Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    12-08-2024 04:00

General

  • Target

    ccc2a60072b214515b1ba5af3838f7c41d5c15531a2047f812588429f8264ee5.exe

  • Size

    1.8MB

  • MD5

    5b496c08c6603286a74edf4f17a1f7e5

  • SHA1

    343311b9d583bde7ed9039731036fe7fd31cc701

  • SHA256

    ccc2a60072b214515b1ba5af3838f7c41d5c15531a2047f812588429f8264ee5

  • SHA512

    b2f80db9884dafc865f351bcbba774a342e10127ff3d720691d4f347a73ed1edab6e76d76f10e0b99e0d2a667675f5a2f5cb756b8d4240f21c75ed9ba1aa9c93

  • SSDEEP

    49152:Z1/YQEbR60x6+yuS8I5FF/Yb8hsS0VDu7Q0L4XcjOk5Q0EGDYF:ZCz16iyupAFhY4hZ030LtjZN

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

0657d1

C2

http://185.215.113.19

Attributes
  • install_dir

    0d8f5eb8a7

  • install_file

    explorti.exe

  • strings_key

    6c55a5f34bb433fbd933a168577b1838

  • url_paths

    /Vi9leo/index.php

rc4.plain

Extracted

Family

stealc

Botnet

kora

C2

http://185.215.113.100

Attributes
  • url_path

    /e2b1563c6670f193.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Stealc

    Stealc is an infostealer written in C++.

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 8 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 6 IoCs
  • Identifies Wine through registry keys 2 TTPs 4 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 2 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • AutoIT Executable 3 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 10 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\ccc2a60072b214515b1ba5af3838f7c41d5c15531a2047f812588429f8264ee5.exe
    "C:\Users\Admin\AppData\Local\Temp\ccc2a60072b214515b1ba5af3838f7c41d5c15531a2047f812588429f8264ee5.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2340
    • C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
      "C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3440
      • C:\Users\Admin\AppData\Local\Temp\1000036001\28d908c376.exe
        "C:\Users\Admin\AppData\Local\Temp\1000036001\28d908c376.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4276
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:2372
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:3452
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
              6⤵
              • Checks processor information in registry
              • Modifies registry class
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:1228
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2004 -parentBuildID 20240401114208 -prefsHandle 1932 -prefMapHandle 1924 -prefsLen 23678 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0fc760da-e3f7-4048-906b-ea6e70cbbc5c} 1228 "\\.\pipe\gecko-crash-server-pipe.1228" gpu
                7⤵
                  PID:3240
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2416 -parentBuildID 20240401114208 -prefsHandle 2280 -prefMapHandle 2256 -prefsLen 24598 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a54ac316-a577-443d-8f1d-519e4441da3b} 1228 "\\.\pipe\gecko-crash-server-pipe.1228" socket
                  7⤵
                    PID:2648
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3108 -childID 1 -isForBrowser -prefsHandle 2788 -prefMapHandle 2688 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8205a63b-3afb-49a1-8ed4-077a324ce461} 1228 "\\.\pipe\gecko-crash-server-pipe.1228" tab
                    7⤵
                      PID:4804
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3720 -childID 2 -isForBrowser -prefsHandle 3712 -prefMapHandle 2960 -prefsLen 29088 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7f7a78a5-0d02-4f36-ad52-9b587c21135f} 1228 "\\.\pipe\gecko-crash-server-pipe.1228" tab
                      7⤵
                        PID:4088
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1284 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4508 -prefMapHandle 4504 -prefsLen 29088 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9c7f7468-9d20-4094-8dfa-6a630d1f8fe5} 1228 "\\.\pipe\gecko-crash-server-pipe.1228" utility
                        7⤵
                        • Checks processor information in registry
                        PID:1404
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5480 -childID 3 -isForBrowser -prefsHandle 5472 -prefMapHandle 5456 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {40f114a9-4141-4e00-8ce4-eb21810ae2d7} 1228 "\\.\pipe\gecko-crash-server-pipe.1228" tab
                        7⤵
                          PID:2344
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5704 -childID 4 -isForBrowser -prefsHandle 5624 -prefMapHandle 5628 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e5efc00e-452b-4c91-8542-32794c2164cd} 1228 "\\.\pipe\gecko-crash-server-pipe.1228" tab
                          7⤵
                            PID:1688
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4620 -childID 5 -isForBrowser -prefsHandle 5844 -prefMapHandle 5848 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bdc5bd1b-8b39-448e-8a74-71d5ca3ee481} 1228 "\\.\pipe\gecko-crash-server-pipe.1228" tab
                            7⤵
                              PID:5112
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6296 -childID 6 -isForBrowser -prefsHandle 6352 -prefMapHandle 6348 -prefsLen 27182 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {75b4dcde-c885-4f00-b8e3-4aa0374cea5d} 1228 "\\.\pipe\gecko-crash-server-pipe.1228" tab
                              7⤵
                                PID:4372
                      • C:\Users\Admin\1000037002\8986e5c397.exe
                        "C:\Users\Admin\1000037002\8986e5c397.exe"
                        3⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of WriteProcessMemory
                        PID:1056
                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                          4⤵
                            PID:4864
                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                            4⤵
                              PID:5088
                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                              4⤵
                              • Loads dropped DLL
                              • System Location Discovery: System Language Discovery
                              • Checks processor information in registry
                              • Suspicious behavior: EnumeratesProcesses
                              PID:2316
                          • C:\Users\Admin\AppData\Local\Temp\1000038001\5946973d7f.exe
                            "C:\Users\Admin\AppData\Local\Temp\1000038001\5946973d7f.exe"
                            3⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            PID:2452
                      • C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                        C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                        1⤵
                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                        • Checks BIOS information in registry
                        • Executes dropped EXE
                        • Identifies Wine through registry keys
                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                        • Suspicious behavior: EnumeratesProcesses
                        PID:2060
                      • C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                        C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                        1⤵
                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                        • Checks BIOS information in registry
                        • Executes dropped EXE
                        • Identifies Wine through registry keys
                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                        • Suspicious behavior: EnumeratesProcesses
                        PID:1976

                      Network

                      MITRE ATT&CK Enterprise v15

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\ProgramData\mozglue.dll

                        Filesize

                        593KB

                        MD5

                        c8fd9be83bc728cc04beffafc2907fe9

                        SHA1

                        95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                        SHA256

                        ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                        SHA512

                        fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                      • C:\ProgramData\nss3.dll

                        Filesize

                        2.0MB

                        MD5

                        1cc453cdf74f31e4d913ff9c10acdde2

                        SHA1

                        6e85eae544d6e965f15fa5c39700fa7202f3aafe

                        SHA256

                        ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                        SHA512

                        dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                      • C:\Users\Admin\1000037002\8986e5c397.exe

                        Filesize

                        206KB

                        MD5

                        c05fd08043fd1dc414300a92bc73e1fc

                        SHA1

                        9d3c8c2a2bd2881606dc2a826aad65f63a332853

                        SHA256

                        531cbb2c4dbaaea781ad6798ce36c7ce254c8f88a892dc42ee0aaed205e1a73d

                        SHA512

                        43f00dbf42c84002b4ab46b907953c1236407cdb55001d01ac193a87e3fab9ecacdf4bbac7d2a02297a41f4e62a2a37b93c2e8b559e791c5484791f2faa1d065

                      • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\activity-stream.discovery_stream.json

                        Filesize

                        42KB

                        MD5

                        4ef88b152e14e9219e19eb3120ce1ae1

                        SHA1

                        4ae904e1cc9c028c0755dd5ed396a095329b6621

                        SHA256

                        ff3e64e72c9305d7d8decd7a6ac2683597b5b265a9fc972d23617cff96e87145

                        SHA512

                        daa4bb92c40d4b31cdc8f3be8d5242ae8172969ea32f818a994b8b9672b3fb7273b001eb2e43c2897ba39d88286433bf48511387641005ee980e4d17fd42a7e4

                      • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\cache2\entries\E449899591A9BC91DFBA673EC0589B51E541A88B

                        Filesize

                        13KB

                        MD5

                        e6a16427ae22f70ce5c4be95cac93d22

                        SHA1

                        3a1d3846010f8f5ff097f0c4ae5b265ffd514c2d

                        SHA256

                        813b693ca1c3219773e2471d849d147fff38341175cdfcbc0d74c8e803ac1fec

                        SHA512

                        5f8c52eb8aa095605e8b05963d2bb8bbf0e419f97c45646b7ef5b2e83e67a3250baca05851b67745a1f43c6e518ff46b92a5ffa762d92f7bcdeef4d97138521e

                      • C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

                        Filesize

                        1.8MB

                        MD5

                        5b496c08c6603286a74edf4f17a1f7e5

                        SHA1

                        343311b9d583bde7ed9039731036fe7fd31cc701

                        SHA256

                        ccc2a60072b214515b1ba5af3838f7c41d5c15531a2047f812588429f8264ee5

                        SHA512

                        b2f80db9884dafc865f351bcbba774a342e10127ff3d720691d4f347a73ed1edab6e76d76f10e0b99e0d2a667675f5a2f5cb756b8d4240f21c75ed9ba1aa9c93

                      • C:\Users\Admin\AppData\Local\Temp\1000036001\28d908c376.exe

                        Filesize

                        1.2MB

                        MD5

                        f5f1e8f743ec3d40dbe97e0e67e14861

                        SHA1

                        14b889a8602eb0d8c05f4bd415977c99fce99b90

                        SHA256

                        a3c814c3833951d016c68679e2f8902cc1ba30d8acbb14a64aa3a58e3f23d51d

                        SHA512

                        cc23bf8b3588fc68e2641c813c2ce1eaa7aa8d123071def3f88fc679abaaffed0d22fdb7e36e3d782170b69e62f0e4585a30f591d328d5c83039b997d8a30732

                      • C:\Users\Admin\AppData\Local\Temp\1000038001\5946973d7f.exe

                        Filesize

                        187KB

                        MD5

                        278ee1426274818874556aa18fd02e3a

                        SHA1

                        185a2761330024dec52134df2c8388c461451acb

                        SHA256

                        37257ddb1a6f309a6e9d147b5fc2551a9cae3a0e52b191b18d9465bfcb5c18eb

                        SHA512

                        07ec6759af5b9a00d8371b9fd9b723012dd0a1614cfcc7cd51975a004f69ffb90083735e9a871a2aa0e8d28799beac53a4748f55f4dd1e7495bc7388ebf4d6a0

                      • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                        Filesize

                        479KB

                        MD5

                        09372174e83dbbf696ee732fd2e875bb

                        SHA1

                        ba360186ba650a769f9303f48b7200fb5eaccee1

                        SHA256

                        c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                        SHA512

                        b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                      • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                        Filesize

                        13.8MB

                        MD5

                        0a8747a2ac9ac08ae9508f36c6d75692

                        SHA1

                        b287a96fd6cc12433adb42193dfe06111c38eaf0

                        SHA256

                        32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                        SHA512

                        59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\AlternateServices.bin

                        Filesize

                        7KB

                        MD5

                        fbbb3af1cea26fdf8475f2c175bbdb6c

                        SHA1

                        6369ce2847883fbf049279c59f4a9e1c2920890a

                        SHA256

                        85b710351ed08c455c1de6771bb41fd8b5e7ccd40c9340fd08133ce0efd09443

                        SHA512

                        389c7caccefac599c5f01b226844e36ed9ec90402ca0a57e9a3ddf8036479421623031baaf1655fb1dbbe5f53e4984f1a6240c8099f5291440e5d62a7f08866f

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\AlternateServices.bin

                        Filesize

                        10KB

                        MD5

                        8075c370b7a80d28702315e9cfc51ea4

                        SHA1

                        50161668fda2930b9aeecf1418a73bca124a22c1

                        SHA256

                        67b47556a645d4c3aaf558f7c91135547f364d1d41f1a95194edcc4867940da3

                        SHA512

                        0119cbe04785266ffa77671343f9830ac64705db105ad1fe6cc0b35d8dd7341cee4c81436c1e2f39d0cd1b4433af2c63606ba22d7a61bf152a8913f6d037fb86

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\cookies.sqlite

                        Filesize

                        512KB

                        MD5

                        22c36879e6831b1d3496dc46066c7378

                        SHA1

                        75ba571d01e5c5d15b1086ab35c149ac43921ee4

                        SHA256

                        c2e48d9e330fa9f3f6056a243f59c3bc42b1656381ed67f1f84946a54fcb252c

                        SHA512

                        433d6d80a1dba4feaa6e7839bcb68e59177b6d14480d67e2063310411e121aa8ae06caea696e30503bc653813e92d051330f54387de9a7363bd54ccd62ef4bcc

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\cookies.sqlite-wal

                        Filesize

                        512KB

                        MD5

                        6dea88812061a9ee96d3fd2860b34dc6

                        SHA1

                        28e141429ed0ad32761b4bac6b70f702c5c3c2bf

                        SHA256

                        40426ca40725fde7faf01c7fedb056beb908bf6c2b1d6f4a846f56b8386b3d6c

                        SHA512

                        a18745e4d9c891cf06cd8f11565514792075c29be4e31188277b7fabc027777b84ce5556daaff5154d04fb8f51a0cae5cc579e1e981c01d1c18cd36b29ec45e9

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\datareporting\glean\db\data.safe.tmp

                        Filesize

                        5KB

                        MD5

                        1778af45615cfd4f237a052b9e6e88af

                        SHA1

                        4b494dda46b3d26c88f73b21e931bc0a5c093721

                        SHA256

                        dff915e9e10507af37ddfbbb72a705e414e783e3b79656569f7be6061bae849a

                        SHA512

                        c1b620a52a08e6fe67bf0ca760a2d9ccec77cf17bbefb6bf6a29e7b3b65a0a80ad1c98b7582ac1307be213c2412b62bd5bbdbf117f8f573801a79778450d2e27

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\datareporting\glean\db\data.safe.tmp

                        Filesize

                        5KB

                        MD5

                        d2886145c021111532aa61b25091756d

                        SHA1

                        e4bace2e6310253f59b06a5adfd629c8e2cb845e

                        SHA256

                        f4d7670e12221c320f0d56906dbbe66419c1e4fc06e7956807c992c30f1850b7

                        SHA512

                        50adb19f6453929062a65dca0d275f73dd7282eb95d00f20b19d242030e12e069cb6c7c89f02dd55d2a0f22243a0767b857a8cb1037e334d1eb7f94f22f0b6bf

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\datareporting\glean\db\data.safe.tmp

                        Filesize

                        6KB

                        MD5

                        4ee9cc2d3741e6cf12f4c1753f692d78

                        SHA1

                        4c510dc4b325ca08975acb454165920cfc79cb70

                        SHA256

                        f2685ae95728cb293c7697bb39b1b95b6d434a507a37223833b62cd4e9bb717e

                        SHA512

                        78e9634bde81f1c11f4026f7258847dd36aa2f9aafaed44087ac405a843d25f0a62afe87e3b044edd56e2f652b571f63252a4270089d00e1d38a74a6390a028b

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\datareporting\glean\db\data.safe.tmp

                        Filesize

                        6KB

                        MD5

                        1b142af34f641c3046872b9d2d22eac1

                        SHA1

                        3225871605bed9239495a2541c3c8115ff47c2a9

                        SHA256

                        8bb2b9b1a4ef806dbf0d6a789d5c392eba51d890bc382726f93b002d79d919b5

                        SHA512

                        2cc50df490becc63761c6aab54a3ec02f46bf8971f47cff44cbbf5dac3e2a525b8fef709423239d9aecfe2f13681125de5edbb8dede13c58e77cf4b08a942b48

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\datareporting\glean\db\data.safe.tmp

                        Filesize

                        16KB

                        MD5

                        239704b6872ad902ec0ea9c44119c9fb

                        SHA1

                        3ca1a2e0beaf8a7e199539a4421aabb1fc182439

                        SHA256

                        db860224cea31cf331ec42a53636b8bee8122f7d509dc44c17e0a50e99bd0948

                        SHA512

                        0c0555e37f65c846cca90905e34ec22ac3e80318c6b5e234bbe6e9984069e0aa475c6e990e5ab5e19a85374a7a05fe197f7cf0b9531132e45f632c7a35ffb835

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\datareporting\glean\pending_pings\087faaa8-9356-4972-a941-6ba5fad93489

                        Filesize

                        982B

                        MD5

                        d2956c37b8a9a317a74d10eaeefc8eba

                        SHA1

                        c0f358f6ce3afbdea5ee47e2a826ea2b21c1d70a

                        SHA256

                        1b9ad7635ff31fe58aa24ae3cb6ec55ef7773e1bbd0768ac49bcf38cddbd4907

                        SHA512

                        d83dc6546c4c4c2d6fd289a99fb515c087195182d887dfe77a87449fb2cfe1581ac4e9b04a93c8bcd26916e4ce331bde0152ec741b3e4d76bd0dac9aa0fb0703

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\datareporting\glean\pending_pings\4457ad61-4005-4509-8a4f-d8b8375dd550

                        Filesize

                        671B

                        MD5

                        f6b80e5813dd3403233c8ed6f1edbca2

                        SHA1

                        e8c3ea9c9fa35bf9b6bac1c26f4b45add04794d0

                        SHA256

                        6af8b74e708967eed080d11d0dc128c752177aa4d1801839ce662e9264589664

                        SHA512

                        6c740471d5a319ca869ece36bf3a7e4c89370c3cffa976b57158d570ba4fe4ab8a869595d0a041412d2dda855172cfbdaab6e5238ea079d53e14823fbc3f9e4b

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\datareporting\glean\pending_pings\d6c9c986-57af-4627-9173-e3cd068db553

                        Filesize

                        25KB

                        MD5

                        a27ceb503b57641f841650c503f87254

                        SHA1

                        f7beea0efbc8df0c69559a60c4f0b32cf8c154f8

                        SHA256

                        cc32e383afb777c55a3d0987b6a3a2e4cd1ec3d8ce56056646842dbe31989e0c

                        SHA512

                        ea5202121c5a4fe4951089208b7e6640365de1f36366b4a4374d5ce89e332b2517dd5bdd16938de07d1ea8748c0e5d8e75942e34b22f5514ea6ff697ede37b97

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\formhistory.sqlite

                        Filesize

                        256KB

                        MD5

                        97c1441748d6cc3e5a7030cda7543975

                        SHA1

                        f5598a45b101a5404126cd27fbb7f4b70861ee32

                        SHA256

                        2015b584b844b091d6a6280d45e9a589ea0feacf5f4b19bdd4cc21c60dbaaf91

                        SHA512

                        29d358ec7725038c6648251d8b9c32f3a40458e9c97926e0000ab42f0369b96d1ba5216eeb7c35800c740633dfd3b1e6e6aa73859644bdb9cdccaf2a3516bcb9

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

                        Filesize

                        1.1MB

                        MD5

                        842039753bf41fa5e11b3a1383061a87

                        SHA1

                        3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                        SHA256

                        d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                        SHA512

                        d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

                        Filesize

                        116B

                        MD5

                        2a461e9eb87fd1955cea740a3444ee7a

                        SHA1

                        b10755914c713f5a4677494dbe8a686ed458c3c5

                        SHA256

                        4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                        SHA512

                        34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

                        Filesize

                        372B

                        MD5

                        bf957ad58b55f64219ab3f793e374316

                        SHA1

                        a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                        SHA256

                        bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                        SHA512

                        79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

                        Filesize

                        17.8MB

                        MD5

                        daf7ef3acccab478aaa7d6dc1c60f865

                        SHA1

                        f8246162b97ce4a945feced27b6ea114366ff2ad

                        SHA256

                        bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                        SHA512

                        5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\places.sqlite-wal

                        Filesize

                        1.3MB

                        MD5

                        a672943f46e75252d08f8fe515850b83

                        SHA1

                        ebcd94df9fa713a87f917bbdcd1aef8fe19fb8f1

                        SHA256

                        243e9bddd72df0116fdc5acc2a3dd41196f868318c32f36e01630c96d3b0e7d9

                        SHA512

                        500eeaf5fc8344825fedd624e42f4e0e36b5716e0a1a223fc4778f380b1847699a353b05c8831583686a222385395a7f9f0ed7993b0cee50ab0befb5d145aca6

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\prefs-1.js

                        Filesize

                        11KB

                        MD5

                        0146d8ab758001e20244ff0608658162

                        SHA1

                        384e00fff450c3e32a2cbf4a873bd6339f68f724

                        SHA256

                        80be065b437e62e05213cd904bb93cc80a3ea8429a08b654fe50da4883ac6549

                        SHA512

                        02eab0996fb2c45b934684751d657f0e0d1ff1b3a52868414201423ee854687d74772d21cd31989f1b497a14a41ead695661aae31d0c4ea5137316ba759f9dfb

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\prefs-1.js

                        Filesize

                        13KB

                        MD5

                        2e8b07ecc3a7b8519efe6012c673238e

                        SHA1

                        b773d448f7fecea3c35e87c304de66a1d5ada51f

                        SHA256

                        4d99b434a958fba0f7f16744180e11dbe45c2113b848a4aa98b8f145f521b111

                        SHA512

                        fd93ecd3915fba1a776c899f6a4db9673b69a7057b6a4e94328bf5712d2a2368b92416b79fa025ade3dcda3aa8bac20d2392195e78c3f70036aa7eec10af62c0

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\prefs.js

                        Filesize

                        10KB

                        MD5

                        63e62f0a11ee11b3a500da3e4a03ccf1

                        SHA1

                        a1c1ca3e66a04545e5c2a25a3c635702cefa0ac7

                        SHA256

                        59ef6b272261ba1aed0f2c572231d0185481a289544ff5b617582d14d54707f7

                        SHA512

                        17d024320a9de65b44c92ad9e53a7d1896218c54d3a0cfa39e0c98ee22feeb7399db36c136fbde1b67becdf98f91ee8660bf8aa77f733d95a15046ca908b77a3

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

                        Filesize

                        1.3MB

                        MD5

                        58fe8717ec26e17249637c889a197bbd

                        SHA1

                        2b37fecff78e82eb16ec4de59c7e3b4875038e0d

                        SHA256

                        2107939574f9abe13350cf9b9099645dd68b85c5d26aaed49111183f802e95af

                        SHA512

                        47b287354f17dd0899c8b09f963b9a3423c7f62e5ebdd507392530bdb4b51f405c6c50074aed4fc1af19bef842ef25f2c427a8556c5419fc66ac7b64bb4d976c

                      • memory/1056-66-0x00000000006D0000-0x0000000000708000-memory.dmp

                        Filesize

                        224KB

                      • memory/1976-2663-0x0000000000260000-0x0000000000723000-memory.dmp

                        Filesize

                        4.8MB

                      • memory/1976-2664-0x0000000000260000-0x0000000000723000-memory.dmp

                        Filesize

                        4.8MB

                      • memory/2060-2121-0x0000000000260000-0x0000000000723000-memory.dmp

                        Filesize

                        4.8MB

                      • memory/2060-2050-0x0000000000260000-0x0000000000723000-memory.dmp

                        Filesize

                        4.8MB

                      • memory/2316-70-0x0000000000400000-0x0000000000643000-memory.dmp

                        Filesize

                        2.3MB

                      • memory/2316-87-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                        Filesize

                        972KB

                      • memory/2316-68-0x0000000000400000-0x0000000000643000-memory.dmp

                        Filesize

                        2.3MB

                      • memory/2340-0-0x00000000006E0000-0x0000000000BA3000-memory.dmp

                        Filesize

                        4.8MB

                      • memory/2340-4-0x00000000006E0000-0x0000000000BA3000-memory.dmp

                        Filesize

                        4.8MB

                      • memory/2340-17-0x00000000006E0000-0x0000000000BA3000-memory.dmp

                        Filesize

                        4.8MB

                      • memory/2340-1-0x0000000077246000-0x0000000077248000-memory.dmp

                        Filesize

                        8KB

                      • memory/2340-2-0x00000000006E1000-0x000000000070F000-memory.dmp

                        Filesize

                        184KB

                      • memory/2340-3-0x00000000006E0000-0x0000000000BA3000-memory.dmp

                        Filesize

                        4.8MB

                      • memory/2372-47-0x0000000000400000-0x000000000052D000-memory.dmp

                        Filesize

                        1.2MB

                      • memory/2372-43-0x0000000000400000-0x000000000052D000-memory.dmp

                        Filesize

                        1.2MB

                      • memory/2372-45-0x0000000000400000-0x000000000052D000-memory.dmp

                        Filesize

                        1.2MB

                      • memory/2452-86-0x00000000007A0000-0x00000000009E3000-memory.dmp

                        Filesize

                        2.3MB

                      • memory/2452-521-0x00000000007A0000-0x00000000009E3000-memory.dmp

                        Filesize

                        2.3MB

                      • memory/3440-18-0x0000000000260000-0x0000000000723000-memory.dmp

                        Filesize

                        4.8MB

                      • memory/3440-2647-0x0000000000260000-0x0000000000723000-memory.dmp

                        Filesize

                        4.8MB

                      • memory/3440-20-0x0000000000260000-0x0000000000723000-memory.dmp

                        Filesize

                        4.8MB

                      • memory/3440-526-0x0000000000260000-0x0000000000723000-memory.dmp

                        Filesize

                        4.8MB

                      • memory/3440-519-0x0000000000260000-0x0000000000723000-memory.dmp

                        Filesize

                        4.8MB

                      • memory/3440-520-0x0000000000260000-0x0000000000723000-memory.dmp

                        Filesize

                        4.8MB

                      • memory/3440-518-0x0000000000260000-0x0000000000723000-memory.dmp

                        Filesize

                        4.8MB

                      • memory/3440-1265-0x0000000000260000-0x0000000000723000-memory.dmp

                        Filesize

                        4.8MB

                      • memory/3440-21-0x0000000000260000-0x0000000000723000-memory.dmp

                        Filesize

                        4.8MB

                      • memory/3440-2673-0x0000000000260000-0x0000000000723000-memory.dmp

                        Filesize

                        4.8MB

                      • memory/3440-2645-0x0000000000260000-0x0000000000723000-memory.dmp

                        Filesize

                        4.8MB

                      • memory/3440-19-0x0000000000260000-0x0000000000723000-memory.dmp

                        Filesize

                        4.8MB

                      • memory/3440-2657-0x0000000000260000-0x0000000000723000-memory.dmp

                        Filesize

                        4.8MB

                      • memory/3440-2659-0x0000000000260000-0x0000000000723000-memory.dmp

                        Filesize

                        4.8MB

                      • memory/3440-2660-0x0000000000260000-0x0000000000723000-memory.dmp

                        Filesize

                        4.8MB

                      • memory/3440-2661-0x0000000000260000-0x0000000000723000-memory.dmp

                        Filesize

                        4.8MB

                      • memory/3440-2672-0x0000000000260000-0x0000000000723000-memory.dmp

                        Filesize

                        4.8MB

                      • memory/3440-465-0x0000000000260000-0x0000000000723000-memory.dmp

                        Filesize

                        4.8MB

                      • memory/3440-2665-0x0000000000260000-0x0000000000723000-memory.dmp

                        Filesize

                        4.8MB

                      • memory/3440-2666-0x0000000000260000-0x0000000000723000-memory.dmp

                        Filesize

                        4.8MB

                      • memory/4276-41-0x00000000000C0000-0x00000000001F0000-memory.dmp

                        Filesize

                        1.2MB

                      • memory/4276-40-0x0000000072C0E000-0x0000000072C0F000-memory.dmp

                        Filesize

                        4KB