Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-07-2024 12:05

General

  • Target

    3e7263c4d3a28991776ac9bd812e605b4018b2883cf22c383b0a8dcfc2ca9a17.exe

  • Size

    1.8MB

  • MD5

    28f7e2ed3725fc403099eac97c08b136

  • SHA1

    5e45a160f6d74cb14bf52809d51495a2f4925445

  • SHA256

    3e7263c4d3a28991776ac9bd812e605b4018b2883cf22c383b0a8dcfc2ca9a17

  • SHA512

    b1216a69c0a995ad953ad8c43f2d728c02518de54dfadd8be9b6f8045de8a37b85abfbe771815c16f97906ac9f0edede39877d2f1b53128a5761044339dfc7c9

  • SSDEEP

    49152:JCjuI8Df/WYdprZRE0bxfkdIdUqmMHuH46jJRolBbMBPw+DvB:JCt8D7BZRE0lfwIeqmMc46jJylpMBo+D

Malware Config

Extracted

Family

amadey

Version

4.30

Botnet

4dd39d

C2

http://77.91.77.82

Attributes
  • install_dir

    ad40971b6b

  • install_file

    explorti.exe

  • strings_key

    a434973ad22def7137dbb5e059b7081e

  • url_paths

    /Hun4Ko/index.php

rc4.plain

Extracted

Family

stealc

Botnet

hate

C2

http://85.28.47.30

Attributes
  • url_path

    /920475a59bac849d.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Stealc

    Stealc is an infostealer written in C++.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 14 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 8 IoCs
  • Identifies Wine through registry keys 2 TTPs 7 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 2 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 10 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 10 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\3e7263c4d3a28991776ac9bd812e605b4018b2883cf22c383b0a8dcfc2ca9a17.exe
    "C:\Users\Admin\AppData\Local\Temp\3e7263c4d3a28991776ac9bd812e605b4018b2883cf22c383b0a8dcfc2ca9a17.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:4772
    • C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
      "C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4596
      • C:\Users\Admin\AppData\Local\Temp\1000006001\644319e2a8.exe
        "C:\Users\Admin\AppData\Local\Temp\1000006001\644319e2a8.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:4248
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\JECGIIIDAK.exe"
          4⤵
            PID:1356
            • C:\Users\Admin\AppData\Local\Temp\JECGIIIDAK.exe
              "C:\Users\Admin\AppData\Local\Temp\JECGIIIDAK.exe"
              5⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • Suspicious behavior: EnumeratesProcesses
              PID:4564
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\DGHJEHJJDA.exe"
            4⤵
              PID:1680
              • C:\Users\Admin\AppData\Local\Temp\DGHJEHJJDA.exe
                "C:\Users\Admin\AppData\Local\Temp\DGHJEHJJDA.exe"
                5⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • Suspicious behavior: EnumeratesProcesses
                PID:5124
          • C:\Users\Admin\AppData\Local\Temp\1000010001\619d3df99d.exe
            "C:\Users\Admin\AppData\Local\Temp\1000010001\619d3df99d.exe"
            3⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of WriteProcessMemory
            PID:1412
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:1512
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
                5⤵
                • Checks processor information in registry
                • Modifies registry class
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:888
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1968 -parentBuildID 20240401114208 -prefsHandle 1884 -prefMapHandle 1876 -prefsLen 25755 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {952d16d3-bbd0-45c5-9f3a-eb03e74d2521} 888 "\\.\pipe\gecko-crash-server-pipe.888" gpu
                  6⤵
                    PID:828
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2408 -parentBuildID 20240401114208 -prefsHandle 2380 -prefMapHandle 2376 -prefsLen 26675 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {be1abe50-2840-4ce2-834c-e0993855f200} 888 "\\.\pipe\gecko-crash-server-pipe.888" socket
                    6⤵
                      PID:4760
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3148 -childID 1 -isForBrowser -prefsHandle 3212 -prefMapHandle 3252 -prefsLen 22698 -prefMapSize 244658 -jsInitHandle 1324 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1c4d1bf0-1727-439d-9366-608a06bb1898} 888 "\\.\pipe\gecko-crash-server-pipe.888" tab
                      6⤵
                        PID:3440
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2720 -childID 2 -isForBrowser -prefsHandle 3900 -prefMapHandle 3896 -prefsLen 31165 -prefMapSize 244658 -jsInitHandle 1324 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b7ccc6d5-dfbc-4b9d-b298-a55a04b53eab} 888 "\\.\pipe\gecko-crash-server-pipe.888" tab
                        6⤵
                          PID:3988
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4648 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4668 -prefMapHandle 4664 -prefsLen 31165 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7eaa192a-0d2c-46d1-a88f-b156226a6992} 888 "\\.\pipe\gecko-crash-server-pipe.888" utility
                          6⤵
                          • Checks processor information in registry
                          PID:5256
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4800 -childID 3 -isForBrowser -prefsHandle 1528 -prefMapHandle 5364 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 1324 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0a6a1fc6-b661-4ef6-920a-d82271dc2b4c} 888 "\\.\pipe\gecko-crash-server-pipe.888" tab
                          6⤵
                            PID:5888
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5500 -childID 4 -isForBrowser -prefsHandle 5580 -prefMapHandle 5576 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 1324 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {947b4eea-66c0-4514-916a-6b912769821d} 888 "\\.\pipe\gecko-crash-server-pipe.888" tab
                            6⤵
                              PID:5900
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5788 -childID 5 -isForBrowser -prefsHandle 5780 -prefMapHandle 5696 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 1324 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {df6f37e5-089e-42e9-b915-c690f2274139} 888 "\\.\pipe\gecko-crash-server-pipe.888" tab
                              6⤵
                                PID:5952
                    • C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
                      C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
                      1⤵
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • Suspicious behavior: EnumeratesProcesses
                      PID:1604
                    • C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
                      C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
                      1⤵
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • Suspicious behavior: EnumeratesProcesses
                      PID:3884
                    • C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
                      C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
                      1⤵
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • Suspicious behavior: EnumeratesProcesses
                      PID:524

                    Network

                    MITRE ATT&CK Enterprise v15

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\ProgramData\mozglue.dll

                      Filesize

                      593KB

                      MD5

                      c8fd9be83bc728cc04beffafc2907fe9

                      SHA1

                      95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                      SHA256

                      ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                      SHA512

                      fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                    • C:\ProgramData\nss3.dll

                      Filesize

                      2.0MB

                      MD5

                      1cc453cdf74f31e4d913ff9c10acdde2

                      SHA1

                      6e85eae544d6e965f15fa5c39700fa7202f3aafe

                      SHA256

                      ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                      SHA512

                      dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1l89xtkq.default-release\activity-stream.discovery_stream.json.tmp

                      Filesize

                      21KB

                      MD5

                      34803dfdf9d8565c164b26e40fff46e9

                      SHA1

                      5bee7e4238f1c347eab314e7fdbb9ecba7d1b8d0

                      SHA256

                      eb8bf15aeacca84b32eca17c3ebf109fea65a4602103e41616ca7aa9167aeb32

                      SHA512

                      c03287d8c98ef302b4fb0c2da114a8226ffae2e5723ea0b5d64f4e24843d2d45aa220fd555525525d545f219458cb702f2fc85c1fa89f8d5e5926c60a12af054

                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1l89xtkq.default-release\cache2\entries\5CD1EBDF6B57F13C7E783CE5E6D8E9C44014FE1A

                      Filesize

                      13KB

                      MD5

                      d52d2f030da53f3f8d642b71738df4e7

                      SHA1

                      776d1057b3faaedef8d19bc4e416a6313fe18b21

                      SHA256

                      7ec20468707f98283e05e1347b57f21d37355fe46f0c77af6e979e32ef9a22ed

                      SHA512

                      f824f44db56f47ba6220a7c5f291bb91b1fcba0bfaaae8d723cb988830b272b7b24044a53c41da85d1f35782239d4acfb5ab41d7832d8d0ed97da3dd74b3a141

                    • C:\Users\Admin\AppData\Local\Temp\1000006001\644319e2a8.exe

                      Filesize

                      2.4MB

                      MD5

                      20fe4b16d13a547a5d7f4dbf543b595a

                      SHA1

                      3c59aca1c693efb9923f04c312fdcd47388d24eb

                      SHA256

                      9be8bf8f01c3b2f8ae295f1fc9be5fe5e05596a80be603d0de23e9a6ddbb5a04

                      SHA512

                      c502ce3049137646c47898640197641696f2421a66aa67fe20df47b51c99e72db64f2c2a4945dafe16c6cb57871d42397b12759b4d779dbdf85225234296b77e

                    • C:\Users\Admin\AppData\Local\Temp\1000010001\619d3df99d.exe

                      Filesize

                      1.2MB

                      MD5

                      bea6ed281b600eae06be252f581721c1

                      SHA1

                      25fae547b4ad0a74bcc0bdf7e819f2c56d8be05d

                      SHA256

                      d18bbfa83202881061743177527c4f1ea0681c658028dd7dd0468f9a8a39e7cf

                      SHA512

                      746a1bcae568caaf399ec8ca393250d6846235296088e22a2c8d80ce290e13d5845d79d7848b4f46adce2dad147b91c3731059b44ce7370f26072c999758bb42

                    • C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe

                      Filesize

                      1.8MB

                      MD5

                      28f7e2ed3725fc403099eac97c08b136

                      SHA1

                      5e45a160f6d74cb14bf52809d51495a2f4925445

                      SHA256

                      3e7263c4d3a28991776ac9bd812e605b4018b2883cf22c383b0a8dcfc2ca9a17

                      SHA512

                      b1216a69c0a995ad953ad8c43f2d728c02518de54dfadd8be9b6f8045de8a37b85abfbe771815c16f97906ac9f0edede39877d2f1b53128a5761044339dfc7c9

                    • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                      Filesize

                      479KB

                      MD5

                      09372174e83dbbf696ee732fd2e875bb

                      SHA1

                      ba360186ba650a769f9303f48b7200fb5eaccee1

                      SHA256

                      c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                      SHA512

                      b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                    • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                      Filesize

                      13.8MB

                      MD5

                      0a8747a2ac9ac08ae9508f36c6d75692

                      SHA1

                      b287a96fd6cc12433adb42193dfe06111c38eaf0

                      SHA256

                      32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                      SHA512

                      59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1l89xtkq.default-release\AlternateServices.bin

                      Filesize

                      7KB

                      MD5

                      8cc6b0d5971a9f6227811023b8d3938b

                      SHA1

                      6a8330d315074a42a3d3748e117bf4c7c3e71601

                      SHA256

                      dbea6f0150e6d48a06e8c0a8d845b07c696161ee202142b734707d546d87ad50

                      SHA512

                      49ffc24eae24633c83a075ef614cc5ef96663dbb736cb6f1fb228201f0d43c2c574445d6ccfb466a1638d208a11a5543225f019fbfcec82a47222488257df7b2

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1l89xtkq.default-release\AlternateServices.bin

                      Filesize

                      11KB

                      MD5

                      3e4d7c1a16e7d0d59ba58658cc877fc7

                      SHA1

                      034f29524547044d2658c5e67147d194fe1ee353

                      SHA256

                      0a76a001bcefc0c0d1b510695a3f52ed6ea9cfa42e7320d4e2ae8fce59e341b1

                      SHA512

                      48483dac0cfa9315061beb7df272044e684105aeb0f0d98f144a80f1350e8fa811fc662d7958fdeb1e2db028b2499318e93f00fee510d3ff69cb7e1c853b9fab

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1l89xtkq.default-release\cookies.sqlite-wal

                      Filesize

                      256KB

                      MD5

                      3e4c91baa4f05d2e862915be6922e5b3

                      SHA1

                      2eda472182ff2a701fe7c49fe9c9274a19663d8a

                      SHA256

                      856805c8b3c500b763b363c1cc359a83947af2c566f62103fc63eff12cb9acb8

                      SHA512

                      f610371fc130ab0303feb136cb661d061917ac9fbd454826830ef0194fe93e8ed8e625de56753e645dc2d1766488c1585544fb7675b1afd67fb68833130339de

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1l89xtkq.default-release\datareporting\glean\db\data.safe.tmp

                      Filesize

                      31KB

                      MD5

                      48ebe5205750c4afcf1e6977c73ba867

                      SHA1

                      e100f0f8621eeffaac9193471b28d38de843fcc7

                      SHA256

                      fe96fd5e5863845dd77744b1cbb390f09ac10c416411d736a375f58cf478a55e

                      SHA512

                      082cc40d569315114af58be66449a8c2c644863cb88da7e5a7c0c89f51faa33447d402d369dde0687c31bd40ccd8fa947f99169fad03eb660da74bb4e5036565

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1l89xtkq.default-release\datareporting\glean\db\data.safe.tmp

                      Filesize

                      5KB

                      MD5

                      e1c33820b9f067561806967e0a45a136

                      SHA1

                      339fa23141700e379f452f8b13f0739f4a362134

                      SHA256

                      cb683eabb80c33db4b7fe18110c63c9db13d10d40f2594c26bbd89a088dec549

                      SHA512

                      5862d5c2b82a0f82504379fe5af55312eb4a0287799a105c4b644e38ea59336dc5cb943ee417f9e469ea1bf9f26124a539a43fa0734bbe7871d94b337e280db3

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1l89xtkq.default-release\datareporting\glean\pending_pings\125f38dd-e818-45b5-ad84-92e69d98de38

                      Filesize

                      982B

                      MD5

                      5eca39e9ccc0d7c9900a71c63b5f7c70

                      SHA1

                      f5f43bf30e11c2d1460aed297248a006df48368a

                      SHA256

                      9b0a55cc16ea00ad757883a3684e2414bc53a6a777e24702dfa3eee16c96ec6f

                      SHA512

                      ea85c11bedaa8738aa7ed3b1243a972fff3d405402bc17503cdb1489cb53114a9d8ade4ede0d12efe85d0a16a5cc67cd7b2294b0c302a26d5bd0634dbbbe2339

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1l89xtkq.default-release\datareporting\glean\pending_pings\88550226-45c2-4a1b-968b-ae4ea4cc9d9c

                      Filesize

                      671B

                      MD5

                      b2fd097ef45c0f5ca578eca76d9a63ae

                      SHA1

                      04f08427b793b6ec9c890edfc0d4d155228ffa0d

                      SHA256

                      ee1effea8c71d4dffb819062f3a20c59351c0fe69392e7238d9b1722639bde12

                      SHA512

                      0cff930010b8f2c6b89b3166996e9622e10a028e08c1f267226e79db62691b48413e16e6532a51dee49144b4a031997f1b81366132e74b603cf44b99eabf4244

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1l89xtkq.default-release\datareporting\glean\pending_pings\e976d836-7ba7-414f-8f24-ba7ebf2f823f

                      Filesize

                      27KB

                      MD5

                      9d7d6361d2bcb655ab4deb73b32b9363

                      SHA1

                      2e282264d9b7a6ebfc06b924978ebdd0cc3604cd

                      SHA256

                      d25bae0f59a2049da278f5530f334fdab1c54b274386582241bc21b880dd3374

                      SHA512

                      db1aa717f3a1651f870b93f3051fd70c99438e3df3b2fbf54b1e2a6cead7c4bd536e20b611545ec0aa7245b629d36aa5c5021b1caabf654fb4dcc2bf4c698b9c

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1l89xtkq.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

                      Filesize

                      1.1MB

                      MD5

                      842039753bf41fa5e11b3a1383061a87

                      SHA1

                      3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                      SHA256

                      d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                      SHA512

                      d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1l89xtkq.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

                      Filesize

                      116B

                      MD5

                      2a461e9eb87fd1955cea740a3444ee7a

                      SHA1

                      b10755914c713f5a4677494dbe8a686ed458c3c5

                      SHA256

                      4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                      SHA512

                      34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1l89xtkq.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

                      Filesize

                      372B

                      MD5

                      bf957ad58b55f64219ab3f793e374316

                      SHA1

                      a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                      SHA256

                      bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                      SHA512

                      79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1l89xtkq.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

                      Filesize

                      17.8MB

                      MD5

                      daf7ef3acccab478aaa7d6dc1c60f865

                      SHA1

                      f8246162b97ce4a945feced27b6ea114366ff2ad

                      SHA256

                      bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                      SHA512

                      5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1l89xtkq.default-release\places.sqlite-wal

                      Filesize

                      992KB

                      MD5

                      17c95451bcec9e5cf93c889268ce8628

                      SHA1

                      87eb0735db07e00ab35b49f71e25166e04391aa3

                      SHA256

                      e0e8fe18a2bd4890f940ba60268bcc84bc8025a268d1155fb720371cce931f5e

                      SHA512

                      beebf23b30e0380ab08e99d394b4c65f02f820eed73e119958dbbb48bbc79b5b6e85a6a39bd27f3fb3dcaa35eec889ae77dacc197efd73b02d3f45a58ad71c5e

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1l89xtkq.default-release\prefs-1.js

                      Filesize

                      8KB

                      MD5

                      1d5504c76bda38e40be1ef1c86caf3d1

                      SHA1

                      18595721d4120554ce8661657e9c2825ded201a8

                      SHA256

                      ce7a35d3157e8e33a2d537f094bd6c6f0f9feb403d5eec9976805d0cea9c19a1

                      SHA512

                      7a3570fde7c4747a1a3acb3bd2d55a0003ce536246be9c0a0a71fe1e6ac9f3e19873ec478330f9450f27f7b855383a9713e2a76f4c2c43be1f71a8319fd8a01e

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1l89xtkq.default-release\prefs-1.js

                      Filesize

                      10KB

                      MD5

                      f32d4ed6730fd085969d9cda26cafb90

                      SHA1

                      449cc9340a3a849978b78fa1f3ac7b8a7a435487

                      SHA256

                      3746c3fca7c86cce1d7a7bb0579878783234f1d34c8997609361d69398f6fc2b

                      SHA512

                      13b4ef04ca796278d5b9057734217750b9014fb964dd237f6e09de085800b67c731ad2a5b31dce66880f22c2dee9f2224699b36755a303ac46a7e01347672190

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1l89xtkq.default-release\prefs-1.js

                      Filesize

                      12KB

                      MD5

                      a2f222268318be9a5611c9bb2e8230f9

                      SHA1

                      49fb64ec1e8236a646afdda89b11475ebb50f5eb

                      SHA256

                      3da118a153494fa94d452578f59e2e2402f8e388a020ccd65a4a7c3e9449839c

                      SHA512

                      3e73cbe0aec49cb93200334714b375e663fb9ce555d2b0ccaa4757d34390bb86b82b1abadbb5abadc4ae57d4ed630db27478eae490d70a212fb9d4ee88a25331

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1l89xtkq.default-release\prefs.js

                      Filesize

                      8KB

                      MD5

                      952886ee6181df64b9e3926fb5bac2b7

                      SHA1

                      b4d49ecbfa4771ffa818ff62347f00ff72574c0a

                      SHA256

                      d37d18255388df0f6bb437d3d33fb94283dbc9f12423b7f02bc3bec0efef7490

                      SHA512

                      b3069a5cfc1ba3d41deb76134c6c7f4adb254dbd87fa5bc664ccd05ec245fa47dd6d6f50b77939dafec06ba092d4fbcefa23261c1d4d55a148d7d61238e49407

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1l89xtkq.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

                      Filesize

                      2.5MB

                      MD5

                      55fd58d3da6b5d82649e6c5b750408aa

                      SHA1

                      d7936c42cfcdbdc5b00fd9ded532bf3aca0819ca

                      SHA256

                      8fad68d7a3944cec48713fce34fb96e50f690f856ef3c492132c2e8ff2353ec1

                      SHA512

                      8de836649cdd7616c48de03c167d3256d4df9fdc26d6bb145e50283fb16883aa5fb2889b10e682ed1cf8ef7544271603409610c49e85bad58093e67df12461ab

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1l89xtkq.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

                      Filesize

                      2.7MB

                      MD5

                      78629fe452d89e087b97bfef28901b23

                      SHA1

                      768620c90bcffb29b0412169aac6770b46e68f91

                      SHA256

                      600376be7901c87e5dd8847792872978038ebc5b14eb80b3b597864163b747dd

                      SHA512

                      c752ca3d183c6696642b9eb9ed7d69ce8139f1a8a95a5b7216327fda382a4c9c54ba7858d05489a08d5dbd0dd30cafbbb29a4e358504333fc9dab62bf7e06c15

                    • memory/524-2775-0x00000000003E0000-0x0000000000886000-memory.dmp

                      Filesize

                      4.6MB

                    • memory/1604-93-0x00000000003E0000-0x0000000000886000-memory.dmp

                      Filesize

                      4.6MB

                    • memory/1604-121-0x00000000003E0000-0x0000000000886000-memory.dmp

                      Filesize

                      4.6MB

                    • memory/3884-2736-0x00000000003E0000-0x0000000000886000-memory.dmp

                      Filesize

                      4.6MB

                    • memory/3884-2648-0x00000000003E0000-0x0000000000886000-memory.dmp

                      Filesize

                      4.6MB

                    • memory/4248-56-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                      Filesize

                      972KB

                    • memory/4248-508-0x0000000000BA0000-0x000000000178A000-memory.dmp

                      Filesize

                      11.9MB

                    • memory/4248-462-0x0000000000BA0000-0x000000000178A000-memory.dmp

                      Filesize

                      11.9MB

                    • memory/4248-37-0x0000000000BA0000-0x000000000178A000-memory.dmp

                      Filesize

                      11.9MB

                    • memory/4564-501-0x0000000000C10000-0x00000000010B6000-memory.dmp

                      Filesize

                      4.6MB

                    • memory/4564-504-0x0000000000C10000-0x00000000010B6000-memory.dmp

                      Filesize

                      4.6MB

                    • memory/4596-2638-0x00000000003E0000-0x0000000000886000-memory.dmp

                      Filesize

                      4.6MB

                    • memory/4596-2769-0x00000000003E0000-0x0000000000886000-memory.dmp

                      Filesize

                      4.6MB

                    • memory/4596-526-0x00000000003E0000-0x0000000000886000-memory.dmp

                      Filesize

                      4.6MB

                    • memory/4596-2781-0x00000000003E0000-0x0000000000886000-memory.dmp

                      Filesize

                      4.6MB

                    • memory/4596-83-0x00000000003E0000-0x0000000000886000-memory.dmp

                      Filesize

                      4.6MB

                    • memory/4596-2773-0x00000000003E0000-0x0000000000886000-memory.dmp

                      Filesize

                      4.6MB

                    • memory/4596-2772-0x00000000003E0000-0x0000000000886000-memory.dmp

                      Filesize

                      4.6MB

                    • memory/4596-21-0x00000000003E0000-0x0000000000886000-memory.dmp

                      Filesize

                      4.6MB

                    • memory/4596-20-0x00000000003E0000-0x0000000000886000-memory.dmp

                      Filesize

                      4.6MB

                    • memory/4596-19-0x00000000003E1000-0x000000000040F000-memory.dmp

                      Filesize

                      184KB

                    • memory/4596-18-0x00000000003E0000-0x0000000000886000-memory.dmp

                      Filesize

                      4.6MB

                    • memory/4596-2771-0x00000000003E0000-0x0000000000886000-memory.dmp

                      Filesize

                      4.6MB

                    • memory/4596-741-0x00000000003E0000-0x0000000000886000-memory.dmp

                      Filesize

                      4.6MB

                    • memory/4596-2770-0x00000000003E0000-0x0000000000886000-memory.dmp

                      Filesize

                      4.6MB

                    • memory/4596-521-0x00000000003E0000-0x0000000000886000-memory.dmp

                      Filesize

                      4.6MB

                    • memory/4596-2766-0x00000000003E0000-0x0000000000886000-memory.dmp

                      Filesize

                      4.6MB

                    • memory/4596-1224-0x00000000003E0000-0x0000000000886000-memory.dmp

                      Filesize

                      4.6MB

                    • memory/4596-1819-0x00000000003E0000-0x0000000000886000-memory.dmp

                      Filesize

                      4.6MB

                    • memory/4596-512-0x00000000003E0000-0x0000000000886000-memory.dmp

                      Filesize

                      4.6MB

                    • memory/4596-489-0x00000000003E0000-0x0000000000886000-memory.dmp

                      Filesize

                      4.6MB

                    • memory/4596-488-0x00000000003E0000-0x0000000000886000-memory.dmp

                      Filesize

                      4.6MB

                    • memory/4772-2-0x00000000008A1000-0x00000000008CF000-memory.dmp

                      Filesize

                      184KB

                    • memory/4772-3-0x00000000008A0000-0x0000000000D46000-memory.dmp

                      Filesize

                      4.6MB

                    • memory/4772-5-0x00000000008A0000-0x0000000000D46000-memory.dmp

                      Filesize

                      4.6MB

                    • memory/4772-17-0x00000000008A0000-0x0000000000D46000-memory.dmp

                      Filesize

                      4.6MB

                    • memory/4772-1-0x0000000077584000-0x0000000077586000-memory.dmp

                      Filesize

                      8KB

                    • memory/4772-0-0x00000000008A0000-0x0000000000D46000-memory.dmp

                      Filesize

                      4.6MB

                    • memory/5124-513-0x0000000000560000-0x0000000000A06000-memory.dmp

                      Filesize

                      4.6MB

                    • memory/5124-520-0x0000000000560000-0x0000000000A06000-memory.dmp

                      Filesize

                      4.6MB