Analysis

  • max time kernel
    149s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12-08-2024 19:28

General

  • Target

    f498dd150cefdd1dbef22f6aa1d9eea874df340a4e778d8fa71680ceb8e47ca8.exe

  • Size

    1.9MB

  • MD5

    2e2977372ee576ba8ebb129e504a0f67

  • SHA1

    e3b233216c22918b1726bd6f14036e0ca625ee8b

  • SHA256

    f498dd150cefdd1dbef22f6aa1d9eea874df340a4e778d8fa71680ceb8e47ca8

  • SHA512

    cf88d2deac28308cd53b2085ef1cf34df1e1b152afcef7ab67fa4c26725262b70a2b9139adfd4b61fcd36470a94638b424a0b0a72ebaa62727566e2c8798e3df

  • SSDEEP

    49152:bU/e476MT5bbzWsoZDcIKn/mT+KSds2LxD4xV:bU26l5bbqsoZdK/4+KSds2LxDo

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

0657d1

C2

http://185.215.113.19

Attributes
  • install_dir

    0d8f5eb8a7

  • install_file

    explorti.exe

  • strings_key

    6c55a5f34bb433fbd933a168577b1838

  • url_paths

    /Vi9leo/index.php

rc4.plain

Extracted

Family

stealc

Botnet

kora

C2

http://185.215.113.100

Attributes
  • url_path

    /e2b1563c6670f193.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Stealc

    Stealc is an infostealer written in C++.

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 10 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 7 IoCs
  • Identifies Wine through registry keys 2 TTPs 5 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • AutoIT Executable 3 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\f498dd150cefdd1dbef22f6aa1d9eea874df340a4e778d8fa71680ceb8e47ca8.exe
    "C:\Users\Admin\AppData\Local\Temp\f498dd150cefdd1dbef22f6aa1d9eea874df340a4e778d8fa71680ceb8e47ca8.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:3788
    • C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
      "C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2984
      • C:\Users\Admin\AppData\Local\Temp\1000036001\dfc59f1b1b.exe
        "C:\Users\Admin\AppData\Local\Temp\1000036001\dfc59f1b1b.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1348
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          4⤵
            PID:1264
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
            4⤵
            • Checks computer location settings
            • System Location Discovery: System Language Discovery
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of WriteProcessMemory
            PID:1528
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:3952
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
                6⤵
                • Checks processor information in registry
                • Modifies registry class
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:2928
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2032 -parentBuildID 20240401114208 -prefsHandle 1960 -prefMapHandle 1952 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {43539b3d-99bb-4a49-90e6-baee1c286da4} 2928 "\\.\pipe\gecko-crash-server-pipe.2928" gpu
                  7⤵
                    PID:3696
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2468 -parentBuildID 20240401114208 -prefsHandle 2460 -prefMapHandle 2456 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c192be87-528b-48c0-91b3-d019da75d99e} 2928 "\\.\pipe\gecko-crash-server-pipe.2928" socket
                    7⤵
                      PID:4964
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2948 -childID 1 -isForBrowser -prefsHandle 3124 -prefMapHandle 3376 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1248 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bbda6e92-7905-48a2-9e82-497c26fc5fd9} 2928 "\\.\pipe\gecko-crash-server-pipe.2928" tab
                      7⤵
                        PID:4796
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3672 -childID 2 -isForBrowser -prefsHandle 3664 -prefMapHandle 3652 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1248 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3de7903a-9e7f-4c38-a206-d7e702f4d284} 2928 "\\.\pipe\gecko-crash-server-pipe.2928" tab
                        7⤵
                          PID:2468
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4660 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4816 -prefMapHandle 4804 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {84773f77-09cf-4f23-8625-ce07efe8b0b6} 2928 "\\.\pipe\gecko-crash-server-pipe.2928" utility
                          7⤵
                          • Checks processor information in registry
                          PID:5308
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4820 -childID 3 -isForBrowser -prefsHandle 4864 -prefMapHandle 5448 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1248 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {21278220-e757-4859-9a60-9d60cfbc8870} 2928 "\\.\pipe\gecko-crash-server-pipe.2928" tab
                          7⤵
                            PID:5876
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5612 -childID 4 -isForBrowser -prefsHandle 5688 -prefMapHandle 5684 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1248 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1003d4a9-b8b6-4516-aab2-d2d834de4486} 2928 "\\.\pipe\gecko-crash-server-pipe.2928" tab
                            7⤵
                              PID:5892
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5928 -childID 5 -isForBrowser -prefsHandle 5948 -prefMapHandle 5944 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1248 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7bf1f800-7cca-4a5b-94d1-5232b90aee60} 2928 "\\.\pipe\gecko-crash-server-pipe.2928" tab
                              7⤵
                                PID:5928
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6316 -childID 6 -isForBrowser -prefsHandle 6280 -prefMapHandle 6296 -prefsLen 27182 -prefMapSize 244658 -jsInitHandle 1248 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1b6be17e-a8df-4fc7-be8c-8db052b1edaa} 2928 "\\.\pipe\gecko-crash-server-pipe.2928" tab
                                7⤵
                                  PID:4712
                        • C:\Users\Admin\1000037002\4141b9b505.exe
                          "C:\Users\Admin\1000037002\4141b9b505.exe"
                          3⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of WriteProcessMemory
                          PID:3880
                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                            4⤵
                              PID:744
                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                              4⤵
                              • System Location Discovery: System Language Discovery
                              PID:888
                          • C:\Users\Admin\AppData\Local\Temp\1000038001\0e0cad4653.exe
                            "C:\Users\Admin\AppData\Local\Temp\1000038001\0e0cad4653.exe"
                            3⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            PID:2408
                      • C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                        C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                        1⤵
                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                        • Checks BIOS information in registry
                        • Executes dropped EXE
                        • Identifies Wine through registry keys
                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                        • Suspicious behavior: EnumeratesProcesses
                        PID:5156
                      • C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                        C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                        1⤵
                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                        • Checks BIOS information in registry
                        • Executes dropped EXE
                        • Identifies Wine through registry keys
                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                        • Suspicious behavior: EnumeratesProcesses
                        PID:5984
                      • C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                        C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                        1⤵
                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                        • Checks BIOS information in registry
                        • Executes dropped EXE
                        • Identifies Wine through registry keys
                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                        • Suspicious behavior: EnumeratesProcesses
                        PID:544

                      Network

                      MITRE ATT&CK Enterprise v15

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Users\Admin\1000037002\4141b9b505.exe

                        Filesize

                        206KB

                        MD5

                        0062f8023ae661666d3878556e8dd739

                        SHA1

                        93874148f18869b9c2bc0bfadae20b7a7c4dbfa3

                        SHA256

                        83890cbc687e678653b1a67c6affb59a37dca660ad16c6d4f39dff8669aa6b3f

                        SHA512

                        7e4e9e7c83c28d4d0c7081f21105c3dc6a13d5fd5dfe6fe9256d12a56a63c63491738ad592527b07c35fbb00f86def4d875c753389c50966474b9798bf3af6e3

                      • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5dqhm7h.default-release\activity-stream.discovery_stream.json

                        Filesize

                        38KB

                        MD5

                        069cdf20124e700c3db102ac02891803

                        SHA1

                        3d551139d7b29f0815d9e485b6e8fa71c069e281

                        SHA256

                        625de0267d036b5bc10073efb675d8b85546dcaa1c370613c84a3f5ce599bfd4

                        SHA512

                        36770b187c68217ec856929813f56690a53547850c72e6e14e1191643e0e1f15e81cc0934c61d36926ab9a9a6b22045689ca2f3861139fb8343499723b1ee83c

                      • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5dqhm7h.default-release\cache2\entries\E449899591A9BC91DFBA673EC0589B51E541A88B

                        Filesize

                        13KB

                        MD5

                        1781fc02cce5adc9960ed8cc6b315cea

                        SHA1

                        6677afa80331363bc486171b7b03c93db301a705

                        SHA256

                        a7099a1497c29013ca9cdb68d2b1090f51592c9510069f7cae12771ed872f1a6

                        SHA512

                        44eafc7dfa991e44c176027f34f16cb321df663303fe87371f68948efb9ca7dc14e80f0da327afdd7db9810ba7d238ae89436c99767487f40a79d01553e20411

                      • C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

                        Filesize

                        1.9MB

                        MD5

                        2e2977372ee576ba8ebb129e504a0f67

                        SHA1

                        e3b233216c22918b1726bd6f14036e0ca625ee8b

                        SHA256

                        f498dd150cefdd1dbef22f6aa1d9eea874df340a4e778d8fa71680ceb8e47ca8

                        SHA512

                        cf88d2deac28308cd53b2085ef1cf34df1e1b152afcef7ab67fa4c26725262b70a2b9139adfd4b61fcd36470a94638b424a0b0a72ebaa62727566e2c8798e3df

                      • C:\Users\Admin\AppData\Local\Temp\1000036001\dfc59f1b1b.exe

                        Filesize

                        1.2MB

                        MD5

                        287552245031dbfba5adc56e5595f06b

                        SHA1

                        bc243787cfd42946785ef87f47066d9d26d8693d

                        SHA256

                        c48ecabd6f927fb1c758a5cbdd416e6f64f49ae2734b39a028bff15e55fed27f

                        SHA512

                        631a29d55b04f807e989a4021b934557b3a7bef7329d5cf9dc8caaafac1b408b227ffe9b9c19eea55d4a412ae19958413500d078dfe4f87cc0fd8794ff797d66

                      • C:\Users\Admin\AppData\Local\Temp\1000038001\0e0cad4653.exe

                        Filesize

                        187KB

                        MD5

                        278ee1426274818874556aa18fd02e3a

                        SHA1

                        185a2761330024dec52134df2c8388c461451acb

                        SHA256

                        37257ddb1a6f309a6e9d147b5fc2551a9cae3a0e52b191b18d9465bfcb5c18eb

                        SHA512

                        07ec6759af5b9a00d8371b9fd9b723012dd0a1614cfcc7cd51975a004f69ffb90083735e9a871a2aa0e8d28799beac53a4748f55f4dd1e7495bc7388ebf4d6a0

                      • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                        Filesize

                        479KB

                        MD5

                        09372174e83dbbf696ee732fd2e875bb

                        SHA1

                        ba360186ba650a769f9303f48b7200fb5eaccee1

                        SHA256

                        c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                        SHA512

                        b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                      • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                        Filesize

                        13.8MB

                        MD5

                        0a8747a2ac9ac08ae9508f36c6d75692

                        SHA1

                        b287a96fd6cc12433adb42193dfe06111c38eaf0

                        SHA256

                        32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                        SHA512

                        59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5dqhm7h.default-release\AlternateServices.bin

                        Filesize

                        10KB

                        MD5

                        a64335eeb9fdff0c1b2d3ee3a425cd2f

                        SHA1

                        642fde0744fd5f1fa9411359e835c328ca852ce5

                        SHA256

                        b7cf89267fd63802d9bf2303dd5e8b1ab5c4239d16c0b1590ba3a06bff19750c

                        SHA512

                        c3f50030380bb234d177a8de4e0853100f506781376a768d93293569b3427f8a36245d71ddb5b4bae89493331a49ec5cbfdf319ea47ecbe5e07106f2ee29cf88

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5dqhm7h.default-release\AlternateServices.bin

                        Filesize

                        11KB

                        MD5

                        9cfc86bc85e0a2d5c66f02a67b296d10

                        SHA1

                        21f5794a7b78d7f4ea91fb2e0963296433cfd781

                        SHA256

                        ba85b3a91f5fb5c2ed5645a1ddbb8361117f1b9807f66d2f8f95282a0862117c

                        SHA512

                        48e4391e9af2f1afd3c423df00c6fb28324efc5277b1d9ed382b72c909435d10c3bcf23cd4da6620f2581364fa95812d06d5da70e7a8691e0c190ca49ec23286

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5dqhm7h.default-release\datareporting\glean\db\data.safe.tmp

                        Filesize

                        5KB

                        MD5

                        9b0c3d16d47ce5f4672c93191d1938c1

                        SHA1

                        e1ce186656fafa35a0f5632aba49fc1e5c9915d8

                        SHA256

                        8a979acaf554f6e688ded35905574e7a59d3a3c4cbafba3963e0eb0473a4992b

                        SHA512

                        ed3d7cc6321f6c995395c48f319073b872fdbf06663d4602e51c912fbd0734d0eb632835b5d95506ad78817565a2ea4eb65a324906581d5f67505e38096b1b7f

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5dqhm7h.default-release\datareporting\glean\db\data.safe.tmp

                        Filesize

                        16KB

                        MD5

                        2dd70bae353142e586e849927cdab789

                        SHA1

                        41be3969483e1aca9b1433ac28492cfd00a5c8a8

                        SHA256

                        d9f24b5335b53498a994930ec6eb4e47297b65bd98b41dc88b753676d8c0fda8

                        SHA512

                        e34f01a87c8ac3e49a62dfcb84ca2afdfd6057a27f75bd31fa8996bd70b82aa57de10c544ab6cd7538e6a38f0a6a2a26a7e9af5ea1a5b9393d1cc22c1621b879

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5dqhm7h.default-release\datareporting\glean\pending_pings\5d67b568-6385-4afa-ab68-14e8096fbe4f

                        Filesize

                        28KB

                        MD5

                        e6119eb753eea42656218964ce44b5d8

                        SHA1

                        89a07d240c3d81fdc82659ba461ae8a8d0a17c65

                        SHA256

                        229dcef47565e30e6644fcf69999933fe6847166162fcbc6a0d5a66afba92898

                        SHA512

                        b0bba064367f62d663bcb6b6b577948a65e9ef4173829a7e3a7ca8f5158e08512804977af8ac9726643d5fa847f1c6b7f72da28391dcfb47906064fd564ecad5

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5dqhm7h.default-release\datareporting\glean\pending_pings\6d1c8558-9af3-4c43-a836-3d3d29518e61

                        Filesize

                        982B

                        MD5

                        c59fa65545e5a19bd2eb5496253a8def

                        SHA1

                        659818777197042b25ca2613dea4316cfc3b4bdb

                        SHA256

                        5e21f52bc799767d5b2dc767523bf9b3c712a1169d557299328b9f670f740389

                        SHA512

                        292c14a75c22f5e07d482257801c70e75631efb385c6c600f446323f526bed4dbbfffa371e5b997c986ce8b91eccf18deaf589a960191742246acad57c645aac

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5dqhm7h.default-release\datareporting\glean\pending_pings\ad769079-d5b7-4ae1-b910-8afd8211779f

                        Filesize

                        671B

                        MD5

                        07191d579a4c4b29dae27a6bee68dbba

                        SHA1

                        866c43f97e5c79b97a7068e067886f953dd18031

                        SHA256

                        5ff12f7f1f68f928c16ede4b6d1f0f801bc6d540055c4ffc64037f2bb2dbfadf

                        SHA512

                        3175358b4eb76c94bcd3197b3f11d480063c1222d98ab37c95f30a08cc89096e45e364bdfff59c001a7d246f8693802c3be7fa34c19ab6a88236f85fadd48e2d

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5dqhm7h.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

                        Filesize

                        1.1MB

                        MD5

                        842039753bf41fa5e11b3a1383061a87

                        SHA1

                        3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                        SHA256

                        d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                        SHA512

                        d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5dqhm7h.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

                        Filesize

                        116B

                        MD5

                        2a461e9eb87fd1955cea740a3444ee7a

                        SHA1

                        b10755914c713f5a4677494dbe8a686ed458c3c5

                        SHA256

                        4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                        SHA512

                        34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5dqhm7h.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

                        Filesize

                        372B

                        MD5

                        bf957ad58b55f64219ab3f793e374316

                        SHA1

                        a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                        SHA256

                        bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                        SHA512

                        79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5dqhm7h.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

                        Filesize

                        17.8MB

                        MD5

                        daf7ef3acccab478aaa7d6dc1c60f865

                        SHA1

                        f8246162b97ce4a945feced27b6ea114366ff2ad

                        SHA256

                        bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                        SHA512

                        5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5dqhm7h.default-release\prefs-1.js

                        Filesize

                        11KB

                        MD5

                        96de6b44363efc36abd2cc3b42a2abc0

                        SHA1

                        6bea8774e5ed153f71997cf39eb1ff567b75168e

                        SHA256

                        2cf23d36ba3494dd94423c34929792f730504041df144d3ef660a5f7c262da7c

                        SHA512

                        221c80d63652dfafda0312bf490ddf133b04d9e3114dcf4d17cb5f3d86018da26fc3c14645d2510416cc4b482de9bec73ec5bc2abc70015a6934e75aa95d53a4

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5dqhm7h.default-release\prefs-1.js

                        Filesize

                        12KB

                        MD5

                        b2e197c8e6f6486608ee11e08a3d5333

                        SHA1

                        0c21ef3aee1cbce7ff5525833977ebe5eda5568b

                        SHA256

                        49826c2ee49282d48b783c7e351c8056c2ecb773deee6335b44543a02013b134

                        SHA512

                        b583187b51c8fb79743f6629bc935ccf39761676269e881894c8ebba3e8beffeb3cc781b325a80572003cadc46f89fea15a435e2ce16d165336e2afa6419b712

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5dqhm7h.default-release\prefs-1.js

                        Filesize

                        16KB

                        MD5

                        6d2694ce22e8fd28eb0b1afdfe8e3b67

                        SHA1

                        198dbff70cd1cffc2e43c137756429fcfec70bee

                        SHA256

                        b43aed514b6c2197c18de679d538e405c258cadd06f23c0508b2bcd6b8f049dc

                        SHA512

                        d37144984a233b38da605c204f5fc7901c9364410605d8ac642511c1571af12afad068b29497cc6cb89d4879c94991326f72c94c22f2e2f35fa1c9294d034b0a

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5dqhm7h.default-release\prefs.js

                        Filesize

                        11KB

                        MD5

                        e40e64264e2df395853166d3ae9d7cb9

                        SHA1

                        80150c0de6f2fe790883abba22e36d1bce8f753b

                        SHA256

                        be0999beac99081a51a4a7034c2ab7392361997a838e0bc48412c4c28df3749e

                        SHA512

                        d808741a76182d03ad644a038414e4c337e16e9ccc92e2749dcc1113de7399f0b5e5f79f8d95e79bde8219b69c682d7e56b76ebbf8a059605282d88d1d5495fe

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5dqhm7h.default-release\prefs.js

                        Filesize

                        11KB

                        MD5

                        e4714c1c1b1cd20b8e0f4393ccfa26c0

                        SHA1

                        18b344877825ab487ddf3389f8867ef3771591ae

                        SHA256

                        f246c75fbc98bb21019fd6d03f817283cae13da6c5141a473209adb09b9659e2

                        SHA512

                        80721a1e00b62685424cf90d9bb994f306430e33af543d68e44e6c15bb2c6cfc132fe271122b7a363f2a178863f97905692d1f06148bfdb98808b700707663f2

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5dqhm7h.default-release\sessionstore-backups\recovery.baklz4

                        Filesize

                        5KB

                        MD5

                        3be24d307d500b6226e096ad9987215f

                        SHA1

                        6883add1728bb72c07e0ceee6d27a22cf844008f

                        SHA256

                        39a656f284d94dd6999c19e965256305d24cdc424dfa30c41d8d8f82c4ae0f9e

                        SHA512

                        a5a7eea6fdd2938d1a007fd056f22f57280b7118a9d299c73ed840ba1316501751b930ac11220e814b389f5d462e4a5991184d1b711eece5265cf6b4b60262d5

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5dqhm7h.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

                        Filesize

                        1.3MB

                        MD5

                        3d38d44622aed00a72970242cf951171

                        SHA1

                        f27408ca062a2039ee148cdfa443b8ee6724ed82

                        SHA256

                        fb3dda2cfe013310f7a6afd222e3f055d20e89f897bbf174f4e69e79ed7aacb4

                        SHA512

                        05a0bc96ae25c14f563f8e23d7dfd983e96d4f439800c8705f062ed939a1928622da5c5d438a1da7e4392fd2906e40bb362bc3ce9a7d86ac3e6c942b55a7ef51

                      • memory/544-2740-0x0000000000270000-0x0000000000748000-memory.dmp

                        Filesize

                        4.8MB

                      • memory/544-2741-0x0000000000270000-0x0000000000748000-memory.dmp

                        Filesize

                        4.8MB

                      • memory/888-67-0x0000000000400000-0x0000000000643000-memory.dmp

                        Filesize

                        2.3MB

                      • memory/888-69-0x0000000000400000-0x0000000000643000-memory.dmp

                        Filesize

                        2.3MB

                      • memory/1348-39-0x000000007356E000-0x000000007356F000-memory.dmp

                        Filesize

                        4KB

                      • memory/1348-40-0x0000000000A40000-0x0000000000B70000-memory.dmp

                        Filesize

                        1.2MB

                      • memory/1528-46-0x0000000000400000-0x000000000052D000-memory.dmp

                        Filesize

                        1.2MB

                      • memory/1528-42-0x0000000000400000-0x000000000052D000-memory.dmp

                        Filesize

                        1.2MB

                      • memory/1528-44-0x0000000000400000-0x000000000052D000-memory.dmp

                        Filesize

                        1.2MB

                      • memory/2408-85-0x0000000000570000-0x00000000007B3000-memory.dmp

                        Filesize

                        2.3MB

                      • memory/2408-86-0x0000000000570000-0x00000000007B3000-memory.dmp

                        Filesize

                        2.3MB

                      • memory/2984-20-0x0000000000270000-0x0000000000748000-memory.dmp

                        Filesize

                        4.8MB

                      • memory/2984-2728-0x0000000000270000-0x0000000000748000-memory.dmp

                        Filesize

                        4.8MB

                      • memory/2984-459-0x0000000000270000-0x0000000000748000-memory.dmp

                        Filesize

                        4.8MB

                      • memory/2984-2742-0x0000000000270000-0x0000000000748000-memory.dmp

                        Filesize

                        4.8MB

                      • memory/2984-2738-0x0000000000270000-0x0000000000748000-memory.dmp

                        Filesize

                        4.8MB

                      • memory/2984-453-0x0000000000270000-0x0000000000748000-memory.dmp

                        Filesize

                        4.8MB

                      • memory/2984-450-0x0000000000270000-0x0000000000748000-memory.dmp

                        Filesize

                        4.8MB

                      • memory/2984-2732-0x0000000000270000-0x0000000000748000-memory.dmp

                        Filesize

                        4.8MB

                      • memory/2984-439-0x0000000000270000-0x0000000000748000-memory.dmp

                        Filesize

                        4.8MB

                      • memory/2984-2731-0x0000000000270000-0x0000000000748000-memory.dmp

                        Filesize

                        4.8MB

                      • memory/2984-428-0x0000000000270000-0x0000000000748000-memory.dmp

                        Filesize

                        4.8MB

                      • memory/2984-19-0x0000000000270000-0x0000000000748000-memory.dmp

                        Filesize

                        4.8MB

                      • memory/2984-2730-0x0000000000270000-0x0000000000748000-memory.dmp

                        Filesize

                        4.8MB

                      • memory/2984-17-0x0000000000270000-0x0000000000748000-memory.dmp

                        Filesize

                        4.8MB

                      • memory/2984-2729-0x0000000000270000-0x0000000000748000-memory.dmp

                        Filesize

                        4.8MB

                      • memory/2984-454-0x0000000000270000-0x0000000000748000-memory.dmp

                        Filesize

                        4.8MB

                      • memory/2984-1013-0x0000000000270000-0x0000000000748000-memory.dmp

                        Filesize

                        4.8MB

                      • memory/2984-1644-0x0000000000270000-0x0000000000748000-memory.dmp

                        Filesize

                        4.8MB

                      • memory/2984-2496-0x0000000000270000-0x0000000000748000-memory.dmp

                        Filesize

                        4.8MB

                      • memory/2984-2719-0x0000000000270000-0x0000000000748000-memory.dmp

                        Filesize

                        4.8MB

                      • memory/3788-3-0x0000000000290000-0x0000000000768000-memory.dmp

                        Filesize

                        4.8MB

                      • memory/3788-4-0x0000000000290000-0x0000000000768000-memory.dmp

                        Filesize

                        4.8MB

                      • memory/3788-18-0x0000000000290000-0x0000000000768000-memory.dmp

                        Filesize

                        4.8MB

                      • memory/3788-2-0x0000000000291000-0x00000000002BF000-memory.dmp

                        Filesize

                        184KB

                      • memory/3788-1-0x0000000077954000-0x0000000077956000-memory.dmp

                        Filesize

                        8KB

                      • memory/3788-0-0x0000000000290000-0x0000000000768000-memory.dmp

                        Filesize

                        4.8MB

                      • memory/3880-65-0x0000000000710000-0x0000000000748000-memory.dmp

                        Filesize

                        224KB

                      • memory/5156-440-0x0000000000270000-0x0000000000748000-memory.dmp

                        Filesize

                        4.8MB

                      • memory/5156-441-0x0000000000270000-0x0000000000748000-memory.dmp

                        Filesize

                        4.8MB

                      • memory/5984-2724-0x0000000000270000-0x0000000000748000-memory.dmp

                        Filesize

                        4.8MB

                      • memory/5984-2725-0x0000000000270000-0x0000000000748000-memory.dmp

                        Filesize

                        4.8MB