Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240704-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12-07-2024 02:06

General

  • Target

    1b6722f558bf4483253663180682caec67066261bc0414d12d6e1622cb848d80.exe

  • Size

    2.4MB

  • MD5

    b5f67083e086299287f0dfb2a7bef96e

  • SHA1

    dccf58d99cd7153859d1ad5a1c3f7e348e2ebbb7

  • SHA256

    1b6722f558bf4483253663180682caec67066261bc0414d12d6e1622cb848d80

  • SHA512

    55c4f5d435a1a27e6c8e14c88e454da4dc2398076f4596a6f983184831db0119c58be9c82b8ddf5ef37265b65b5cea56e5963c871b2be0f8e88064224681d654

  • SSDEEP

    49152:EEKU59C+b8stxJK8rWjiw8+gz7RGkV6ladMPlgFUfEIb017XKzyB6su:DKktejS+wtJYlaGIsOKzyEs

Malware Config

Extracted

Family

stealc

Botnet

hate

C2

http://85.28.47.30

Attributes
  • url_path

    /920475a59bac849d.php

Extracted

Family

amadey

Version

4.30

Botnet

4dd39d

C2

http://77.91.77.82

Attributes
  • install_dir

    ad40971b6b

  • install_file

    explorti.exe

  • strings_key

    a434973ad22def7137dbb5e059b7081e

  • url_paths

    /Hun4Ko/index.php

rc4.plain

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Stealc

    Stealc is an infostealer written in C++.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 8 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 5 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 6 IoCs
  • Identifies Wine through registry keys 2 TTPs 4 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 2 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\1b6722f558bf4483253663180682caec67066261bc0414d12d6e1622cb848d80.exe
    "C:\Users\Admin\AppData\Local\Temp\1b6722f558bf4483253663180682caec67066261bc0414d12d6e1622cb848d80.exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3356
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\KFBFCAFCBK.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2368
      • C:\Users\Admin\AppData\Local\Temp\KFBFCAFCBK.exe
        "C:\Users\Admin\AppData\Local\Temp\KFBFCAFCBK.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Checks computer location settings
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:888
        • C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
          "C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe"
          4⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Checks computer location settings
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1428
          • C:\Users\Admin\AppData\Local\Temp\1000006001\8fdd20a71a.exe
            "C:\Users\Admin\AppData\Local\Temp\1000006001\8fdd20a71a.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious use of SetWindowsHookEx
            PID:4396
          • C:\Users\Admin\AppData\Local\Temp\1000011001\4f7e97739d.exe
            "C:\Users\Admin\AppData\Local\Temp\1000011001\4f7e97739d.exe"
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of WriteProcessMemory
            PID:1596
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:696
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
                7⤵
                • Checks processor information in registry
                • Modifies registry class
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:3976
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3976.0.1769097270\898519217" -parentBuildID 20230214051806 -prefsHandle 1804 -prefMapHandle 1796 -prefsLen 21998 -prefMapSize 235091 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a81cf3f6-860a-47df-94e5-2c68da3aadd0} 3976 "\\.\pipe\gecko-crash-server-pipe.3976" 1884 18f7e60f358 gpu
                  8⤵
                    PID:4688
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3976.1.537272367\641344352" -parentBuildID 20230214051806 -prefsHandle 2464 -prefMapHandle 2460 -prefsLen 22849 -prefMapSize 235091 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {05f7ff75-fea2-4337-9d44-97192e42ac8e} 3976 "\\.\pipe\gecko-crash-server-pipe.3976" 2476 18f71a89f58 socket
                    8⤵
                      PID:3396
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3976.2.475354292\2134972578" -childID 1 -isForBrowser -prefsHandle 2992 -prefMapHandle 2988 -prefsLen 22887 -prefMapSize 235091 -jsInitHandle 1264 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6254bc33-a4dc-4bd4-acbc-9338a69a94e5} 3976 "\\.\pipe\gecko-crash-server-pipe.3976" 3004 18f02059258 tab
                      8⤵
                        PID:4152
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3976.3.2055203877\953599654" -childID 2 -isForBrowser -prefsHandle 3652 -prefMapHandle 3648 -prefsLen 27538 -prefMapSize 235091 -jsInitHandle 1264 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {be9b1594-2f11-42d5-bfff-42039b027a38} 3976 "\\.\pipe\gecko-crash-server-pipe.3976" 3660 18f03875458 tab
                        8⤵
                          PID:5044
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3976.4.1881051538\1475640367" -childID 3 -isForBrowser -prefsHandle 5272 -prefMapHandle 5268 -prefsLen 27538 -prefMapSize 235091 -jsInitHandle 1264 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {60cae52a-f8f9-4478-bca5-24880666e9f4} 3976 "\\.\pipe\gecko-crash-server-pipe.3976" 5280 18f06153b58 tab
                          8⤵
                            PID:2212
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3976.5.332807018\1211741545" -childID 4 -isForBrowser -prefsHandle 5424 -prefMapHandle 5432 -prefsLen 27538 -prefMapSize 235091 -jsInitHandle 1264 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {211d530b-af5f-496d-8e61-11feb6e0d791} 3976 "\\.\pipe\gecko-crash-server-pipe.3976" 5416 18f06153e58 tab
                            8⤵
                              PID:4424
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3976.6.1266532874\1710725373" -childID 5 -isForBrowser -prefsHandle 5608 -prefMapHandle 5612 -prefsLen 27538 -prefMapSize 235091 -jsInitHandle 1264 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3235083b-d054-4085-8ca0-25400959d77e} 3976 "\\.\pipe\gecko-crash-server-pipe.3976" 5396 18f06151d58 tab
                              8⤵
                                PID:1012
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\EHDHDHIECG.exe"
                    2⤵
                    • Checks computer location settings
                    • Suspicious use of SetWindowsHookEx
                    PID:4724
                • C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
                  C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
                  1⤵
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Identifies Wine through registry keys
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • Suspicious behavior: EnumeratesProcesses
                  PID:1864
                • C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
                  C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
                  1⤵
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Identifies Wine through registry keys
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • Suspicious behavior: EnumeratesProcesses
                  PID:3764

                Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\ProgramData\mozglue.dll

                  Filesize

                  593KB

                  MD5

                  c8fd9be83bc728cc04beffafc2907fe9

                  SHA1

                  95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                  SHA256

                  ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                  SHA512

                  fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                • C:\ProgramData\nss3.dll

                  Filesize

                  2.0MB

                  MD5

                  1cc453cdf74f31e4d913ff9c10acdde2

                  SHA1

                  6e85eae544d6e965f15fa5c39700fa7202f3aafe

                  SHA256

                  ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                  SHA512

                  dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\q38sqp1f.default-release\activity-stream.discovery_stream.json.tmp

                  Filesize

                  30KB

                  MD5

                  adb6b16c2e20c52683cb03cef589bac8

                  SHA1

                  be691bf1b318eaa6203d468982195205bdb2509f

                  SHA256

                  e62e09eee7cc110c4387707d455575683b59578a71448bde86ea4c215474d66e

                  SHA512

                  ceb38f4acf06729ef6277627780a4db68b379fd69e9a95c21cb08137eaeba9fa02730f94a1ce506ab56090242c6a116b3bb8ea7b33ac080df4a6bf9a3c6208e3

                • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\q38sqp1f.default-release\cache2\entries\5CD1EBDF6B57F13C7E783CE5E6D8E9C44014FE1A

                  Filesize

                  13KB

                  MD5

                  43640f16a7f083dec074d745ba97c532

                  SHA1

                  4cece6433d332dc66ab9a20efac3ab8095134541

                  SHA256

                  fcaeca217e9f05c7d0cae84199f5cc9d1028dae4844838755f922b9291df4a78

                  SHA512

                  8bf638cf3190fc3223bc588e2912ee60c94102baa37517f4b04efd74e40c23489176875a6f70f8b0a93ee7641a0976933b4e2a36eed5af154b8e2122165e2c06

                • C:\Users\Admin\AppData\Local\Temp\1000006001\8fdd20a71a.exe

                  Filesize

                  2.4MB

                  MD5

                  b5f67083e086299287f0dfb2a7bef96e

                  SHA1

                  dccf58d99cd7153859d1ad5a1c3f7e348e2ebbb7

                  SHA256

                  1b6722f558bf4483253663180682caec67066261bc0414d12d6e1622cb848d80

                  SHA512

                  55c4f5d435a1a27e6c8e14c88e454da4dc2398076f4596a6f983184831db0119c58be9c82b8ddf5ef37265b65b5cea56e5963c871b2be0f8e88064224681d654

                • C:\Users\Admin\AppData\Local\Temp\1000011001\4f7e97739d.exe

                  Filesize

                  1.2MB

                  MD5

                  89d94c18987eb5d638be8f74bc307ac5

                  SHA1

                  5f7d6e6d18cb0dc610dcfa684d424b38ae4f7ff9

                  SHA256

                  384ce4a6f2794b0cb3c5fe36dc9b19b755315c9918ad19c925401099c41be9e6

                  SHA512

                  8f3880137b1a7e511dbbc3164c0a28cd1933776a009120df4eba0476f07dbd2b7764dae406620da6b2ab324ac0aa8011f914db6aad213fbacc4d73f0d28c2a63

                • C:\Users\Admin\AppData\Local\Temp\KFBFCAFCBK.exe

                  Filesize

                  1.8MB

                  MD5

                  7eac58c3aac017b11c5a2a99ae66c51a

                  SHA1

                  570339f867e074afb6f0238ca2152a50356647e1

                  SHA256

                  5b7c5538d46b65c20287b12f35f75d4f62e7d9e9188490b24892c96724d652b2

                  SHA512

                  d99289c3746bb2d429d80c6d6757b44f125980a8b461c8d5716d4e49acb2fee1c0c4a94ff66b9a1c90b21d7d23e767201ecb6282288b0b2f068e912942729769

                • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                  Filesize

                  442KB

                  MD5

                  85430baed3398695717b0263807cf97c

                  SHA1

                  fffbee923cea216f50fce5d54219a188a5100f41

                  SHA256

                  a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

                  SHA512

                  06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

                • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                  Filesize

                  8.0MB

                  MD5

                  a01c5ecd6108350ae23d2cddf0e77c17

                  SHA1

                  c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

                  SHA256

                  345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

                  SHA512

                  b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q38sqp1f.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

                  Filesize

                  997KB

                  MD5

                  fe3355639648c417e8307c6d051e3e37

                  SHA1

                  f54602d4b4778da21bc97c7238fc66aa68c8ee34

                  SHA256

                  1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

                  SHA512

                  8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q38sqp1f.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

                  Filesize

                  116B

                  MD5

                  3d33cdc0b3d281e67dd52e14435dd04f

                  SHA1

                  4db88689282fd4f9e9e6ab95fcbb23df6e6485db

                  SHA256

                  f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

                  SHA512

                  a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q38sqp1f.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

                  Filesize

                  479B

                  MD5

                  49ddb419d96dceb9069018535fb2e2fc

                  SHA1

                  62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

                  SHA256

                  2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

                  SHA512

                  48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q38sqp1f.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

                  Filesize

                  372B

                  MD5

                  8be33af717bb1b67fbd61c3f4b807e9e

                  SHA1

                  7cf17656d174d951957ff36810e874a134dd49e0

                  SHA256

                  e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

                  SHA512

                  6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q38sqp1f.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

                  Filesize

                  11.8MB

                  MD5

                  33bf7b0439480effb9fb212efce87b13

                  SHA1

                  cee50f2745edc6dc291887b6075ca64d716f495a

                  SHA256

                  8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

                  SHA512

                  d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q38sqp1f.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

                  Filesize

                  1KB

                  MD5

                  688bed3676d2104e7f17ae1cd2c59404

                  SHA1

                  952b2cdf783ac72fcb98338723e9afd38d47ad8e

                  SHA256

                  33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

                  SHA512

                  7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q38sqp1f.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

                  Filesize

                  1KB

                  MD5

                  937326fead5fd401f6cca9118bd9ade9

                  SHA1

                  4526a57d4ae14ed29b37632c72aef3c408189d91

                  SHA256

                  68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

                  SHA512

                  b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q38sqp1f.default-release\prefs-1.js

                  Filesize

                  8KB

                  MD5

                  8cf8fb96acf3a196489fe3d79c05afd0

                  SHA1

                  a6151c96374cc82a7a17d65363ec346cac3832fc

                  SHA256

                  4cba838cd84da0760874a4e5c2f0da54df36bfe28395c20bf3bb4239cc13a55f

                  SHA512

                  c815a5d56c37a9e9b8e0f460488b05aad9d2dbb4393a871874bc23b464b6e57946538028cd5f635ae558801e76c5c76be563111ff4704f30f0c48aa07b262a26

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q38sqp1f.default-release\prefs-1.js

                  Filesize

                  10KB

                  MD5

                  bc922cc63cfa573f932520b3037e9427

                  SHA1

                  214e07fca9a42a69a4826a88cc2c03c1de669eba

                  SHA256

                  34afac9ec6bc511a1a733261a37d02b69e0e8b60c781767189f2770e3fa39206

                  SHA512

                  bc65f8289ce8523dbfa4ec7de58da9f4c6fce28e8ca56a4cd18507f9d0cf937e64cab3e3cbaabf1f955fe2d98509e9c1cba6a1adf74f0f7fd7a0894ed86e1945

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q38sqp1f.default-release\prefs.js

                  Filesize

                  6KB

                  MD5

                  5f156d805defff43f81442de6a88fd91

                  SHA1

                  5faf5a2f3db5eac9a8782fd080db63657e111863

                  SHA256

                  65f31f26697d1592339762a0ce61fe77bc0a96bf57ead99899dd74cb0c03abd8

                  SHA512

                  cffb1f9e04e8805c90cc42db41afd19b8980c975746eeb66e081858ac8b1427ce5b21550d0d5b6bdb149258267a77a072afcdbf369019c21526cc5822a8c5a61

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q38sqp1f.default-release\sessionstore-backups\recovery.jsonlz4

                  Filesize

                  4KB

                  MD5

                  b64a2c2f21226490a6644475a17b426a

                  SHA1

                  7e51c37e636916061b143e2185253d8647e75b63

                  SHA256

                  2e99e2dab79a1dca7ddd8e3f1083d9df3b2e9fd95a4c9e0715a5275d00e01f1b

                  SHA512

                  fa6967cdc125b652e126fb7a97551e2a4c035649641a8fcefe959914feecf3271d72b489bcb1190c0483eb419f43ed3808ceea642e6e770f502099ce647333e8

                • memory/888-83-0x0000000000990000-0x0000000000E44000-memory.dmp

                  Filesize

                  4.7MB

                • memory/888-94-0x0000000000990000-0x0000000000E44000-memory.dmp

                  Filesize

                  4.7MB

                • memory/1428-256-0x0000000000B40000-0x0000000000FF4000-memory.dmp

                  Filesize

                  4.7MB

                • memory/1428-2273-0x0000000000B40000-0x0000000000FF4000-memory.dmp

                  Filesize

                  4.7MB

                • memory/1428-2284-0x0000000000B40000-0x0000000000FF4000-memory.dmp

                  Filesize

                  4.7MB

                • memory/1428-2278-0x0000000000B40000-0x0000000000FF4000-memory.dmp

                  Filesize

                  4.7MB

                • memory/1428-266-0x0000000000B40000-0x0000000000FF4000-memory.dmp

                  Filesize

                  4.7MB

                • memory/1428-216-0x0000000000B40000-0x0000000000FF4000-memory.dmp

                  Filesize

                  4.7MB

                • memory/1428-2277-0x0000000000B40000-0x0000000000FF4000-memory.dmp

                  Filesize

                  4.7MB

                • memory/1428-1965-0x0000000000B40000-0x0000000000FF4000-memory.dmp

                  Filesize

                  4.7MB

                • memory/1428-2272-0x0000000000B40000-0x0000000000FF4000-memory.dmp

                  Filesize

                  4.7MB

                • memory/1428-2271-0x0000000000B40000-0x0000000000FF4000-memory.dmp

                  Filesize

                  4.7MB

                • memory/1428-2270-0x0000000000B40000-0x0000000000FF4000-memory.dmp

                  Filesize

                  4.7MB

                • memory/1428-96-0x0000000000B40000-0x0000000000FF4000-memory.dmp

                  Filesize

                  4.7MB

                • memory/1428-657-0x0000000000B40000-0x0000000000FF4000-memory.dmp

                  Filesize

                  4.7MB

                • memory/1428-2251-0x0000000000B40000-0x0000000000FF4000-memory.dmp

                  Filesize

                  4.7MB

                • memory/1864-1336-0x0000000000B40000-0x0000000000FF4000-memory.dmp

                  Filesize

                  4.7MB

                • memory/1864-1489-0x0000000000B40000-0x0000000000FF4000-memory.dmp

                  Filesize

                  4.7MB

                • memory/3356-3-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                  Filesize

                  972KB

                • memory/3356-79-0x000000007F890000-0x000000007FC61000-memory.dmp

                  Filesize

                  3.8MB

                • memory/3356-1-0x000000007F890000-0x000000007FC61000-memory.dmp

                  Filesize

                  3.8MB

                • memory/3356-78-0x0000000000700000-0x00000000012E1000-memory.dmp

                  Filesize

                  11.9MB

                • memory/3356-74-0x0000000000700000-0x00000000012E1000-memory.dmp

                  Filesize

                  11.9MB

                • memory/3356-0-0x0000000000700000-0x00000000012E1000-memory.dmp

                  Filesize

                  11.9MB

                • memory/3764-2275-0x0000000000B40000-0x0000000000FF4000-memory.dmp

                  Filesize

                  4.7MB

                • memory/3764-2276-0x0000000000B40000-0x0000000000FF4000-memory.dmp

                  Filesize

                  4.7MB

                • memory/4396-112-0x0000000000DB0000-0x0000000001991000-memory.dmp

                  Filesize

                  11.9MB

                • memory/4396-113-0x0000000000DB0000-0x0000000001991000-memory.dmp

                  Filesize

                  11.9MB