risepro | 414bc8252808bd382cbd95d01ab481cebb912ace9f4e4ff6fa3d3c4ca3e4db4b

Analysis

max time kernel
162s
max time network
175s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
24-06-2024 05:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Setup.exe
Size

763.9MB
MD5

4bd4b45bd3794ed04f005e35fe26a1ae
SHA1

af6c84972f62c82e34452bc525e6e9853d674420
SHA256

20873ad9d1cec3cc30369b5efa593e53ba9cfbf1769fa919be59d6f6eea7fb1c
SHA512

6aa4a0b1bfab7a9f00c1c7a5da7cd2647abcc1891041ded060c2e1e27cefd5c77e1d8072f19879c38acb2eaa055c47635559ccde03f234c2a8bcbb4ae7a914a7
SSDEEP

196608:ViMcReCLHdwM5kVKqSVlMWXmam9uLepUltO7cF+d9e/nd:VhCHCokVKrzMWX7m6lkIF+did

Score

10^/10

risepro collection discovery spyware stealer

Malware Config

Extracted

Family

risepro

77.91.77.117:50500

Signatures

RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Setup.exe
Key opened	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Setup.exe
Key opened	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Setup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
100	ipinfo.io
102	ipinfo.io

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
1432	Setup.exe
1432	Setup.exe
1432	Setup.exe
1432	Setup.exe
1432	Setup.exe
1432	Setup.exe
1432	Setup.exe
1432	Setup.exe
1432	Setup.exe
1432	Setup.exe
1432	Setup.exe
1432	Setup.exe
1432	Setup.exe
1432	Setup.exe
1432	Setup.exe
1432	Setup.exe
1432	Setup.exe
1432	Setup.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2672	firefox.exe
Token: SeDebugPrivilege	2672	firefox.exe
Token: SeDebugPrivilege	2672	firefox.exe
Token: SeDebugPrivilege	2672	firefox.exe
Token: SeDebugPrivilege	2672	firefox.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
2672	firefox.exe
2672	firefox.exe
2672	firefox.exe
2672	firefox.exe
2672	firefox.exe
2672	firefox.exe
2672	firefox.exe
2672	firefox.exe

Suspicious use of SendNotifyMessage 7 IoCs

pid	Process
2672	firefox.exe
2672	firefox.exe
2672	firefox.exe
2672	firefox.exe
2672	firefox.exe
2672	firefox.exe
2672	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2672	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3596 wrote to memory of 2672	3596	firefox.exe	94
PID 3596 wrote to memory of 2672	3596	firefox.exe	94
PID 3596 wrote to memory of 2672	3596	firefox.exe	94
PID 3596 wrote to memory of 2672	3596	firefox.exe	94
PID 3596 wrote to memory of 2672	3596	firefox.exe	94
PID 3596 wrote to memory of 2672	3596	firefox.exe	94
PID 3596 wrote to memory of 2672	3596	firefox.exe	94
PID 3596 wrote to memory of 2672	3596	firefox.exe	94
PID 3596 wrote to memory of 2672	3596	firefox.exe	94
PID 3596 wrote to memory of 2672	3596	firefox.exe	94
PID 3596 wrote to memory of 2672	3596	firefox.exe	94
PID 2672 wrote to memory of 1700	2672	firefox.exe	95
PID 2672 wrote to memory of 1700	2672	firefox.exe	95
PID 2672 wrote to memory of 4556	2672	firefox.exe	96
PID 2672 wrote to memory of 4556	2672	firefox.exe	96
PID 2672 wrote to memory of 4556	2672	firefox.exe	96
PID 2672 wrote to memory of 4556	2672	firefox.exe	96
PID 2672 wrote to memory of 4556	2672	firefox.exe	96
PID 2672 wrote to memory of 4556	2672	firefox.exe	96
PID 2672 wrote to memory of 4556	2672	firefox.exe	96
PID 2672 wrote to memory of 4556	2672	firefox.exe	96
PID 2672 wrote to memory of 4556	2672	firefox.exe	96
PID 2672 wrote to memory of 4556	2672	firefox.exe	96
PID 2672 wrote to memory of 4556	2672	firefox.exe	96
PID 2672 wrote to memory of 4556	2672	firefox.exe	96
PID 2672 wrote to memory of 4556	2672	firefox.exe	96
PID 2672 wrote to memory of 4556	2672	firefox.exe	96
PID 2672 wrote to memory of 4556	2672	firefox.exe	96
PID 2672 wrote to memory of 4556	2672	firefox.exe	96
PID 2672 wrote to memory of 4556	2672	firefox.exe	96
PID 2672 wrote to memory of 4556	2672	firefox.exe	96
PID 2672 wrote to memory of 4556	2672	firefox.exe	96
PID 2672 wrote to memory of 4556	2672	firefox.exe	96
PID 2672 wrote to memory of 4556	2672	firefox.exe	96
PID 2672 wrote to memory of 4556	2672	firefox.exe	96
PID 2672 wrote to memory of 4556	2672	firefox.exe	96
PID 2672 wrote to memory of 4556	2672	firefox.exe	96
PID 2672 wrote to memory of 4556	2672	firefox.exe	96
PID 2672 wrote to memory of 4556	2672	firefox.exe	96
PID 2672 wrote to memory of 4556	2672	firefox.exe	96
PID 2672 wrote to memory of 4556	2672	firefox.exe	96
PID 2672 wrote to memory of 4556	2672	firefox.exe	96
PID 2672 wrote to memory of 4556	2672	firefox.exe	96
PID 2672 wrote to memory of 4556	2672	firefox.exe	96
PID 2672 wrote to memory of 4556	2672	firefox.exe	96
PID 2672 wrote to memory of 4556	2672	firefox.exe	96
PID 2672 wrote to memory of 4556	2672	firefox.exe	96
PID 2672 wrote to memory of 4556	2672	firefox.exe	96
PID 2672 wrote to memory of 4556	2672	firefox.exe	96
PID 2672 wrote to memory of 4556	2672	firefox.exe	96
PID 2672 wrote to memory of 4556	2672	firefox.exe	96
PID 2672 wrote to memory of 4556	2672	firefox.exe	96
PID 2672 wrote to memory of 4556	2672	firefox.exe	96
PID 2672 wrote to memory of 4556	2672	firefox.exe	96
PID 2672 wrote to memory of 4556	2672	firefox.exe	96
PID 2672 wrote to memory of 4556	2672	firefox.exe	96
PID 2672 wrote to memory of 4556	2672	firefox.exe	96
PID 2672 wrote to memory of 4556	2672	firefox.exe	96
PID 2672 wrote to memory of 4556	2672	firefox.exe	96
PID 2672 wrote to memory of 4556	2672	firefox.exe	96
PID 2672 wrote to memory of 4556	2672	firefox.exe	96
PID 2672 wrote to memory of 1740	2672	firefox.exe	98
PID 2672 wrote to memory of 1740	2672	firefox.exe	98
PID 2672 wrote to memory of 1740	2672	firefox.exe	98

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Setup.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Setup.exe

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- outlook_office_path
- outlook_win_path
PID:1432

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3920

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3596
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2672
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2672.0.758054801\820098164" -parentBuildID 20221007134813 -prefsHandle 1868 -prefMapHandle 1860 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {245c1333-f2d2-4bcc-9de9-23f468f98c88} 2672 "\\.\pipe\gecko-crash-server-pipe.2672" 1948 2939acd7e58 gpu
    3⤵
    PID:1700
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2672.1.1865159524\420839275" -parentBuildID 20221007134813 -prefsHandle 2336 -prefMapHandle 2304 -prefsLen 20785 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {37ecf012-c87c-4bff-b1f9-7c42850be31b} 2672 "\\.\pipe\gecko-crash-server-pipe.2672" 2348 29387072258 socket
    3⤵
    - Checks processor information in registry
    PID:4556
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2672.2.241903981\107823924" -childID 1 -isForBrowser -prefsHandle 3148 -prefMapHandle 3144 -prefsLen 20888 -prefMapSize 233444 -jsInitHandle 1400 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0cb2dcc6-fae1-4518-977c-9050ebfa3af2} 2672 "\\.\pipe\gecko-crash-server-pipe.2672" 3160 2939ac5fc58 tab
    3⤵
    PID:1740
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2672.3.1303583022\367173366" -childID 2 -isForBrowser -prefsHandle 3616 -prefMapHandle 3612 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1400 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5e946068-35d9-4c1c-b70e-49d39766fbc7} 2672 "\\.\pipe\gecko-crash-server-pipe.2672" 3628 29387062258 tab
    3⤵
    PID:4832
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2672.4.561402243\1089402875" -childID 3 -isForBrowser -prefsHandle 4776 -prefMapHandle 4772 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1400 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bfed0bec-e6a4-4a68-a86d-824d46276644} 2672 "\\.\pipe\gecko-crash-server-pipe.2672" 4788 293a0081058 tab
    3⤵
    PID:4536
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2672.5.1227911079\1021766037" -childID 4 -isForBrowser -prefsHandle 5148 -prefMapHandle 5152 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1400 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {483c2efb-e1b0-4c28-83bf-7a50f56858c4} 2672 "\\.\pipe\gecko-crash-server-pipe.2672" 4992 2938705e558 tab
    3⤵
    PID:5136
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2672.6.521669167\1664377290" -childID 5 -isForBrowser -prefsHandle 5236 -prefMapHandle 5240 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1400 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8a1b2adc-272b-4cb1-889a-feefaae737b0} 2672 "\\.\pipe\gecko-crash-server-pipe.2672" 5268 29387060158 tab
    3⤵
    PID:5168
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2672.7.1974151600\1886907209" -childID 6 -isForBrowser -prefsHandle 5436 -prefMapHandle 5440 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1400 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c34ddead-6be5-4206-91f5-e94b45eb4bdb} 2672 "\\.\pipe\gecko-crash-server-pipe.2672" 5328 293a0081958 tab
    3⤵
    PID:5184
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2672.8.1680576434\1484047417" -childID 7 -isForBrowser -prefsHandle 4956 -prefMapHandle 2908 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1400 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4dacc64c-b33f-419b-9e93-8a415d77e1ad} 2672 "\\.\pipe\gecko-crash-server-pipe.2672" 3024 293a1fe3258 tab
    3⤵
    PID:5868

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3756 --field-trial-handle=2248,i,10247514684337323751,15511974759131734137,262144 --variations-seed-version /prefetch:8
1⤵
PID:380

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=2952 --field-trial-handle=2248,i,10247514684337323751,15511974759131734137,262144 --variations-seed-version /prefetch:3
1⤵
PID:4608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\a9c04813-27e3-45d3-94ed-0a7b41ced13d.tmp

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4s2odj76.default-release\cache2\entries\62DDE6077D1C69BAC79D366A23438C5D7E86D770

Filesize
213KB

MD5
d6b41e304673b7390a0f4b92c56acefa

SHA1
c8dceefa04468a31958ad98d7696b9a9db248658

SHA256
1a499b0b3e230c33f2232180914e08fbaa77e34bfdfb021672386b327f9b0f13

SHA512
22cb2400d553799febb5e2c385879b831b82b76b8acdf4e53acee6201eabcdca516e245fb943bc1c6816cbd49916f38a816ea0d7cb9948380326477b5a58038c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4s2odj76.default-release\cache2\entries\C6A6389A9162CEB2E1F41436B370871FECA58F75

Filesize
60KB

MD5
318a6dd997df4167d752aac0f0f34dd0

SHA1
21452fb54b1f209ad09a32f197cfe403d7f97995

SHA256
636c97fba8e988dcfedbe6248f570fa3ba9129f0816a8f5390b0e755a67270f3

SHA512
849676625330c558328e6a06e44453ab7c2e5fc875fab6c52e5ff2dfa0ac19ac2c62eab67e73dae40270c0c5590df03d51bb44575ee10b80c17fb15ad7aad7a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\spanuRXwAXcggagv\McvWOkHsI3hQWeb Data

Filesize
220KB

MD5
568f1b99bed86691e4117ef061008380

SHA1
4ae332f6c14b0c6440e4a339eb2a4b6cea238554

SHA256
e3d4ae5acddea28f2d5f67ce7adbba95841b8c4096b586e6b14f860739fc46ca

SHA512
a69bf696f713b5c35f047cfd5fbb6202950b24054d235756b8ea29eb646668a409b02d5014196ad7fb6dd4923ee4eaea02be1ba6d5832cc155be4c963336004f

Download Submit
C:\Users\Admin\AppData\Local\Temp\spanuRXwAXcggagv\r1o45mIuidGMWeb Data

Filesize
92KB

MD5
4c2e2189b87f507edc2e72d7d55583a0

SHA1
1f06e340f76d41ea0d1e8560acd380a901b2a5bd

SHA256
99a5f8dea08b5cf512ed888b3e533cc77c08dc644078793dc870abd8828c1bca

SHA512
8b6b49e55afe8a697aaf71d975fab9e906143339827f75a57876a540d0d7b9e3cbbcdd8b5435d6198900a73895cc52d2082e66ee8cec342e72f2e427dde71600

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
37cd7ff37c0db30ad189bf8eb46eecf6

SHA1
c91623829f9635baee9b6f21bdd811457d3722c6

SHA256
5c6d64a914a0d1a229f9e03b632bbd62937599336dca714472525e6f32c5e465

SHA512
4031c73dd55ba639fab46186c3ff05f6426fb969016b89de1f4514117bcfba55c916bc4536a5a09c72db64640d2bed8bf6a0604955c4cd0d5c6e524b049ce18e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\datareporting\glean\pending_pings\28fcae64-dfe2-4e41-a00b-d82214198f67

Filesize
10KB

MD5
6a6948f90ebc7b9085261dfc3c38fba3

SHA1
34171a817ce8a7d97e063cfd810033b765d7e78b

SHA256
638010ef1df2b2c8bc6741c35e2ccfc5dc627fd99ba4d44a5818081c18690401

SHA512
786155858551430783e56cf5122987efb17e6fde8facd6437729240be97a1919257554187ff3c1fac64a66c17d5bb865bdc76230f67da01f915c05ba85eb7730

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\datareporting\glean\pending_pings\5dabbf3f-3a2d-4bd7-b70e-19fd80b9af22

Filesize
746B

MD5
01011ae5bda1db516f447217a935dcb7

SHA1
dd25c16080193d53beb0126c9a1782a5c5262916

SHA256
d203b62b35cfa3c3bb280d59e758a1fc33fc6c3f3c0d8a57d3ce071e26dcc73c

SHA512
1e5344d67e00d1cef85e9128961290d63d34e63eb6ab3d2cb2df8d23d3a73eabfb0d51923f28f91eef18ada51d2a97845085a6b249f86c78fcf25677a8b30c34

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\formhistory.sqlite

Filesize
256KB

MD5
67788df398f5680febc990c1def186e0

SHA1
de1cc07b8478c5eee1b89f686df1e575c94675bc

SHA256
66e1d5e172c486dad6351806165b42cfbfa669e885fa35b282d366cbe5eabb73

SHA512
38e2e738e41a5ae7554337b4fb3cda0f38c48118120ea33b695ed1921852a5ad79512989d33187e97b76d72415c0fd4acccdc9a18fa501ead954620d4e69d07f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\places.sqlite

Filesize
5.0MB

MD5
88b63349ff8121bb1c6dfe726a0bb8f8

SHA1
c2493c1cc3303b2b8da58ec9b135b32b2c4db516

SHA256
43558f1f3d00d6f23239744cf948a65fee6e28063d1e19e30caece9a08f9a7e2

SHA512
0cd4fa0e57a7147391c64df2d678edca24febc1c81895e1e2e53bc67c2be973adfc8a757896b8ab22d583958bc88952bb2872c43aa72f0dad120b247d206de3c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\prefs-1.js

Filesize
6KB

MD5
adee6c9e4e3ec42e4ac9d258e7e78f54

SHA1
f0f1534591f3e9fc98611092e84e3d627fd88eab

SHA256
3174cf5cfef6af6d7f54aa9a7def9a8e99b16539925b53701612eb7334c3b409

SHA512
98100c38e912d8104d9383a439888f08a180929fdfd24f4755718e68423de739a7544fbb9bc5954f665bb955400fc453d21da5427008744a59c6bfd12ed23699

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\prefs-1.js

Filesize
6KB

MD5
5b8ee4dabb6f1290195b1bffd31605de

SHA1
daa6e85af6391edc7f4d02611a6cb30b6a2c0650

SHA256
330d889587695399b2a99098367ab82da5d39b6f89ed33f6f2c3c118c6654498

SHA512
07d128ec4b7a86a1dfc3f8995ccda7af521c9a35364ca89cbd75c51904183844fe78a7c3e72f95438dd6f10d198767116bd2de63b1c872fe445aa7546eb70246

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\prefs.js

Filesize
6KB

MD5
9ea67bae7954a4780b3e536597756e93

SHA1
f38d209b39730d388e9bfc6f20f827f2a23e4325

SHA256
e00c7a435aab2ed20fbbe8ad2e17634ee1b02c2392346ae3e726bce02397a6e9

SHA512
09bc47a6232ac89dc2f2e8a64de116a206d06bef0840edec9dbb032fbff008655a76afa9601f641d13f38ec066fd9c5a15aaedbe8ed26887d8c590114d24ae03

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\prefs.js

Filesize
6KB

MD5
ac9ef55da3fe6959b3119282641401b2

SHA1
e295dc6ee3b72bca3bc7b53c31575a9a9994c4e0

SHA256
c8064341a5bf00e1a7dce34acac9cea100eebef582d18972f9b8181fd3e64694

SHA512
2274294fbea349841d45009ba394900a0d7a67772941ccfec88c022d40ee9b106933c191bc0d006e22b9aced729649e7d509a9e60e43ae37f53305a60aeeb996

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
0666bc1d51515ef4af93734ccd574f72

SHA1
9b5cc3d02be5b46e210e59780883ad56d125358b

SHA256
d056a43a1396cf23c0ffd77b8c790eb79fa98b1ad4582572182338d94577180d

SHA512
101cf6d7a52049f8c244e61808bfffdbbf0a7d401b2400bbaf63674df58dcb349c2e56088bb81c59fbad4607d42d0f7c33c3ed24e486ca3fdaa96537599f220b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
80c69813fa4bc13ff60dae76a83b4e7d

SHA1
8d4e467bf191fc6e933fc7fd5ad755fbe5aba3ff

SHA256
6f2d602718a0f35c6973c1ce05d6d24c846fb584228de09afe30b5a0b4e1b279

SHA512
de00a93a0f978f50d4d0ba8a3e75c1625140beba7e1f549cf1ce125eb2fea5423fc7bf7b96e490148428b8aa97720fc2a2cea7b56567d245d4337caff8dd7f53

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
18444cfb0765efdbd917959b86025fe3

SHA1
e0e50b44544eb9825aba272ad443c2230a7b385d

SHA256
7f4b8986d0dbbad9ca75c78a0624195ef69a331e08467cc6861a614a7fea5642

SHA512
c96a381d9b2330d485e182a921394f7401003f2162e6fe9fbfd22d2428d6629e1eaa47da52c62a1993004ec354ce48464ed77e2d3f9b1a070a0e18d525c6947c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
e5575fb8a9e01af79e4b6e40aeba4d18

SHA1
806a3c1e7978a60166e7241d56867ffed0ed4acf

SHA256
72e01302d61947dd957819d5bc2fc6c1a758e9c52794ec8286544cdd837f5f6c

SHA512
35b7028a1aeee669cb6ed30f4cb7f0cfffc238de66287d044923f1422e51a838fad30cb8f39dc446fb90defad92842239115063cd381b7c8d2a28e9ee7b8b43e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore.jsonlz4

Filesize
4KB

MD5
9b8158482a98ca65467e7e5e055194d8

SHA1
820fa73c7649a2a0509a6e3ebb22f0de2687829b

SHA256
54e30dc24a0d91beb5898a9a0a972348570eb433267deb9a3a1bcaae13a11dcc

SHA512
af8e773b84906303ebfd54f6446df05f4c01ff11c2e709ce6415dda3b690497ef116379a3af3300616c83e3268b34f4c7cd94918044e8ab738436437ab254239

Download Submit
memory/1432-8-0x00000000000F0000-0x0000000000FE8000-memory.dmp

Filesize
15.0MB

Download
memory/1432-13-0x00000000000F0000-0x0000000000FE8000-memory.dmp

Filesize
15.0MB

Download
memory/1432-7-0x00000000000F0000-0x0000000000FE8000-memory.dmp

Filesize
15.0MB

Download
memory/1432-199-0x00000000005EA000-0x0000000000850000-memory.dmp

Filesize
2.4MB

Download
memory/1432-6-0x0000000003500000-0x0000000003501000-memory.dmp

Filesize
4KB

Download
memory/1432-0-0x00000000005EA000-0x0000000000850000-memory.dmp

Filesize
2.4MB

Download
memory/1432-1-0x00000000014C0000-0x00000000014C1000-memory.dmp

Filesize
4KB

Download
memory/1432-3-0x0000000001680000-0x0000000001681000-memory.dmp

Filesize
4KB

Download
memory/1432-4-0x00000000016A0000-0x00000000016A1000-memory.dmp

Filesize
4KB

Download
memory/1432-5-0x00000000034F0000-0x00000000034F1000-memory.dmp

Filesize
4KB

Download
memory/1432-200-0x00000000000F0000-0x0000000000FE8000-memory.dmp

Filesize
15.0MB

Download
memory/1432-2-0x0000000001560000-0x0000000001561000-memory.dmp

Filesize
4KB

Download