Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240709-en
  • resource tags

    arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    12-07-2024 05:00

General

  • Target

    aba717ff50dd3ff2b81104e804cef5cb531a0b39b1b7dafa5fa65cf0ba7606ad.exe

  • Size

    1.8MB

  • MD5

    b216ac082608e4fd08c4dfb765dd61c9

  • SHA1

    9f9eeb5f1d152e1d0d24dc51e910f772f0acacec

  • SHA256

    aba717ff50dd3ff2b81104e804cef5cb531a0b39b1b7dafa5fa65cf0ba7606ad

  • SHA512

    51accd2042eaf9459c5b60bf79c0f786f33058be3ccf853fc6e8a1bec3d4aa992d17481a91e9f9370bd836fb9eea67155368c34f01f9b940d39d1f141b25a495

  • SSDEEP

    49152:j7h5kRwehJbhar3b8uROfHyqX6Qz84ova3V1S:j7D8wMJbWRIjqwBoT

Malware Config

Extracted

Family

amadey

Version

4.30

Botnet

4dd39d

C2

http://77.91.77.82

Attributes
  • install_dir

    ad40971b6b

  • install_file

    explorti.exe

  • strings_key

    a434973ad22def7137dbb5e059b7081e

  • url_paths

    /Hun4Ko/index.php

rc4.plain

Extracted

Family

stealc

Botnet

hate

C2

http://85.28.47.30

Attributes
  • url_path

    /920475a59bac849d.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Stealc

    Stealc is an infostealer written in C++.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 14 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 8 IoCs
  • Identifies Wine through registry keys 2 TTPs 7 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 2 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 20 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 10 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\aba717ff50dd3ff2b81104e804cef5cb531a0b39b1b7dafa5fa65cf0ba7606ad.exe
    "C:\Users\Admin\AppData\Local\Temp\aba717ff50dd3ff2b81104e804cef5cb531a0b39b1b7dafa5fa65cf0ba7606ad.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:1448
    • C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
      "C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3040
      • C:\Users\Admin\AppData\Local\Temp\1000006001\c2c7939d0a.exe
        "C:\Users\Admin\AppData\Local\Temp\1000006001\c2c7939d0a.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:1344
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\AAEHIDAKEC.exe"
          4⤵
            PID:2136
            • C:\Users\Admin\AppData\Local\Temp\AAEHIDAKEC.exe
              "C:\Users\Admin\AppData\Local\Temp\AAEHIDAKEC.exe"
              5⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • Suspicious behavior: EnumeratesProcesses
              PID:3160
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\AEGIJKEHCA.exe"
            4⤵
              PID:2124
              • C:\Users\Admin\AppData\Local\Temp\AEGIJKEHCA.exe
                "C:\Users\Admin\AppData\Local\Temp\AEGIJKEHCA.exe"
                5⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • Suspicious behavior: EnumeratesProcesses
                PID:2824
          • C:\Users\Admin\AppData\Local\Temp\1000011001\226c8c6353.exe
            "C:\Users\Admin\AppData\Local\Temp\1000011001\226c8c6353.exe"
            3⤵
            • Executes dropped EXE
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of WriteProcessMemory
            PID:4592
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:1440
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
                5⤵
                • Checks processor information in registry
                • Modifies registry class
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:4636
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2000 -parentBuildID 20240401114208 -prefsHandle 1916 -prefMapHandle 1904 -prefsLen 25751 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ff68c7d8-4a19-4a06-afa8-76adce81510b} 4636 "\\.\pipe\gecko-crash-server-pipe.4636" gpu
                  6⤵
                    PID:4392
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2416 -parentBuildID 20240401114208 -prefsHandle 2408 -prefMapHandle 2404 -prefsLen 26671 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {78614967-18c9-4586-ad60-0f5004d6ad0a} 4636 "\\.\pipe\gecko-crash-server-pipe.4636" socket
                    6⤵
                      PID:436
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3268 -childID 1 -isForBrowser -prefsHandle 3260 -prefMapHandle 3256 -prefsLen 22698 -prefMapSize 244658 -jsInitHandle 1348 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9e8ae51a-8f91-483d-bd91-86e84cf23130} 4636 "\\.\pipe\gecko-crash-server-pipe.4636" tab
                      6⤵
                        PID:3088
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3616 -childID 2 -isForBrowser -prefsHandle 3608 -prefMapHandle 3604 -prefsLen 31161 -prefMapSize 244658 -jsInitHandle 1348 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {42749d2e-c38c-4a70-b9de-da636f98152a} 4636 "\\.\pipe\gecko-crash-server-pipe.4636" tab
                        6⤵
                          PID:4840
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4680 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4540 -prefMapHandle 4664 -prefsLen 31161 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {470de6e0-1ea1-4154-81fb-d35358ae35b4} 4636 "\\.\pipe\gecko-crash-server-pipe.4636" utility
                          6⤵
                          • Checks processor information in registry
                          PID:2388
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5292 -childID 3 -isForBrowser -prefsHandle 5284 -prefMapHandle 5268 -prefsLen 26990 -prefMapSize 244658 -jsInitHandle 1348 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {86c89247-2989-4ca6-86fb-c09b4509ca8a} 4636 "\\.\pipe\gecko-crash-server-pipe.4636" tab
                          6⤵
                            PID:2740
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5292 -childID 4 -isForBrowser -prefsHandle 5460 -prefMapHandle 5456 -prefsLen 26990 -prefMapSize 244658 -jsInitHandle 1348 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3fff7103-3b44-4e14-a851-5b9a8cc69e9a} 4636 "\\.\pipe\gecko-crash-server-pipe.4636" tab
                            6⤵
                              PID:2816
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5612 -childID 5 -isForBrowser -prefsHandle 5180 -prefMapHandle 5216 -prefsLen 26990 -prefMapSize 244658 -jsInitHandle 1348 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3b6d3037-203d-42b1-95d1-7843d25b01c9} 4636 "\\.\pipe\gecko-crash-server-pipe.4636" tab
                              6⤵
                                PID:3716
                    • C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
                      C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
                      1⤵
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • Suspicious behavior: EnumeratesProcesses
                      PID:2308
                    • C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
                      C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
                      1⤵
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • Suspicious behavior: EnumeratesProcesses
                      PID:5020
                    • C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
                      C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
                      1⤵
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • Suspicious behavior: EnumeratesProcesses
                      PID:5028

                    Network

                    MITRE ATT&CK Enterprise v15

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\ProgramData\mozglue.dll

                      Filesize

                      593KB

                      MD5

                      c8fd9be83bc728cc04beffafc2907fe9

                      SHA1

                      95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                      SHA256

                      ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                      SHA512

                      fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                    • C:\ProgramData\nss3.dll

                      Filesize

                      2.0MB

                      MD5

                      1cc453cdf74f31e4d913ff9c10acdde2

                      SHA1

                      6e85eae544d6e965f15fa5c39700fa7202f3aafe

                      SHA256

                      ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                      SHA512

                      dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\7qnbgwy0.default-release\activity-stream.discovery_stream.json.tmp

                      Filesize

                      18KB

                      MD5

                      73c90ae0ef84bfdac4e0f1a159ba1f27

                      SHA1

                      03826d4ff34ba38f2784919336666f009c129be5

                      SHA256

                      5db58e00be2cdc018d6ffca83c9adfab6818038cca5fde209f525f6c3a46b9a9

                      SHA512

                      ba01402914cfdb6f7ce430d0fb214993acf0fc562e58af003dc1854e8137e3b59c0bd5e3f55df831ff08aed9e5c1b4807f531663e6d84565caaf5ee0598591a4

                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\7qnbgwy0.default-release\cache2\entries\5CD1EBDF6B57F13C7E783CE5E6D8E9C44014FE1A

                      Filesize

                      13KB

                      MD5

                      2ae25fb44e5328f7939594c14cfb9dd6

                      SHA1

                      d8f9aeaca3d02e4e6412a5aa64cb2cc474fbb4ce

                      SHA256

                      3eae3969cae6655264c3e50e537e3aa1990f530934ca39e305ba09b887d7f5b6

                      SHA512

                      0c3512d6c6efd1be482752c05d2d61a6efcc67c57a19abe01d4af4080454c0254cbad87651337969e08a0bb9d7034fd94b4a7a0eaad2c16811d49fa094be9c57

                    • C:\Users\Admin\AppData\Local\Temp\1000006001\c2c7939d0a.exe

                      Filesize

                      2.4MB

                      MD5

                      b5f67083e086299287f0dfb2a7bef96e

                      SHA1

                      dccf58d99cd7153859d1ad5a1c3f7e348e2ebbb7

                      SHA256

                      1b6722f558bf4483253663180682caec67066261bc0414d12d6e1622cb848d80

                      SHA512

                      55c4f5d435a1a27e6c8e14c88e454da4dc2398076f4596a6f983184831db0119c58be9c82b8ddf5ef37265b65b5cea56e5963c871b2be0f8e88064224681d654

                    • C:\Users\Admin\AppData\Local\Temp\1000011001\226c8c6353.exe

                      Filesize

                      1.2MB

                      MD5

                      86037c510a58b81892f98de398dd778a

                      SHA1

                      0f85715b93e6fc8bd7a8218d0bbfa44a90782491

                      SHA256

                      482eff0a8df5b73a7d3c7915c4d4c058e80445ff38f0133b9c8c125bec84e54b

                      SHA512

                      17de2e8c469efd2cd79df22f93a13c2b2487892650eb7ef88db0222087a1662147e14e9b2acf45ac11bf0e192715a8dbdd7b203e7cf845516b92d89e40ce3187

                    • C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe

                      Filesize

                      1.8MB

                      MD5

                      b216ac082608e4fd08c4dfb765dd61c9

                      SHA1

                      9f9eeb5f1d152e1d0d24dc51e910f772f0acacec

                      SHA256

                      aba717ff50dd3ff2b81104e804cef5cb531a0b39b1b7dafa5fa65cf0ba7606ad

                      SHA512

                      51accd2042eaf9459c5b60bf79c0f786f33058be3ccf853fc6e8a1bec3d4aa992d17481a91e9f9370bd836fb9eea67155368c34f01f9b940d39d1f141b25a495

                    • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                      Filesize

                      479KB

                      MD5

                      09372174e83dbbf696ee732fd2e875bb

                      SHA1

                      ba360186ba650a769f9303f48b7200fb5eaccee1

                      SHA256

                      c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                      SHA512

                      b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                    • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                      Filesize

                      13.8MB

                      MD5

                      0a8747a2ac9ac08ae9508f36c6d75692

                      SHA1

                      b287a96fd6cc12433adb42193dfe06111c38eaf0

                      SHA256

                      32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                      SHA512

                      59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7qnbgwy0.default-release\AlternateServices.bin

                      Filesize

                      10KB

                      MD5

                      5d1cfd79521fa8647c1d6e59731215fc

                      SHA1

                      28a3afca295e02d9abf377b5fbfced8a57f7bed6

                      SHA256

                      3d28281662df2023090f5b2de1d2c43999dbf3ecf6492c2e9bbc2a0fdb50741e

                      SHA512

                      c146079d53f6e2d477bfdd9baece17315fce647cf0e0135ac9f4dbe76617eff3cee25edc36db48b8930a4546e2a2b149989be1c793e4c6513b72fb7eaddcd9f6

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7qnbgwy0.default-release\AlternateServices.bin

                      Filesize

                      16KB

                      MD5

                      aabbbfdf331f85e9f3f9b3cfa9843e8b

                      SHA1

                      ea5f7c091c90684045df23514f041522be4c7ad7

                      SHA256

                      79f263e565f2b08eac1063db80be481e914b396bd805a0ac0023136bc11e94c3

                      SHA512

                      12d43fed85ceae1f2cae4ee9f696cac8b771b6ec44059ece9fca42ad841656bd963984344a07698333b9ea4b5055b03f4efdc7a90c6ca8cb8b56d290b7e3a1bb

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7qnbgwy0.default-release\cookies.sqlite-wal

                      Filesize

                      256KB

                      MD5

                      0a6e2f1f40636d634e12e15fb1420054

                      SHA1

                      b872da95ded584a32d1016cd58e1fe18b5016ff9

                      SHA256

                      16a280c604c5a7004a64a112387ff1d0c250e9e443c013bb59e1843fe99d4d27

                      SHA512

                      307f324345d66297aa0910fec7ad63c6c76cccaf752f52af593b15c3d2e8dd77d1e910f29967fe0ec1b38bb82f28469480300bdf32bfbef4c7aca59069a4a21a

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7qnbgwy0.default-release\datareporting\glean\db\data.safe.tmp

                      Filesize

                      16KB

                      MD5

                      f81385a3c1d3e53dbf61be1e8fbe8c95

                      SHA1

                      7ae7826c55d54bfed8b97fab442105c16be75f70

                      SHA256

                      29a7456e0b58f9da7f8af9eb1111834be71c975f8b5a81c772a6dc9869d5a5b4

                      SHA512

                      d54603648d24ba4e6319a1d725847bfc28112901c840a82cc5901eea634fb035e01dd000bb5d3fc90adc7bf881755c7a213702e6efb73df74884df9b186b9329

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7qnbgwy0.default-release\datareporting\glean\db\data.safe.tmp

                      Filesize

                      6KB

                      MD5

                      79006a035d184dae0cf239fe476a1513

                      SHA1

                      eddeecf95089c8222e75b1138a2877154008a068

                      SHA256

                      00e01c40f47ffef6c99442d894e7092118335346ede3946e5cc4591ae179437b

                      SHA512

                      64efec41e33e9c45c200d8d7e3b44c1bb29e28b5e67a29b77a20bfdd36b1e952d7eeb0ad0217ab5b866c6b1bf732a627df738cb2a88d57e0c8564bb35e7c8c3c

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7qnbgwy0.default-release\datareporting\glean\db\data.safe.tmp

                      Filesize

                      5KB

                      MD5

                      62264da14d5d71e5a1904b7ed6fa9892

                      SHA1

                      577fbdd91b75c2299ed26db738749a2d823256ab

                      SHA256

                      5810ceb69cf41f08f68ac2f64bbd4a67d5dd02d956b9d8129ac51a46d555d371

                      SHA512

                      ac16997168da602e9be4696d0bbca26ea1f94630eafeb24dc2dd163c8f9eb7dd108aba2ddfdd5e355beeebc2df64834da1768728fb4ef0c169ba2d4f239d26d5

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7qnbgwy0.default-release\datareporting\glean\db\data.safe.tmp

                      Filesize

                      5KB

                      MD5

                      8358d810ea7cbe80007cd3c200934c76

                      SHA1

                      4c3ecc73f4e8d3d4b12dbdd02c95c797a4a1df48

                      SHA256

                      94e2e6735ad121676c2bbfd7dfe10d1b35d77d9e4ed5d4c884ed02d40c7f7e75

                      SHA512

                      e95f0985b6bf39d7f77c3c884425228802b3dece8abbd97dd8b83acc1a4720ad366e24b0c36eb24188e586b398854557e9fa9ea0e2e84be2b63a7ff8d0ba6877

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7qnbgwy0.default-release\datareporting\glean\pending_pings\00697d61-6c28-4bbf-b8bd-7de95d71fdd3

                      Filesize

                      982B

                      MD5

                      aeedcb555a27f28d95d82ecfa4de009a

                      SHA1

                      2aacaaf58a03bbab8c31116e4b559d828c814ba8

                      SHA256

                      d0c56e6594e6ae19f7bd97a01dcc2b8458cf04044e4b0a07d76a51a71b10e022

                      SHA512

                      80928c1c4aa71666068d36a01d0421ab3798a2e513d82da61e49f9426f3ab175286794af891c373dfe9cd65debf44b86abc3555fe3e0d2527e16b21d527c8b92

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7qnbgwy0.default-release\datareporting\glean\pending_pings\a14bc278-546f-4114-a531-5df14c0453e6

                      Filesize

                      671B

                      MD5

                      44da68470007b492fd6ebb75cc0ff60b

                      SHA1

                      1998dd2cdef0133105a40eb6e2d495b78df79b3a

                      SHA256

                      a35ba0c5dc70bc1dbda63977e76c963509956d182ad928fd3eee93647fb01217

                      SHA512

                      3ca0d833ee48c60ff9bc02d17717a078a9db297686b86327fad05dec550758e1a9fb9fe4f631e5643db344a0651e645ceb3d9c0bffa8501c846a03cd80b36055

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7qnbgwy0.default-release\datareporting\glean\pending_pings\c3d90760-5219-47d7-af8c-1d799f41f32f

                      Filesize

                      24KB

                      MD5

                      952733b62f7e792b27265e538e9b263b

                      SHA1

                      4544fc9dede266925434a1d020f06dd7b61f8823

                      SHA256

                      eb45c4149d899a52bd6bf715eaa40be9c0efe49684f4cbeb5f3169ab8cd87b68

                      SHA512

                      d6edaf4598f07c576c09a521a2f14ff2369f9743c95487833511ad3ca7d8a9635e4058ec2e56f324128d3b82283e79ea76fcb3d8050974416f2c37fb42ef3862

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7qnbgwy0.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

                      Filesize

                      1.1MB

                      MD5

                      842039753bf41fa5e11b3a1383061a87

                      SHA1

                      3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                      SHA256

                      d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                      SHA512

                      d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7qnbgwy0.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

                      Filesize

                      116B

                      MD5

                      2a461e9eb87fd1955cea740a3444ee7a

                      SHA1

                      b10755914c713f5a4677494dbe8a686ed458c3c5

                      SHA256

                      4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                      SHA512

                      34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7qnbgwy0.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

                      Filesize

                      372B

                      MD5

                      bf957ad58b55f64219ab3f793e374316

                      SHA1

                      a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                      SHA256

                      bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                      SHA512

                      79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7qnbgwy0.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

                      Filesize

                      17.8MB

                      MD5

                      daf7ef3acccab478aaa7d6dc1c60f865

                      SHA1

                      f8246162b97ce4a945feced27b6ea114366ff2ad

                      SHA256

                      bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                      SHA512

                      5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7qnbgwy0.default-release\places.sqlite-wal

                      Filesize

                      992KB

                      MD5

                      c63c3f954889b2d51f1802dbfa85ec85

                      SHA1

                      d3401fd596e8264ad0a1ac6a03c6dd76b8533fce

                      SHA256

                      3231a7c9d4a3b787e8758f1a7f28ef7f03b5dd2bcb7023bc239f0acb30b7831c

                      SHA512

                      e43192ddcedeb8c7e53c89e4401a8ed963ee5124bd9039a10abb969accec1987e7496bff92217667837d7beca290e98367bcfbbbe9699489c8550f7e89f94484

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7qnbgwy0.default-release\prefs-1.js

                      Filesize

                      11KB

                      MD5

                      f018298583eebb6574955261708df58e

                      SHA1

                      ce986a9841f2c64b0476feedbfa7d06d994fafc7

                      SHA256

                      2cd3dc19d048865642d7619308f5778464b126fd23965c84d54be13334449b5c

                      SHA512

                      8d568285bd94b1cdf9a28e4292a508cf0f125772939709b154d73743690eec04a888e2c63924293349f00ab6259bda6f02c9979fa0fbef93a73ac4eb667cfe96

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7qnbgwy0.default-release\prefs-1.js

                      Filesize

                      13KB

                      MD5

                      c89c9ebbd1472c664aa10a53d2ee2f4e

                      SHA1

                      39c788c56ca40679583dd8a322c528ac217f327d

                      SHA256

                      9c39ea2e1643177d2104abc99117be28ef6c4545b942b5e5ea3a5b68baf57502

                      SHA512

                      5c8cb169ebe1665902e3b34a978abb5ad1cd9d3f2095fb3c38632ebd57d8def756ad02b9b63637765f3d967932923518b06097b8ba2ab3b627a6add91915c417

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7qnbgwy0.default-release\prefs.js

                      Filesize

                      15KB

                      MD5

                      7b4e644baa136ee646acdd393c7fa296

                      SHA1

                      6f4f15f4efb19816d7313a2215f5f73a389bd696

                      SHA256

                      2ad460419d75fbd04a48b905564baa5acae954d65390f53e8bbe1a16ab429da2

                      SHA512

                      52b8b929196d4c610f99f63bbc74fe44c2c0601c59d83a273052ccdc7c54faba83e33de7a1888205d752705fc4c52a4435ef417bef5e58ec5594d416a10692ea

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7qnbgwy0.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

                      Filesize

                      1.3MB

                      MD5

                      42e5fff3833929d92aaace0d38654ab3

                      SHA1

                      6a047bfebdc058982bd6b4ecf70a70f028761611

                      SHA256

                      1913972e83ab722dd064c8f9f9af02fd2567ab08c4594e6616d0a96e38fff97b

                      SHA512

                      311dbb2c717113fa9fd39fbc9b7adba467e6aa76793e652f1d857a5b64e5a70b615365639b3501d7e43d223f8384ccaa1d0f79b79c08791d62846375eea4d0ba

                    • memory/1344-2892-0x0000000000E80000-0x0000000001A61000-memory.dmp

                      Filesize

                      11.9MB

                    • memory/1344-2908-0x0000000000E80000-0x0000000001A61000-memory.dmp

                      Filesize

                      11.9MB

                    • memory/1344-460-0x0000000000E80000-0x0000000001A61000-memory.dmp

                      Filesize

                      11.9MB

                    • memory/1344-2011-0x0000000000E80000-0x0000000001A61000-memory.dmp

                      Filesize

                      11.9MB

                    • memory/1344-466-0x0000000000E80000-0x0000000001A61000-memory.dmp

                      Filesize

                      11.9MB

                    • memory/1344-38-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                      Filesize

                      972KB

                    • memory/1344-1512-0x0000000000E80000-0x0000000001A61000-memory.dmp

                      Filesize

                      11.9MB

                    • memory/1344-37-0x0000000000E80000-0x0000000001A61000-memory.dmp

                      Filesize

                      11.9MB

                    • memory/1344-1339-0x0000000000E80000-0x0000000001A61000-memory.dmp

                      Filesize

                      11.9MB

                    • memory/1344-391-0x0000000000E80000-0x0000000001A61000-memory.dmp

                      Filesize

                      11.9MB

                    • memory/1344-727-0x0000000000E80000-0x0000000001A61000-memory.dmp

                      Filesize

                      11.9MB

                    • memory/1344-1109-0x0000000000E80000-0x0000000001A61000-memory.dmp

                      Filesize

                      11.9MB

                    • memory/1344-583-0x0000000000E80000-0x0000000001A61000-memory.dmp

                      Filesize

                      11.9MB

                    • memory/1344-2438-0x0000000000E80000-0x0000000001A61000-memory.dmp

                      Filesize

                      11.9MB

                    • memory/1344-1005-0x0000000000E80000-0x0000000001A61000-memory.dmp

                      Filesize

                      11.9MB

                    • memory/1448-17-0x0000000000500000-0x00000000009AA000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/1448-0-0x0000000000500000-0x00000000009AA000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/1448-5-0x0000000000500000-0x00000000009AA000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/1448-3-0x0000000000500000-0x00000000009AA000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/1448-2-0x0000000000501000-0x000000000052F000-memory.dmp

                      Filesize

                      184KB

                    • memory/1448-1-0x0000000077686000-0x0000000077688000-memory.dmp

                      Filesize

                      8KB

                    • memory/2308-98-0x0000000000E00000-0x00000000012AA000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/2308-97-0x0000000000E00000-0x00000000012AA000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/2824-2912-0x0000000000030000-0x00000000004DA000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/2824-2914-0x0000000000030000-0x00000000004DA000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/3040-20-0x0000000000E00000-0x00000000012AA000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/3040-21-0x0000000000E00000-0x00000000012AA000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/3040-599-0x0000000000E00000-0x00000000012AA000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/3040-1079-0x0000000000E00000-0x00000000012AA000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/3040-2928-0x0000000000E00000-0x00000000012AA000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/3040-2915-0x0000000000E00000-0x00000000012AA000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/3040-18-0x0000000000E00000-0x00000000012AA000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/3040-71-0x0000000000E00000-0x00000000012AA000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/3040-392-0x0000000000E00000-0x00000000012AA000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/3040-1173-0x0000000000E00000-0x00000000012AA000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/3040-19-0x0000000000E01000-0x0000000000E2F000-memory.dmp

                      Filesize

                      184KB

                    • memory/3040-1471-0x0000000000E00000-0x00000000012AA000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/3040-497-0x0000000000E00000-0x00000000012AA000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/3040-1657-0x0000000000E00000-0x00000000012AA000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/3040-461-0x0000000000E00000-0x00000000012AA000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/3040-2068-0x0000000000E00000-0x00000000012AA000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/3040-451-0x0000000000E00000-0x00000000012AA000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/3040-2470-0x0000000000E00000-0x00000000012AA000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/3040-441-0x0000000000E00000-0x00000000012AA000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/3040-838-0x0000000000E00000-0x00000000012AA000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/3160-1125-0x0000000000FB0000-0x000000000145A000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/3160-1124-0x0000000000FB0000-0x000000000145A000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/5020-1108-0x0000000000E00000-0x00000000012AA000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/5020-1107-0x0000000000E00000-0x00000000012AA000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/5028-2918-0x0000000000E00000-0x00000000012AA000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/5028-2919-0x0000000000E00000-0x00000000012AA000-memory.dmp

                      Filesize

                      4.7MB