Analysis

  • max time kernel
    149s
  • max time network
    154s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240709-en
  • resource tags

    arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    10-07-2024 07:30

General

  • Target

    4f8c4c304d73e6e2d3d11708c57b158e648bd79132f0a973520dc14f9e3e2e01.exe

  • Size

    2.4MB

  • MD5

    7eac5517949c3ba823c0d05f296bd953

  • SHA1

    89d79b84addb51db2bdfeb90c7780dda23fabd2d

  • SHA256

    4f8c4c304d73e6e2d3d11708c57b158e648bd79132f0a973520dc14f9e3e2e01

  • SHA512

    d7b189e5b24e7c68d57eb9c42b71233463d80b046a8d6b85e40391f477db5fb09348a1a1c0a78ce93320601a238972220dd04ed41b8fa84de69feec575c9ab89

  • SSDEEP

    49152:81s8BuadFFjSnGgQWYec225D4JnoSIOXEUMF9+wKm1fMkK:2BP9SnGrfeGh+onOXEdf6m1Ek

Malware Config

Extracted

Family

stealc

Botnet

hate

C2

http://85.28.47.30

Attributes
  • url_path

    /920475a59bac849d.php

Extracted

Family

amadey

Version

4.30

Botnet

4dd39d

C2

http://77.91.77.82

Attributes
  • install_dir

    ad40971b6b

  • install_file

    explorti.exe

  • strings_key

    a434973ad22def7137dbb5e059b7081e

  • url_paths

    /Hun4Ko/index.php

rc4.plain

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Stealc

    Stealc is an infostealer written in C++.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 8 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 6 IoCs
  • Identifies Wine through registry keys 2 TTPs 4 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 2 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 10 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\4f8c4c304d73e6e2d3d11708c57b158e648bd79132f0a973520dc14f9e3e2e01.exe
    "C:\Users\Admin\AppData\Local\Temp\4f8c4c304d73e6e2d3d11708c57b158e648bd79132f0a973520dc14f9e3e2e01.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4968
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\GIJJKFCGDG.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1476
      • C:\Users\Admin\AppData\Local\Temp\GIJJKFCGDG.exe
        "C:\Users\Admin\AppData\Local\Temp\GIJJKFCGDG.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4128
        • C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
          "C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe"
          4⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1552
          • C:\Users\Admin\AppData\Local\Temp\1000006001\a1239b82bf.exe
            "C:\Users\Admin\AppData\Local\Temp\1000006001\a1239b82bf.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious use of SetWindowsHookEx
            PID:5144
          • C:\Users\Admin\AppData\Local\Temp\1000010001\a98f9f6bb6.exe
            "C:\Users\Admin\AppData\Local\Temp\1000010001\a98f9f6bb6.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of WriteProcessMemory
            PID:3132
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:1440
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
                7⤵
                • Checks processor information in registry
                • Modifies registry class
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:3568
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1916 -parentBuildID 20240401114208 -prefsHandle 1844 -prefMapHandle 1824 -prefsLen 25757 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {975738fe-308f-401f-bb80-d25f3c85bb70} 3568 "\\.\pipe\gecko-crash-server-pipe.3568" gpu
                  8⤵
                    PID:2320
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2336 -parentBuildID 20240401114208 -prefsHandle 2328 -prefMapHandle 2324 -prefsLen 26677 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ddfcd32f-92f6-4964-8dbf-06c31b4199a0} 3568 "\\.\pipe\gecko-crash-server-pipe.3568" socket
                    8⤵
                      PID:4332
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3120 -childID 1 -isForBrowser -prefsHandle 2916 -prefMapHandle 3204 -prefsLen 22698 -prefMapSize 244658 -jsInitHandle 1348 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {65dc593c-1e2a-4224-b671-049d61906f01} 3568 "\\.\pipe\gecko-crash-server-pipe.3568" tab
                      8⤵
                        PID:4048
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3940 -childID 2 -isForBrowser -prefsHandle 3932 -prefMapHandle 3872 -prefsLen 31167 -prefMapSize 244658 -jsInitHandle 1348 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7b68d972-c66a-4c6e-9233-3889b6cc9340} 3568 "\\.\pipe\gecko-crash-server-pipe.3568" tab
                        8⤵
                          PID:5524
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4760 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4764 -prefMapHandle 4172 -prefsLen 31167 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f81ef044-7503-4d2a-af39-0f34ef154cb7} 3568 "\\.\pipe\gecko-crash-server-pipe.3568" utility
                          8⤵
                          • Checks processor information in registry
                          PID:1696
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5572 -childID 3 -isForBrowser -prefsHandle 5580 -prefMapHandle 5588 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 1348 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {02142226-d7a4-4747-885f-fff1cdc5d9e2} 3568 "\\.\pipe\gecko-crash-server-pipe.3568" tab
                          8⤵
                            PID:3476
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5528 -childID 4 -isForBrowser -prefsHandle 5724 -prefMapHandle 5728 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 1348 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {af1c8a63-7161-41df-9f37-a3f602220996} 3568 "\\.\pipe\gecko-crash-server-pipe.3568" tab
                            8⤵
                              PID:5212
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5912 -childID 5 -isForBrowser -prefsHandle 5988 -prefMapHandle 5984 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 1348 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e287d9b0-5762-4150-880e-fcd602ca2b46} 3568 "\\.\pipe\gecko-crash-server-pipe.3568" tab
                              8⤵
                                PID:420
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\IIDHJDGCGD.exe"
                    2⤵
                    • Suspicious use of SetWindowsHookEx
                    PID:4104
                • C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
                  C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
                  1⤵
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Identifies Wine through registry keys
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • Suspicious behavior: EnumeratesProcesses
                  PID:3296
                • C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
                  C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
                  1⤵
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Identifies Wine through registry keys
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • Suspicious behavior: EnumeratesProcesses
                  PID:5000

                Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\ProgramData\mozglue.dll

                  Filesize

                  593KB

                  MD5

                  c8fd9be83bc728cc04beffafc2907fe9

                  SHA1

                  95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                  SHA256

                  ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                  SHA512

                  fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                • C:\ProgramData\nss3.dll

                  Filesize

                  2.0MB

                  MD5

                  1cc453cdf74f31e4d913ff9c10acdde2

                  SHA1

                  6e85eae544d6e965f15fa5c39700fa7202f3aafe

                  SHA256

                  ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                  SHA512

                  dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\q0xshw2k.default-release\activity-stream.discovery_stream.json.tmp

                  Filesize

                  18KB

                  MD5

                  de2db5a4fa74b1a500bfb9ffb3f81528

                  SHA1

                  713a350cc4ed31c355c8100808ee064a695723ff

                  SHA256

                  23a0b1e83de46d4675274b37a31d7e13a1f6b580586d0a9298be271c113ef922

                  SHA512

                  87d01203cacee424f44f081c7446f512776f19604e8bf12f15f7c0f46b36a858973d4565e98fe3ae99495429d61ae046f56eb88511cadd526ba34914cccfe281

                • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\q0xshw2k.default-release\cache2\entries\5CD1EBDF6B57F13C7E783CE5E6D8E9C44014FE1A

                  Filesize

                  13KB

                  MD5

                  0d5ee1a5f99482a7038e797816121e40

                  SHA1

                  86fe9653ff1485e59145b5f70399bdc9ee849f98

                  SHA256

                  b6b4cf0feeae5f717b5b4228cb41196908587f5b05021618c4b243fe9726916a

                  SHA512

                  401948b5106228ec80917a8eb09068ae32139b644d4ba775021b7f662849f717fb783e97140f8706af3d47cdb2afd9528bf222cc7fc34d9db3127db58b566787

                • C:\Users\Admin\AppData\Local\Temp\1000006001\a1239b82bf.exe

                  Filesize

                  2.4MB

                  MD5

                  7eac5517949c3ba823c0d05f296bd953

                  SHA1

                  89d79b84addb51db2bdfeb90c7780dda23fabd2d

                  SHA256

                  4f8c4c304d73e6e2d3d11708c57b158e648bd79132f0a973520dc14f9e3e2e01

                  SHA512

                  d7b189e5b24e7c68d57eb9c42b71233463d80b046a8d6b85e40391f477db5fb09348a1a1c0a78ce93320601a238972220dd04ed41b8fa84de69feec575c9ab89

                • C:\Users\Admin\AppData\Local\Temp\1000010001\a98f9f6bb6.exe

                  Filesize

                  1.2MB

                  MD5

                  bea6ed281b600eae06be252f581721c1

                  SHA1

                  25fae547b4ad0a74bcc0bdf7e819f2c56d8be05d

                  SHA256

                  d18bbfa83202881061743177527c4f1ea0681c658028dd7dd0468f9a8a39e7cf

                  SHA512

                  746a1bcae568caaf399ec8ca393250d6846235296088e22a2c8d80ce290e13d5845d79d7848b4f46adce2dad147b91c3731059b44ce7370f26072c999758bb42

                • C:\Users\Admin\AppData\Local\Temp\GIJJKFCGDG.exe

                  Filesize

                  1.8MB

                  MD5

                  8e5cc3afe25b3fa1938214fb22b4b782

                  SHA1

                  9f244a294689f1f2b3fb730e7edaa9751c578068

                  SHA256

                  c6b8415226bd057d38f7ede39eac5cd20dd41881269ae69f1cf22a71208a0f8f

                  SHA512

                  8d782afdd9fa14270c37f9e58ad3fa61ca1374d041483ca9c7c6b3ef7aa4f22ba1a0c2dad00df456ff65f4d8b4abc99d88317a830bad67ca2533a5e1ee84bc34

                • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                  Filesize

                  479KB

                  MD5

                  09372174e83dbbf696ee732fd2e875bb

                  SHA1

                  ba360186ba650a769f9303f48b7200fb5eaccee1

                  SHA256

                  c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                  SHA512

                  b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                  Filesize

                  13.8MB

                  MD5

                  0a8747a2ac9ac08ae9508f36c6d75692

                  SHA1

                  b287a96fd6cc12433adb42193dfe06111c38eaf0

                  SHA256

                  32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                  SHA512

                  59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q0xshw2k.default-release\AlternateServices.bin

                  Filesize

                  8KB

                  MD5

                  41320c4b8971fe620688ca24047a2f8c

                  SHA1

                  084a15650a77a1015ca840c1c5920ab3286b3787

                  SHA256

                  78a9ae25202dd1d5378f2788ef86a939675174df89cd089081fdb864b19d95c0

                  SHA512

                  23cb1fe8cbbb1f5fd24bdf2fe0980dd08e7f16f2d4494fd1fbd546adac0f71cb40d9b60a623a1eb371d2ca43fc585662f137ea9f80cf4c7d2e2885844cfc0eb3

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q0xshw2k.default-release\AlternateServices.bin

                  Filesize

                  12KB

                  MD5

                  bb3b9d789ef84f37b7264afc7f2d05f9

                  SHA1

                  d5f24b4b0b730020e740f30ddf47146be6b0a0f6

                  SHA256

                  50a3ff28719b4f6926273f211b65f6b6f15b2f6a3c6422d51a9e02a02fdeb871

                  SHA512

                  e3c2e41b94818e62c6b85b80f236dc8427a407540a1f1ae23a312ad5a680b4f37ae691daeff969885dcf47ac64b1fdfb3b4bb8b6ab687f58efe0befa7f9786d4

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q0xshw2k.default-release\datareporting\glean\db\data.safe.tmp

                  Filesize

                  16KB

                  MD5

                  c8e089c06c919ab5560931447e4586fb

                  SHA1

                  c4ccdd5f83190b522bc450b67cdfad5dc95eb2a4

                  SHA256

                  b93af6eee0779ef70e8453742e55d02f7833c1ea1a87eee71708ef310cadbb52

                  SHA512

                  037fc36443c0bfcb78416d44c38a619224cfd72dde0d1295da045fa88ca4fc154a16f9469d71c5648f7cd75f3ac649b68fcc93b7206c9154653cc80f9acd1c81

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q0xshw2k.default-release\datareporting\glean\db\data.safe.tmp

                  Filesize

                  16KB

                  MD5

                  b4302663e5942ec36ffdb71c6d55685a

                  SHA1

                  1fd3e8a581d8d94cae462fc804769584857b778e

                  SHA256

                  4eecaca5445fefa6b3460a01d58a79cae3aec7b74fcfe34a085d151ee7d21c55

                  SHA512

                  345b78b734df01486ffd971edd4fcc41c65259dc3a5bfd8b0b150fb20ce4fb2655e83eb5d2d516f6b1cf490a433ed6f709d8a20cfdd1e32b1f77389997e5a8e8

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q0xshw2k.default-release\datareporting\glean\db\data.safe.tmp

                  Filesize

                  5KB

                  MD5

                  767910d068b6aaf7579fa427530b05a8

                  SHA1

                  55a09294750ccff83553d6f267b4bfe9d1e156be

                  SHA256

                  b14b9c57570b0a3b553173f9df4750131ad5c62349f8e751969c2ecb1dddacf5

                  SHA512

                  eb153e2dcd5ff30f55a9c9ed73785d71cd2db066dac89475129fe6de137c5688effbf11e4dd2fb1e973493ac93d4c74478d9836c546041a7ff05be96398ad2ae

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q0xshw2k.default-release\datareporting\glean\pending_pings\080ef24b-41d5-4df6-898f-fee048fc17ae

                  Filesize

                  671B

                  MD5

                  ee865a5925f2d306f7002136f2ebc182

                  SHA1

                  de24bdc3a436643ab522051df99be507986fb0bf

                  SHA256

                  b7814cdbbd9586fbe516ce008d5ea605a4322ae8d06ea6a801cf6d4b21ae7492

                  SHA512

                  707bb3d8fbe606708e725973c77507b65628274c98a5fc67a2babe8b29e422f30835ce201e335f50bdc385ee5a0c50b57f080ac53c6ca1f18a8ee8761cf0976c

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q0xshw2k.default-release\datareporting\glean\pending_pings\a71d6e00-fc9f-45f3-8348-e2b4431c5b4b

                  Filesize

                  982B

                  MD5

                  a45740849fa856d704c1c6dffd3e3701

                  SHA1

                  adf24c4f5eeb0c4b853f281fb71c7edd0e6ed9c8

                  SHA256

                  7dec8088988802c0a44f5123948e32911d0ecfd20e7e028b2b3f3b4676350024

                  SHA512

                  fbeae0744b4b860309e0e95702e8abea463b0e59e1e7ccc18dbe0ed532046dfe3cfbae697554c575750eed93f091f2ba93f84397d7766342dca0b4d312919423

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q0xshw2k.default-release\datareporting\glean\pending_pings\ee833bea-987a-411e-85b8-45a448d91dde

                  Filesize

                  26KB

                  MD5

                  6b265892b590a76c6ab5cddf0cfb58d8

                  SHA1

                  ba5db57c06bd0d103a6bfae3dbfce7bdc56a2ba3

                  SHA256

                  64f2c385972046ec45646d153b90526def5db8201a986b11dc3697efb5ac596c

                  SHA512

                  88ff5ffba0da59c3ed8f3f70e0be1c5e0a386b33bc606c9ba0366bed7a030652f51f42344e7b813504905bd0a072bfeb57f6d2b616adefe292423d62dd645bb6

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q0xshw2k.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

                  Filesize

                  1.1MB

                  MD5

                  842039753bf41fa5e11b3a1383061a87

                  SHA1

                  3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                  SHA256

                  d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                  SHA512

                  d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q0xshw2k.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

                  Filesize

                  116B

                  MD5

                  2a461e9eb87fd1955cea740a3444ee7a

                  SHA1

                  b10755914c713f5a4677494dbe8a686ed458c3c5

                  SHA256

                  4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                  SHA512

                  34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q0xshw2k.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

                  Filesize

                  372B

                  MD5

                  bf957ad58b55f64219ab3f793e374316

                  SHA1

                  a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                  SHA256

                  bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                  SHA512

                  79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q0xshw2k.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

                  Filesize

                  17.8MB

                  MD5

                  daf7ef3acccab478aaa7d6dc1c60f865

                  SHA1

                  f8246162b97ce4a945feced27b6ea114366ff2ad

                  SHA256

                  bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                  SHA512

                  5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q0xshw2k.default-release\prefs-1.js

                  Filesize

                  10KB

                  MD5

                  32faf7f0ef4009cc2f6c5e47f29aa217

                  SHA1

                  d36836473ce36e26d1a8b73111f9e8668a93ffca

                  SHA256

                  792308b86a6c863ff70950a18bfdfdbada31408e508448c56235a89be6b9f455

                  SHA512

                  f79a654b7b54d4f14e5223d831eac41e7a5d953daa5280933dca18e2fdc62e4c23b68777880cc00625a6d8377ce4f1bf1017c7710f8d0d18e03ad89918c03ea3

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q0xshw2k.default-release\prefs-1.js

                  Filesize

                  13KB

                  MD5

                  d9143f352eeeb88b239f516842f33fcf

                  SHA1

                  e47cb929fe759f4ff24646dc4d8cebb2e1bdccc0

                  SHA256

                  51fbcd4bbc46eb2164ab15ba19a86173328694a461dcfeb76d03ee2167b83ce0

                  SHA512

                  ae498cda89b773a2085555bb9355a65fc3e5084435207485450e5b66150697376f892323d1e29c217018b47e4edd0ea0d9684832daa5548badfb6e79301fb3fd

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q0xshw2k.default-release\prefs.js

                  Filesize

                  8KB

                  MD5

                  3a8409d3a93ed9260d1eb7f3a31fa39a

                  SHA1

                  ebbb341517ebdbd4724cc0ca42fed897899f2a3e

                  SHA256

                  83c122d8bf03427d73c617bbe9f2164ddee268bb26549d5b16c167b024a6f88f

                  SHA512

                  a434649524024aa72ded154ffe7281ab438d5db64b5875d5c41ac52a6da77b5cdcc3f2d9a43e23cddb20d4a433ba5c5bc6c07e806d77e24db2456665f038255b

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q0xshw2k.default-release\prefs.js

                  Filesize

                  8KB

                  MD5

                  6b6d42cc3237664dfcc44432da30aad9

                  SHA1

                  d197d637484c4bb71b8dc0626e93f7e8d43008c4

                  SHA256

                  bc470c39faf13a3af2afc4a2f153509432365f9d0b2c4b0198d89e6ab83923ce

                  SHA512

                  56b8088a0d9c712e837bd3a903cc9da26265acef4d465846c9c1bdc674e514ee238e3f1cd87340a8f1a46691c26d7b748cdd22dbac14b8ea453a96fe1e83b6c5

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q0xshw2k.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

                  Filesize

                  1.1MB

                  MD5

                  1b7eeedbcc3c02ebfee7c045225276b6

                  SHA1

                  4c5351ed2f33fa223bccfc078db6ac89861a4f06

                  SHA256

                  cc304746bc2a03d455c8af030be688ce9aae709a54dcc8490af7edd86d28be9f

                  SHA512

                  f7bb671fc323b8c0adb4df7064dda763f3d8abb077c22f5010e207c4044b2ee8767b02e4fbc3ed0f391e889e0a127e4dca9781e04a6e47a77d8a7ef433481727

                • memory/1552-491-0x0000000000DA0000-0x0000000001257000-memory.dmp

                  Filesize

                  4.7MB

                • memory/1552-2608-0x0000000000DA0000-0x0000000001257000-memory.dmp

                  Filesize

                  4.7MB

                • memory/1552-981-0x0000000000DA0000-0x0000000001257000-memory.dmp

                  Filesize

                  4.7MB

                • memory/1552-499-0x0000000000DA0000-0x0000000001257000-memory.dmp

                  Filesize

                  4.7MB

                • memory/1552-2609-0x0000000000DA0000-0x0000000001257000-memory.dmp

                  Filesize

                  4.7MB

                • memory/1552-490-0x0000000000DA0000-0x0000000001257000-memory.dmp

                  Filesize

                  4.7MB

                • memory/1552-473-0x0000000000DA0000-0x0000000001257000-memory.dmp

                  Filesize

                  4.7MB

                • memory/1552-2602-0x0000000000DA0000-0x0000000001257000-memory.dmp

                  Filesize

                  4.7MB

                • memory/1552-2607-0x0000000000DA0000-0x0000000001257000-memory.dmp

                  Filesize

                  4.7MB

                • memory/1552-2594-0x0000000000DA0000-0x0000000001257000-memory.dmp

                  Filesize

                  4.7MB

                • memory/1552-97-0x0000000000DA0000-0x0000000001257000-memory.dmp

                  Filesize

                  4.7MB

                • memory/1552-2600-0x0000000000DA0000-0x0000000001257000-memory.dmp

                  Filesize

                  4.7MB

                • memory/1552-2606-0x0000000000DA0000-0x0000000001257000-memory.dmp

                  Filesize

                  4.7MB

                • memory/1552-2210-0x0000000000DA0000-0x0000000001257000-memory.dmp

                  Filesize

                  4.7MB

                • memory/3296-493-0x0000000000DA0000-0x0000000001257000-memory.dmp

                  Filesize

                  4.7MB

                • memory/3296-498-0x0000000000DA0000-0x0000000001257000-memory.dmp

                  Filesize

                  4.7MB

                • memory/4128-83-0x0000000000D60000-0x0000000001217000-memory.dmp

                  Filesize

                  4.7MB

                • memory/4128-96-0x0000000000D60000-0x0000000001217000-memory.dmp

                  Filesize

                  4.7MB

                • memory/4968-78-0x0000000000270000-0x0000000000E5F000-memory.dmp

                  Filesize

                  11.9MB

                • memory/4968-1-0x000000007F720000-0x000000007FAF1000-memory.dmp

                  Filesize

                  3.8MB

                • memory/4968-2-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                  Filesize

                  972KB

                • memory/4968-74-0x0000000000270000-0x0000000000E5F000-memory.dmp

                  Filesize

                  11.9MB

                • memory/4968-79-0x000000007F720000-0x000000007FAF1000-memory.dmp

                  Filesize

                  3.8MB

                • memory/4968-0-0x0000000000270000-0x0000000000E5F000-memory.dmp

                  Filesize

                  11.9MB

                • memory/5000-2604-0x0000000000DA0000-0x0000000001257000-memory.dmp

                  Filesize

                  4.7MB

                • memory/5000-2605-0x0000000000DA0000-0x0000000001257000-memory.dmp

                  Filesize

                  4.7MB

                • memory/5144-113-0x0000000000FF0000-0x0000000001BDF000-memory.dmp

                  Filesize

                  11.9MB

                • memory/5144-115-0x0000000000FF0000-0x0000000001BDF000-memory.dmp

                  Filesize

                  11.9MB