release\cache2\entries\E66F5AA5E3C285C270CF84BD11111C74D38F245C

                                  Filesize

                                  13KB

                                  MD5

                                  52313373fcac6836b68a7e4a9d3d919d

                                  SHA1

                                  a3910a50a721dac7e454725e4570439580c8121a

                                  SHA256

                                  da24be381aa9c6669a802009699305091e2df294f20d1c9af498ddacc0af3b6b

                                  SHA512

                                  004dc9f75d0c8a6bc609cd139d83b56748f55e5d5be856579fd635449203c259d3754433abeb7a1697ba437d854d2c789fb86d4ebdf7e476a1e39040059b252f

                                • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\24252\Expressions.pif

                                  Filesize

                                  924KB

                                  MD5

                                  848164d084384c49937f99d5b894253e

                                  SHA1

                                  3055ef803eeec4f175ebf120f94125717ee12444

                                  SHA256

                                  f58d3a4b2f3f7f10815c24586fae91964eeed830369e7e0701b43895b0cefbd3

                                  SHA512

                                  aabe1cf076f48f32542f49a92e4ca9f054b31d5a9949119991b897b9489fe775d8009896408ba49ac43ec431c87c0d385daead9dbbde7ef6309b0c97bbaf852a

                                • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\24252\RegAsm.exe

                                  Filesize

                                  63KB

                                  MD5

                                  42ab6e035df99a43dbb879c86b620b91

                                  SHA1

                                  c6e116569d17d8142dbb217b1f8bfa95bc148c38

                                  SHA256

                                  53195987d396986ebcb20425ac130e78ad308fdbd918f33f3fd92b99abda314b

                                  SHA512

                                  2e79de2d394ad33023d71611bb728b254aa4680b5a3a1ef5282b1155ddfaa2f3585c840a6700dfe0d1a276dac801298431f0187086d2e8f96b22f6c808fb97e5

                                • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Approve

                                  Filesize

                                  11KB

                                  MD5

                                  4849b374e88e174f9b35b5e5e9269ae6

                                  SHA1

                                  6199bff5bad3b5088685aeb08686ad303f4f6c29

                                  SHA256

                                  1deef19e64390b8d41481acd973405e9ce23cfabdcac203f684532de244ac073

                                  SHA512

                                  1c079cb1d8f78e1833945967fc0daf3bd8250196fe430bea1db8522385e0b193e1ee488b821c760e1f12f4c8d61b653871df4675e73c115964857ed3d2cc0ff9

                                • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Merger

                                  Filesize

                                  191KB

                                  MD5

                                  7196d7109e4b363cd13654db907ffea4

                                  SHA1

                                  21f016d6c8e5bde1c23e48e9cb811dce3227eb7b

                                  SHA256

                                  9eacfcb6381b4e19513707811960b233337460e57a798e053d6cd0b4e1c3a7e4

                                  SHA512

                                  41ab7e0411dcb7b378a2068756a403f0092b19dac52f244f871e871abee10b78d29b54a89b411a9b841777a5e4d47def9c60f40cdbbd60bc2f3690c739fd4b02

                                • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Nuclear

                                  Filesize

                                  188KB

                                  MD5

                                  62a7e75d1df779e6169adb0cfa905694

                                  SHA1

                                  3f855dc814432bd0cd6e793c5a5bb2776b838602

                                  SHA256

                                  7fa7da730c634c4a21832d2d35cbe4a6d1484fcfadbae988e2e97a9ad76f73db

                                  SHA512

                                  1f22866bfe4c6186b77c05aca2e4088c30e7ea1fe6057782a2a7aefda9221c78be2fe2cc5c673fd266e12218e91a66b254e90ff1d94f9ba6b8552c1e6bbc1698

                                • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Plasma

                                  Filesize

                                  253KB

                                  MD5

                                  65b274e03e99948cbb03a0464e66ba89

                                  SHA1

                                  129196df7c9cc04f868f66e0f8fad494a6c4e379

                                  SHA256

                                  4bfaa5267e22645c0cdacc3154902d9ca2ea3559f47d6acf6813aa20ee1bb75d

                                  SHA512

                                  2fcb83966b7c9d1709124c9efc5bd24aa1135e91a74d2c92e344465de1ab4b42811a8f2e264e801acbe4f3080e575a0730a38e87564c9f5c74a9d5f71b7a8bc4

                                • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Practice

                                  Filesize

                                  1.2MB

                                  MD5

                                  02c12a95e4fcbadc9cd8c35c8a6b5b45

                                  SHA1

                                  3f9f0e5680497727ff7f6a3a3a245087ec668a79

                                  SHA256

                                  d3cd709f6751e6f167b3e04706f45542528088af51454a6cfde05041523b0e72

                                  SHA512

                                  5cb441debcb4a68dbe2ad07576452bb7bbdc2630b711a9ef2a2d9068216c48d00e9a063d52fce2bdb274b7872d842c91e84318da31d6d7c8d2d41a4e72204a2c

                                • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Proper

                                  Filesize

                                  292KB

                                  MD5

                                  5047c62efa1d3a7319f3495137cb8224

                                  SHA1

                                  0d0d3d840d2d484d8e4db23fd72aff6a0c514aed

                                  SHA256

                                  76c8d934bd2c8abae1b4cc482c45cf910935411ab643f8c0e54be92c2f63849a

                                  SHA512

                                  66cfc6656cd6f18fea5fba95d0403664b188acf21a53d76eda5f6692d41950f69ccf2b0ae8e7aeefb0e50c068acf4f61357109983ff2c6db8e1efc076bd9ecfc

                                • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                                  Filesize

                                  442KB

                                  MD5

                                  85430baed3398695717b0263807cf97c

                                  SHA1

                                  fffbee923cea216f50fce5d54219a188a5100f41

                                  SHA256

                                  a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

                                  SHA512

                                  06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

                                • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                                  Filesize

                                  4.9MB

                                  MD5

                                  70e04a4dbbf107e041089857e81b76d9

                                  SHA1

                                  0a53fa1bb0f4435bfcc85f4cfda3a3d5cc10cd5e

                                  SHA256

                                  ae62c3d82c5762d5c601376abeb2d082dbac4a71babe8a35bc5b12e68049a6ed

                                  SHA512

                                  2048229652bec6a09b972224fc49d0f3c6c8a9cebcdcebfd690487acfe12e16a0967fc3a4d54a922dc96bdf2f32c19bee29bb25960bd022eed9b801f5aa3ed97

                                • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exe

                                  Filesize

                                  4KB

                                  MD5

                                  a5ce3aba68bdb438e98b1d0c70a3d95c

                                  SHA1

                                  013f5aa9057bf0b3c0c24824de9d075434501354

                                  SHA256

                                  9b860be98a046ea97a7f67b006e0b1bc9ab7731dd2a0f3a9fd3d710f6c43278a

                                  SHA512

                                  7446f1256873b51a59b9d2d3498cef5a41dbce55864c2a5fb8cb7d25f7d6e6d8ea249d551a45b75d99b1ad0d6fb4b5e4544e5ca77bcd627717d6598b5f566a79

                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vkmkrhdv.default-release\datareporting\glean\db\data.safe.bin

                                  Filesize

                                  2KB

                                  MD5

                                  0af622e932df1e7e6fc47bc4f492f587

                                  SHA1

                                  ec2cbe411991e23bd66182d92851403acff4f6b1

                                  SHA256

                                  abe28bafdb98d844bd8984b4dd0eb36c521c6cdff9c093085560305f42b1d3af

                                  SHA512

                                  b877d05b40f16d224a27f1e47efc3c55c3839831546d7735620f324194c17e2a80a9e6b82a491b3b14723c0d33e1560c69f21a7dafae805f25b8f2976061fa36

                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vkmkrhdv.default-release\datareporting\glean\pending_pings\236f4082-6a2b-4316-8585-201990d2f1b7

                                  Filesize

                                  12KB

                                  MD5

                                  08f755cbdf1677ced27487e175d27257

                                  SHA1

                                  70f5c598c4c12c72517178f0736cafb96b96e4d1

                                  SHA256

                                  9d9bb22e736e269e3711787340343f379c6592c6001bdfca5d4d02859360eca2

                                  SHA512

                                  88612a5ce38310ade58177edcb83c0d6a9a8bd3278e0ecad8961cc89261226eaea71c98f7ecc2dc72d718cb0b316d18d81f8658cec0d0c0e97c77f1aa76dae68

                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vkmkrhdv.default-release\datareporting\glean\pending_pings\86b1ecb8-0ddf-48a4-93ec-03f6e9040372

                                  Filesize

                                  746B

                                  MD5

                                  6b940b60a756d2c95b223d19bbcdfd69

                                  SHA1

                                  8d15f55babad4a41c155b07399fd09883b067a55

                                  SHA256

                                  53b42f37e2b463349eff2e034ba4afa1cc4d2ae0cd9689a72cd5713bde194e53

                                  SHA512

                                  9e6c0498fb8e4c90d0dcd65685110734590f61348c0eb3184d08b2aa9cc79ccf1b641614a029475d6910c31b41db6fec1aabaceb1e29dc2035656726432db379

                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vkmkrhdv.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

                                  Filesize

                                  997KB

                                  MD5

                                  fe3355639648c417e8307c6d051e3e37

                                  SHA1

                                  f54602d4b4778da21bc97c7238fc66aa68c8ee34

                                  SHA256

                                  1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

                                  SHA512

                                  8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vkmkrhdv.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

                                  Filesize

                                  116B

                                  MD5

                                  3d33cdc0b3d281e67dd52e14435dd04f

                                  SHA1

                                  4db88689282fd4f9e9e6ab95fcbb23df6e6485db

                                  SHA256

                                  f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

                                  SHA512

                                  a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vkmkrhdv.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

                                  Filesize

                                  479B

                                  MD5

                                  49ddb419d96dceb9069018535fb2e2fc

                                  SHA1

                                  62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

                                  SHA256

                                  2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

                                  SHA512

                                  48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vkmkrhdv.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

                                  Filesize

                                  372B

                                  MD5

                                  8be33af717bb1b67fbd61c3f4b807e9e

                                  SHA1

                                  7cf17656d174d951957ff36810e874a134dd49e0

                                  SHA256

                                  e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

                                  SHA512

                                  6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vkmkrhdv.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

                                  Filesize

                                  4.3MB

                                  MD5

                                  304a31b460365fa382886de3282a6fd2

                                  SHA1

                                  2beef6cdfbdbbb1fcbae6bb92036a11815085160

                                  SHA256

                                  bdd90bfedd51310f94e851876b2773e927f160fdc73b03eb423b7d7e2aa7506a

                                  SHA512

                                  e2651ce0e1af68ee6aa4f0cadaad57f1be849d722d7391bf9cc3e89ee4b47cbfaca71f8527d23eb0ce0834c135d132c1d3e90e0090d140ed44272510005ecf43

                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vkmkrhdv.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

                                  Filesize

                                  1KB

                                  MD5

                                  688bed3676d2104e7f17ae1cd2c59404

                                  SHA1

                                  952b2cdf783ac72fcb98338723e9afd38d47ad8e

                                  SHA256

                                  33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

                                  SHA512

                                  7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vkmkrhdv.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

                                  Filesize

                                  1KB

                                  MD5

                                  937326fead5fd401f6cca9118bd9ade9

                                  SHA1

                                  4526a57d4ae14ed29b37632c72aef3c408189d91

                                  SHA256

                                  68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

                                  SHA512

                                  b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vkmkrhdv.default-release\prefs-1.js

                                  Filesize

                                  6KB

                                  MD5

                                  a4d515a5d68dc409c013bbe6df0c82d5

                                  SHA1

                                  183049b71f138db57c8fdbba91c2c84c45c03ede

                                  SHA256

                                  8ebe51f2e8d051f440520507c73b98a1946214ce5102b6a63d85da2571e81654

                                  SHA512

                                  9389c5f5951174d1233b0bc30bfef624cf8b74dbcbda30b16d836af68269c555f41f9943dba7a52d2da15be0c3ccca30c5a0b2c943870110cee8e7844ccf1d35

                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vkmkrhdv.default-release\prefs-1.js

                                  Filesize

                                  8KB

                                  MD5

                                  5917509aa83e833dc264b392f35c6673

                                  SHA1

                                  d6885a7f1c36e1dfd180fc2e2cb1e47d8124b912

                                  SHA256

                                  84cf04077971649b1a6f32928c05f98aec42833fda0e32f9e47f91f5e7c51438

                                  SHA512

                                  e7b06e867bfc43b7124d8640e71a5eea9959d2a83e76de74240b68683de853d48168c395b78a0f843964640eea2a341c4d91011750d7a980b0d425e8909db91e

                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vkmkrhdv.default-release\sessionstore-backups\recovery.jsonlz4

                                  Filesize

                                  1KB

                                  MD5

                                  2bc6e144f6d23b377d79ba76c58842d2

                                  SHA1

                                  1d2408abad245dbe18a1ccb16a59992cf311d645

                                  SHA256

                                  154e649c4a8507ff053c1da3c221e2e47590bea295d54c0f419aa89fd9f79a9f

                                  SHA512

                                  c82618f5ab09e4f043dfed77b673b349613483e21e4dc86849d1e1a15c918c1aae84cd602c349aad1c9222e9246c13a30fb128cd0ce7ec96a610ae364421b51f

                                • memory/1108-62-0x00007FFC291B0000-0x00007FFC29C72000-memory.dmp

                                  Filesize

                                  10.8MB

                                • memory/1108-61-0x00007FFC291B0000-0x00007FFC29C72000-memory.dmp

                                  Filesize

                                  10.8MB

                                • memory/1108-60-0x00000000001F0000-0x00000000001F8000-memory.dmp

                                  Filesize

                                  32KB

                                • memory/4292-27-0x0000000004140000-0x0000000004141000-memory.dmp

                                  Filesize

                                  4KB

                                • memory/4292-24-0x0000000077531000-0x0000000077653000-memory.dmp

                                  Filesize

                                  1.1MB

                                • memory/4648-32-0x0000000072D90000-0x0000000073541000-memory.dmp

                                  Filesize

                                  7.7MB

                                • memory/4648-59-0x0000000072D90000-0x0000000073541000-memory.dmp

                                  Filesize

                                  7.7MB

                                • memory/4648-46-0x0000000008300000-0x000000000882C000-memory.dmp

                                  Filesize

                                  5.2MB

                                • memory/4648-45-0x0000000007C00000-0x0000000007DC2000-memory.dmp

                                  Filesize

                                  1.8MB

                                • memory/4648-44-0x0000000007640000-0x0000000007690000-memory.dmp

                                  Filesize

                                  320KB

                                • memory/4648-43-0x00000000067C0000-0x00000000067DE000-memory.dmp

                                  Filesize

                                  120KB

                                • memory/4648-42-0x0000000006740000-0x00000000067B6000-memory.dmp

                                  Filesize

                                  472KB

                                • memory/4648-41-0x00000000066A0000-0x0000000006732000-memory.dmp

                                  Filesize

                                  584KB

                                • memory/4648-40-0x0000000006B40000-0x00000000070E6000-memory.dmp

                                  Filesize

                                  5.6MB

                                • memory/4648-39-0x0000000005BC0000-0x0000000005C26000-memory.dmp

                                  Filesize

                                  408KB

                                • memory/4648-38-0x0000000005A30000-0x0000000005A7C000-memory.dmp

                                  Filesize

                                  304KB

                                • memory/4648-37-0x00000000057A0000-0x00000000057DC000-memory.dmp

                                  Filesize

                                  240KB

                                • memory/4648-36-0x0000000005740000-0x0000000005752000-memory.dmp

                                  Filesize

                                  72KB

                                • memory/4648-35-0x0000000005920000-0x0000000005A2A000-memory.dmp

                                  Filesize

                                  1.0MB

                                • memory/4648-34-0x0000000005E30000-0x0000000006448000-memory.dmp

                                  Filesize

                                  6.1MB

                                • memory/4648-33-0x0000000005800000-0x0000000005810000-memory.dmp

                                  Filesize

                                  64KB

                                • memory/4648-29-0x0000000001020000-0x00000000010B8000-memory.dmp

                                  Filesize

                                  608KB