Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12-08-2024 00:19

General

  • Target

    ef2f02b758860cfd61fad4e871636c0b4a8447e895baa8033d858ae0246a463e.exe

  • Size

    1.8MB

  • MD5

    089886bf7e26432d1b8871ad0fad7a6f

  • SHA1

    658b258103dfa62705e1a8d3a1cc3a0da105c9f7

  • SHA256

    ef2f02b758860cfd61fad4e871636c0b4a8447e895baa8033d858ae0246a463e

  • SHA512

    72006c3cfcbba34bfcbc8e4404eef75067ce5945529ae5802bc3b4a4790781ec032ded0ccd4c96df38f5a5a37cdc9b88b72734a6ed0abbccbb09c9ccb1b0c7e5

  • SSDEEP

    49152:DYDVWg9g4L78+neMv0+mvHhK2HoIAWXPAEC7Bloj:MTga8LMbmvHhbHoIAWXPhCdlu

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

0657d1

C2

http://185.215.113.19

Attributes
  • install_dir

    0d8f5eb8a7

  • install_file

    explorti.exe

  • strings_key

    6c55a5f34bb433fbd933a168577b1838

  • url_paths

    /Vi9leo/index.php

rc4.plain

Extracted

Family

stealc

Botnet

kora

C2

http://185.215.113.100

Attributes
  • url_path

    /e2b1563c6670f193.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Stealc

    Stealc is an infostealer written in C++.

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 8 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 6 IoCs
  • Identifies Wine through registry keys 2 TTPs 4 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • AutoIT Executable 3 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\ef2f02b758860cfd61fad4e871636c0b4a8447e895baa8033d858ae0246a463e.exe
    "C:\Users\Admin\AppData\Local\Temp\ef2f02b758860cfd61fad4e871636c0b4a8447e895baa8033d858ae0246a463e.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1148
    • C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
      "C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:212
      • C:\Users\Admin\AppData\Local\Temp\1000036001\287dd4930a.exe
        "C:\Users\Admin\AppData\Local\Temp\1000036001\287dd4930a.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4188
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          4⤵
          • Checks computer location settings
          • System Location Discovery: System Language Discovery
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:2068
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:3976
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
              6⤵
              • Checks processor information in registry
              • Modifies registry class
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:1116
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2012 -parentBuildID 20240401114208 -prefsHandle 1936 -prefMapHandle 1928 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {da708147-397a-45ab-9409-447d8d920bd5} 1116 "\\.\pipe\gecko-crash-server-pipe.1116" gpu
                7⤵
                  PID:3608
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2448 -parentBuildID 20240401114208 -prefsHandle 2432 -prefMapHandle 2428 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {15514122-c61c-436b-8c30-83f6b46c3620} 1116 "\\.\pipe\gecko-crash-server-pipe.1116" socket
                  7⤵
                    PID:812
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1576 -childID 1 -isForBrowser -prefsHandle 2968 -prefMapHandle 3204 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4d3b098f-d7c9-4a29-b1a7-c0b66c3004ad} 1116 "\\.\pipe\gecko-crash-server-pipe.1116" tab
                    7⤵
                      PID:3468
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2680 -childID 2 -isForBrowser -prefsHandle 3616 -prefMapHandle 3632 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e0b3f03b-17d2-4575-9c7a-9aa33a06d735} 1116 "\\.\pipe\gecko-crash-server-pipe.1116" tab
                      7⤵
                        PID:4496
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4688 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4648 -prefMapHandle 4644 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {71bf4753-179a-4fcd-a545-4219481967ed} 1116 "\\.\pipe\gecko-crash-server-pipe.1116" utility
                        7⤵
                        • Checks processor information in registry
                        PID:5212
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5620 -childID 3 -isForBrowser -prefsHandle 5612 -prefMapHandle 5608 -prefsLen 27182 -prefMapSize 244658 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {715a827a-8638-4ecb-9d93-02ab4170b983} 1116 "\\.\pipe\gecko-crash-server-pipe.1116" tab
                        7⤵
                          PID:4808
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5884 -childID 4 -isForBrowser -prefsHandle 5844 -prefMapHandle 5876 -prefsLen 27182 -prefMapSize 244658 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {804c5693-a8ec-4a02-9c71-85336d039aff} 1116 "\\.\pipe\gecko-crash-server-pipe.1116" tab
                          7⤵
                            PID:956
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5892 -childID 5 -isForBrowser -prefsHandle 5772 -prefMapHandle 5644 -prefsLen 27182 -prefMapSize 244658 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {76198f52-577d-48ec-9c1f-fe2a0de028eb} 1116 "\\.\pipe\gecko-crash-server-pipe.1116" tab
                            7⤵
                              PID:4320
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6228 -childID 6 -isForBrowser -prefsHandle 6308 -prefMapHandle 6304 -prefsLen 27182 -prefMapSize 244658 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8cd19a29-3e2d-46be-b59a-5afcc7866233} 1116 "\\.\pipe\gecko-crash-server-pipe.1116" tab
                              7⤵
                                PID:5404
                      • C:\Users\Admin\1000037002\956ba0e9e9.exe
                        "C:\Users\Admin\1000037002\956ba0e9e9.exe"
                        3⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of WriteProcessMemory
                        PID:840
                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                          4⤵
                            PID:4952
                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                            4⤵
                              PID:1096
                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                              4⤵
                                PID:924
                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                4⤵
                                • System Location Discovery: System Language Discovery
                                PID:4296
                            • C:\Users\Admin\AppData\Local\Temp\1000038001\7906e48338.exe
                              "C:\Users\Admin\AppData\Local\Temp\1000038001\7906e48338.exe"
                              3⤵
                              • Executes dropped EXE
                              • System Location Discovery: System Language Discovery
                              PID:3956
                        • C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                          C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                          1⤵
                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                          • Checks BIOS information in registry
                          • Executes dropped EXE
                          • Identifies Wine through registry keys
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          • Suspicious behavior: EnumeratesProcesses
                          PID:5560
                        • C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                          C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                          1⤵
                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                          • Checks BIOS information in registry
                          • Executes dropped EXE
                          • Identifies Wine through registry keys
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          • Suspicious behavior: EnumeratesProcesses
                          PID:3000

                        Network

                        MITRE ATT&CK Enterprise v15

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\Users\Admin\1000037002\956ba0e9e9.exe

                          Filesize

                          206KB

                          MD5

                          e826e5dda653e04af408850d34bcde30

                          SHA1

                          ef68ca7be13805e1a4ce73320015567df98b07ff

                          SHA256

                          bdf3491c9a75b80277746b1d6c105da79a3b5fba637236b87dd4af15af33e3b2

                          SHA512

                          c2750171b88c7d138299b29341af7cd20d97c2a22f6cb82b5e7711cc28f7947ac943fbf9ba8c038f49678b1b38d6a752706242786ed627fa69db267690da3072

                        • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bxumog7h.default-release\activity-stream.discovery_stream.json

                          Filesize

                          42KB

                          MD5

                          01ac7a4a7050eeffdc399be6f4328250

                          SHA1

                          69f15fc79e886d106a2892e739bbe2b4724ab486

                          SHA256

                          904b21330c1cf8aa0fbd01b05e6e3ec1703106057a4be7c6f39ca6642c11f9bb

                          SHA512

                          38e80670624936e704d6a844c98383338884869369b0803aab37bc13eb37ce49864509ce82294bc6fd8aa6203d574ba46cc81bcc4f110babf8ecefddb2c8d239

                        • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bxumog7h.default-release\cache2\entries\E449899591A9BC91DFBA673EC0589B51E541A88B

                          Filesize

                          13KB

                          MD5

                          b512a27125d39872f175ecec1e1f70b5

                          SHA1

                          4238f7ea47829d871424dcbd8d2286b68f61e939

                          SHA256

                          f603f8cd65f4144ae628924629947557b8377bd64c4da1c26c81e450bb50502f

                          SHA512

                          c45696aef229a84cb3c48fb9a0d58ed38bbc3b9627e0912b345a3016c18cf078bdc1f064512e8fb42e1a49da625b0ad909345ca22c638c858ff753b313acfeff

                        • C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

                          Filesize

                          1.8MB

                          MD5

                          089886bf7e26432d1b8871ad0fad7a6f

                          SHA1

                          658b258103dfa62705e1a8d3a1cc3a0da105c9f7

                          SHA256

                          ef2f02b758860cfd61fad4e871636c0b4a8447e895baa8033d858ae0246a463e

                          SHA512

                          72006c3cfcbba34bfcbc8e4404eef75067ce5945529ae5802bc3b4a4790781ec032ded0ccd4c96df38f5a5a37cdc9b88b72734a6ed0abbccbb09c9ccb1b0c7e5

                        • C:\Users\Admin\AppData\Local\Temp\1000036001\287dd4930a.exe

                          Filesize

                          1.2MB

                          MD5

                          b4b7887bba964f06c545500381908ba9

                          SHA1

                          c8a668c954d459269b3fcf7d4f4359a5630f731c

                          SHA256

                          00d63a7e31523200db556616515fdd747cdfee7788adc5a5c946f2b6bcb8e4c5

                          SHA512

                          285acc9fe1b166dec1793e55c47abe5fe96d7edee670808f0b424f9bcf88d5027a9a29f74189625539c1dff9bc6cc8ca31b23df86982266f72d8bb436d55c018

                        • C:\Users\Admin\AppData\Local\Temp\1000038001\7906e48338.exe

                          Filesize

                          187KB

                          MD5

                          278ee1426274818874556aa18fd02e3a

                          SHA1

                          185a2761330024dec52134df2c8388c461451acb

                          SHA256

                          37257ddb1a6f309a6e9d147b5fc2551a9cae3a0e52b191b18d9465bfcb5c18eb

                          SHA512

                          07ec6759af5b9a00d8371b9fd9b723012dd0a1614cfcc7cd51975a004f69ffb90083735e9a871a2aa0e8d28799beac53a4748f55f4dd1e7495bc7388ebf4d6a0

                        • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                          Filesize

                          479KB

                          MD5

                          09372174e83dbbf696ee732fd2e875bb

                          SHA1

                          ba360186ba650a769f9303f48b7200fb5eaccee1

                          SHA256

                          c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                          SHA512

                          b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                        • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                          Filesize

                          13.8MB

                          MD5

                          0a8747a2ac9ac08ae9508f36c6d75692

                          SHA1

                          b287a96fd6cc12433adb42193dfe06111c38eaf0

                          SHA256

                          32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                          SHA512

                          59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\AlternateServices.bin

                          Filesize

                          16KB

                          MD5

                          b9d371f11b4a8b5f28b2dfb7cec3edc9

                          SHA1

                          0dbabd17604f11f0385388e1117ae7b9f9747f64

                          SHA256

                          51e54e56c1f27946bfe02ab7805e0dc352478de440c0cdb8c60b5d2fd271e233

                          SHA512

                          fde2e6c356857dda87c17e30fe4f641197591ca38c379cefd88ae245d157568084de20a3c504708fd90ac0c4aeef458336530ade03a92b4c3379e1b7d6f14f2f

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\AlternateServices.bin

                          Filesize

                          10KB

                          MD5

                          a5e32b464a7bb339ab28f2ba8d355fe8

                          SHA1

                          b7980b94c555f0d456bb03342c710bad10fd179e

                          SHA256

                          33c0b251816599ed8d43cfb19c53de139664aae8fbcd92f8d60a48ced35f87e9

                          SHA512

                          cb2147a765bb6063419c620e871160b417754673b01b169729bba8c001a734e996aec89fabdb92e91b99c4ecf3427ec1c79cb33f647f9f551ccc1fdaabd8399a

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\datareporting\glean\db\data.safe.tmp

                          Filesize

                          21KB

                          MD5

                          247e8d4a73bf6d392806f666e0456530

                          SHA1

                          2f14236a1b1c64c1c5d04262b064f3592e148709

                          SHA256

                          deb2051e550d77f075533ec713fc2c956a095b0d6cd6929e6ee4afcf8ce8b20d

                          SHA512

                          6bd8bbab48facb19c9bcec96d09e2f43df39f4f275eaa7fb9c1ce8a2c74b45f43d6079f8028920f4235ed7e9293c00d8002aac7925b704788cb460a660129864

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\datareporting\glean\db\data.safe.tmp

                          Filesize

                          24KB

                          MD5

                          3bce1625dedef6649f36cad10db103d3

                          SHA1

                          2be5624b878b66a01cf17be18edf66efa6f9f680

                          SHA256

                          0cd9534b5eaa27d33f140862c49f57ddf7b28776ee380e5f08b7c4daf500b68a

                          SHA512

                          c497597b0d49ec1b3fb4b773a457d14aa771e2272a6c3a1737472c8e3ee879fbfb7ab0555708ca298df1a5df2f08428c36e6ab30fa5f252d377287b8da41d912

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\datareporting\glean\db\data.safe.tmp

                          Filesize

                          22KB

                          MD5

                          3bbf8d50963fac9c2319bdea2c961d69

                          SHA1

                          1f9df882717dba0ae50815d831b5b99f7383d1eb

                          SHA256

                          f45b9b5b32f52039c513694fe9635c2d12c165b939dd0902bf52b20827247eb8

                          SHA512

                          ec8a087df5724184cfdd34760661077f260fa6e0c7e1979709ed38b651cec081a85c86d2a4bcf7d393a0742ad3d4893a55156f1166c297f078c949cf3e30230a

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\datareporting\glean\pending_pings\8f9c83ed-bb4f-4dc1-b6f0-636c00af5159

                          Filesize

                          659B

                          MD5

                          295aead7d1bb165208975d445c8bd15f

                          SHA1

                          d2c689583c9b4a8b7f8f3c23b404dcf0cf2a5494

                          SHA256

                          b4e1dc10f8307c8d7a8a2887c0273bd9340f094a8f54af7b8732f74058d307e3

                          SHA512

                          873b292ed5730781a199129a2069f417b4f45221a24c2b59529829cb642ef59bbed9cd2dc9fd1334d8cc080b175ab2838c9d9d3674caa5489c4e398f1ad99735

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\datareporting\glean\pending_pings\f01d6409-e002-4cae-af6a-8d537da57ff8

                          Filesize

                          982B

                          MD5

                          3f93b9b7cb633da17555c6b9bcd3eff1

                          SHA1

                          9d7d82054fb3a008d79146dde7f9cf89c91bfb0e

                          SHA256

                          93fed6b75d05654f4ea9e70b751a02d3367383facc81d4ff04e709ad2b6cb8a9

                          SHA512

                          3f780e3a4c7478131ada7469a66999d6c13b4f758fcdff44605761ad175d90dd0f23669aaa0dd3d4fae532770d6b79149cf196156ade50707480d71e3ab4513b

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

                          Filesize

                          1.1MB

                          MD5

                          842039753bf41fa5e11b3a1383061a87

                          SHA1

                          3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                          SHA256

                          d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                          SHA512

                          d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

                          Filesize

                          116B

                          MD5

                          2a461e9eb87fd1955cea740a3444ee7a

                          SHA1

                          b10755914c713f5a4677494dbe8a686ed458c3c5

                          SHA256

                          4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                          SHA512

                          34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

                          Filesize

                          372B

                          MD5

                          bf957ad58b55f64219ab3f793e374316

                          SHA1

                          a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                          SHA256

                          bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                          SHA512

                          79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

                          Filesize

                          17.8MB

                          MD5

                          daf7ef3acccab478aaa7d6dc1c60f865

                          SHA1

                          f8246162b97ce4a945feced27b6ea114366ff2ad

                          SHA256

                          bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                          SHA512

                          5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\prefs-1.js

                          Filesize

                          13KB

                          MD5

                          d7622f78418e15e34ed6db4605bb50e0

                          SHA1

                          7ed6b35748980f28f61c81dfecaa151a8228f906

                          SHA256

                          748841e2fc42def588940e027f5625c0b883a52570614c7eaeb610fd7a1579f3

                          SHA512

                          96a969da68b33d2b5cb85a4b565027c010555cd628af2c563b09e3b7a6f96b22a7ab90e931ece0a3a002a33783baf84443131931ba1e044320f283234a53f9b9

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\sessionstore-backups\recovery.baklz4

                          Filesize

                          5KB

                          MD5

                          a765ad194e80e5a65aa41568c3da7cfc

                          SHA1

                          9487fda1ed89fb5193ef81301eb28ce5a732d53d

                          SHA256

                          eaefe9414403d6c652c35859424493fd06c1ec3b2f4576eb574f6211f7fb221b

                          SHA512

                          1f43200167ad3e7e1b44d17883187f3cc1039eefb39e9b0d5a6b526262c04e8d29d61eadebf036bf063e665c22a4c7008aa7ac7951d3ad1f12c9d19a13f24097

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

                          Filesize

                          1.4MB

                          MD5

                          df6f5f2a3e7213865fb687b327f35383

                          SHA1

                          ccc09d70b21903c715513a393b5d2af95cf169a1

                          SHA256

                          f0906ed53339393044f2c2c72b7bd0d76ce87950dd85770700c7e0c6f9859c4e

                          SHA512

                          5143fb907ab69cd761202a0babdee21c50782abbdcf01dc41de4310e5130492a30a66b545802dd84b8f9f6fbb6d2f88ae1cea9cab25e6aa1e652df7879551183

                        • memory/212-405-0x00000000005E0000-0x0000000000A90000-memory.dmp

                          Filesize

                          4.7MB

                        • memory/212-18-0x00000000005E0000-0x0000000000A90000-memory.dmp

                          Filesize

                          4.7MB

                        • memory/212-2647-0x00000000005E0000-0x0000000000A90000-memory.dmp

                          Filesize

                          4.7MB

                        • memory/212-2645-0x00000000005E0000-0x0000000000A90000-memory.dmp

                          Filesize

                          4.7MB

                        • memory/212-2636-0x00000000005E0000-0x0000000000A90000-memory.dmp

                          Filesize

                          4.7MB

                        • memory/212-2635-0x00000000005E0000-0x0000000000A90000-memory.dmp

                          Filesize

                          4.7MB

                        • memory/212-2631-0x00000000005E0000-0x0000000000A90000-memory.dmp

                          Filesize

                          4.7MB

                        • memory/212-2630-0x00000000005E0000-0x0000000000A90000-memory.dmp

                          Filesize

                          4.7MB

                        • memory/212-2629-0x00000000005E0000-0x0000000000A90000-memory.dmp

                          Filesize

                          4.7MB

                        • memory/212-416-0x00000000005E0000-0x0000000000A90000-memory.dmp

                          Filesize

                          4.7MB

                        • memory/212-427-0x00000000005E0000-0x0000000000A90000-memory.dmp

                          Filesize

                          4.7MB

                        • memory/212-428-0x00000000005E0000-0x0000000000A90000-memory.dmp

                          Filesize

                          4.7MB

                        • memory/212-2628-0x00000000005E0000-0x0000000000A90000-memory.dmp

                          Filesize

                          4.7MB

                        • memory/212-444-0x00000000005E0000-0x0000000000A90000-memory.dmp

                          Filesize

                          4.7MB

                        • memory/212-2621-0x00000000005E0000-0x0000000000A90000-memory.dmp

                          Filesize

                          4.7MB

                        • memory/212-2620-0x00000000005E0000-0x0000000000A90000-memory.dmp

                          Filesize

                          4.7MB

                        • memory/212-21-0x00000000005E0000-0x0000000000A90000-memory.dmp

                          Filesize

                          4.7MB

                        • memory/212-20-0x00000000005E0000-0x0000000000A90000-memory.dmp

                          Filesize

                          4.7MB

                        • memory/212-19-0x00000000005E1000-0x000000000060F000-memory.dmp

                          Filesize

                          184KB

                        • memory/212-1609-0x00000000005E0000-0x0000000000A90000-memory.dmp

                          Filesize

                          4.7MB

                        • memory/840-66-0x00000000003A0000-0x00000000003D8000-memory.dmp

                          Filesize

                          224KB

                        • memory/1148-4-0x0000000000DC0000-0x0000000001270000-memory.dmp

                          Filesize

                          4.7MB

                        • memory/1148-3-0x0000000000DC0000-0x0000000001270000-memory.dmp

                          Filesize

                          4.7MB

                        • memory/1148-2-0x0000000000DC1000-0x0000000000DEF000-memory.dmp

                          Filesize

                          184KB

                        • memory/1148-1-0x0000000077E84000-0x0000000077E86000-memory.dmp

                          Filesize

                          8KB

                        • memory/1148-17-0x0000000000DC0000-0x0000000001270000-memory.dmp

                          Filesize

                          4.7MB

                        • memory/1148-0-0x0000000000DC0000-0x0000000001270000-memory.dmp

                          Filesize

                          4.7MB

                        • memory/2068-47-0x0000000000400000-0x000000000052D000-memory.dmp

                          Filesize

                          1.2MB

                        • memory/2068-43-0x0000000000400000-0x000000000052D000-memory.dmp

                          Filesize

                          1.2MB

                        • memory/2068-45-0x0000000000400000-0x000000000052D000-memory.dmp

                          Filesize

                          1.2MB

                        • memory/3000-2634-0x00000000005E0000-0x0000000000A90000-memory.dmp

                          Filesize

                          4.7MB

                        • memory/3000-2633-0x00000000005E0000-0x0000000000A90000-memory.dmp

                          Filesize

                          4.7MB

                        • memory/3956-87-0x0000000000220000-0x0000000000463000-memory.dmp

                          Filesize

                          2.3MB

                        • memory/3956-86-0x0000000000220000-0x0000000000463000-memory.dmp

                          Filesize

                          2.3MB

                        • memory/4188-41-0x0000000000460000-0x0000000000590000-memory.dmp

                          Filesize

                          1.2MB

                        • memory/4188-40-0x0000000073A9E000-0x0000000073A9F000-memory.dmp

                          Filesize

                          4KB

                        • memory/4296-70-0x0000000000400000-0x0000000000643000-memory.dmp

                          Filesize

                          2.3MB

                        • memory/4296-68-0x0000000000400000-0x0000000000643000-memory.dmp

                          Filesize

                          2.3MB

                        • memory/5560-2619-0x00000000005E0000-0x0000000000A90000-memory.dmp

                          Filesize

                          4.7MB

                        • memory/5560-2613-0x00000000005E0000-0x0000000000A90000-memory.dmp

                          Filesize

                          4.7MB