Analysis

  • max time kernel
    149s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12-07-2024 05:00

General

  • Target

    aba717ff50dd3ff2b81104e804cef5cb531a0b39b1b7dafa5fa65cf0ba7606ad.exe

  • Size

    1.8MB

  • MD5

    b216ac082608e4fd08c4dfb765dd61c9

  • SHA1

    9f9eeb5f1d152e1d0d24dc51e910f772f0acacec

  • SHA256

    aba717ff50dd3ff2b81104e804cef5cb531a0b39b1b7dafa5fa65cf0ba7606ad

  • SHA512

    51accd2042eaf9459c5b60bf79c0f786f33058be3ccf853fc6e8a1bec3d4aa992d17481a91e9f9370bd836fb9eea67155368c34f01f9b940d39d1f141b25a495

  • SSDEEP

    49152:j7h5kRwehJbhar3b8uROfHyqX6Qz84ova3V1S:j7D8wMJbWRIjqwBoT

Malware Config

Extracted

Family

amadey

Version

4.30

Botnet

4dd39d

C2

http://77.91.77.82

Attributes
  • install_dir

    ad40971b6b

  • install_file

    explorti.exe

  • strings_key

    a434973ad22def7137dbb5e059b7081e

  • url_paths

    /Hun4Ko/index.php

rc4.plain

Extracted

Family

stealc

Botnet

hate

C2

http://85.28.47.30

Attributes
  • url_path

    /920475a59bac849d.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Stealc

    Stealc is an infostealer written in C++.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 14 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 8 IoCs
  • Identifies Wine through registry keys 2 TTPs 7 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 2 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 19 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 10 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\aba717ff50dd3ff2b81104e804cef5cb531a0b39b1b7dafa5fa65cf0ba7606ad.exe
    "C:\Users\Admin\AppData\Local\Temp\aba717ff50dd3ff2b81104e804cef5cb531a0b39b1b7dafa5fa65cf0ba7606ad.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:3040
    • C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
      "C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3364
      • C:\Users\Admin\AppData\Local\Temp\1000006001\c2c7939d0a.exe
        "C:\Users\Admin\AppData\Local\Temp\1000006001\c2c7939d0a.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:1116
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\FIDGHIIECG.exe"
          4⤵
            PID:4880
            • C:\Users\Admin\AppData\Local\Temp\FIDGHIIECG.exe
              "C:\Users\Admin\AppData\Local\Temp\FIDGHIIECG.exe"
              5⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • Suspicious behavior: EnumeratesProcesses
              PID:5044
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\BFHJJJDAFB.exe"
            4⤵
              PID:5204
              • C:\Users\Admin\AppData\Local\Temp\BFHJJJDAFB.exe
                "C:\Users\Admin\AppData\Local\Temp\BFHJJJDAFB.exe"
                5⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • Suspicious behavior: EnumeratesProcesses
                PID:5660
          • C:\Users\Admin\AppData\Local\Temp\1000011001\aae024fc00.exe
            "C:\Users\Admin\AppData\Local\Temp\1000011001\aae024fc00.exe"
            3⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of WriteProcessMemory
            PID:2332
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:4636
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
                5⤵
                • Checks processor information in registry
                • Modifies registry class
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:4416
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2028 -parentBuildID 20240401114208 -prefsHandle 1956 -prefMapHandle 1948 -prefsLen 25755 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a54f8aa3-5418-4536-a9d2-4fd23ea1ccef} 4416 "\\.\pipe\gecko-crash-server-pipe.4416" gpu
                  6⤵
                    PID:100
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2464 -parentBuildID 20240401114208 -prefsHandle 2456 -prefMapHandle 2452 -prefsLen 26675 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6f396995-1f16-40a7-9e55-584981959295} 4416 "\\.\pipe\gecko-crash-server-pipe.4416" socket
                    6⤵
                      PID:1420
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3232 -childID 1 -isForBrowser -prefsHandle 3060 -prefMapHandle 3264 -prefsLen 22698 -prefMapSize 244658 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {357d28e9-37d5-45fd-87cb-102b7c67a231} 4416 "\\.\pipe\gecko-crash-server-pipe.4416" tab
                      6⤵
                        PID:4440
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3920 -childID 2 -isForBrowser -prefsHandle 3912 -prefMapHandle 3908 -prefsLen 31165 -prefMapSize 244658 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fce59941-8720-4b50-9ac9-f399a0a7dcab} 4416 "\\.\pipe\gecko-crash-server-pipe.4416" tab
                        6⤵
                          PID:3572
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4780 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4788 -prefMapHandle 4764 -prefsLen 31165 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {588ee0b3-14a2-4555-ba55-22eb94718bb5} 4416 "\\.\pipe\gecko-crash-server-pipe.4416" utility
                          6⤵
                          • Checks processor information in registry
                          PID:5240
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5556 -childID 3 -isForBrowser -prefsHandle 5544 -prefMapHandle 5548 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d8eed289-af34-4605-b0c3-5cc0da86e993} 4416 "\\.\pipe\gecko-crash-server-pipe.4416" tab
                          6⤵
                            PID:5900
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5680 -childID 4 -isForBrowser -prefsHandle 5760 -prefMapHandle 5756 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f5cb4f1f-3315-4970-a911-fff7a888d994} 4416 "\\.\pipe\gecko-crash-server-pipe.4416" tab
                            6⤵
                              PID:5912
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5948 -childID 5 -isForBrowser -prefsHandle 5868 -prefMapHandle 5872 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ce1899ac-d5bd-44b4-97d4-e0dfb52d57b0} 4416 "\\.\pipe\gecko-crash-server-pipe.4416" tab
                              6⤵
                                PID:5924
                    • C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
                      C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
                      1⤵
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • Suspicious behavior: EnumeratesProcesses
                      PID:3744
                    • C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
                      C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
                      1⤵
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • Suspicious behavior: EnumeratesProcesses
                      PID:6092
                    • C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
                      C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
                      1⤵
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • Suspicious behavior: EnumeratesProcesses
                      PID:5496

                    Network

                    MITRE ATT&CK Enterprise v15

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\ProgramData\mozglue.dll

                      Filesize

                      593KB

                      MD5

                      c8fd9be83bc728cc04beffafc2907fe9

                      SHA1

                      95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                      SHA256

                      ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                      SHA512

                      fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                    • C:\ProgramData\nss3.dll

                      Filesize

                      2.0MB

                      MD5

                      1cc453cdf74f31e4d913ff9c10acdde2

                      SHA1

                      6e85eae544d6e965f15fa5c39700fa7202f3aafe

                      SHA256

                      ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                      SHA512

                      dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3mrom4gn.default-release\activity-stream.discovery_stream.json.tmp

                      Filesize

                      18KB

                      MD5

                      ace08027d88d58b941918bb03190f422

                      SHA1

                      dc7813d14c95dc33cd9953ce2991e8175c712c2a

                      SHA256

                      0b4403d0030b43c88562d7c65009dafeecb1a52f31e04aa61e29ac381141fe43

                      SHA512

                      211553c068ce02f1c2657f2354c2a9fdd186a94beb92bd7a23bc2e661481e605a410b8c2178328e1f76d32460bf695a630bc5feb056a3ba8b45929c3cefba104

                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3mrom4gn.default-release\cache2\entries\5CD1EBDF6B57F13C7E783CE5E6D8E9C44014FE1A

                      Filesize

                      13KB

                      MD5

                      adf75fc41407349a03f4d96bf496e685

                      SHA1

                      8f72fff1497a24f93939b11e024d4ad1c81e30b1

                      SHA256

                      8efe8a155340c8f2a28729b187b39cff643e2e8de8c0e12798d2c9be798765f9

                      SHA512

                      868ffab103738215f1dfad2d1a24e2b4d180f0de1295f5972c3e80fb984a9bc0d8cb569e53611cb3e7c6e7094656f23fc5b6e095ef4fb129651064974ce4ac4d

                    • C:\Users\Admin\AppData\Local\Temp\1000006001\c2c7939d0a.exe

                      Filesize

                      2.4MB

                      MD5

                      b5f67083e086299287f0dfb2a7bef96e

                      SHA1

                      dccf58d99cd7153859d1ad5a1c3f7e348e2ebbb7

                      SHA256

                      1b6722f558bf4483253663180682caec67066261bc0414d12d6e1622cb848d80

                      SHA512

                      55c4f5d435a1a27e6c8e14c88e454da4dc2398076f4596a6f983184831db0119c58be9c82b8ddf5ef37265b65b5cea56e5963c871b2be0f8e88064224681d654

                    • C:\Users\Admin\AppData\Local\Temp\1000011001\aae024fc00.exe

                      Filesize

                      1.2MB

                      MD5

                      86037c510a58b81892f98de398dd778a

                      SHA1

                      0f85715b93e6fc8bd7a8218d0bbfa44a90782491

                      SHA256

                      482eff0a8df5b73a7d3c7915c4d4c058e80445ff38f0133b9c8c125bec84e54b

                      SHA512

                      17de2e8c469efd2cd79df22f93a13c2b2487892650eb7ef88db0222087a1662147e14e9b2acf45ac11bf0e192715a8dbdd7b203e7cf845516b92d89e40ce3187

                    • C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe

                      Filesize

                      1.8MB

                      MD5

                      b216ac082608e4fd08c4dfb765dd61c9

                      SHA1

                      9f9eeb5f1d152e1d0d24dc51e910f772f0acacec

                      SHA256

                      aba717ff50dd3ff2b81104e804cef5cb531a0b39b1b7dafa5fa65cf0ba7606ad

                      SHA512

                      51accd2042eaf9459c5b60bf79c0f786f33058be3ccf853fc6e8a1bec3d4aa992d17481a91e9f9370bd836fb9eea67155368c34f01f9b940d39d1f141b25a495

                    • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                      Filesize

                      479KB

                      MD5

                      09372174e83dbbf696ee732fd2e875bb

                      SHA1

                      ba360186ba650a769f9303f48b7200fb5eaccee1

                      SHA256

                      c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                      SHA512

                      b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                    • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                      Filesize

                      13.8MB

                      MD5

                      0a8747a2ac9ac08ae9508f36c6d75692

                      SHA1

                      b287a96fd6cc12433adb42193dfe06111c38eaf0

                      SHA256

                      32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                      SHA512

                      59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3mrom4gn.default-release\AlternateServices.bin

                      Filesize

                      11KB

                      MD5

                      b86fc1d67a097461d0262aff00d3dc74

                      SHA1

                      e4cee7e28d49e497bdea7bb3c1d76427fef3a0fe

                      SHA256

                      0dcb6d55c51e3c9b6d635588b9a5f31d6a8580081e7a60a67307710353873b15

                      SHA512

                      b83b5d64bbd5953061553e165b9957a3ba1fd145be3b9e6fe854a837c61be1868b2fc13998fd27a3add2918536fcb4c3a4d78e8a785012461d2accc27d021912

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3mrom4gn.default-release\cookies.sqlite-wal

                      Filesize

                      256KB

                      MD5

                      32e28e123de341c40e35ef7bca0f2838

                      SHA1

                      20bcc0745285b172a86e1939653846d713fd6d2c

                      SHA256

                      c8ae62aad7d76740a60758073cb1aaff3da8db2e65b09a00a76693b29c7ae9f0

                      SHA512

                      6c78fa50e541befe7c8ffa66ba384057aa9316baf58b8e6f0c821dbe0897dc5b5e49a295848eda4f9b19b11ce19158f0d9be1b7ac2e3108cb9b9011a550cc033

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3mrom4gn.default-release\datareporting\glean\db\data.safe.tmp

                      Filesize

                      5KB

                      MD5

                      238c002ac2e8754d281b99a46bb8c9d1

                      SHA1

                      f165c22f25037de6f3045fa6fd644d079bb4660d

                      SHA256

                      5833de12c54e4ad7d6efc06b6e10a7cfcafc0de57c37d9eb2ed60f7d98f7b4ba

                      SHA512

                      a1f0bf808e138da6581d83c9320d5dd9de3da7afe3e503a41198d9e9974044b1e4c614c453505b1da9b0765fc25578f9637474a56d5b9bb5dd3f18922d7cf838

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3mrom4gn.default-release\datareporting\glean\db\data.safe.tmp

                      Filesize

                      16KB

                      MD5

                      4c5cc8db51fb06cf3cdfd6a6af346384

                      SHA1

                      8d49746ee35c5dd81da712c945b717a8b48f88f1

                      SHA256

                      a6528d32948ac4f351e6981c38f73b10eec71b23ac051e38a20bd688fa0ce502

                      SHA512

                      11a21fe9f0850c32cfc03a404226e34950f1c237f9b8792ebd23b0c244cf235d611718d026ddfa214144b89a8fb6f6766ba1cd3e0928c2726c9082f3677c5f3c

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3mrom4gn.default-release\datareporting\glean\db\data.safe.tmp

                      Filesize

                      5KB

                      MD5

                      145d0c0ec1fe0fc7aa15fb800486a276

                      SHA1

                      c491f044fd574828b1b1ae0642e5478ebffa9792

                      SHA256

                      fb24456e911c7e3382129f17bdfb54d36301c298b0d8f6bc4772fd94c49cc446

                      SHA512

                      82cc10e6a8e3bc2cf0974b4b10c83b6c343c39072509bbe62292aae28175d7029efd6b5054cf1ccce7843dce7bd4116203c7aa8f78e6c85a7afb4c9952f5f5e8

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3mrom4gn.default-release\datareporting\glean\pending_pings\2bb68aec-63ec-465f-84f5-16f41211ef4e

                      Filesize

                      982B

                      MD5

                      9137a601e7cc20b481246f88cdaf664a

                      SHA1

                      1d92534c489a5005bd76b19820bd9be55a8665a4

                      SHA256

                      17692c4d8ca1ec90a24fbbd9b61ec10086110c4308f8a3856eab5f7380120434

                      SHA512

                      bfce56b58b9636bb3c9bc6c99866adc89459084d44f5c82c48e0515ef7bacc3124f9d7fb70c93e94f02635494b8ed174ca8194b1cf860cb9cb312b21e7ed1462

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3mrom4gn.default-release\datareporting\glean\pending_pings\b213df6d-37b7-4dc7-ba58-f9b61a36e76f

                      Filesize

                      671B

                      MD5

                      366083f4af085cac4a62f98c3a20f514

                      SHA1

                      09157e81e353a871c33dc18647a45e9030ac3e4e

                      SHA256

                      81ad39b67786e0c835e33aeb1c04ccb8f28105aec94666a13b496554d938d3d9

                      SHA512

                      2c6c50bdf4b0f90c2c6d8e5f52595132a3e9abf268b20742080edd7add655222407e4b6bc9d5438a82f53d58a0256454844b303bdae2038cb8e07df9f2265a5d

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3mrom4gn.default-release\datareporting\glean\pending_pings\fbe7de17-3ace-419a-a81e-042f13d3aa7a

                      Filesize

                      25KB

                      MD5

                      2981728a060e01e67ff7c8232f0b8582

                      SHA1

                      aae954037be6837069bedddcac560593fec2a415

                      SHA256

                      b7441f7fecf46c5ad53b3ac671e4a59097a4b414139e204f788b9ea20c7185cd

                      SHA512

                      02fe348d296b2862047593e01810d297c6f63838196a8c2a3fdcf4657c9c9042f4cb3ca98ffa618e96eef9674ca770a212436c953f54efec4f99f230ed5f9c11

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3mrom4gn.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

                      Filesize

                      1.1MB

                      MD5

                      842039753bf41fa5e11b3a1383061a87

                      SHA1

                      3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                      SHA256

                      d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                      SHA512

                      d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3mrom4gn.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

                      Filesize

                      116B

                      MD5

                      2a461e9eb87fd1955cea740a3444ee7a

                      SHA1

                      b10755914c713f5a4677494dbe8a686ed458c3c5

                      SHA256

                      4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                      SHA512

                      34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3mrom4gn.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

                      Filesize

                      372B

                      MD5

                      bf957ad58b55f64219ab3f793e374316

                      SHA1

                      a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                      SHA256

                      bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                      SHA512

                      79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3mrom4gn.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

                      Filesize

                      17.8MB

                      MD5

                      daf7ef3acccab478aaa7d6dc1c60f865

                      SHA1

                      f8246162b97ce4a945feced27b6ea114366ff2ad

                      SHA256

                      bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                      SHA512

                      5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3mrom4gn.default-release\places.sqlite-wal

                      Filesize

                      992KB

                      MD5

                      50629c52481c683df53702ae7ef11844

                      SHA1

                      1c21e2335e6309f1a55832a708e68bb3eb01b920

                      SHA256

                      1d3b86f1a00698cc3965bdc0332289d216981d905d050c8188d62487d7d5505c

                      SHA512

                      ab51ce223cfc9413115e64316b0967794a368d495f20d2e816ebf48bc4efb2f05ad1e0bb1109190bc802a06bd4ddd54a856d5372f972c3fbec825d2c8854944d

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3mrom4gn.default-release\prefs-1.js

                      Filesize

                      10KB

                      MD5

                      242a0a81e6f71f56a010a5af4a66a5c8

                      SHA1

                      2452ec0b7167e9d8563280fba3eb485dd8486a5c

                      SHA256

                      f1c1c84fad4de9259e2d59e74d29fc9e2a23944219fe71a6619104cc36ee36d9

                      SHA512

                      f38255c5ac752ec4ffff95e68d776cadd21393f098da17b22d92f742e7822044b8d7099bb103ef2c1c15cda07f3e5efd83ec3422028a08f899efec7b70d3e1f6

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3mrom4gn.default-release\prefs-1.js

                      Filesize

                      11KB

                      MD5

                      f9cc0e1e72d626815d74e1970a2daf62

                      SHA1

                      bf01825678b1de78c2e06266caabe2d8ebf5dd87

                      SHA256

                      49f5c67f1e8c4622d698202d99d40fb2ef9e00f95167fb00c446a768f6820f32

                      SHA512

                      c783ab3206a3ec7c2444c62930b1374d5d78704663ddb21a5736ad26e8d2e5e1c54920557e5c8742bdde82139ac8062384cf3925381f8b4879f5ddaf8512cbbf

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3mrom4gn.default-release\prefs-1.js

                      Filesize

                      13KB

                      MD5

                      1959f293100bcdd5a864f4fad71ae411

                      SHA1

                      f3d28e2973928ee511d2f5465ca0da6ba8b5589b

                      SHA256

                      69ec23178bedecb4ae106c82b48188482aab8a73f0d002b4b74853cd1414b47a

                      SHA512

                      2dd80c0957ca31f716574641aeb6e7a60621697754c6b62d69649b8a81816b7f70b4e2bad7f55e86fd26e6f528d454b842164262cb8c97b527a177e26e43717e

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3mrom4gn.default-release\prefs.js

                      Filesize

                      8KB

                      MD5

                      61e5c97589b462e251ae563d8a5f7af2

                      SHA1

                      93bb1742c22f0ef48425b942e5bb17d9a6e29ad7

                      SHA256

                      f93a8e9fda6a936cbee52b55363b52ba5c07ef5612798a3a43760ef329040c3f

                      SHA512

                      0d95e658f9b39b2cd6125265e90da715d5f855f8cbfba4729d1b5064e20ede7bd4b0c505d8a59523dcea22f74fb85c26fda3052acf75316db04d57e9ef9737e3

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3mrom4gn.default-release\prefs.js

                      Filesize

                      15KB

                      MD5

                      123be9f25e10cda6fd34b4181ba620cc

                      SHA1

                      f62a0451f20cd9c3c6639ac68bb5983046bcccc8

                      SHA256

                      7c627394250bf49021e42327aebd7378cc6cab5ff5ca3392ac7cef1cc047973f

                      SHA512

                      c3562f7db888e81156b559f090162e54fe18a157e7a752be93ea74f2913468b0a8029fb61effa7a0271f22d856ced5f11ee0017355cc4fda1996711733f4337c

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3mrom4gn.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

                      Filesize

                      1.3MB

                      MD5

                      d48592cd545a275911a82c514a350561

                      SHA1

                      fb92c1a1e228a0768516ecb948d59473501f68c3

                      SHA256

                      92544f0e66defbaac90339a76466bd46dae456cc2db923b5fa5531c5e9c2ba73

                      SHA512

                      3cb23b48a57d82f95723c1965639d5c8197ff8c53e36f6b46b2b557d4156e77a12c7d40baabded49ce58bf717ee3b54fd10507f255287294ae954fb236071bfe

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3mrom4gn.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

                      Filesize

                      1.5MB

                      MD5

                      dcf34e966aced9a1585790b6198f96af

                      SHA1

                      d753db23de7a5096c48671df38c5a967bb3ed269

                      SHA256

                      5c12d868d46cadc2598fba09d88b8794590ead95514a9ecb3acb7c292cdb39e6

                      SHA512

                      74755608d576c875fe84df5466598169676d58ea356ae1476bc0434ed27f61051a1a536126cc74c1610d8483e2ee190c2389a51d08cc5bec7b2f62a3edfb9529

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3mrom4gn.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

                      Filesize

                      1.5MB

                      MD5

                      5b3214b6c766adb29a46ea87fdf66c36

                      SHA1

                      b4e6158990a5acb4451e9c4921c3c95d046e3d22

                      SHA256

                      efa0c022557d96bae68b1bae22e37322059e3522d4698e6f3ffda5544cacd875

                      SHA512

                      89cbc2b92107879002a4fbced017f94d99e6c40ace7cf468c791b84f7b7f25ca52217c1558f95dd9c4be2dd31f23a645d81a31f92e604a493d6b14ecce7f5641

                    • memory/1116-286-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                      Filesize

                      972KB

                    • memory/1116-48-0x00000000001A0000-0x0000000000D81000-memory.dmp

                      Filesize

                      11.9MB

                    • memory/1116-1645-0x00000000001A0000-0x0000000000D81000-memory.dmp

                      Filesize

                      11.9MB

                    • memory/1116-395-0x00000000001A0000-0x0000000000D81000-memory.dmp

                      Filesize

                      11.9MB

                    • memory/1116-1704-0x00000000001A0000-0x0000000000D81000-memory.dmp

                      Filesize

                      11.9MB

                    • memory/1116-1694-0x00000000001A0000-0x0000000000D81000-memory.dmp

                      Filesize

                      11.9MB

                    • memory/1116-447-0x00000000001A0000-0x0000000000D81000-memory.dmp

                      Filesize

                      11.9MB

                    • memory/1116-46-0x00000000001A0000-0x0000000000D81000-memory.dmp

                      Filesize

                      11.9MB

                    • memory/1116-1461-0x00000000001A0000-0x0000000000D81000-memory.dmp

                      Filesize

                      11.9MB

                    • memory/1116-473-0x00000000001A0000-0x0000000000D81000-memory.dmp

                      Filesize

                      11.9MB

                    • memory/1116-1765-0x00000000001A0000-0x0000000000D81000-memory.dmp

                      Filesize

                      11.9MB

                    • memory/1116-988-0x00000000001A0000-0x0000000000D81000-memory.dmp

                      Filesize

                      11.9MB

                    • memory/1116-616-0x00000000001A0000-0x0000000000D81000-memory.dmp

                      Filesize

                      11.9MB

                    • memory/3040-18-0x0000000000750000-0x0000000000BFA000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/3040-2-0x0000000000751000-0x000000000077F000-memory.dmp

                      Filesize

                      184KB

                    • memory/3040-1-0x0000000077E14000-0x0000000077E16000-memory.dmp

                      Filesize

                      8KB

                    • memory/3040-0-0x0000000000750000-0x0000000000BFA000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/3040-3-0x0000000000750000-0x0000000000BFA000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/3040-5-0x0000000000750000-0x0000000000BFA000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/3364-44-0x0000000000550000-0x00000000009FA000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/3364-19-0x0000000000550000-0x00000000009FA000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/3364-589-0x0000000000550000-0x00000000009FA000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/3364-472-0x0000000000550000-0x00000000009FA000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/3364-2808-0x0000000000550000-0x00000000009FA000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/3364-446-0x0000000000550000-0x00000000009FA000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/3364-68-0x0000000000550000-0x00000000009FA000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/3364-47-0x0000000000550000-0x00000000009FA000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/3364-983-0x0000000000550000-0x00000000009FA000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/3364-29-0x0000000000550000-0x00000000009FA000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/3364-1460-0x0000000000550000-0x00000000009FA000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/3364-28-0x0000000000550000-0x00000000009FA000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/3364-1644-0x0000000000550000-0x00000000009FA000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/3364-2122-0x0000000000550000-0x00000000009FA000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/3364-16-0x0000000000550000-0x00000000009FA000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/3364-1703-0x0000000000550000-0x00000000009FA000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/3364-20-0x0000000000550000-0x00000000009FA000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/3364-22-0x0000000000550000-0x00000000009FA000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/3364-21-0x0000000000550000-0x00000000009FA000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/3364-1693-0x0000000000550000-0x00000000009FA000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/3744-24-0x0000000000550000-0x00000000009FA000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/3744-25-0x0000000000550000-0x00000000009FA000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/3744-26-0x0000000000550000-0x00000000009FA000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/3744-27-0x0000000000550000-0x00000000009FA000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/5044-1711-0x0000000000DA0000-0x000000000124A000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/5044-1712-0x0000000000DA0000-0x000000000124A000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/5496-2123-0x0000000000550000-0x00000000009FA000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/5496-2325-0x0000000000550000-0x00000000009FA000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/5660-1790-0x0000000000720000-0x0000000000BCA000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/5660-1989-0x0000000000720000-0x0000000000BCA000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/6092-617-0x0000000000550000-0x00000000009FA000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/6092-691-0x0000000000550000-0x00000000009FA000-memory.dmp

                      Filesize

                      4.7MB