Analysis

  • max time kernel
    300s
  • max time network
    298s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    12-08-2024 05:06

General

  • Target

    b7f96c69f3ea24af265a57bb9a8799a3501e06b2551ff170d768cf5949344b4e.exe

  • Size

    1.8MB

  • MD5

    71a0c8fa3b7166ee00b2871ab257049e

  • SHA1

    a10d5aa83d11a6a1f661ef5422e8d5455791e897

  • SHA256

    b7f96c69f3ea24af265a57bb9a8799a3501e06b2551ff170d768cf5949344b4e

  • SHA512

    aa95eb6e6aa71fb298babcc9a97cfaf55c3dcd7fd607acafd550a03d21365e0367c89d1da3f41cb26d68a6ef5131e761d1d67b9022cbd1cf599136e25013ca95

  • SSDEEP

    24576:U015/xtUjxORnKVliMwoqgPD0rskl7qVfJqkHLsF5fcCmn7oB2I/tyYtCuhHjUVP:71dtKVliM4AMzYV8kHLw2n8fFycZSS6

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

0657d1

C2

http://185.215.113.19

Attributes
  • install_dir

    0d8f5eb8a7

  • install_file

    explorti.exe

  • strings_key

    6c55a5f34bb433fbd933a168577b1838

  • url_paths

    /Vi9leo/index.php

rc4.plain

Extracted

Family

stealc

Botnet

kora

C2

http://185.215.113.100

Attributes
  • url_path

    /e2b1563c6670f193.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Stealc

    Stealc is an infostealer written in C++.

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 14 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 9 IoCs
  • Identifies Wine through registry keys 2 TTPs 7 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • AutoIT Executable 3 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 5 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\b7f96c69f3ea24af265a57bb9a8799a3501e06b2551ff170d768cf5949344b4e.exe
    "C:\Users\Admin\AppData\Local\Temp\b7f96c69f3ea24af265a57bb9a8799a3501e06b2551ff170d768cf5949344b4e.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2948
    • C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
      "C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:5088
      • C:\Users\Admin\AppData\Local\Temp\1000036001\fc90da749b.exe
        "C:\Users\Admin\AppData\Local\Temp\1000036001\fc90da749b.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4856
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:960
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:424
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
              6⤵
              • Checks processor information in registry
              • Modifies registry class
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:4200
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4200.0.1235524689\1194870533" -parentBuildID 20221007134813 -prefsHandle 1704 -prefMapHandle 1696 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c6528481-4215-4e95-a46e-1b0112c47629} 4200 "\\.\pipe\gecko-crash-server-pipe.4200" 1792 27eb75eea58 gpu
                7⤵
                  PID:4152
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4200.1.733413856\1406890073" -parentBuildID 20221007134813 -prefsHandle 2156 -prefMapHandle 2152 -prefsLen 21608 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {33be0bf5-9ef8-42fd-99c9-b9a7cccb6b6d} 4200 "\\.\pipe\gecko-crash-server-pipe.4200" 2168 27ea5373958 socket
                  7⤵
                    PID:4636
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4200.2.1767867523\1982242420" -childID 1 -isForBrowser -prefsHandle 1536 -prefMapHandle 2712 -prefsLen 21711 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {335dd2c9-88ec-42cc-9966-8ebf839bd5d4} 4200 "\\.\pipe\gecko-crash-server-pipe.4200" 2992 27ebb4f5158 tab
                    7⤵
                      PID:1520
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4200.3.1889977537\1194354767" -childID 2 -isForBrowser -prefsHandle 3596 -prefMapHandle 3592 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c5219606-5846-4509-878c-49ccb0f00bc4} 4200 "\\.\pipe\gecko-crash-server-pipe.4200" 3608 27ea536d558 tab
                      7⤵
                        PID:2496
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4200.4.1771439312\472159204" -childID 3 -isForBrowser -prefsHandle 4840 -prefMapHandle 4820 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f3954df5-3dbe-4dd7-9451-d5c6dcbaf55c} 4200 "\\.\pipe\gecko-crash-server-pipe.4200" 4424 27ebeb3cd58 tab
                        7⤵
                          PID:600
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4200.5.432700353\1618554730" -childID 4 -isForBrowser -prefsHandle 4592 -prefMapHandle 4808 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d5fd5b88-2943-417e-8938-4cbac4a8631e} 4200 "\\.\pipe\gecko-crash-server-pipe.4200" 4964 27ebebf5258 tab
                          7⤵
                            PID:5044
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4200.6.152620598\667972772" -childID 5 -isForBrowser -prefsHandle 5152 -prefMapHandle 5144 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ba435a13-7c9f-442d-b73d-6570a2e87b5a} 4200 "\\.\pipe\gecko-crash-server-pipe.4200" 5252 27ebebf6458 tab
                            7⤵
                              PID:4548
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4200.7.779975920\1308443175" -childID 6 -isForBrowser -prefsHandle 5524 -prefMapHandle 5508 -prefsLen 26424 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1132ca02-d492-42b4-90c5-3eb301dfa384} 4200 "\\.\pipe\gecko-crash-server-pipe.4200" 5532 27ea5b75b58 tab
                              7⤵
                                PID:4620
                      • C:\Users\Admin\1000037002\6951581cab.exe
                        "C:\Users\Admin\1000037002\6951581cab.exe"
                        3⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of WriteProcessMemory
                        PID:1004
                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                          4⤵
                            PID:816
                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                            4⤵
                            • System Location Discovery: System Language Discovery
                            PID:3012
                        • C:\Users\Admin\AppData\Local\Temp\1000038001\66881af88e.exe
                          "C:\Users\Admin\AppData\Local\Temp\1000038001\66881af88e.exe"
                          3⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          PID:700
                    • C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                      C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                      1⤵
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • Suspicious behavior: EnumeratesProcesses
                      PID:2856
                    • C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                      C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                      1⤵
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • Suspicious behavior: EnumeratesProcesses
                      PID:4172
                    • C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                      C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                      1⤵
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • Suspicious behavior: EnumeratesProcesses
                      PID:4908
                    • C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                      C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                      1⤵
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • Suspicious behavior: EnumeratesProcesses
                      PID:4872
                    • C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                      C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                      1⤵
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • Suspicious behavior: EnumeratesProcesses
                      PID:756

                    Network

                    MITRE ATT&CK Enterprise v15

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Admin\1000037002\6951581cab.exe

                      Filesize

                      206KB

                      MD5

                      62c81eb8cd78dbcf5767f84caad6972e

                      SHA1

                      9a508e8724c1431394717ebd3c6dee2f9f21d082

                      SHA256

                      166a8fac98b553a4e3647cefc034fe826b753958c0be902d9483148edb001250

                      SHA512

                      2feaa6cb070e548790b01601fe13846cd7eb005e2f1b8441092f4f92a1e4cfea6c1bc84314f78ea023e10bec8e3d5712ca43336c090eed0073c7ed99ebbf5af5

                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\cache2\entries\037778A55E1B7E9BED3390289866D09402D6C913

                      Filesize

                      9KB

                      MD5

                      66199c92a4637c44a4bdb86b76361e93

                      SHA1

                      d945cadb7c07f55ad13af465dd7f19a9e0515230

                      SHA256

                      7e884e656cacf97b3a06837f08ddd2a13a71aacf15acbf2b253f6aecad6df15e

                      SHA512

                      98a6138f0c57ec3da030b59bcda8ea44636ea642851f4e0ee935ef0e652ae09054511dc6f5f73d598529bb2a91ec1d25494b6ef3b12d582d5e4ee8657fa0cba5

                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\cache2\entries\254256B27E0C48CF9B80B695F0B3B8CA84610495

                      Filesize

                      9KB

                      MD5

                      a118d2921ffc92e16490398822b967d1

                      SHA1

                      515e9976172e3712b4710851aae491f5249a4866

                      SHA256

                      3c6eabc084b5a0f9b0e517d5ead5da3d4ee85044b1e81ec4146bc82f85423b95

                      SHA512

                      2639a101e2181b23ecd726da8bbe070b25add4c8b10bf6b033c2451e9388e4891deada996998de150329b9c760f849644fbd252d70929b63a09df336cc264658

                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\cache2\entries\C72D4296C2EBC6FD41A9F780CD0C8F30F0FF937C

                      Filesize

                      13KB

                      MD5

                      384be794115f7b6da5b3e72105e7e5a0

                      SHA1

                      a834f6d87085493ff37577dacbcca819aaaf6e01

                      SHA256

                      d6ff4cfee6017733763b6c6b4d3a1a76faeb064c750ea1b36b5495473b07f39c

                      SHA512

                      847a023eca7b6b5cfce3311ce444f983d492f321312213a3835b932255eef57e6f660d22ff33e8e399d6d231e8ab13ef8c974f4a0bf12bb7ee08f952fde2767b

                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\cache2\entries\E449899591A9BC91DFBA673EC0589B51E541A88B

                      Filesize

                      13KB

                      MD5

                      8498a62f74d246eaf2fdaa17e8a18207

                      SHA1

                      2fe874ec0accbeba9d8c89fe315181baf992da9b

                      SHA256

                      43d0a399a3870fd22ad377d50b6a172c8d0af30530efdfc6f00d590eff323ef9

                      SHA512

                      010a3a1c188ac18b7dd504e6dde68a58c2170036501633138a91d479675c5f2477c819fbf84e693794fe2362fb3e586604bee6a5867819dc005119ec4fb4b1dc

                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\cache2\entries\F210D48319A1879FD1C5213FA010C613B99BA085

                      Filesize

                      11KB

                      MD5

                      3a79178a4ce6a44c2dd10d3d99a8adb0

                      SHA1

                      aae76f063586beef31ef70c7ce1341eddc5ff42b

                      SHA256

                      d832f5c845a3492cfcf70c797f350afa854fbc05e9a5d9591fc0c05eec8c2c46

                      SHA512

                      0c257fa3f206b8a003603037ffa15114d608b0cfa8b4033a62fd4799f48a75d92eb4ba22d463bc55ca9abdbc948c6229aa77fc3e97283f71de9c97d3600385cb

                    • C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

                      Filesize

                      1.8MB

                      MD5

                      71a0c8fa3b7166ee00b2871ab257049e

                      SHA1

                      a10d5aa83d11a6a1f661ef5422e8d5455791e897

                      SHA256

                      b7f96c69f3ea24af265a57bb9a8799a3501e06b2551ff170d768cf5949344b4e

                      SHA512

                      aa95eb6e6aa71fb298babcc9a97cfaf55c3dcd7fd607acafd550a03d21365e0367c89d1da3f41cb26d68a6ef5131e761d1d67b9022cbd1cf599136e25013ca95

                    • C:\Users\Admin\AppData\Local\Temp\1000036001\fc90da749b.exe

                      Filesize

                      1.2MB

                      MD5

                      db946418424011c782182c76ab8c179f

                      SHA1

                      d640d54d341cf6341bd434c9015d23d22156612a

                      SHA256

                      bfdffea79fd6126c2256fab3f3b0421ec9b3a77a618fc406cd0f2e7d4a38f04e

                      SHA512

                      a73c645fe96ff6e49207326af35635998af343d2aa5ddd5e8b2bbd2bcded52869d588bb8c69eb220593d3152be99812e3462b1b09deea80adcac30bed9ed8956

                    • C:\Users\Admin\AppData\Local\Temp\1000038001\66881af88e.exe

                      Filesize

                      187KB

                      MD5

                      278ee1426274818874556aa18fd02e3a

                      SHA1

                      185a2761330024dec52134df2c8388c461451acb

                      SHA256

                      37257ddb1a6f309a6e9d147b5fc2551a9cae3a0e52b191b18d9465bfcb5c18eb

                      SHA512

                      07ec6759af5b9a00d8371b9fd9b723012dd0a1614cfcc7cd51975a004f69ffb90083735e9a871a2aa0e8d28799beac53a4748f55f4dd1e7495bc7388ebf4d6a0

                    • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                      Filesize

                      442KB

                      MD5

                      85430baed3398695717b0263807cf97c

                      SHA1

                      fffbee923cea216f50fce5d54219a188a5100f41

                      SHA256

                      a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

                      SHA512

                      06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

                    • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                      Filesize

                      8.0MB

                      MD5

                      a01c5ecd6108350ae23d2cddf0e77c17

                      SHA1

                      c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

                      SHA256

                      345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

                      SHA512

                      b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

                    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

                      Filesize

                      7KB

                      MD5

                      6f539587efb0295f2f6ad892321d66dc

                      SHA1

                      5bb73d50166dfb983934d17f203f8d5965fe0f15

                      SHA256

                      a86e9ef027554c38f3899ced3a50e97d8ee6e2f68453fa47ef6da0c7eed89521

                      SHA512

                      db3b8c4f528a86bfb9698b88be34dd0441bff58d81d088deb287985be018ee6fad21565a107029aa151d6d5bdb5a6390b446f211d1ce9ca423a0ed344efedeb6

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\bookmarkbackups\bookmarks-2024-08-12_11_ynjabA+xcPNHPZU1gEyrew==.jsonlz4

                      Filesize

                      946B

                      MD5

                      bc3030c50bf86982219a2ef0685a4342

                      SHA1

                      f5959d9850ba5f1b0e7ac71cfa35550c0dfb6c85

                      SHA256

                      5e38cdcb2dda5e8038815eb31f05ec6bf9d4db0718af6443aa4247fb70d888d6

                      SHA512

                      7970c02c7a335c3b1ae73f9363fd3282f495ddb8238947af59828eca4c52345e5ed2801e2b766b86d13f1fd784629ea86dba711711cc0760fcd579e11c0dae8b

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\broadcast-listeners.json

                      Filesize

                      204B

                      MD5

                      72c95709e1a3b27919e13d28bbe8e8a2

                      SHA1

                      00892decbee63d627057730bfc0c6a4f13099ee4

                      SHA256

                      9cf589357fceea2f37cd1a925e5d33fd517a44d22a16c357f7fb5d4d187034aa

                      SHA512

                      613ca9dd2d12afe31fb2c4a8d9337eeecfb58dabaeaaba11404b9a736a4073dfd9b473ba27c1183d3cc91d5a9233a83dce5a135a81f755d978cea9e198209182

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\datareporting\glean\db\data.safe.bin

                      Filesize

                      2KB

                      MD5

                      4d18078e82ad394b935cfdfe0c9ecaaa

                      SHA1

                      f50706adc2082244e1d3e596e555e3e8a9276383

                      SHA256

                      d886464fa32613977e6573cedb5b6814a242c10f835285e8b6899f7c04e92651

                      SHA512

                      5ee9465b9f6209ffd35a998c8a12e6a839f0162e3c22efa39148d47155bb3e423a929c738685a62efc8d1eccf5fa6c9b8817fc7667901f812db4b9f4841c88a3

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\datareporting\glean\pending_pings\32237785-9316-47ab-ae5c-5a1f1d5238ca

                      Filesize

                      10KB

                      MD5

                      58ca6601139e083898eba1847dda8e0d

                      SHA1

                      b5b76461f4cecc67f86b06a96e06e4240d275f38

                      SHA256

                      ff773a394b03eac772e842b7ebd7c371100532348299e17c4ef530fbf3b04281

                      SHA512

                      27534d5f1fae7e68c19964ed9a6cf35ebaeb4203a9bda7adcb1eab980bd4d1067677f452b2378e995018fb54fe22870dac6690e74c47990414520282e4b3d2d4

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\datareporting\glean\pending_pings\edd0a9ae-dc48-4ee0-96f4-96f979df937b

                      Filesize

                      746B

                      MD5

                      c6714710acf80821405f4075b6175424

                      SHA1

                      2a0153d39b99d11ef3a79fb9365d113580f66d74

                      SHA256

                      a0f6af4878d2e42bd325e432340528490fad763b96701babf5413a7facae6fb0

                      SHA512

                      027f7afbb8bc56b7a77db6ed5502390fc3fc9ab913c20fc8ac274022b2aff242c5b77ba734381b56db12ed1eb307f21e4790ca3a601fd146b321c41209bb69be

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

                      Filesize

                      997KB

                      MD5

                      fe3355639648c417e8307c6d051e3e37

                      SHA1

                      f54602d4b4778da21bc97c7238fc66aa68c8ee34

                      SHA256

                      1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

                      SHA512

                      8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

                      Filesize

                      116B

                      MD5

                      3d33cdc0b3d281e67dd52e14435dd04f

                      SHA1

                      4db88689282fd4f9e9e6ab95fcbb23df6e6485db

                      SHA256

                      f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

                      SHA512

                      a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

                      Filesize

                      479B

                      MD5

                      49ddb419d96dceb9069018535fb2e2fc

                      SHA1

                      62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

                      SHA256

                      2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

                      SHA512

                      48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

                      Filesize

                      372B

                      MD5

                      8be33af717bb1b67fbd61c3f4b807e9e

                      SHA1

                      7cf17656d174d951957ff36810e874a134dd49e0

                      SHA256

                      e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

                      SHA512

                      6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

                      Filesize

                      11.8MB

                      MD5

                      33bf7b0439480effb9fb212efce87b13

                      SHA1

                      cee50f2745edc6dc291887b6075ca64d716f495a

                      SHA256

                      8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

                      SHA512

                      d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

                      Filesize

                      1KB

                      MD5

                      688bed3676d2104e7f17ae1cd2c59404

                      SHA1

                      952b2cdf783ac72fcb98338723e9afd38d47ad8e

                      SHA256

                      33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

                      SHA512

                      7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

                      Filesize

                      1KB

                      MD5

                      937326fead5fd401f6cca9118bd9ade9

                      SHA1

                      4526a57d4ae14ed29b37632c72aef3c408189d91

                      SHA256

                      68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

                      SHA512

                      b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\prefs-1.js

                      Filesize

                      7KB

                      MD5

                      b7baf4863569e669f541ad4ac2b00f20

                      SHA1

                      55746b9d4d5fafd642765d6a81660415d202d4a5

                      SHA256

                      e0a506b0d5fa38377641b34afc86d51a926465c995b3f2130157ad58b31d5a66

                      SHA512

                      c6c4cc89f71c7a1aa4e7dd8a2e660f3a8b329769bae41cc7903b04e3536debc32033f25d5dce7e372659abb85dceb9161c3b3d6959941d4e3250750d6ed78fb7

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\prefs-1.js

                      Filesize

                      6KB

                      MD5

                      678eeeea908ac1fc9f6e248a45233f8b

                      SHA1

                      fd46e63d1e79da85b190c6513d4a3127069c204c

                      SHA256

                      c7e4fb9491625129f461aaf0e9c3b4f6e82183a062f075efa63aa3d5d402bab6

                      SHA512

                      1dc8bf039821e4d8d9f268242d7b82c820368ee8d9bfafca10b06c013265010e2a476814a6e196bc02af693cce2b81861493b848e96d5cfbb230781936bb65de

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\prefs-1.js

                      Filesize

                      6KB

                      MD5

                      89763d273e6552c2612267d76f6dc7e8

                      SHA1

                      855100ac847f2c8127206d5c5d078ea328bbc6c0

                      SHA256

                      f38798ca745732133540780da9e5db95f5eeb848fe15261cd82cd49b8156336d

                      SHA512

                      fb7ae9acbb3cf40676ea97411fea1beace06ddbd21505e8f17069215a4bf8e78c3246fe926801a63d3f105b00fb7fac425b14a6e43d424ad7cd1da0e081a89bc

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\prefs-1.js

                      Filesize

                      7KB

                      MD5

                      ef6ef5a2a60562597a4f7d665853f5b3

                      SHA1

                      897da8a22e65120a4dbc42dad6d039cdcb15dcb5

                      SHA256

                      ae73710450166bfcc8362ba82becb926f27880ccd1813d0b6112cad7358beca1

                      SHA512

                      de8201e1d25e8abdc5de8eb64fbd57f26ce8be0fba0f12c3f9ed9acc908dc9d21fafe1251c9b7bc985ee6430e1e96087da1dd73a98c5745918fd8d4315f326fd

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\sessionCheckpoints.json

                      Filesize

                      90B

                      MD5

                      c4ab2ee59ca41b6d6a6ea911f35bdc00

                      SHA1

                      5942cd6505fc8a9daba403b082067e1cdefdfbc4

                      SHA256

                      00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2

                      SHA512

                      71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\sessionstore-backups\recovery.jsonlz4

                      Filesize

                      4KB

                      MD5

                      52e7da06db3b6544d4ebd0f1934bebcf

                      SHA1

                      cb953386e10950e68b07780add4e4932a91a0ecc

                      SHA256

                      f0ba35fc514dbb8ecd7e9ef8eaec69e6b57d02251ebb11072e566daa0271b511

                      SHA512

                      ca7b21c9eaef94a6eda8eb451dcdbd82a8d90f99400ce3292232c67ae1fe5a7a2617520af4b541b6e50e001ff67e238cb97d89ad4c878c897b4dbe883098f6b4

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

                      Filesize

                      184KB

                      MD5

                      a4627d94b477e3f653435fcf27e2663d

                      SHA1

                      d5dc31c0165277e469d92453c556786995e2800d

                      SHA256

                      7c1ea6cee0386d6af3cb7523167c2b880592657ceacc4e56edbc2394575c5c69

                      SHA512

                      7619d8f8f790c6b47faa75eb3f834640fe6ab684209f2eeb6eff26017c7ebb44972018463bb15d0e7955bed5bde4ebff809754b3c2057d7749bafe82dbe48455

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\targeting.snapshot.json

                      Filesize

                      3KB

                      MD5

                      21455d005122849a866a7fe5f780fe3e

                      SHA1

                      65338e1b19a1a15990c94ad9286a0fac0e3daffc

                      SHA256

                      bb4ded9e635967a4ca63dad0f134e7ed7accd9d7cf11318250865796acca24ec

                      SHA512

                      38a70dbba5cf72f026b51b03741ebc7400830cc3b48070f70b9839c5c7165c944b37934e92397f5068f68bdf3ba6df35d0ea35d579cee1e01aeb14a948ad4efc

                    • memory/700-68-0x0000000000290000-0x00000000004D3000-memory.dmp

                      Filesize

                      2.3MB

                    • memory/700-67-0x0000000000290000-0x00000000004D3000-memory.dmp

                      Filesize

                      2.3MB

                    • memory/756-423-0x0000000001250000-0x000000000170F000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/756-424-0x0000000001250000-0x000000000170F000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/960-35-0x0000000000400000-0x000000000052D000-memory.dmp

                      Filesize

                      1.2MB

                    • memory/960-37-0x0000000000400000-0x000000000052D000-memory.dmp

                      Filesize

                      1.2MB

                    • memory/960-33-0x0000000000400000-0x000000000052D000-memory.dmp

                      Filesize

                      1.2MB

                    • memory/1004-50-0x0000000000110000-0x0000000000148000-memory.dmp

                      Filesize

                      224KB

                    • memory/2856-305-0x0000000001250000-0x000000000170F000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/2856-304-0x0000000001250000-0x000000000170F000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/2948-14-0x0000000000390000-0x000000000084F000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/2948-2-0x0000000000391000-0x00000000003BF000-memory.dmp

                      Filesize

                      184KB

                    • memory/2948-1-0x0000000077114000-0x0000000077115000-memory.dmp

                      Filesize

                      4KB

                    • memory/2948-3-0x0000000000390000-0x000000000084F000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/2948-0-0x0000000000390000-0x000000000084F000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/2948-5-0x0000000000390000-0x000000000084F000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/3012-54-0x0000000000400000-0x0000000000643000-memory.dmp

                      Filesize

                      2.3MB

                    • memory/3012-52-0x0000000000400000-0x0000000000643000-memory.dmp

                      Filesize

                      2.3MB

                    • memory/4172-319-0x0000000001250000-0x000000000170F000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/4172-317-0x0000000001250000-0x000000000170F000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/4856-31-0x00000000009D0000-0x0000000000B00000-memory.dmp

                      Filesize

                      1.2MB

                    • memory/4872-394-0x0000000001250000-0x000000000170F000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/4872-393-0x0000000001250000-0x000000000170F000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/4908-338-0x0000000001250000-0x000000000170F000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/4908-337-0x0000000001250000-0x000000000170F000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/5088-299-0x0000000001250000-0x000000000170F000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/5088-320-0x0000000001250000-0x000000000170F000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/5088-326-0x0000000001250000-0x000000000170F000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/5088-327-0x0000000001250000-0x000000000170F000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/5088-328-0x0000000001250000-0x000000000170F000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/5088-334-0x0000000001250000-0x000000000170F000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/5088-335-0x0000000001250000-0x000000000170F000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/5088-315-0x0000000001250000-0x000000000170F000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/5088-314-0x0000000001250000-0x000000000170F000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/5088-339-0x0000000001250000-0x000000000170F000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/5088-340-0x0000000001250000-0x000000000170F000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/5088-341-0x0000000001250000-0x000000000170F000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/5088-342-0x0000000001250000-0x000000000170F000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/5088-343-0x0000000001250000-0x000000000170F000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/5088-313-0x0000000001250000-0x000000000170F000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/5088-312-0x0000000001250000-0x000000000170F000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/5088-311-0x0000000001250000-0x000000000170F000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/5088-306-0x0000000001250000-0x000000000170F000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/5088-301-0x0000000001250000-0x000000000170F000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/5088-222-0x0000000001250000-0x000000000170F000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/5088-215-0x0000000001250000-0x000000000170F000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/5088-212-0x0000000001250000-0x000000000170F000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/5088-205-0x0000000001250000-0x000000000170F000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/5088-391-0x0000000001250000-0x000000000170F000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/5088-202-0x0000000001250000-0x000000000170F000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/5088-197-0x0000000001250000-0x000000000170F000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/5088-395-0x0000000001250000-0x000000000170F000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/5088-18-0x0000000001250000-0x000000000170F000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/5088-406-0x0000000001250000-0x000000000170F000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/5088-407-0x0000000001250000-0x000000000170F000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/5088-408-0x0000000001250000-0x000000000170F000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/5088-413-0x0000000001250000-0x000000000170F000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/5088-17-0x0000000001250000-0x000000000170F000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/5088-421-0x0000000001250000-0x000000000170F000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/5088-16-0x0000000001251000-0x000000000127F000-memory.dmp

                      Filesize

                      184KB

                    • memory/5088-15-0x0000000001250000-0x000000000170F000-memory.dmp

                      Filesize

                      4.7MB