Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/07/2024, 22:35

General

  • Target

    file.exe

  • Size

    2.4MB

  • MD5

    fcac53ade6abee5bd5c813c626a7dc2e

  • SHA1

    49d2890836e8122188c20cfe0d4e412862e58c02

  • SHA256

    17c2797cb63c1cc15869f36031c9dc2c7f63953ae08ee9f257faa3b7a916629a

  • SHA512

    03689b9d80408e79a258f234daa782c7721f4c4f69349838e89e7e6056c28a1f492e1fee1f62f5cde23adaaea64086eb4a2684261afa0c57ceb21b3e5855491d

  • SSDEEP

    49152:la3U2Quvnr17NUfsaGMXyKM7c7QabvKvfeuzfv3mGt2uUaSbK/NxHeFEKc8:gkgsxGjIkaZ4eY2um2eFEKL

Malware Config

Extracted

Family

stealc

Botnet

funny

C2

http://85.28.47.30

Attributes
  • url_path

    /920475a59bac849d.php

Extracted

Family

amadey

Version

4.30

Botnet

4dd39d

C2

http://77.91.77.82

Attributes
  • install_dir

    ad40971b6b

  • install_file

    explorti.exe

  • strings_key

    a434973ad22def7137dbb5e059b7081e

  • url_paths

    /Hun4Ko/index.php

rc4.plain

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Stealc

    Stealc is an infostealer written in C++.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 8 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 6 IoCs
  • Identifies Wine through registry keys 2 TTPs 4 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 2 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 17 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 10 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3568
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\BGIIDAEBGC.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:940
      • C:\Users\Admin\AppData\Local\Temp\BGIIDAEBGC.exe
        "C:\Users\Admin\AppData\Local\Temp\BGIIDAEBGC.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Checks computer location settings
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1428
        • C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
          "C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe"
          4⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Checks computer location settings
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:4472
          • C:\Users\Admin\AppData\Local\Temp\1000006001\7563d0efa9.exe
            "C:\Users\Admin\AppData\Local\Temp\1000006001\7563d0efa9.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious use of SetWindowsHookEx
            PID:4484
          • C:\Users\Admin\AppData\Local\Temp\1000011001\d38314c416.exe
            "C:\Users\Admin\AppData\Local\Temp\1000011001\d38314c416.exe"
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of WriteProcessMemory
            PID:5084
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:2508
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
                7⤵
                • Checks processor information in registry
                • Modifies registry class
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:1476
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1940 -parentBuildID 20240401114208 -prefsHandle 1852 -prefMapHandle 1844 -prefsLen 25753 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {008c1c78-1b9f-4ef4-a86f-41382720d787} 1476 "\\.\pipe\gecko-crash-server-pipe.1476" gpu
                  8⤵
                    PID:1564
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2420 -parentBuildID 20240401114208 -prefsHandle 2396 -prefMapHandle 2392 -prefsLen 26673 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7279291e-adcd-4483-9cb8-e8a25a11754a} 1476 "\\.\pipe\gecko-crash-server-pipe.1476" socket
                    8⤵
                      PID:1692
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3172 -childID 1 -isForBrowser -prefsHandle 3164 -prefMapHandle 2788 -prefsLen 22698 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5b5b6fd2-fc27-4404-bacd-8e0cbf343515} 1476 "\\.\pipe\gecko-crash-server-pipe.1476" tab
                      8⤵
                        PID:3380
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4012 -childID 2 -isForBrowser -prefsHandle 4024 -prefMapHandle 4020 -prefsLen 31163 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {96de096d-1579-40e1-9344-8b036ea810fe} 1476 "\\.\pipe\gecko-crash-server-pipe.1476" tab
                        8⤵
                          PID:1288
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4844 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4836 -prefMapHandle 4832 -prefsLen 31163 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ce72ebee-c5b8-4065-8447-677ce2152e21} 1476 "\\.\pipe\gecko-crash-server-pipe.1476" utility
                          8⤵
                          • Checks processor information in registry
                          PID:4476
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5256 -childID 3 -isForBrowser -prefsHandle 5248 -prefMapHandle 5212 -prefsLen 26990 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {069a1402-637b-4d3c-97e6-9db102caf75b} 1476 "\\.\pipe\gecko-crash-server-pipe.1476" tab
                          8⤵
                            PID:3472
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5404 -childID 4 -isForBrowser -prefsHandle 5480 -prefMapHandle 5476 -prefsLen 26990 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9c1ddf2a-cb95-4c1f-a57d-1b830850191f} 1476 "\\.\pipe\gecko-crash-server-pipe.1476" tab
                            8⤵
                              PID:1804
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5384 -childID 5 -isForBrowser -prefsHandle 5616 -prefMapHandle 5620 -prefsLen 26990 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f3cb552e-c806-4baa-ba16-feb7f84fd5da} 1476 "\\.\pipe\gecko-crash-server-pipe.1476" tab
                              8⤵
                                PID:2200
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\CFHCGHJDBF.exe"
                    2⤵
                    • Suspicious use of WriteProcessMemory
                    PID:4944
                    • C:\Users\Admin\AppData\Local\Temp\CFHCGHJDBF.exe
                      "C:\Users\Admin\AppData\Local\Temp\CFHCGHJDBF.exe"
                      3⤵
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • Suspicious behavior: EnumeratesProcesses
                      PID:1676
                • C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
                  C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
                  1⤵
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Identifies Wine through registry keys
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • Suspicious behavior: EnumeratesProcesses
                  PID:1688

                Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\ProgramData\mozglue.dll

                  Filesize

                  593KB

                  MD5

                  c8fd9be83bc728cc04beffafc2907fe9

                  SHA1

                  95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                  SHA256

                  ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                  SHA512

                  fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                • C:\ProgramData\nss3.dll

                  Filesize

                  2.0MB

                  MD5

                  1cc453cdf74f31e4d913ff9c10acdde2

                  SHA1

                  6e85eae544d6e965f15fa5c39700fa7202f3aafe

                  SHA256

                  ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                  SHA512

                  dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yol9faaa.default-release\activity-stream.discovery_stream.json.tmp

                  Filesize

                  21KB

                  MD5

                  602c127bdfa601d96f54c3d650dad097

                  SHA1

                  3c5dbb138b615b9efb101c517629356a4d0edb5b

                  SHA256

                  46cba93d345bf7fa41477a8e13894445674f2f927435216787746132087cda24

                  SHA512

                  14aeac9142d09654c718ad7a03808edbc61936f3d0f72e52d509934cc6af5e5c29948820ed28e37b877676fcc0570dc24d2ecf847ee849693b335e5161ee540d

                • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yol9faaa.default-release\cache2\entries\8A2034D325DC0B5C9E11EDDA3FC70A54C8DC1C0D

                  Filesize

                  13KB

                  MD5

                  497b9df5fa87aa1387c4b3d7ef1ca0a0

                  SHA1

                  b40ee35a4699a12562cc6b82c04c8a8b5feea1d4

                  SHA256

                  36be0d262f43bb95f3a1e618a44d030ad924b20689d0721f20525b7bb24a0a5f

                  SHA512

                  e4e2c91cac8a7925f4085af97e95fcc5a760f8b72fee8d96c13c25edb3f54890e6977f3a3da9b24fcc6ac3e816c8ad34e92947b1d0a15ef4ee120392cb925f80

                • C:\Users\Admin\AppData\Local\Temp\1000006001\7563d0efa9.exe

                  Filesize

                  2.4MB

                  MD5

                  fcac53ade6abee5bd5c813c626a7dc2e

                  SHA1

                  49d2890836e8122188c20cfe0d4e412862e58c02

                  SHA256

                  17c2797cb63c1cc15869f36031c9dc2c7f63953ae08ee9f257faa3b7a916629a

                  SHA512

                  03689b9d80408e79a258f234daa782c7721f4c4f69349838e89e7e6056c28a1f492e1fee1f62f5cde23adaaea64086eb4a2684261afa0c57ceb21b3e5855491d

                • C:\Users\Admin\AppData\Local\Temp\1000011001\d38314c416.exe

                  Filesize

                  1.2MB

                  MD5

                  91927606a724c341db688cc798879bfd

                  SHA1

                  0f7110664498b4d037db0bb7bb7c3e41cdc4efa4

                  SHA256

                  ca279e3490d392e41efb3ce649f1d187f9ab6cee32a490d608fa24b6a6050234

                  SHA512

                  d2c09f9a4bf4a499b7b53436139b142dea0ef6dfde27008a37be52cacef09ab94ce2e35abf21e2cf2fdab586bad5a25953bcba60b7ba1bde65126722c87a508a

                • C:\Users\Admin\AppData\Local\Temp\BGIIDAEBGC.exe

                  Filesize

                  1.8MB

                  MD5

                  affbfbbc1052df9ad856c0a05306a913

                  SHA1

                  b791484e5d918aa7f692f95cf70633c2648e79a3

                  SHA256

                  a3026329d0bea6d65853bc011f2f1032da1b92e89c6c0c810734633628496c81

                  SHA512

                  439a8d3163c4030a81d5cd7ccf7afeb0beaaf37ab083c6a9a38a25c125194b021b9efb00bceecdf96bf132f6d76789304865b0aa2a6fcf03d04d5929f7f6d53e

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yol9faaa.default-release\AlternateServices.bin

                  Filesize

                  8KB

                  MD5

                  4c7a5ed86352b4f9893399eeed1ac6a8

                  SHA1

                  16bad1920fae3729f7401d9689231843b9101604

                  SHA256

                  dc3aafc843a4a21f0275a33475ea9ee28be05bd87ad9b705bc306e6ce88e124c

                  SHA512

                  5d52d66ca587b0647aa2d42ce7a48bc3f2e447c5e548ab09f48bc5fdd3cb5e336c8b31b3147b726640e145671beabcdced453f6a7bb7001d28a7d8883e8f1219

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yol9faaa.default-release\datareporting\glean\db\data.safe.tmp

                  Filesize

                  5KB

                  MD5

                  f7185a8ac6d76f8446bc833dc0e78cff

                  SHA1

                  02d5867afd18f4774e09d16aa158b93c9dd12c45

                  SHA256

                  909a2e54fed0a74a5220dc042457bdd2b1bc865c64e7112d076880495ed58390

                  SHA512

                  82ccbe060a56929ccee9d00a1c81d23f2f5a6af2fa9e86f70806bb866dab6e78babf070fc2d241978cf52f0d1c77762c25011240cd4fdfac8a76fcc88b214159

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yol9faaa.default-release\datareporting\glean\db\data.safe.tmp

                  Filesize

                  5KB

                  MD5

                  dc2b3ec60fcf3c0640210d570b59c967

                  SHA1

                  a957980795407f2084c763487681601dec9951f5

                  SHA256

                  f76daf1d272f3d8fc164adc89c632148dd9673d63597136e18bd6f1435abd161

                  SHA512

                  f103c6bb509e30fb82b765bec5b0967748c10be7c76326e4c8c13ac2cc83ac926b0ea34f8ac3db0393a908f755b348e07abc9165a63f952daa6e72827134ac9a

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yol9faaa.default-release\datareporting\glean\pending_pings\3306cc86-12f3-4fc0-998a-bcdb931f5eb2

                  Filesize

                  671B

                  MD5

                  d80f9bcd97997b8f081e1a2337e28374

                  SHA1

                  9911f33f25c29aa75062612984145f2f2223ce18

                  SHA256

                  8ec98201ab2b57153a06a5cebffa812c1013c28d5d270bcd151e44e6c027504f

                  SHA512

                  2b1b70bb9abf3533e48079689b93e668f1a39dd783f59279f435ce22e1e77f7559363d327a8285e340ef77c1303ed0517ed9283ad2f9e282cf1b6f5d7695b9f5

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yol9faaa.default-release\datareporting\glean\pending_pings\b299237f-83e2-4f24-8201-286d758f8232

                  Filesize

                  982B

                  MD5

                  ebe43e90c883b6c74fc61e279c6f9176

                  SHA1

                  933f99fa2aba4ab421598e74df007c5ca5a4b550

                  SHA256

                  b5ad88e8d4554a5004147963d0b165f2f79dd7f8013af0c564c9def0e8662b25

                  SHA512

                  476fbef042a3b2d77957af85bd9a2b1c76ff97bdafe58991a3d62c4c4374b7ace84f434d5e2778eaec607150c2f2db324f4e49c7c598f750f06aa627495220cf

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yol9faaa.default-release\datareporting\glean\pending_pings\e1189cb8-5b12-43a4-8a2a-1cd574c6ef22

                  Filesize

                  26KB

                  MD5

                  0bde7c7d1e7b098eb4b52c29aae835af

                  SHA1

                  5ee98e758f9afcf37fb4d7113436c573f1216047

                  SHA256

                  9a136408e9a5575a5ecb50aea9dc105db46df755f572ae12f12663292e0d8c2f

                  SHA512

                  a325ec2152ce9269204d34272f178dcefd9ac5bd132e1980206d6d8063e39d2968a530ed58f604e641cab19c02f6b113f965027131525f807e13f56b7d96b4a4

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yol9faaa.default-release\prefs-1.js

                  Filesize

                  12KB

                  MD5

                  76f4ab28a4b7caf4d55ff48dcc3f6c19

                  SHA1

                  6e35c7e7c07947521c8afd8ea99f661f416c8ead

                  SHA256

                  0bac2b762f4fefec26c001d5afab086de86c9f480cdd685de969c026d95de11d

                  SHA512

                  bda3f5b7976a700913925e25c1db791e745a87a154bd74a49a975f50f0d395a648814fa5b21821c4bcaaca704567e44bb2606bebabf5c0e9202521ecc411a59d

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yol9faaa.default-release\prefs-1.js

                  Filesize

                  12KB

                  MD5

                  b15ecbb60aa8c2daeaf13757f0ed7df0

                  SHA1

                  0bdabe426ecd26892500030db32560926143b24d

                  SHA256

                  8f95a0d9a9b75dca546065e5a6cc5023f196dce074779426e6f87506f8ac6104

                  SHA512

                  a7d9a957987617539c3a7dded5821552e08f0ada2052b2b6a28d0812d7d9d919809e39dc4620295fe4213c447b508f2af2e3d6a2b8e608f97052a95f2af0ebcd

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yol9faaa.default-release\prefs-1.js

                  Filesize

                  11KB

                  MD5

                  1004a5b744cd2b7eaecc994eec2c8d5c

                  SHA1

                  2a92cd4c727aceaf0acb79e22dacf4a204261842

                  SHA256

                  b1420143e9dc45af9e992a742166f68de9417f8ef29beda3f237acb7997cdfaf

                  SHA512

                  547fe85e84bed7fbd31344ae50d4c789c57200a74435d682f1f63541d5943975d2e5a18f11d60251c894ed11cea22bc27e569172c60b86a1b72c5e4a2e2e9a96

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yol9faaa.default-release\prefs-1.js

                  Filesize

                  11KB

                  MD5

                  5f429ca0e62ec7327f6d7a44712ea857

                  SHA1

                  c6fcf058bb1ae5a9b6f115879138194ca79cfe67

                  SHA256

                  a28c3836ba2cd9c281d42330c1f07288d6ffae3fc78979069898921d35f5f8d7

                  SHA512

                  090822967a8f9d74438e1e2cbf6e27684dee54ca320ae5cf9b7fbf913c21bbfb9f8e4d8679b610426152884de2b5ac500dedbbcbbf5841eff253c36ef972ef63

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yol9faaa.default-release\prefs.js

                  Filesize

                  8KB

                  MD5

                  10702eff3edf06b284c9b98a17da1007

                  SHA1

                  adfefa3e4e2ea0d08bc67135b719d12ae661b258

                  SHA256

                  31c1f5dee381fa886b653937c420b149a8e619cfa79c20bcb3b52c850c4bf451

                  SHA512

                  63630f615a0b378263274a704e1b7203d1762a973434dbcc5a5d7d60bb60cedb46257241c814121ab262c5d702e14073a80dff5ceb45eee0d44f9587d9bf4fba

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yol9faaa.default-release\prefs.js

                  Filesize

                  8KB

                  MD5

                  5e1fa910e510622685babcaf1eec39e4

                  SHA1

                  a2ef25ff3f871a260b64b5f85afb101c53b4b206

                  SHA256

                  d88a2d0a20f605fbc01d2202dd63a9657e2bebb24c8059a983a63a7f5d6105f6

                  SHA512

                  8dbce9777dffa46c4a3fd1994136dfed57c5b77483d8846276e1fff07a6e914c0d42c502730c2a2363376be9b272aca01cfc5ad6765d466b5640943aad2cdeeb

                • memory/1428-106-0x0000000000E60000-0x000000000131F000-memory.dmp

                  Filesize

                  4.7MB

                • memory/1428-92-0x0000000000E60000-0x000000000131F000-memory.dmp

                  Filesize

                  4.7MB

                • memory/1428-94-0x0000000000E60000-0x000000000131F000-memory.dmp

                  Filesize

                  4.7MB

                • memory/1428-89-0x0000000000E60000-0x000000000131F000-memory.dmp

                  Filesize

                  4.7MB

                • memory/1428-90-0x0000000077244000-0x0000000077246000-memory.dmp

                  Filesize

                  8KB

                • memory/1428-91-0x0000000000E61000-0x0000000000E8F000-memory.dmp

                  Filesize

                  184KB

                • memory/1676-115-0x00000000002A0000-0x000000000075F000-memory.dmp

                  Filesize

                  4.7MB

                • memory/1676-117-0x00000000002A0000-0x000000000075F000-memory.dmp

                  Filesize

                  4.7MB

                • memory/1688-155-0x0000000000100000-0x00000000005BF000-memory.dmp

                  Filesize

                  4.7MB

                • memory/1688-157-0x0000000000100000-0x00000000005BF000-memory.dmp

                  Filesize

                  4.7MB

                • memory/3568-111-0x0000000000140000-0x0000000000D1F000-memory.dmp

                  Filesize

                  11.9MB

                • memory/3568-4-0x0000000000140000-0x0000000000D1F000-memory.dmp

                  Filesize

                  11.9MB

                • memory/3568-7-0x0000000000140000-0x0000000000D1F000-memory.dmp

                  Filesize

                  11.9MB

                • memory/3568-8-0x0000000000140000-0x0000000000D1F000-memory.dmp

                  Filesize

                  11.9MB

                • memory/3568-10-0x0000000000140000-0x0000000000D1F000-memory.dmp

                  Filesize

                  11.9MB

                • memory/3568-6-0x0000000000140000-0x0000000000D1F000-memory.dmp

                  Filesize

                  11.9MB

                • memory/3568-82-0x0000000000140000-0x0000000000D1F000-memory.dmp

                  Filesize

                  11.9MB

                • memory/3568-5-0x000000007EBA0000-0x000000007EF71000-memory.dmp

                  Filesize

                  3.8MB

                • memory/3568-9-0x0000000000140000-0x0000000000D1F000-memory.dmp

                  Filesize

                  11.9MB

                • memory/3568-0-0x0000000000140000-0x0000000000D1F000-memory.dmp

                  Filesize

                  11.9MB

                • memory/3568-11-0x0000000000140000-0x0000000000D1F000-memory.dmp

                  Filesize

                  11.9MB

                • memory/3568-1-0x000000007EBA0000-0x000000007EF71000-memory.dmp

                  Filesize

                  3.8MB

                • memory/3568-3-0x0000000000140000-0x0000000000D1F000-memory.dmp

                  Filesize

                  11.9MB

                • memory/3568-12-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                  Filesize

                  972KB

                • memory/3568-2-0x0000000000140000-0x0000000000D1F000-memory.dmp

                  Filesize

                  11.9MB

                • memory/4472-458-0x0000000000100000-0x00000000005BF000-memory.dmp

                  Filesize

                  4.7MB

                • memory/4472-437-0x0000000000100000-0x00000000005BF000-memory.dmp

                  Filesize

                  4.7MB

                • memory/4472-177-0x0000000000100000-0x00000000005BF000-memory.dmp

                  Filesize

                  4.7MB

                • memory/4472-528-0x0000000000100000-0x00000000005BF000-memory.dmp

                  Filesize

                  4.7MB

                • memory/4472-134-0x0000000000100000-0x00000000005BF000-memory.dmp

                  Filesize

                  4.7MB

                • memory/4472-605-0x0000000000100000-0x00000000005BF000-memory.dmp

                  Filesize

                  4.7MB

                • memory/4472-107-0x0000000000100000-0x00000000005BF000-memory.dmp

                  Filesize

                  4.7MB

                • memory/4484-135-0x0000000000DB0000-0x000000000198F000-memory.dmp

                  Filesize

                  11.9MB

                • memory/4484-133-0x0000000000DB0000-0x000000000198F000-memory.dmp

                  Filesize

                  11.9MB