Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    14-08-2024 02:33

General

  • Target

    284c72735b95b18cf111d5c5178bb7565d2f4d4d36ca6573f88dd0598b58425f.exe

  • Size

    1.8MB

  • MD5

    48c24a152ce98431b83006650bc02fc8

  • SHA1

    d76713abc3ba7c3fbe823fbefc49d30484ea6ad9

  • SHA256

    284c72735b95b18cf111d5c5178bb7565d2f4d4d36ca6573f88dd0598b58425f

  • SHA512

    35296079dcf7a710a3aeda4e5eca0cb6998f2f1253da50a7393fa42ff26a98ee36d2ba79fbd0c0c513db2bd0c7958d29a4e7ddd70d58b27080c2fa17492147fb

  • SSDEEP

    49152:wIQoAqAqx7YRidXvdrG4O1aTd49puiyvOED:wjoAqlYRipv84nd49puiyvOED

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

0657d1

C2

http://185.215.113.19

Attributes
  • install_dir

    0d8f5eb8a7

  • install_file

    explorti.exe

  • strings_key

    6c55a5f34bb433fbd933a168577b1838

  • url_paths

    /Vi9leo/index.php

rc4.plain

Extracted

Family

stealc

Botnet

nord

C2

http://185.215.113.100

Attributes
  • url_path

    /e2b1563c6670f193.php

Extracted

Family

stealc

Botnet

kora

C2

http://185.215.113.100

Attributes
  • url_path

    /e2b1563c6670f193.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Stealc

    Stealc is an infostealer written in C++.

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 10 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 7 IoCs
  • Identifies Wine through registry keys 2 TTPs 5 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 2 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • AutoIT Executable 3 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 10 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\284c72735b95b18cf111d5c5178bb7565d2f4d4d36ca6573f88dd0598b58425f.exe
    "C:\Users\Admin\AppData\Local\Temp\284c72735b95b18cf111d5c5178bb7565d2f4d4d36ca6573f88dd0598b58425f.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2664
    • C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
      "C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4948
      • C:\Users\Admin\AppData\Local\Temp\1000036001\e739d7e3e8.exe
        "C:\Users\Admin\AppData\Local\Temp\1000036001\e739d7e3e8.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3748
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:2992
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:1804
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
              6⤵
              • Checks processor information in registry
              • Modifies registry class
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:2596
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1996 -parentBuildID 20240401114208 -prefsHandle 1924 -prefMapHandle 1916 -prefsLen 23678 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b2559a9b-bdb0-4ad9-a785-6d793f975726} 2596 "\\.\pipe\gecko-crash-server-pipe.2596" gpu
                7⤵
                  PID:4048
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2416 -parentBuildID 20240401114208 -prefsHandle 2408 -prefMapHandle 2404 -prefsLen 24598 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ecd797ab-eed8-415d-bdee-6d11099d75f2} 2596 "\\.\pipe\gecko-crash-server-pipe.2596" socket
                  7⤵
                    PID:2376
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3024 -childID 1 -isForBrowser -prefsHandle 2996 -prefMapHandle 3060 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4413f9e1-deba-45bb-89a1-5a1b1ec407b7} 2596 "\\.\pipe\gecko-crash-server-pipe.2596" tab
                    7⤵
                      PID:2500
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4124 -childID 2 -isForBrowser -prefsHandle 4116 -prefMapHandle 4112 -prefsLen 29088 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3fd52be4-79da-4498-86d4-7597a79e3f7a} 2596 "\\.\pipe\gecko-crash-server-pipe.2596" tab
                      7⤵
                        PID:552
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4976 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4852 -prefMapHandle 4972 -prefsLen 29088 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9891c3f0-f463-4718-9580-7743dc0746d9} 2596 "\\.\pipe\gecko-crash-server-pipe.2596" utility
                        7⤵
                        • Checks processor information in registry
                        PID:5276
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5568 -childID 3 -isForBrowser -prefsHandle 5532 -prefMapHandle 5488 -prefsLen 27182 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {baf8f874-53d6-4692-be81-fdac7b4b9be7} 2596 "\\.\pipe\gecko-crash-server-pipe.2596" tab
                        7⤵
                          PID:3444
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5808 -childID 4 -isForBrowser -prefsHandle 5532 -prefMapHandle 5488 -prefsLen 27182 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fff4d9ba-9652-4855-96ba-dea0a0fa43ae} 2596 "\\.\pipe\gecko-crash-server-pipe.2596" tab
                          7⤵
                            PID:1244
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5944 -childID 5 -isForBrowser -prefsHandle 5952 -prefMapHandle 5956 -prefsLen 27182 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {143f97c5-add2-4696-bad4-eecbdd4afd39} 2596 "\\.\pipe\gecko-crash-server-pipe.2596" tab
                            7⤵
                              PID:2268
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6132 -childID 6 -isForBrowser -prefsHandle 6140 -prefMapHandle 6148 -prefsLen 27182 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {433e9818-88db-4f79-a4d0-807bfba26619} 2596 "\\.\pipe\gecko-crash-server-pipe.2596" tab
                              7⤵
                                PID:4900
                      • C:\Users\Admin\1000037002\72353cd75e.exe
                        "C:\Users\Admin\1000037002\72353cd75e.exe"
                        3⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of WriteProcessMemory
                        PID:5084
                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                          4⤵
                          • Loads dropped DLL
                          • System Location Discovery: System Language Discovery
                          • Checks processor information in registry
                          • Suspicious behavior: EnumeratesProcesses
                          PID:940
                      • C:\Users\Admin\AppData\Local\Temp\1000038001\e806b8991f.exe
                        "C:\Users\Admin\AppData\Local\Temp\1000038001\e806b8991f.exe"
                        3⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        PID:2804
                  • C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                    C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                    1⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Identifies Wine through registry keys
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • Suspicious behavior: EnumeratesProcesses
                    PID:6036
                  • C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                    C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                    1⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Identifies Wine through registry keys
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • Suspicious behavior: EnumeratesProcesses
                    PID:5220
                  • C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                    C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                    1⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Identifies Wine through registry keys
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • Suspicious behavior: EnumeratesProcesses
                    PID:5820

                  Network

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\ProgramData\mozglue.dll

                    Filesize

                    593KB

                    MD5

                    c8fd9be83bc728cc04beffafc2907fe9

                    SHA1

                    95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                    SHA256

                    ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                    SHA512

                    fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                  • C:\ProgramData\nss3.dll

                    Filesize

                    2.0MB

                    MD5

                    1cc453cdf74f31e4d913ff9c10acdde2

                    SHA1

                    6e85eae544d6e965f15fa5c39700fa7202f3aafe

                    SHA256

                    ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                    SHA512

                    dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                  • C:\Users\Admin\1000037002\72353cd75e.exe

                    Filesize

                    207KB

                    MD5

                    2b845ae9efa4fee06f704f96b9828fdd

                    SHA1

                    c3ebc546d88d08c19fb65ba086d153aae2fe46fe

                    SHA256

                    da122348356834ca10d6bf9efa9cf352ba2db2e851699f981753e126cae9e508

                    SHA512

                    7f1631de67e75bf5b8e08f33b7d3c5cc07b843b48ae8fc40b36cf9698538fca79f2b1cb496d2018a4d93459cc6b83d2cd3d052b1d72997694fa6221547de85c3

                  • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\seoxtri5.default-release\activity-stream.discovery_stream.json

                    Filesize

                    41KB

                    MD5

                    16d1f94e7f3e8c2ce31a89d36f7f1074

                    SHA1

                    ab1c70cbbd572ab8620ac5365d2fc27ebd8d0af7

                    SHA256

                    220a29913faf0f9dfba73116883000d467ec71249e674a44191b7796641977a1

                    SHA512

                    0f759516ebf76229b4d6571291549254eeb10369d15f4a18dfbf96ae4437bc2429eff4276ca245b7fd0dfe97641f8db20f70781ea53beed4d80011fa99b1a252

                  • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\seoxtri5.default-release\cache2\entries\E449899591A9BC91DFBA673EC0589B51E541A88B

                    Filesize

                    13KB

                    MD5

                    eb92fb68283908c41685c5383c389ce5

                    SHA1

                    fda7497fc49d493d2bff7aae388f2de95c113a15

                    SHA256

                    586d984dbdc78b3257da504fe4e6059a9f42b5d903807e59d07177c36f38505b

                    SHA512

                    6f4906762b1056a9893369d58b16b08b03ba7bf2c0753b13ca951751bc4391884c51f57973d1e4c47c7ee73db4c818b413aa79f507b1ddf43dad100a3b7ff88f

                  • C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

                    Filesize

                    1.8MB

                    MD5

                    48c24a152ce98431b83006650bc02fc8

                    SHA1

                    d76713abc3ba7c3fbe823fbefc49d30484ea6ad9

                    SHA256

                    284c72735b95b18cf111d5c5178bb7565d2f4d4d36ca6573f88dd0598b58425f

                    SHA512

                    35296079dcf7a710a3aeda4e5eca0cb6998f2f1253da50a7393fa42ff26a98ee36d2ba79fbd0c0c513db2bd0c7958d29a4e7ddd70d58b27080c2fa17492147fb

                  • C:\Users\Admin\AppData\Local\Temp\1000036001\e739d7e3e8.exe

                    Filesize

                    1.2MB

                    MD5

                    8af76706f6ecb73d3ed8680a5e2cdc0f

                    SHA1

                    3668dbf5a57164102d1b0adea941316fa55f47fc

                    SHA256

                    922c12d506652b85601064eb571333ef395c88e201acfd6f2a4b69ee13eae5f9

                    SHA512

                    ea7f1cd1b32705e3f80a0f050ca9630505604343099e787fb57aa5cdcfee1b75218eb252519e6854ad368513e4af0756256ae7443c8dae93c9cd08829aeab3cd

                  • C:\Users\Admin\AppData\Local\Temp\1000038001\e806b8991f.exe

                    Filesize

                    187KB

                    MD5

                    278ee1426274818874556aa18fd02e3a

                    SHA1

                    185a2761330024dec52134df2c8388c461451acb

                    SHA256

                    37257ddb1a6f309a6e9d147b5fc2551a9cae3a0e52b191b18d9465bfcb5c18eb

                    SHA512

                    07ec6759af5b9a00d8371b9fd9b723012dd0a1614cfcc7cd51975a004f69ffb90083735e9a871a2aa0e8d28799beac53a4748f55f4dd1e7495bc7388ebf4d6a0

                  • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                    Filesize

                    479KB

                    MD5

                    09372174e83dbbf696ee732fd2e875bb

                    SHA1

                    ba360186ba650a769f9303f48b7200fb5eaccee1

                    SHA256

                    c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                    SHA512

                    b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                  • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                    Filesize

                    13.8MB

                    MD5

                    0a8747a2ac9ac08ae9508f36c6d75692

                    SHA1

                    b287a96fd6cc12433adb42193dfe06111c38eaf0

                    SHA256

                    32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                    SHA512

                    59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\seoxtri5.default-release\AlternateServices.bin

                    Filesize

                    10KB

                    MD5

                    ca2c4b56da08997d456a75c8766bf5b7

                    SHA1

                    1e75390a4f650da198dd8faae44e1b8babd12233

                    SHA256

                    3f585015e836e627fcdaf115a67215cfddd68fa7bf252cc29655e526f26ce9a5

                    SHA512

                    0f57b862dbddd5e930c19c40eb4638737bbecd883bc1b5450e739bcc75f4a95e06c5d8aceebdbfedaacc88fececbe79cc373db0f4ef82da3e740f4a55b7f0d7c

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\seoxtri5.default-release\cookies.sqlite-wal

                    Filesize

                    384KB

                    MD5

                    caadc88cfc1a8addb4a9e3e451034ba6

                    SHA1

                    a53f17e4a19179f22eff0fd4a12643490a3bd212

                    SHA256

                    e442950dcd2246a8aee282ba9323605c1cca3a9fd928b613ecbb9bc7c4e469db

                    SHA512

                    3995347462de1d14c862be1d386664f3eedcf6644777549f6cbc18aaf1471174c77d6fb635bbb67a1cc89867aaeea3e63995446648ea849efbf7628c562e4391

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\seoxtri5.default-release\datareporting\glean\db\data.safe.tmp

                    Filesize

                    22KB

                    MD5

                    5088020ca7a406e2660725717bcab2a4

                    SHA1

                    4eea11f62bcf25effff082a402c1debf0cfc3bab

                    SHA256

                    3c763e69d1d89728d7b5a131972e5cf1eb50899eba2c305a6fdfb22b062f3afd

                    SHA512

                    0fe7587e6155125a1841b3946ec7b53f93afc70d46a85d633e03aefa46bdd0a98e0cf83d0a576ae8fbf21515162da99ecffbcf9c71e15805b84d52d9c5ffd4ff

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\seoxtri5.default-release\datareporting\glean\db\data.safe.tmp

                    Filesize

                    25KB

                    MD5

                    a715e411d0ee7349aca85f6993a77908

                    SHA1

                    efc4ca2e0e31ba9fe733ac9967e726ddc339815b

                    SHA256

                    abf778f5fbd27067410be1854d0c8e2cd0fdf553405feac26a6cbe66bfd525b2

                    SHA512

                    5eff29ab72c697302671a55108de105468aa5174383f6edcded85f47b17114b3138da5a7d090b9580ad0846f352dd4fd5d4d877a64691729159985d34e6faffc

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\seoxtri5.default-release\datareporting\glean\db\data.safe.tmp

                    Filesize

                    25KB

                    MD5

                    c1582c81c84a1bd3f36db23d84f64d45

                    SHA1

                    8cdbb8ecc8e22646c1715ccbb228f76686bf03d7

                    SHA256

                    4c3cabf710c75dd61bf972bc971883ec0f6f267ccdfb7a839b6c32f4769ae00b

                    SHA512

                    a3a32ce6771b960ce5b60024baa17d4d5aeb0e84b551f67e028a783596548c5baeec7dd1b0bef3e02eaf33a6ac72e8a02e2a923ab4e64e84e63aa1fc8122b54f

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\seoxtri5.default-release\datareporting\glean\pending_pings\09601f96-9a8e-4fdc-86b3-282849d4fff4

                    Filesize

                    982B

                    MD5

                    d6a47061eab5acc62a5167e2bb731595

                    SHA1

                    67ce135d6e2a58a98ed5963f9d437906937ed86b

                    SHA256

                    0280335868c4f371fa7233ac4e6a41998bd93147e0f457b494fe1ed37ca4d204

                    SHA512

                    d0b93e4d35ebbe5383592724baf8d95f6181f7a96fc9a7918eea655a00a3573fefc5e2d0668d9fa35bdd71d01bbde8ab46ae8180e8787425ab938dcbdbbf7fa8

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\seoxtri5.default-release\datareporting\glean\pending_pings\44ff73d5-ee94-4c05-b82f-6fe196543212

                    Filesize

                    659B

                    MD5

                    7a7d1b0f8a19acf4852bddc98341b2d1

                    SHA1

                    b9af496737fa3d4839008e1993f2b097ee8e6f93

                    SHA256

                    b90ee40c7fd6fa96fd96f060937e12c966d16f197f5c90839959d19453634838

                    SHA512

                    540e3e9ef4560610423aa9d18669281846b549d7d04c317311ae033bded46a4d39a06417f18debbbbc04f4552566c7051717097f47c6b8aa9c3238197baa094e

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\seoxtri5.default-release\formhistory.sqlite

                    Filesize

                    256KB

                    MD5

                    97c1441748d6cc3e5a7030cda7543975

                    SHA1

                    f5598a45b101a5404126cd27fbb7f4b70861ee32

                    SHA256

                    2015b584b844b091d6a6280d45e9a589ea0feacf5f4b19bdd4cc21c60dbaaf91

                    SHA512

                    29d358ec7725038c6648251d8b9c32f3a40458e9c97926e0000ab42f0369b96d1ba5216eeb7c35800c740633dfd3b1e6e6aa73859644bdb9cdccaf2a3516bcb9

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\seoxtri5.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

                    Filesize

                    1.1MB

                    MD5

                    842039753bf41fa5e11b3a1383061a87

                    SHA1

                    3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                    SHA256

                    d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                    SHA512

                    d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\seoxtri5.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

                    Filesize

                    116B

                    MD5

                    2a461e9eb87fd1955cea740a3444ee7a

                    SHA1

                    b10755914c713f5a4677494dbe8a686ed458c3c5

                    SHA256

                    4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                    SHA512

                    34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\seoxtri5.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

                    Filesize

                    372B

                    MD5

                    bf957ad58b55f64219ab3f793e374316

                    SHA1

                    a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                    SHA256

                    bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                    SHA512

                    79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\seoxtri5.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

                    Filesize

                    17.8MB

                    MD5

                    daf7ef3acccab478aaa7d6dc1c60f865

                    SHA1

                    f8246162b97ce4a945feced27b6ea114366ff2ad

                    SHA256

                    bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                    SHA512

                    5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\seoxtri5.default-release\places.sqlite-wal

                    Filesize

                    1.3MB

                    MD5

                    e60b5df9fda1a7fe66a16c64637a5ffe

                    SHA1

                    7275806abf4d302aefe33090f8d00367b4afb0bd

                    SHA256

                    bd98230098f4ac47a00a6e2b007142019347961018dca0c5dedec193c18afa00

                    SHA512

                    ac796c8b560666ac8b945855dc381bf36f5ed03890a693ec692804d71e3feb33df274dc52ea8ccb169680c9a432710adf647339c534d5ccd45cfbfa9120e5057

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\seoxtri5.default-release\prefs-1.js

                    Filesize

                    11KB

                    MD5

                    b8e69225dcff894207f7217c76ed2aef

                    SHA1

                    b7e181ccb776e5f02087d1965d6db638fc27c050

                    SHA256

                    f2ae905ebb3aec8bf0f42d54ba257b9cc00010268bff18752d244183eb4ee837

                    SHA512

                    da249b0931afb68b69c9af507f7f108e688ad0098568f16c11bb83d26dfb1a70b70da3eadb1c0e44b0975a5ed34e42f092e9748504588d9e6b7e66d1e91e2cc6

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\seoxtri5.default-release\prefs-1.js

                    Filesize

                    13KB

                    MD5

                    41781e6a4c3d2a8aa1cdce77f70bf127

                    SHA1

                    57085ebdc659315845a67bf073028850c2cbe72c

                    SHA256

                    766a02d75ec73e40df8eed00ddf57d39ea8569623be668b689bf0944b522558a

                    SHA512

                    134dc2b22b0bb9346dd616881749cb6bc496650e926795d4e5a41ec8b9c1faf2a2f65059460bb8e91d0d4577dfcbe5ceafb797da715ef0090cf0ae268e6db353

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\seoxtri5.default-release\prefs.js

                    Filesize

                    11KB

                    MD5

                    ef63d22499a52df473520eec3bb3a057

                    SHA1

                    9b53006981e9ac26edc28c2a3c2926839965bb6a

                    SHA256

                    68192470417054c5fb750bb7cfb6b89cb18dc0537c09906f82dff8376d3b958c

                    SHA512

                    563b368db5a042f6a27a4a605863c3d10bf2ddcb85b61fca9342320c43f03428b483a7c5617ac0a369f8ed29161a8d7eba33bf6a05181e56b8d6bc9408bf46f9

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\seoxtri5.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

                    Filesize

                    1.6MB

                    MD5

                    ca17f9cfa124a0a598a9b335caadd661

                    SHA1

                    ee133183d10d45f6a6825c7799572b3d02c9ca01

                    SHA256

                    9b72fdacab3ce760ded0c790939be7894e05a433d3fcb5baa4548cb146bc1acc

                    SHA512

                    039112fbe4883cb6bc343df57322634dbd0fa3161f50e465e78a508e5c9f55bf82696a20f9f71bac56e7c7d91c4b8345ffb29a44c0c52316b2de08d21d58ce3c

                  • memory/940-87-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                    Filesize

                    972KB

                  • memory/940-70-0x0000000000400000-0x0000000000643000-memory.dmp

                    Filesize

                    2.3MB

                  • memory/940-68-0x0000000000400000-0x0000000000643000-memory.dmp

                    Filesize

                    2.3MB

                  • memory/2664-2-0x0000000000D31000-0x0000000000D5F000-memory.dmp

                    Filesize

                    184KB

                  • memory/2664-0-0x0000000000D30000-0x00000000011E5000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/2664-1-0x0000000077A46000-0x0000000077A48000-memory.dmp

                    Filesize

                    8KB

                  • memory/2664-3-0x0000000000D30000-0x00000000011E5000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/2664-5-0x0000000000D30000-0x00000000011E5000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/2664-16-0x0000000000D30000-0x00000000011E5000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/2804-86-0x0000000000460000-0x00000000006A3000-memory.dmp

                    Filesize

                    2.3MB

                  • memory/2804-503-0x0000000000460000-0x00000000006A3000-memory.dmp

                    Filesize

                    2.3MB

                  • memory/2992-43-0x0000000000400000-0x000000000052D000-memory.dmp

                    Filesize

                    1.2MB

                  • memory/2992-47-0x0000000000400000-0x000000000052D000-memory.dmp

                    Filesize

                    1.2MB

                  • memory/2992-45-0x0000000000400000-0x000000000052D000-memory.dmp

                    Filesize

                    1.2MB

                  • memory/3748-41-0x0000000000E30000-0x0000000000F62000-memory.dmp

                    Filesize

                    1.2MB

                  • memory/3748-40-0x000000007340E000-0x000000007340F000-memory.dmp

                    Filesize

                    4KB

                  • memory/4948-19-0x0000000000FE1000-0x000000000100F000-memory.dmp

                    Filesize

                    184KB

                  • memory/4948-2636-0x0000000000FE0000-0x0000000001495000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/4948-514-0x0000000000FE0000-0x0000000001495000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/4948-536-0x0000000000FE0000-0x0000000001495000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/4948-513-0x0000000000FE0000-0x0000000001495000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/4948-17-0x0000000000FE0000-0x0000000001495000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/4948-510-0x0000000000FE0000-0x0000000001495000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/4948-500-0x0000000000FE0000-0x0000000001495000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/4948-20-0x0000000000FE0000-0x0000000001495000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/4948-21-0x0000000000FE0000-0x0000000001495000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/4948-462-0x0000000000FE0000-0x0000000001495000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/4948-2662-0x0000000000FE0000-0x0000000001495000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/4948-2661-0x0000000000FE0000-0x0000000001495000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/4948-2652-0x0000000000FE0000-0x0000000001495000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/4948-1624-0x0000000000FE0000-0x0000000001495000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/4948-515-0x0000000000FE0000-0x0000000001495000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/4948-2639-0x0000000000FE0000-0x0000000001495000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/4948-2651-0x0000000000FE0000-0x0000000001495000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/4948-2650-0x0000000000FE0000-0x0000000001495000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/4948-2646-0x0000000000FE0000-0x0000000001495000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/4948-2648-0x0000000000FE0000-0x0000000001495000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/4948-2649-0x0000000000FE0000-0x0000000001495000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/5084-66-0x0000000000F20000-0x0000000000F5A000-memory.dmp

                    Filesize

                    232KB

                  • memory/5220-2645-0x0000000000FE0000-0x0000000001495000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/5220-2644-0x0000000000FE0000-0x0000000001495000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/5820-2659-0x0000000000FE0000-0x0000000001495000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/5820-2660-0x0000000000FE0000-0x0000000001495000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/6036-390-0x0000000000FE0000-0x0000000001495000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/6036-399-0x0000000000FE0000-0x0000000001495000-memory.dmp

                    Filesize

                    4.7MB