Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12-07-2024 03:35

General

  • Target

    8462138a8aa6167aa5c96c6a0ab0f49aac24bf4c0715c07a522d0c2a25aed1bc.exe

  • Size

    1.8MB

  • MD5

    5c680c61385dd58f4fc12a03b7faf3aa

  • SHA1

    0ae6c6bb9d9a1175215187b487c9fd3a419c4680

  • SHA256

    8462138a8aa6167aa5c96c6a0ab0f49aac24bf4c0715c07a522d0c2a25aed1bc

  • SHA512

    10ced6edd0fb538d210a7aca9e29af1140d985d079826149c5cdddc3445775084cf599644fe567271da9e09db6006ce9513624ed14681be763baa84f57d9cf67

  • SSDEEP

    49152:n72nmmbesQ6AuQmng0iBKFanvJ5xjgGgGCnTks6:nqnmwesQ6ABmneBKFUrxjnogx

Malware Config

Extracted

Family

amadey

Version

4.30

Botnet

4dd39d

C2

http://77.91.77.82

Attributes
  • install_dir

    ad40971b6b

  • install_file

    explorti.exe

  • strings_key

    a434973ad22def7137dbb5e059b7081e

  • url_paths

    /Hun4Ko/index.php

rc4.plain

Extracted

Family

stealc

Botnet

hate

C2

http://85.28.47.30

Attributes
  • url_path

    /920475a59bac849d.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Stealc

    Stealc is an infostealer written in C++.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 12 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 7 IoCs
  • Identifies Wine through registry keys 2 TTPs 6 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 2 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 10 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\8462138a8aa6167aa5c96c6a0ab0f49aac24bf4c0715c07a522d0c2a25aed1bc.exe
    "C:\Users\Admin\AppData\Local\Temp\8462138a8aa6167aa5c96c6a0ab0f49aac24bf4c0715c07a522d0c2a25aed1bc.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2364
    • C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
      "C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4488
      • C:\Users\Admin\AppData\Local\Temp\1000006001\e1db465562.exe
        "C:\Users\Admin\AppData\Local\Temp\1000006001\e1db465562.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:380
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\IIEBGIDAAF.exe"
          4⤵
            PID:3032
            • C:\Users\Admin\AppData\Local\Temp\IIEBGIDAAF.exe
              "C:\Users\Admin\AppData\Local\Temp\IIEBGIDAAF.exe"
              5⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • Suspicious behavior: EnumeratesProcesses
              PID:2936
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\DAAFIIJDAA.exe"
            4⤵
              PID:1936
              • C:\Users\Admin\AppData\Local\Temp\DAAFIIJDAA.exe
                "C:\Users\Admin\AppData\Local\Temp\DAAFIIJDAA.exe"
                5⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • Suspicious behavior: EnumeratesProcesses
                PID:660
          • C:\Users\Admin\AppData\Local\Temp\1000011001\3128f53eae.exe
            "C:\Users\Admin\AppData\Local\Temp\1000011001\3128f53eae.exe"
            3⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of WriteProcessMemory
            PID:3400
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:2040
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
                5⤵
                • Checks processor information in registry
                • Modifies registry class
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:224
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1988 -parentBuildID 20240401114208 -prefsHandle 1924 -prefMapHandle 1916 -prefsLen 25757 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {44b7c734-20d3-4369-ac02-5f5141947eeb} 224 "\\.\pipe\gecko-crash-server-pipe.224" gpu
                  6⤵
                    PID:3580
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2432 -parentBuildID 20240401114208 -prefsHandle 2424 -prefMapHandle 2420 -prefsLen 26677 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9b04be97-8562-4b64-88fa-9ef879258a9e} 224 "\\.\pipe\gecko-crash-server-pipe.224" socket
                    6⤵
                      PID:3260
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3136 -childID 1 -isForBrowser -prefsHandle 3180 -prefMapHandle 3088 -prefsLen 22698 -prefMapSize 244658 -jsInitHandle 1288 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b3f75b9c-2df2-45f7-8be9-e4e4f2ae8b7d} 224 "\\.\pipe\gecko-crash-server-pipe.224" tab
                      6⤵
                        PID:2252
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3860 -childID 2 -isForBrowser -prefsHandle 2864 -prefMapHandle 3076 -prefsLen 31167 -prefMapSize 244658 -jsInitHandle 1288 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {589aa9a2-9569-4dc1-b683-d1b639eb4988} 224 "\\.\pipe\gecko-crash-server-pipe.224" tab
                        6⤵
                          PID:4152
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4492 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4384 -prefMapHandle 4484 -prefsLen 31167 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {844a60c1-9d0a-4d82-8540-bdbfd928260a} 224 "\\.\pipe\gecko-crash-server-pipe.224" utility
                          6⤵
                          • Checks processor information in registry
                          PID:628
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3852 -childID 3 -isForBrowser -prefsHandle 5368 -prefMapHandle 5360 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1288 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0bfbec6c-cafe-4920-ad4a-885139acf772} 224 "\\.\pipe\gecko-crash-server-pipe.224" tab
                          6⤵
                            PID:5584
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5508 -childID 4 -isForBrowser -prefsHandle 5516 -prefMapHandle 5520 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1288 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c5bc4e35-dafb-4ab3-816f-d99baf697807} 224 "\\.\pipe\gecko-crash-server-pipe.224" tab
                            6⤵
                              PID:5596
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5784 -childID 5 -isForBrowser -prefsHandle 5704 -prefMapHandle 5708 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1288 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c51f008f-9846-424d-939f-d28b1927c45b} 224 "\\.\pipe\gecko-crash-server-pipe.224" tab
                              6⤵
                                PID:5608
                    • C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
                      C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
                      1⤵
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • Suspicious behavior: EnumeratesProcesses
                      PID:4944
                    • C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
                      C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
                      1⤵
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • Suspicious behavior: EnumeratesProcesses
                      PID:5948

                    Network

                    MITRE ATT&CK Enterprise v15

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\ProgramData\mozglue.dll

                      Filesize

                      593KB

                      MD5

                      c8fd9be83bc728cc04beffafc2907fe9

                      SHA1

                      95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                      SHA256

                      ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                      SHA512

                      fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                    • C:\ProgramData\nss3.dll

                      Filesize

                      2.0MB

                      MD5

                      1cc453cdf74f31e4d913ff9c10acdde2

                      SHA1

                      6e85eae544d6e965f15fa5c39700fa7202f3aafe

                      SHA256

                      ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                      SHA512

                      dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5n0dnl6r.default-release\activity-stream.discovery_stream.json.tmp

                      Filesize

                      18KB

                      MD5

                      2bcf67283d39b9d1c312345a818b50bc

                      SHA1

                      90b9404cdb403ad4de6f45fd4da85e5fd8c8c730

                      SHA256

                      632eb9cd0bfb6640bb8e51b6216c88d820c33874f4102f3e0680d62c0ecdbe34

                      SHA512

                      c110ddd7c4da99d5b25a865078a57011da13c442bd058e6055e343ce1d77f8b63441dc6caf8f9d87426668a4b6bbae6af3229af81b75e100056bfe8b77d3b824

                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5n0dnl6r.default-release\cache2\entries\5CD1EBDF6B57F13C7E783CE5E6D8E9C44014FE1A

                      Filesize

                      13KB

                      MD5

                      2f24d9ecdc3b3acdca0b8e67ac4dffab

                      SHA1

                      b3d7129cc7e0b4886c6e5f3e2910a194d007f8f8

                      SHA256

                      d7d5dbc26bf7701bf6a68b7b7ac73b6a1f9254d337b879fc2661d586bf76dc43

                      SHA512

                      bfd7b6d161645f2ddccbe2cbddb282b4e668ced36f267a24c79653439bb041c8616e3ef9cb9eadca93b7816acae63f93a9c12b98dac07ef1bfc0d1208f4df8ad

                    • C:\Users\Admin\AppData\Local\Temp\1000006001\e1db465562.exe

                      Filesize

                      2.4MB

                      MD5

                      b5f67083e086299287f0dfb2a7bef96e

                      SHA1

                      dccf58d99cd7153859d1ad5a1c3f7e348e2ebbb7

                      SHA256

                      1b6722f558bf4483253663180682caec67066261bc0414d12d6e1622cb848d80

                      SHA512

                      55c4f5d435a1a27e6c8e14c88e454da4dc2398076f4596a6f983184831db0119c58be9c82b8ddf5ef37265b65b5cea56e5963c871b2be0f8e88064224681d654

                    • C:\Users\Admin\AppData\Local\Temp\1000011001\3128f53eae.exe

                      Filesize

                      1.2MB

                      MD5

                      fd0b9abb452747cdf5b01aa567ba1bb6

                      SHA1

                      10964d022c5a21e53ec407facc763ba7b155b674

                      SHA256

                      1c269084aaa81ff27f94106ab4572d394b2a467956f5bf0fff6fd130d00214d0

                      SHA512

                      a0f6f551cbd3899044e2e6b7c47601b77fd1df92178cbdbb0a484f291aa656d2f71abc314870db7fe82cc06d0bc8af84887eaafd6f23faac3fec9e1db3730826

                    • C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe

                      Filesize

                      1.8MB

                      MD5

                      5c680c61385dd58f4fc12a03b7faf3aa

                      SHA1

                      0ae6c6bb9d9a1175215187b487c9fd3a419c4680

                      SHA256

                      8462138a8aa6167aa5c96c6a0ab0f49aac24bf4c0715c07a522d0c2a25aed1bc

                      SHA512

                      10ced6edd0fb538d210a7aca9e29af1140d985d079826149c5cdddc3445775084cf599644fe567271da9e09db6006ce9513624ed14681be763baa84f57d9cf67

                    • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                      Filesize

                      479KB

                      MD5

                      09372174e83dbbf696ee732fd2e875bb

                      SHA1

                      ba360186ba650a769f9303f48b7200fb5eaccee1

                      SHA256

                      c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                      SHA512

                      b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                    • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                      Filesize

                      13.8MB

                      MD5

                      0a8747a2ac9ac08ae9508f36c6d75692

                      SHA1

                      b287a96fd6cc12433adb42193dfe06111c38eaf0

                      SHA256

                      32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                      SHA512

                      59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5n0dnl6r.default-release\AlternateServices.bin

                      Filesize

                      10KB

                      MD5

                      11f502a170f878438399ad1616188bfa

                      SHA1

                      927538b04a7f7d717cb152bac9a276614c5f1217

                      SHA256

                      c8a8e14cb272ebdf6074ec5c37d97107e7467f32edb759e3e55f7f2eceeb7d8e

                      SHA512

                      4298754b50a149ad8c6bfc96cd340efeaad1fa0a1e621e029dd26a0dcf4d6d54da29cfdaabe68a4398e3d4d5d1f1a7b3ba60b3d423b4523bb08180bd3ddc8b3e

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5n0dnl6r.default-release\AlternateServices.bin

                      Filesize

                      12KB

                      MD5

                      53be33b7fa11313b9be95b0692ab598b

                      SHA1

                      a830ce1efc5002c046e7b1fa8b8787ea1720d413

                      SHA256

                      c2e5fcc5a1fc3f89aaf058bdebd1f7284a8b5de66e8ddfdbbd171099c73e1c12

                      SHA512

                      9d155202625fea31767f76eeff1557d966391166d631c0bc50c57267543876eb85f2c3adf36f8fcf3e2f0485287d2b8ce3a3ddcce6be17f59ada85b33ca6810b

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5n0dnl6r.default-release\cookies.sqlite-wal

                      Filesize

                      256KB

                      MD5

                      3f31885c2e368e5fdb713df4cb5b0e83

                      SHA1

                      ac0f92b9d8db27026ac44d03d909f693e0ae7f41

                      SHA256

                      e624a6d4fdbc3ad7f781083eeeafb52bfadfcd5fa72c8d9b2bc9ae480b599347

                      SHA512

                      172cb4ebf573dc2b75eafaac65499e6c8fe3dd6832ac901723090cdadadb164485e29c4eb86850d5166a1f9d8d25764b0dd3149383c6d8007bf60be16cbabe82

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5n0dnl6r.default-release\datareporting\glean\db\data.safe.tmp

                      Filesize

                      22KB

                      MD5

                      2be5214e07c4038ea3882deb774a4a52

                      SHA1

                      c4f6e0f0b30e0d70a13329c4e43e14f2a0806306

                      SHA256

                      9a672d7026ff87e3a158c5552e985020d462ccfa3e87d632c2a421e2aef410a9

                      SHA512

                      e38ceb64222655209afccda5fbc2420a3e84f7300007cfa67cc0761f9ab20c51877ce25b604a0c69b0e16d4c654f5d9dbed072dc428142737fcb6c95a002bfce

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5n0dnl6r.default-release\datareporting\glean\db\data.safe.tmp

                      Filesize

                      21KB

                      MD5

                      4623ba8b7baf6b327a286be4047af8b1

                      SHA1

                      175d1521682bbca8cbaf300eb857d9a8d94f6cee

                      SHA256

                      4e856d24eb6805527bd9f2d4fa0d475bad353164e82807b8f161184479c4fd1f

                      SHA512

                      569da3ae40d284ca117dbcb15183c5ce7e1b2ae0a0e8246e4eecdb7258b9f5a6403d8d54c3e942c8747db212a05963d528b06caef66fa5ed8b58330ff63e34c6

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5n0dnl6r.default-release\datareporting\glean\db\data.safe.tmp

                      Filesize

                      24KB

                      MD5

                      8450e45e10c2d2cfc54e82121368063b

                      SHA1

                      aed03e6f29e5a6b6fa0bcab99aa211e817f11106

                      SHA256

                      2b3a46a958c2971aee75b06105d98cdd5e998c32fd3b17e4328f72b652fa2b2f

                      SHA512

                      32fb6dae5096211f3fa1167973d9d7204dfd57baae187358c8b68abff9a49b4cbeb715064aff425a3191385de9dcc7a4c78b88ce7684c37157c98ee608408b42

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5n0dnl6r.default-release\datareporting\glean\pending_pings\2b8f9080-3b6b-40ca-bce8-766dda2580c9

                      Filesize

                      982B

                      MD5

                      5baad71546167e1729ac9b7f8f079b53

                      SHA1

                      8f481d6648b406ce3e7ab7624f7894932e1157b8

                      SHA256

                      868d1753eec1b932fc5573665f0ece9765239b2f0d6bab67e8719e9ac928a79c

                      SHA512

                      3bb08a1eb060c7676c9928e09d417434f7270102ae833eeb16722fd77aa2a880b8111c2ca3abba99e132002b76d2b5d61910b3e2e1aab709ab89cb659bbaa950

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5n0dnl6r.default-release\datareporting\glean\pending_pings\ac71c2a5-baec-4497-a40c-714e97dfd710

                      Filesize

                      659B

                      MD5

                      921f8fe1b635c3b339a47fb0860b3ecb

                      SHA1

                      fc22d07f38d3017961660bde6ee34bc211c31d53

                      SHA256

                      d00745d128e8b705190f634d9e55a9295bb7017df6691da4221b331bced1fef1

                      SHA512

                      8b1f19cb6e7405e0e15720171096b790abb20317fcfe5ee72f2feb01c32bb5e06ef01a1ad042e080ef040c29690a425aca5c5c91b458e96e6e0a2dd1611ed0da

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5n0dnl6r.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

                      Filesize

                      1.1MB

                      MD5

                      842039753bf41fa5e11b3a1383061a87

                      SHA1

                      3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                      SHA256

                      d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                      SHA512

                      d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5n0dnl6r.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

                      Filesize

                      116B

                      MD5

                      2a461e9eb87fd1955cea740a3444ee7a

                      SHA1

                      b10755914c713f5a4677494dbe8a686ed458c3c5

                      SHA256

                      4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                      SHA512

                      34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5n0dnl6r.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

                      Filesize

                      372B

                      MD5

                      bf957ad58b55f64219ab3f793e374316

                      SHA1

                      a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                      SHA256

                      bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                      SHA512

                      79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5n0dnl6r.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

                      Filesize

                      17.8MB

                      MD5

                      daf7ef3acccab478aaa7d6dc1c60f865

                      SHA1

                      f8246162b97ce4a945feced27b6ea114366ff2ad

                      SHA256

                      bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                      SHA512

                      5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5n0dnl6r.default-release\places.sqlite-wal

                      Filesize

                      992KB

                      MD5

                      6154b371d85b9394ba3e67085b9b7fe2

                      SHA1

                      55c938e44d0f968a395b526225e17b7dc243b22a

                      SHA256

                      33ebdcdf4f9e746740c72177dbfd2afe165b60c82cbbae0a44fd8c00c7a50864

                      SHA512

                      3de9a0f2dbad56fa13700cb7b11239bf7c89fbec420474e2cef516ac51ab208c007bc96b2aa586d47fc86e01a549cecd0c8487478fac669f4f5f53fa90f255ae

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5n0dnl6r.default-release\prefs-1.js

                      Filesize

                      12KB

                      MD5

                      305ef60b32ea40ffe3f309cce926442d

                      SHA1

                      ccc8b4d71604f1522ea27740bc9535a556531d73

                      SHA256

                      e17dd16ff691ef94328b3adb809705925e27757c1bbb8f2a325c37d1b2d4abdb

                      SHA512

                      fa84b2a48573a9530b81dcafba228dec261eebbf5b8d1aacf85f6e05b2238cbf7fd93ead04c46755d9cd5f018cc0a662aafbbd75454073e3bcb7d6e2cbb22c94

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5n0dnl6r.default-release\prefs-1.js

                      Filesize

                      15KB

                      MD5

                      647d840faa370136bea60fdaf5eec94c

                      SHA1

                      ba6c83c1bc9a000093ccea601f46f24ba07540c5

                      SHA256

                      240c1df5db743705e4d3243c1bb726ed1f2d6b61e6e1019c890b768688ad833e

                      SHA512

                      e8eb61c796ff553982f911f8268974f507ed6675ecced3a64a0ed8fde04e39c28a63d54fa355b0278e5cb8caa79b0deb8d0ef72d4628295d6f33fc39d9382c68

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5n0dnl6r.default-release\prefs.js

                      Filesize

                      8KB

                      MD5

                      2304683d7426ec881aac62c16895c824

                      SHA1

                      0fdf80e9b90402993ea944effe5cf1cf2dfa86ae

                      SHA256

                      48c52cb2cd6463264751af9f8e680884eaffbbf22f1048e82c53f78bd2029838

                      SHA512

                      ecf61bff6639183f05d11c02fbc1a391e017fc3df4a5e0bda9dc510634bac172e0efbf022c9280e3ca7434a7b6cd0797abc076dd68206c185c3f360e7d9dd01d

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5n0dnl6r.default-release\prefs.js

                      Filesize

                      10KB

                      MD5

                      1a928adbafa47633d10585caa1f46f6f

                      SHA1

                      6508d4367bc6db36b7e994365a0bd501296ee54a

                      SHA256

                      4fe2455d786acfcaf955dac11cd61e5926d838956b310810bd51b1095df33e4f

                      SHA512

                      5aea98b77cce90fb9bb49f543ff0dcfd94cea461d8f97a9f61a518389c99742ba8a3e5959c600e22450597a5b2cc3e240e70812d3c4dee65cd14965f31e23bd3

                    • memory/380-472-0x0000000000900000-0x00000000014E1000-memory.dmp

                      Filesize

                      11.9MB

                    • memory/380-56-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                      Filesize

                      972KB

                    • memory/380-37-0x0000000000900000-0x00000000014E1000-memory.dmp

                      Filesize

                      11.9MB

                    • memory/380-452-0x0000000000900000-0x00000000014E1000-memory.dmp

                      Filesize

                      11.9MB

                    • memory/660-478-0x0000000000CD0000-0x000000000117F000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/660-476-0x0000000000CD0000-0x000000000117F000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/2364-5-0x0000000000170000-0x000000000061F000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/2364-0-0x0000000000170000-0x000000000061F000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/2364-1-0x0000000077B14000-0x0000000077B16000-memory.dmp

                      Filesize

                      8KB

                    • memory/2364-2-0x0000000000171000-0x000000000019F000-memory.dmp

                      Filesize

                      184KB

                    • memory/2364-3-0x0000000000170000-0x000000000061F000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/2364-17-0x0000000000170000-0x000000000061F000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/2936-468-0x00000000002E0000-0x000000000078F000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/2936-467-0x00000000002E0000-0x000000000078F000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/4488-20-0x0000000000210000-0x00000000006BF000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/4488-2626-0x0000000000210000-0x00000000006BF000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/4488-21-0x0000000000210000-0x00000000006BF000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/4488-18-0x0000000000210000-0x00000000006BF000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/4488-423-0x0000000000210000-0x00000000006BF000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/4488-494-0x0000000000210000-0x00000000006BF000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/4488-489-0x0000000000210000-0x00000000006BF000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/4488-488-0x0000000000210000-0x00000000006BF000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/4488-487-0x0000000000210000-0x00000000006BF000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/4488-1020-0x0000000000210000-0x00000000006BF000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/4488-2101-0x0000000000210000-0x00000000006BF000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/4488-2639-0x0000000000210000-0x00000000006BF000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/4488-2633-0x0000000000210000-0x00000000006BF000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/4488-2617-0x0000000000210000-0x00000000006BF000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/4488-2623-0x0000000000210000-0x00000000006BF000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/4488-2625-0x0000000000210000-0x00000000006BF000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/4488-19-0x0000000000211000-0x000000000023F000-memory.dmp

                      Filesize

                      184KB

                    • memory/4488-2627-0x0000000000210000-0x00000000006BF000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/4488-2628-0x0000000000210000-0x00000000006BF000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/4488-2632-0x0000000000210000-0x00000000006BF000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/4944-2616-0x0000000000210000-0x00000000006BF000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/4944-2613-0x0000000000210000-0x00000000006BF000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/5948-2631-0x0000000000210000-0x00000000006BF000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/5948-2630-0x0000000000210000-0x00000000006BF000-memory.dmp

                      Filesize

                      4.7MB