Analysis

  • max time kernel
    150s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12-08-2024 10:21

General

  • Target

    2c308b17b9a74b604bb0ca961e755e1a05cdeb8b7368ccf770d385bfa33a9510.exe

  • Size

    1.8MB

  • MD5

    c9fa55d8572cf366bdfa9013244a191e

  • SHA1

    94289da9815d1d2f4fe372a5f3295c23e13009f6

  • SHA256

    2c308b17b9a74b604bb0ca961e755e1a05cdeb8b7368ccf770d385bfa33a9510

  • SHA512

    156bc7fcbf891341759fcc463045c4a6ca52d1aa9c5cd8c5b89f7a6f471f044ca54d0ab23dc4e85cb031a3ca4ec4488651b14843a79e714e4af87427f8d55215

  • SSDEEP

    49152:h58Y6LRy9vKJb5dHjee1izISXYGSQoUKmykA:ht6315dHSe1inXYGSZUKm1A

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

0657d1

C2

http://185.215.113.19

Attributes
  • install_dir

    0d8f5eb8a7

  • install_file

    explorti.exe

  • strings_key

    6c55a5f34bb433fbd933a168577b1838

  • url_paths

    /Vi9leo/index.php

rc4.plain

Extracted

Family

stealc

Botnet

kora

C2

http://185.215.113.100

Attributes
  • url_path

    /e2b1563c6670f193.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Stealc

    Stealc is an infostealer written in C++.

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 10 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 7 IoCs
  • Identifies Wine through registry keys 2 TTPs 5 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • AutoIT Executable 3 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\2c308b17b9a74b604bb0ca961e755e1a05cdeb8b7368ccf770d385bfa33a9510.exe
    "C:\Users\Admin\AppData\Local\Temp\2c308b17b9a74b604bb0ca961e755e1a05cdeb8b7368ccf770d385bfa33a9510.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:712
    • C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
      "C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:5084
      • C:\Users\Admin\AppData\Local\Temp\1000036001\4dde3e6fff.exe
        "C:\Users\Admin\AppData\Local\Temp\1000036001\4dde3e6fff.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3432
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          4⤵
            PID:2176
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
            4⤵
            • Checks computer location settings
            • System Location Discovery: System Language Discovery
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of WriteProcessMemory
            PID:3776
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:4912
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
                6⤵
                • Checks processor information in registry
                • Modifies registry class
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:2496
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2028 -parentBuildID 20240401114208 -prefsHandle 1956 -prefMapHandle 1948 -prefsLen 23602 -prefMapSize 244628 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4b54f575-1201-411b-9461-cda26e7bbce8} 2496 "\\.\pipe\gecko-crash-server-pipe.2496" gpu
                  7⤵
                    PID:668
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2464 -parentBuildID 20240401114208 -prefsHandle 2456 -prefMapHandle 2444 -prefsLen 24522 -prefMapSize 244628 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {27b50145-2fcc-4790-ad1a-c6a30b4635ae} 2496 "\\.\pipe\gecko-crash-server-pipe.2496" socket
                    7⤵
                      PID:4396
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3268 -childID 1 -isForBrowser -prefsHandle 3016 -prefMapHandle 2972 -prefsLen 22590 -prefMapSize 244628 -jsInitHandle 1076 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4e6b501a-a10b-48ef-88f2-81902757bb10} 2496 "\\.\pipe\gecko-crash-server-pipe.2496" tab
                      7⤵
                        PID:3912
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4100 -childID 2 -isForBrowser -prefsHandle 4028 -prefMapHandle 3972 -prefsLen 29012 -prefMapSize 244628 -jsInitHandle 1076 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {397ace17-646a-4d91-b450-5e0b5ba4636a} 2496 "\\.\pipe\gecko-crash-server-pipe.2496" tab
                        7⤵
                          PID:1352
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4716 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4692 -prefMapHandle 4672 -prefsLen 29012 -prefMapSize 244628 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3fc489fa-7201-41f0-ae7c-33a0c2739808} 2496 "\\.\pipe\gecko-crash-server-pipe.2496" utility
                          7⤵
                          • Checks processor information in registry
                          PID:5396
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5300 -childID 3 -isForBrowser -prefsHandle 5080 -prefMapHandle 5248 -prefsLen 26882 -prefMapSize 244628 -jsInitHandle 1076 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ef207620-156b-4808-8b29-97bce48bf716} 2496 "\\.\pipe\gecko-crash-server-pipe.2496" tab
                          7⤵
                            PID:5796
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5424 -childID 4 -isForBrowser -prefsHandle 5500 -prefMapHandle 5496 -prefsLen 26882 -prefMapSize 244628 -jsInitHandle 1076 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2a457740-59a0-4350-a3ff-0d426ab7d0c8} 2496 "\\.\pipe\gecko-crash-server-pipe.2496" tab
                            7⤵
                              PID:5808
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5500 -childID 5 -isForBrowser -prefsHandle 5668 -prefMapHandle 5672 -prefsLen 26882 -prefMapSize 244628 -jsInitHandle 1076 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {720683c4-ea5a-4fe3-b659-b5e6f9b1c452} 2496 "\\.\pipe\gecko-crash-server-pipe.2496" tab
                              7⤵
                                PID:5844
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6256 -childID 6 -isForBrowser -prefsHandle 6236 -prefMapHandle 6252 -prefsLen 27039 -prefMapSize 244628 -jsInitHandle 1076 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e64f4efe-0291-40c7-bcc6-f79d8402e263} 2496 "\\.\pipe\gecko-crash-server-pipe.2496" tab
                                7⤵
                                  PID:4576
                        • C:\Users\Admin\1000037002\c861ede2eb.exe
                          "C:\Users\Admin\1000037002\c861ede2eb.exe"
                          3⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of WriteProcessMemory
                          PID:3716
                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                            4⤵
                            • System Location Discovery: System Language Discovery
                            PID:2716
                        • C:\Users\Admin\AppData\Local\Temp\1000038001\7443a7e688.exe
                          "C:\Users\Admin\AppData\Local\Temp\1000038001\7443a7e688.exe"
                          3⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          PID:2312
                    • C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                      C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                      1⤵
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • Suspicious behavior: EnumeratesProcesses
                      PID:5756
                    • C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                      C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                      1⤵
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • Suspicious behavior: EnumeratesProcesses
                      PID:4012
                    • C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                      C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                      1⤵
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • Suspicious behavior: EnumeratesProcesses
                      PID:4792

                    Network

                    MITRE ATT&CK Enterprise v15

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Admin\1000037002\c861ede2eb.exe

                      Filesize

                      206KB

                      MD5

                      75990096077c1eb9c1da28255e8c6beb

                      SHA1

                      522618e1fb7e5c96fd580658b60dbcf99b0355b4

                      SHA256

                      d7b867a7cbf5c2ff477ca1baa1d6d437d5798c4d65a862ebd54f85529346b4c6

                      SHA512

                      de79349cc9eef97c02bc2ae88f61c8f001573f635b1d6be783cda52366924bda21d3ba5feb3533f5652fb0138ef64a0ea40ca7ac7537193d220d4b5588e3b7b1

                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yaq795em.default-release\cache2\entries\E449899591A9BC91DFBA673EC0589B51E541A88B

                      Filesize

                      13KB

                      MD5

                      5f8d42f6018685378f245284733c403a

                      SHA1

                      ce66a0290e59cce8d98fcdb6b34a27494e2cbd05

                      SHA256

                      ce3cc7a60aab3823251705b77e7a81fa4cfa3a546b7432f7e10f2b386c4e1dfd

                      SHA512

                      2e1944b81745952fffcaa213190dbf16b1b1b90b9c7abee94a38410b081b4e49f1820fa3b9726c29b4ceecd7e8730cf590e9886d46a4ba71e69f83a010401d74

                    • C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

                      Filesize

                      1.8MB

                      MD5

                      c9fa55d8572cf366bdfa9013244a191e

                      SHA1

                      94289da9815d1d2f4fe372a5f3295c23e13009f6

                      SHA256

                      2c308b17b9a74b604bb0ca961e755e1a05cdeb8b7368ccf770d385bfa33a9510

                      SHA512

                      156bc7fcbf891341759fcc463045c4a6ca52d1aa9c5cd8c5b89f7a6f471f044ca54d0ab23dc4e85cb031a3ca4ec4488651b14843a79e714e4af87427f8d55215

                    • C:\Users\Admin\AppData\Local\Temp\1000036001\4dde3e6fff.exe

                      Filesize

                      1.2MB

                      MD5

                      531502fd99b86924df6c84ed89331e38

                      SHA1

                      384b4fc4f639da0138bdcda682a3e0dda2345525

                      SHA256

                      ad9949bf0e2984d16e62a3093eb3bd63d97bde59fd5084ce41d64089294e9b7a

                      SHA512

                      ef596856a3d15972cc029209d0f76d6615cad3395413a3266a44ff2628c8711a14c1bf0074c6edb16475d246ed08f2c3b772a59d13347fe11d834ea440e73b57

                    • C:\Users\Admin\AppData\Local\Temp\1000038001\7443a7e688.exe

                      Filesize

                      187KB

                      MD5

                      278ee1426274818874556aa18fd02e3a

                      SHA1

                      185a2761330024dec52134df2c8388c461451acb

                      SHA256

                      37257ddb1a6f309a6e9d147b5fc2551a9cae3a0e52b191b18d9465bfcb5c18eb

                      SHA512

                      07ec6759af5b9a00d8371b9fd9b723012dd0a1614cfcc7cd51975a004f69ffb90083735e9a871a2aa0e8d28799beac53a4748f55f4dd1e7495bc7388ebf4d6a0

                    • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                      Filesize

                      479KB

                      MD5

                      09372174e83dbbf696ee732fd2e875bb

                      SHA1

                      ba360186ba650a769f9303f48b7200fb5eaccee1

                      SHA256

                      c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                      SHA512

                      b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                    • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                      Filesize

                      13.8MB

                      MD5

                      0a8747a2ac9ac08ae9508f36c6d75692

                      SHA1

                      b287a96fd6cc12433adb42193dfe06111c38eaf0

                      SHA256

                      32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                      SHA512

                      59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\AlternateServices.bin

                      Filesize

                      8KB

                      MD5

                      9c00a385bbddab80d5cc4efd85b79791

                      SHA1

                      678aad4c98d6a59a3022823e7f9e65d158578921

                      SHA256

                      d1e8c3f2bf5e96b3f0a1202182f9bca1fbfaf2c881661fc34ef4d47ca6e74223

                      SHA512

                      c0246429e2e94659d03a3aeb10f3b273ea61c6e84545198741dce43a1615249daccb620f2e4d8e64a7bf31035ba852c1a1e1566acd026269697262d84d261ea2

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\AlternateServices.bin

                      Filesize

                      11KB

                      MD5

                      59385628c47bc40dda889355d375ed82

                      SHA1

                      692a45606a08da9fb07ab3ca3e8ba5cc688e7064

                      SHA256

                      9855283f093f47c163e316380cd95f5cb733040eaa9c5fb783ffafab0d8b0f91

                      SHA512

                      2963c0e89b4bbfce3904642538c5d1d8bda47513e328953842b457574d760470b5707e2f700eafad6d8fa44ac7597bcac1d9a2f60961c790efd1a861da89da35

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\datareporting\glean\db\data.safe.tmp

                      Filesize

                      5KB

                      MD5

                      efd964ebfb0201b9ef8085c990955318

                      SHA1

                      8388c68829327137c5385c86ec7d3f33f5dda7c7

                      SHA256

                      1faaaec1a15c33ac1a4bf6397fcc5fd913caed2959d968be5e4b6a9d763bc921

                      SHA512

                      e380f0f70d65f4417aaea0d4b1359bc58f4a176847a75ccbe73dfd963eb3d6b3117ef7b0dedf919c365049cb4e74b29cd3eca2504317814f1d163d90f6f1c17e

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\datareporting\glean\db\data.safe.tmp

                      Filesize

                      16KB

                      MD5

                      3e19748ef280ab99505f2ba404c0e696

                      SHA1

                      136103167e2882595b050111d7c220cf7fc1d6cb

                      SHA256

                      27563ea7cc234ca5650cab15bc397d67c04acbe071b16665474a6a08fcf8c08d

                      SHA512

                      89df0ad427a5996410856e29d5fddcde97ea0e99872f6cdf14e86b3f0964e7dd694ff11476d48deb44a6a7da7e767c6304ba003a04de9d7e0857340a594accdb

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\datareporting\glean\db\data.safe.tmp

                      Filesize

                      16KB

                      MD5

                      a8e25ee6e85c0b93cf0a8628776c3412

                      SHA1

                      c6fb3d54e45d76aa1574f0af6e51b9c1638a147c

                      SHA256

                      c987f4f67ab406853b7b38003ab47549aa88270991fca2c45918b048e221dab9

                      SHA512

                      1ed489a09306a238686c9ea00bb476b0279bd1fb85a4a05bc7328ff69772456881c6d92bc6f57732f3365543160ef659862a0b6858e5c656735fd7add298b903

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\datareporting\glean\pending_pings\105dfdbf-076a-45d9-a827-45708355a662

                      Filesize

                      671B

                      MD5

                      6db4cec707effebbb15f363ed9d4909d

                      SHA1

                      642a1ed864d4750441f85d919bb3a16a4912cb92

                      SHA256

                      3aeb433126fd5fe7009b3c604bb15c44ef913f655d71b55100cd2f0c5fe2a638

                      SHA512

                      8b41f1978e6c28a6e94957b51409593fea145844ac68c15d19a171dc0028f1c8847c2f05a9120a887c628e281e0b149be1d9901652b4ba75ffe4225bb3aaffc0

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\datareporting\glean\pending_pings\7ee70754-ccae-49c8-b38e-c7e39b0dc881

                      Filesize

                      982B

                      MD5

                      8905141981344c01934d1e0ba46f3eb4

                      SHA1

                      ce31a65f22490729faa5a7463ff05ffee28ae7fa

                      SHA256

                      741ec953bd332a6c1930a5a99be64aa0d79fedbb1460b8f81638a3055be83efc

                      SHA512

                      eedc0cfd6f8464556d703f95629162f3a87ea4cab3f36f4c6137b4fd63932b54f7f2937e81242b313cbef6b2ce9ebd6b2dca340ac92cb7e57fbcc94ebb3c034e

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\datareporting\glean\pending_pings\8609bc97-356f-4c8b-a232-92c21c8f251d

                      Filesize

                      27KB

                      MD5

                      f4f3885135b1b4dbb0910d68842afb96

                      SHA1

                      5d0069c92cd6ae89df21e5462161fc0d65b6da28

                      SHA256

                      f664406b18514ab527e5a9e6d748f763155f371bae1b467629e120ba0c4b6f12

                      SHA512

                      dde32c5aa030b676cd24ab2f3ba0b557b7c8285903f7c5a35e0280e4159a92f9af1765f718e12fd9d56cbb17ae2de7bea8743c7dabecb4894e5d2ffd8630211c

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

                      Filesize

                      1.1MB

                      MD5

                      842039753bf41fa5e11b3a1383061a87

                      SHA1

                      3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                      SHA256

                      d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                      SHA512

                      d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

                      Filesize

                      116B

                      MD5

                      2a461e9eb87fd1955cea740a3444ee7a

                      SHA1

                      b10755914c713f5a4677494dbe8a686ed458c3c5

                      SHA256

                      4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                      SHA512

                      34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

                      Filesize

                      372B

                      MD5

                      bf957ad58b55f64219ab3f793e374316

                      SHA1

                      a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                      SHA256

                      bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                      SHA512

                      79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

                      Filesize

                      17.8MB

                      MD5

                      daf7ef3acccab478aaa7d6dc1c60f865

                      SHA1

                      f8246162b97ce4a945feced27b6ea114366ff2ad

                      SHA256

                      bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                      SHA512

                      5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\prefs-1.js

                      Filesize

                      16KB

                      MD5

                      327069a1d55bb9b1ab28e8145741140b

                      SHA1

                      cafe5269a431b7142bf00274c09db6caa23ca7a7

                      SHA256

                      4fb38cef10202d70eb8b9c1a8b38701cb5f6b03a6f9763ae542ea1307fbed49a

                      SHA512

                      3faac7de199b8c375b2f64e790c040d100a1817999369b77bc707fdfe5b29569ae122d36b4abdebdeed820c12ee21509e1f3c904cb97e326489ce8a9d5a6dc6a

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\prefs-1.js

                      Filesize

                      15KB

                      MD5

                      0f4108178ce2cd7bcc2baea935d63b71

                      SHA1

                      672bcf6aa9d6ffcdebb4d2ca6b0e1e6d8136d4c4

                      SHA256

                      b4ac1e347155de0a7b34eb6093f8877b6cdc98c257c8e3ac77186fc874b12e92

                      SHA512

                      0eef78fc02530e088b329bb7abe2e229b80745bc9bee2778a7f280b11ff8d120c289229b6a52c2138ea7a5f60b5a33aee8ed438297862323fbd28974d0ae1c17

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\prefs-1.js

                      Filesize

                      12KB

                      MD5

                      9799303e04fcf3eb2516b51bf621044b

                      SHA1

                      ce04020fb8004d646808c113235d1f2d5b33619a

                      SHA256

                      4af08213073abb52fa5bbfe9ecf21314dab7546bd932beecf2c15a6b23208aaf

                      SHA512

                      4a8584a42066743aa8dcd5969cf41bbdaa78124cb110df03325076bde66f44ec8a3be1f47639229cf043d909d11247624b6daefa2dbc52ad5c111c52e6148c54

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\prefs.js

                      Filesize

                      11KB

                      MD5

                      e95d543ff3ac19eb976c173d980f7b66

                      SHA1

                      b315fe367eb9f6c49482662e4160df2d67ede680

                      SHA256

                      1ef84be5401374b8b731dbbc21abd2b2b83b74a03f638c44b18e1291a8a56426

                      SHA512

                      3a8cdc617c805621eea7829ee15a5c838bf956d7e9bd464cef995a29aed78802dbb8aec39a466468c10ea7ee6baf9aa56b4c21d8bda44d27ef73c8da5df59752

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

                      Filesize

                      1.4MB

                      MD5

                      93f5fc7d2c19ce3e83fd3d643a446388

                      SHA1

                      5482cf6a44cac0819b8841c4604512e3d1ca3845

                      SHA256

                      3700f28dcc63b34ad1c15fb3259d5df6d99b9c205b617499f1a6037c766b8adb

                      SHA512

                      c0b4465845b1c404a0ca597d0b945970c51fd7ff92045466371c47ddcd7853327ca36df7593f5465159efac08d59ccfc92d50bf649a317820cb7d28d4193fe88

                    • memory/712-1-0x0000000077D64000-0x0000000077D66000-memory.dmp

                      Filesize

                      8KB

                    • memory/712-2-0x0000000000C11000-0x0000000000C3F000-memory.dmp

                      Filesize

                      184KB

                    • memory/712-3-0x0000000000C10000-0x00000000010B6000-memory.dmp

                      Filesize

                      4.6MB

                    • memory/712-0-0x0000000000C10000-0x00000000010B6000-memory.dmp

                      Filesize

                      4.6MB

                    • memory/712-4-0x0000000000C10000-0x00000000010B6000-memory.dmp

                      Filesize

                      4.6MB

                    • memory/712-17-0x0000000000C10000-0x00000000010B6000-memory.dmp

                      Filesize

                      4.6MB

                    • memory/2312-88-0x0000000000BC0000-0x0000000000E03000-memory.dmp

                      Filesize

                      2.3MB

                    • memory/2312-87-0x0000000000BC0000-0x0000000000E03000-memory.dmp

                      Filesize

                      2.3MB

                    • memory/2716-71-0x0000000000400000-0x0000000000643000-memory.dmp

                      Filesize

                      2.3MB

                    • memory/2716-69-0x0000000000400000-0x0000000000643000-memory.dmp

                      Filesize

                      2.3MB

                    • memory/3432-42-0x0000000000250000-0x0000000000380000-memory.dmp

                      Filesize

                      1.2MB

                    • memory/3432-41-0x000000007397E000-0x000000007397F000-memory.dmp

                      Filesize

                      4KB

                    • memory/3716-67-0x00000000009D0000-0x0000000000A08000-memory.dmp

                      Filesize

                      224KB

                    • memory/3776-46-0x0000000000400000-0x000000000052D000-memory.dmp

                      Filesize

                      1.2MB

                    • memory/3776-48-0x0000000000400000-0x000000000052D000-memory.dmp

                      Filesize

                      1.2MB

                    • memory/3776-44-0x0000000000400000-0x000000000052D000-memory.dmp

                      Filesize

                      1.2MB

                    • memory/4012-2648-0x00000000006B0000-0x0000000000B56000-memory.dmp

                      Filesize

                      4.6MB

                    • memory/4012-2647-0x00000000006B0000-0x0000000000B56000-memory.dmp

                      Filesize

                      4.6MB

                    • memory/4792-2855-0x00000000006B0000-0x0000000000B56000-memory.dmp

                      Filesize

                      4.6MB

                    • memory/4792-2853-0x00000000006B0000-0x0000000000B56000-memory.dmp

                      Filesize

                      4.6MB

                    • memory/5084-18-0x00000000006B0000-0x0000000000B56000-memory.dmp

                      Filesize

                      4.6MB

                    • memory/5084-2227-0x00000000006B0000-0x0000000000B56000-memory.dmp

                      Filesize

                      4.6MB

                    • memory/5084-466-0x00000000006B0000-0x0000000000B56000-memory.dmp

                      Filesize

                      4.6MB

                    • memory/5084-22-0x00000000006B0000-0x0000000000B56000-memory.dmp

                      Filesize

                      4.6MB

                    • memory/5084-788-0x00000000006B0000-0x0000000000B56000-memory.dmp

                      Filesize

                      4.6MB

                    • memory/5084-21-0x00000000006B0000-0x0000000000B56000-memory.dmp

                      Filesize

                      4.6MB

                    • memory/5084-19-0x00000000006B1000-0x00000000006DF000-memory.dmp

                      Filesize

                      184KB

                    • memory/5084-20-0x00000000006B0000-0x0000000000B56000-memory.dmp

                      Filesize

                      4.6MB

                    • memory/5084-486-0x00000000006B0000-0x0000000000B56000-memory.dmp

                      Filesize

                      4.6MB

                    • memory/5084-1110-0x00000000006B0000-0x0000000000B56000-memory.dmp

                      Filesize

                      4.6MB

                    • memory/5084-1716-0x00000000006B0000-0x0000000000B56000-memory.dmp

                      Filesize

                      4.6MB

                    • memory/5084-425-0x00000000006B0000-0x0000000000B56000-memory.dmp

                      Filesize

                      4.6MB

                    • memory/5084-2605-0x00000000006B0000-0x0000000000B56000-memory.dmp

                      Filesize

                      4.6MB

                    • memory/5084-475-0x00000000006B0000-0x0000000000B56000-memory.dmp

                      Filesize

                      4.6MB

                    • memory/5084-478-0x00000000006B0000-0x0000000000B56000-memory.dmp

                      Filesize

                      4.6MB

                    • memory/5084-2837-0x00000000006B0000-0x0000000000B56000-memory.dmp

                      Filesize

                      4.6MB

                    • memory/5084-2840-0x00000000006B0000-0x0000000000B56000-memory.dmp

                      Filesize

                      4.6MB

                    • memory/5084-2843-0x00000000006B0000-0x0000000000B56000-memory.dmp

                      Filesize

                      4.6MB

                    • memory/5084-2844-0x00000000006B0000-0x0000000000B56000-memory.dmp

                      Filesize

                      4.6MB

                    • memory/5084-2845-0x00000000006B0000-0x0000000000B56000-memory.dmp

                      Filesize

                      4.6MB

                    • memory/5084-2851-0x00000000006B0000-0x0000000000B56000-memory.dmp

                      Filesize

                      4.6MB

                    • memory/5756-480-0x00000000006B0000-0x0000000000B56000-memory.dmp

                      Filesize

                      4.6MB

                    • memory/5756-481-0x00000000006B0000-0x0000000000B56000-memory.dmp

                      Filesize

                      4.6MB