Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12-08-2024 22:49

General

  • Target

    74526e54eb59d8804296c282956d430668c784af2bebb99d872fb24b4aa689c1.exe

  • Size

    1.8MB

  • MD5

    1c001b7c1daa650908f734203a11329f

  • SHA1

    d5cbdc631e0fc50f85ade35e12b9fd1d78053205

  • SHA256

    74526e54eb59d8804296c282956d430668c784af2bebb99d872fb24b4aa689c1

  • SHA512

    7f3eebb2d11f77ce9d242fb5610faa43081cb41b17bff3f37416b1b15bf71495f227f228f6b3efa6c5b685c0a1e5f1fdea8145ea6507fe4ac59483cdb0c42fa7

  • SSDEEP

    49152:2GVkZJYb8UXrgcujxbbjNz5UT0kxe9QhcmmfVuZD:2GeU7gvjxXpmx/hcDf8p

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

0657d1

C2

http://185.215.113.19

Attributes
  • install_dir

    0d8f5eb8a7

  • install_file

    explorti.exe

  • strings_key

    6c55a5f34bb433fbd933a168577b1838

  • url_paths

    /Vi9leo/index.php

rc4.plain

Extracted

Family

stealc

Botnet

nord

C2

http://185.215.113.100

Attributes
  • url_path

    /e2b1563c6670f193.php

Extracted

Family

stealc

Botnet

kora

C2

http://185.215.113.100

Attributes
  • url_path

    /e2b1563c6670f193.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Stealc

    Stealc is an infostealer written in C++.

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 8 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 6 IoCs
  • Identifies Wine through registry keys 2 TTPs 4 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • AutoIT Executable 3 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\74526e54eb59d8804296c282956d430668c784af2bebb99d872fb24b4aa689c1.exe
    "C:\Users\Admin\AppData\Local\Temp\74526e54eb59d8804296c282956d430668c784af2bebb99d872fb24b4aa689c1.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3144
    • C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
      "C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2116
      • C:\Users\Admin\AppData\Local\Temp\1000036001\4b740206d4.exe
        "C:\Users\Admin\AppData\Local\Temp\1000036001\4b740206d4.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:544
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          4⤵
          • Checks computer location settings
          • System Location Discovery: System Language Discovery
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:3540
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:2572
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
              6⤵
              • Checks processor information in registry
              • Modifies registry class
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:2328
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2032 -parentBuildID 20240401114208 -prefsHandle 1960 -prefMapHandle 1928 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5cf2a4bd-0993-4bee-ba63-dd33dbe21876} 2328 "\\.\pipe\gecko-crash-server-pipe.2328" gpu
                7⤵
                  PID:3612
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2468 -parentBuildID 20240401114208 -prefsHandle 2452 -prefMapHandle 2448 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1dbfe358-012a-48a1-b412-0bd7b28b9a6e} 2328 "\\.\pipe\gecko-crash-server-pipe.2328" socket
                  7⤵
                    PID:4952
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3272 -childID 1 -isForBrowser -prefsHandle 3292 -prefMapHandle 3288 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1276 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {96981efc-b796-4d07-b94b-1d735d6788df} 2328 "\\.\pipe\gecko-crash-server-pipe.2328" tab
                    7⤵
                      PID:1260
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3992 -childID 2 -isForBrowser -prefsHandle 3032 -prefMapHandle 4000 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1276 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {38ab5151-0863-4a66-9b8d-13db076bb969} 2328 "\\.\pipe\gecko-crash-server-pipe.2328" tab
                      7⤵
                        PID:4088
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4232 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4440 -prefMapHandle 4436 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3bba19ab-3bf8-4aee-829d-9f872bf97a8a} 2328 "\\.\pipe\gecko-crash-server-pipe.2328" utility
                        7⤵
                        • Checks processor information in registry
                        PID:5180
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5516 -childID 3 -isForBrowser -prefsHandle 5592 -prefMapHandle 5556 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1276 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f60d6379-e6ac-4d58-8b42-3c60db15f0a0} 2328 "\\.\pipe\gecko-crash-server-pipe.2328" tab
                        7⤵
                          PID:992
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5716 -childID 4 -isForBrowser -prefsHandle 5724 -prefMapHandle 5728 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1276 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {646d114e-e2a2-41a3-912d-c639b9ed93c4} 2328 "\\.\pipe\gecko-crash-server-pipe.2328" tab
                          7⤵
                            PID:5428
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6004 -childID 5 -isForBrowser -prefsHandle 5924 -prefMapHandle 5928 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1276 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3c38d377-62ad-44e8-9b46-c7308db4fd91} 2328 "\\.\pipe\gecko-crash-server-pipe.2328" tab
                            7⤵
                              PID:4184
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6600 -childID 6 -isForBrowser -prefsHandle 6608 -prefMapHandle 6516 -prefsLen 27182 -prefMapSize 244658 -jsInitHandle 1276 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {72f2e460-92eb-4541-b45e-5c6fe0a1d4a1} 2328 "\\.\pipe\gecko-crash-server-pipe.2328" tab
                              7⤵
                                PID:5252
                      • C:\Users\Admin\1000037002\004c0c619f.exe
                        "C:\Users\Admin\1000037002\004c0c619f.exe"
                        3⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of WriteProcessMemory
                        PID:1948
                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                          4⤵
                            PID:1516
                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                            4⤵
                            • System Location Discovery: System Language Discovery
                            PID:5080
                        • C:\Users\Admin\AppData\Local\Temp\1000038001\cc9647d99c.exe
                          "C:\Users\Admin\AppData\Local\Temp\1000038001\cc9647d99c.exe"
                          3⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          PID:4184
                    • C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                      C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                      1⤵
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • Suspicious behavior: EnumeratesProcesses
                      PID:3944
                    • C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                      C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                      1⤵
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • Suspicious behavior: EnumeratesProcesses
                      PID:1876

                    Network

                    MITRE ATT&CK Enterprise v15

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Admin\1000037002\004c0c619f.exe

                      Filesize

                      206KB

                      MD5

                      184ac865439679ad7884b845084b1aad

                      SHA1

                      cdf22ebfa466e18e2e7e2d7bfa419e04d0bca2dc

                      SHA256

                      a5105e830cde1a2cd8b5464114e3684b7c71b4680122918e6e213d86cb62b59f

                      SHA512

                      cbe62b31319dbc5775cc67855be5413f0c13e050629cf12a4dde478080e22f0210078ec7b0c718346ead1cb5cec7959f907d4167d003877cf10d0e14f539c10b

                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yaq795em.default-release\activity-stream.discovery_stream.json

                      Filesize

                      35KB

                      MD5

                      af2325e86f7c935a016fdb9da1453176

                      SHA1

                      73515fac53941fca2e706b1335337a84a1e5ecf3

                      SHA256

                      ee11df9d2c7d8fe6bf84f68106d8f1b85fccb1a7c5fe3b15af77bfee6441e44b

                      SHA512

                      385513cff9e584e9aa301acb0da262fdb8dc80e23fe4b2e3f451975dcf84ec6987b05c1a07b7a3fa16bc3fbeedd622ed54853922e05932e9c7583690f930c2c3

                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yaq795em.default-release\cache2\entries\E449899591A9BC91DFBA673EC0589B51E541A88B

                      Filesize

                      13KB

                      MD5

                      cd3b5a150658841721110d493ce8eeeb

                      SHA1

                      b45dda4b383fd5ccca90fe5b345ac061d7671e4a

                      SHA256

                      8cda48c5c521ae0a089f210465e55cb98300805137a1001bedd1249776845121

                      SHA512

                      8811720314c7e921644285dd63de44946d84c8d4623fcd15d71fac75de537c7db4e6e43050840db83a2b12dddd75af63b24fe57ceb4c8d4dbe22d4669dbc6300

                    • C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

                      Filesize

                      1.8MB

                      MD5

                      1c001b7c1daa650908f734203a11329f

                      SHA1

                      d5cbdc631e0fc50f85ade35e12b9fd1d78053205

                      SHA256

                      74526e54eb59d8804296c282956d430668c784af2bebb99d872fb24b4aa689c1

                      SHA512

                      7f3eebb2d11f77ce9d242fb5610faa43081cb41b17bff3f37416b1b15bf71495f227f228f6b3efa6c5b685c0a1e5f1fdea8145ea6507fe4ac59483cdb0c42fa7

                    • C:\Users\Admin\AppData\Local\Temp\1000036001\4b740206d4.exe

                      Filesize

                      1.2MB

                      MD5

                      0034ee4a88a9fc8d25c363524fa9fa0f

                      SHA1

                      c1f17b6ccea75290c2c9c8d7f42856428e7fad29

                      SHA256

                      45b08cdfdae665ef8140d7a099c7031c7ee582ba7a30dc9a484ac03775ec29a2

                      SHA512

                      624e7aa712e79fae69a4e1e301f01710f584f0a85768aeab7a18739b26c9e1c146d007795b776c8e23721f42dec98d6a7edd04cc168e1995345a58ace71fa85a

                    • C:\Users\Admin\AppData\Local\Temp\1000038001\cc9647d99c.exe

                      Filesize

                      187KB

                      MD5

                      278ee1426274818874556aa18fd02e3a

                      SHA1

                      185a2761330024dec52134df2c8388c461451acb

                      SHA256

                      37257ddb1a6f309a6e9d147b5fc2551a9cae3a0e52b191b18d9465bfcb5c18eb

                      SHA512

                      07ec6759af5b9a00d8371b9fd9b723012dd0a1614cfcc7cd51975a004f69ffb90083735e9a871a2aa0e8d28799beac53a4748f55f4dd1e7495bc7388ebf4d6a0

                    • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                      Filesize

                      479KB

                      MD5

                      09372174e83dbbf696ee732fd2e875bb

                      SHA1

                      ba360186ba650a769f9303f48b7200fb5eaccee1

                      SHA256

                      c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                      SHA512

                      b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                    • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                      Filesize

                      13.8MB

                      MD5

                      0a8747a2ac9ac08ae9508f36c6d75692

                      SHA1

                      b287a96fd6cc12433adb42193dfe06111c38eaf0

                      SHA256

                      32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                      SHA512

                      59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\AlternateServices.bin

                      Filesize

                      10KB

                      MD5

                      5b486b71e38a8c12a62471fc16c359ed

                      SHA1

                      187fd8d02b3add7ddbc6e4051d4f184cf3be5c0c

                      SHA256

                      132536e91c434cbbf875d3767137820bfc6fe3acc26c7a896d1cd8f649c580a7

                      SHA512

                      b0c506f1fd48aacb4d4e46af7150238a374f7d1fd93be978cf1b1018ad45f9be19ebd9b10a8768270c6d605c0ff8f4685b14144390b841804e7537124ff27bc8

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\datareporting\glean\db\data.safe.tmp

                      Filesize

                      5KB

                      MD5

                      d7c2f01a9a7de6f8b662a7bac281c4b7

                      SHA1

                      d2ab0ecd0ffe4e929100fa8663f49d64cd78049c

                      SHA256

                      38d6dfce8a8f42a61c7784924ff9d070cc6a8cb8760599800a36a9210bc3ffa1

                      SHA512

                      7783e6a16de8b06e28b2ee49c912146bed4655372994e2303c5d179760cbfb61052cc286fbcd714b05729b2a235b785ab8765360ae6fd855883d9d2c21664615

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\datareporting\glean\db\data.safe.tmp

                      Filesize

                      6KB

                      MD5

                      cbee26e6ae42d84893598223b50c8676

                      SHA1

                      62a02b9152166d6c75976ecd3ca7161cbdf6c1f2

                      SHA256

                      3ac8de18957a6376e1610498af5964b6d212cd404bd1773f67e2748b138449af

                      SHA512

                      7be570a3718b19f13beaca1813bb238290c669c50b2a0d7872a521c3493452d0d0113fabcc0a04a092fa87f15199da6c04c3ece10815752c6f92a1a7873fb360

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\datareporting\glean\db\data.safe.tmp

                      Filesize

                      16KB

                      MD5

                      ce689b86559bd7562fa47ea9fad899e5

                      SHA1

                      d5f54568102b92cd824fb3da47194f5710f6c6d9

                      SHA256

                      1e549f375f4f185991fcd0c2ee009fac9ab642eadeb47c7dcdeb80b3d67d3d4d

                      SHA512

                      ff79e785bbec3a8eb002ed4cadb79331c87385a9f359ff71542f8375bfe9bf79b6f21ef728a3b56156aab27c1ac7db04f147bc5ab49b619b1348fbdecb989e53

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\datareporting\glean\db\data.safe.tmp

                      Filesize

                      16KB

                      MD5

                      ca01201882b0b9d1adf73194c3d457af

                      SHA1

                      bda18cff07aa5f653422f03433de24705b867185

                      SHA256

                      b61e7e60c0c5476c406ba42c19efaa4457becfcdc560cffffde0fb8bc3ab5b48

                      SHA512

                      50ec4a5e1b2817c5f624430a97d89fc6794472fe2fffc7864277c35d438c7be2abf2d0485f8be139bb0f7a82af97452485f9ae3132282a569181009a97c7964d

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\datareporting\glean\pending_pings\41a8f4a1-9193-42a3-88d7-2826be7e6567

                      Filesize

                      26KB

                      MD5

                      dbdd1679647b13c43e0970d4ef01b8ed

                      SHA1

                      c4b8672d15321ee1cdba7c0a5fab90c8583ac7ca

                      SHA256

                      a00d0c665653622d4e58dc9aaab747dedbb6597d11f7ed80db76e631268c28ef

                      SHA512

                      428d9e7c8aa9e76b1f5aa19acac5af43e16ce2043f34cfabbdb6c2c7df91049ca363c1be83a95257b94d623b8cbbe09a1eaffbc51eaf3564092f0728dbd7a8d6

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\datareporting\glean\pending_pings\72dd1379-4fd8-42ce-880e-c239a9b1f481

                      Filesize

                      982B

                      MD5

                      494a2eacaba107de831c59a2a0f58b76

                      SHA1

                      498a3e5bea62721a93c62c99529d37dd46018452

                      SHA256

                      cda54a3153936b94122884c4523688a02d2b03dc2d751831ed800be5e392c86a

                      SHA512

                      e28833661f93dae21665bc5bf743cfa42e420dac4ac371446f718570f5933019255a80b7295996eda6e947164a9e912ad76dd29b3dcf1f14784c8457c6e5dc67

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\datareporting\glean\pending_pings\dd80f20e-f427-40a6-9f78-52ebf257db00

                      Filesize

                      671B

                      MD5

                      0bd472804d29abc418e560ce7404575f

                      SHA1

                      5aec6bbdbd2b0a213ed58b56d9a1acd87d44e4e1

                      SHA256

                      9c36fdd2781265d8b8ed8fa728282f17438024a6d587283a5a791ab1d8fa92fd

                      SHA512

                      365e99abda22dfb3f99647559a9bfe272232b9ed269feaa60fcea56189f75a6006d46c0b6306d77a65315e9c85ab52eeb9317ba710a1ae658a689693845fd39d

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

                      Filesize

                      1.1MB

                      MD5

                      842039753bf41fa5e11b3a1383061a87

                      SHA1

                      3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                      SHA256

                      d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                      SHA512

                      d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

                      Filesize

                      116B

                      MD5

                      2a461e9eb87fd1955cea740a3444ee7a

                      SHA1

                      b10755914c713f5a4677494dbe8a686ed458c3c5

                      SHA256

                      4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                      SHA512

                      34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

                      Filesize

                      372B

                      MD5

                      bf957ad58b55f64219ab3f793e374316

                      SHA1

                      a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                      SHA256

                      bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                      SHA512

                      79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

                      Filesize

                      17.8MB

                      MD5

                      daf7ef3acccab478aaa7d6dc1c60f865

                      SHA1

                      f8246162b97ce4a945feced27b6ea114366ff2ad

                      SHA256

                      bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                      SHA512

                      5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\prefs-1.js

                      Filesize

                      12KB

                      MD5

                      b9be4d26f240cce56372456a49c08d43

                      SHA1

                      681b0045a65ce001050e25f2f74f3ff2cf8cad3c

                      SHA256

                      7f85094d6ac8978f265c732ba59d61d328c898f313bae9dad8abd6e7c690bfcf

                      SHA512

                      af4bac9d552385100e98e962ed8a62f2109f50be3e1ab87786416090ad125401a04c58df2e6542af231111673efd62ac6d67e011fe23e5384c11e06a25141eb9

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\prefs-1.js

                      Filesize

                      15KB

                      MD5

                      dcb7257cf824d67c27536a77785deb28

                      SHA1

                      dc5fe252346b47e80969b401c6f4e2943142079d

                      SHA256

                      31b661337b589e52f782e6c706c8d637a6cca10ea5db4db5c9a21fcbfea0b2e4

                      SHA512

                      4bcf691a06d539efe27c08c5cd0506c70eb2df99650c67d8226da88f2d29dff641e777aebd9b1b856fc6d886397e6e5e616af2c55ebbe67c694fe720fd0ba0cd

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\prefs.js

                      Filesize

                      11KB

                      MD5

                      a0f3b5158d81b2fbd74906f2c8a28408

                      SHA1

                      873b71782d6fefa44e83390c2e53dfee65679de8

                      SHA256

                      fe1134ded02e45289066899f8ee271051db6fcbbffa84ac9ec2b8f6b6a752760

                      SHA512

                      fe86d6d76bb24fd3d9f66b14f6ef2ce94e02beb67e9620431b339b2c5cc3a3be83fa2d9150dc896302a79544c1b12dad745610aa1525d0aa9196c836f44b3939

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

                      Filesize

                      1.4MB

                      MD5

                      93f5fc7d2c19ce3e83fd3d643a446388

                      SHA1

                      5482cf6a44cac0819b8841c4604512e3d1ca3845

                      SHA256

                      3700f28dcc63b34ad1c15fb3259d5df6d99b9c205b617499f1a6037c766b8adb

                      SHA512

                      c0b4465845b1c404a0ca597d0b945970c51fd7ff92045466371c47ddcd7853327ca36df7593f5465159efac08d59ccfc92d50bf649a317820cb7d28d4193fe88

                    • memory/544-41-0x0000000000CE0000-0x0000000000E10000-memory.dmp

                      Filesize

                      1.2MB

                    • memory/544-40-0x000000007352E000-0x000000007352F000-memory.dmp

                      Filesize

                      4KB

                    • memory/1876-2629-0x0000000000EB0000-0x0000000001352000-memory.dmp

                      Filesize

                      4.6MB

                    • memory/1876-2628-0x0000000000EB0000-0x0000000001352000-memory.dmp

                      Filesize

                      4.6MB

                    • memory/1948-66-0x0000000000020000-0x0000000000058000-memory.dmp

                      Filesize

                      224KB

                    • memory/2116-425-0x0000000000EB0000-0x0000000001352000-memory.dmp

                      Filesize

                      4.6MB

                    • memory/2116-2630-0x0000000000EB0000-0x0000000001352000-memory.dmp

                      Filesize

                      4.6MB

                    • memory/2116-2638-0x0000000000EB0000-0x0000000001352000-memory.dmp

                      Filesize

                      4.6MB

                    • memory/2116-2632-0x0000000000EB0000-0x0000000001352000-memory.dmp

                      Filesize

                      4.6MB

                    • memory/2116-443-0x0000000000EB0000-0x0000000001352000-memory.dmp

                      Filesize

                      4.6MB

                    • memory/2116-446-0x0000000000EB0000-0x0000000001352000-memory.dmp

                      Filesize

                      4.6MB

                    • memory/2116-447-0x0000000000EB0000-0x0000000001352000-memory.dmp

                      Filesize

                      4.6MB

                    • memory/2116-452-0x0000000000EB0000-0x0000000001352000-memory.dmp

                      Filesize

                      4.6MB

                    • memory/2116-2631-0x0000000000EB0000-0x0000000001352000-memory.dmp

                      Filesize

                      4.6MB

                    • memory/2116-1046-0x0000000000EB0000-0x0000000001352000-memory.dmp

                      Filesize

                      4.6MB

                    • memory/2116-2626-0x0000000000EB0000-0x0000000001352000-memory.dmp

                      Filesize

                      4.6MB

                    • memory/2116-2625-0x0000000000EB0000-0x0000000001352000-memory.dmp

                      Filesize

                      4.6MB

                    • memory/2116-2624-0x0000000000EB0000-0x0000000001352000-memory.dmp

                      Filesize

                      4.6MB

                    • memory/2116-21-0x0000000000EB0000-0x0000000001352000-memory.dmp

                      Filesize

                      4.6MB

                    • memory/2116-20-0x0000000000EB0000-0x0000000001352000-memory.dmp

                      Filesize

                      4.6MB

                    • memory/2116-19-0x0000000000EB1000-0x0000000000EDF000-memory.dmp

                      Filesize

                      184KB

                    • memory/2116-18-0x0000000000EB0000-0x0000000001352000-memory.dmp

                      Filesize

                      4.6MB

                    • memory/2116-2620-0x0000000000EB0000-0x0000000001352000-memory.dmp

                      Filesize

                      4.6MB

                    • memory/2116-2616-0x0000000000EB0000-0x0000000001352000-memory.dmp

                      Filesize

                      4.6MB

                    • memory/2116-1866-0x0000000000EB0000-0x0000000001352000-memory.dmp

                      Filesize

                      4.6MB

                    • memory/3144-17-0x0000000000740000-0x0000000000BE2000-memory.dmp

                      Filesize

                      4.6MB

                    • memory/3144-1-0x0000000077914000-0x0000000077916000-memory.dmp

                      Filesize

                      8KB

                    • memory/3144-0-0x0000000000740000-0x0000000000BE2000-memory.dmp

                      Filesize

                      4.6MB

                    • memory/3144-3-0x0000000000740000-0x0000000000BE2000-memory.dmp

                      Filesize

                      4.6MB

                    • memory/3144-4-0x0000000000740000-0x0000000000BE2000-memory.dmp

                      Filesize

                      4.6MB

                    • memory/3144-2-0x0000000000741000-0x000000000076F000-memory.dmp

                      Filesize

                      184KB

                    • memory/3540-43-0x0000000000400000-0x000000000052D000-memory.dmp

                      Filesize

                      1.2MB

                    • memory/3540-45-0x0000000000400000-0x000000000052D000-memory.dmp

                      Filesize

                      1.2MB

                    • memory/3540-47-0x0000000000400000-0x000000000052D000-memory.dmp

                      Filesize

                      1.2MB

                    • memory/3944-1365-0x0000000000EB0000-0x0000000001352000-memory.dmp

                      Filesize

                      4.6MB

                    • memory/3944-1415-0x0000000000EB0000-0x0000000001352000-memory.dmp

                      Filesize

                      4.6MB

                    • memory/4184-87-0x00000000009E0000-0x0000000000C23000-memory.dmp

                      Filesize

                      2.3MB

                    • memory/4184-86-0x00000000009E0000-0x0000000000C23000-memory.dmp

                      Filesize

                      2.3MB

                    • memory/5080-68-0x0000000000400000-0x0000000000643000-memory.dmp

                      Filesize

                      2.3MB

                    • memory/5080-70-0x0000000000400000-0x0000000000643000-memory.dmp

                      Filesize

                      2.3MB