Analysis

  • max time kernel
    119s
  • max time network
    118s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-08-2024 08:10

General

  • Target

    f0c81b8c2d9d3804826e6c70a7dc11c0N.exe

  • Size

    1.8MB

  • MD5

    f0c81b8c2d9d3804826e6c70a7dc11c0

  • SHA1

    17515f05154788c2c974890c754c5a925b2f54d1

  • SHA256

    3b1d6e7f53b18c7b220d7017d996716e071ec4616d15cd117d7fc2d6fac0bdc5

  • SHA512

    3807f57b2154f2e29b78c00e11c0c95ef4f9579251804c7f2279aa63f5f36762c4e22f3f9116b11cd11fdaa8575570533fd83f2422a1317f6037560b325d7ab5

  • SSDEEP

    24576:QG52P0Ya3guZpMPl2AxWhflnUFoAXZclm3mfrbrMEALW6SSqth5vlJfp2SHkwQDY:QtSgyMPlalnUFoyUngEwW1xTpfaM

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

0657d1

C2

http://185.215.113.19

Attributes
  • install_dir

    0d8f5eb8a7

  • install_file

    explorti.exe

  • strings_key

    6c55a5f34bb433fbd933a168577b1838

  • url_paths

    /Vi9leo/index.php

rc4.plain

Extracted

Family

stealc

Botnet

nord

C2

http://185.215.113.100

Attributes
  • url_path

    /e2b1563c6670f193.php

Extracted

Family

stealc

Botnet

kora

C2

http://185.215.113.100

Attributes
  • url_path

    /e2b1563c6670f193.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Stealc

    Stealc is an infostealer written in C++.

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 8 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 6 IoCs
  • Identifies Wine through registry keys 2 TTPs 4 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 2 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • AutoIT Executable 3 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 10 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\f0c81b8c2d9d3804826e6c70a7dc11c0N.exe
    "C:\Users\Admin\AppData\Local\Temp\f0c81b8c2d9d3804826e6c70a7dc11c0N.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1468
    • C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
      "C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2500
      • C:\Users\Admin\AppData\Local\Temp\1000036001\08bc458f26.exe
        "C:\Users\Admin\AppData\Local\Temp\1000036001\08bc458f26.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1784
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          4⤵
          • Checks computer location settings
          • System Location Discovery: System Language Discovery
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:5088
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:4836
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
              6⤵
              • Checks processor information in registry
              • Modifies registry class
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:4444
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2016 -parentBuildID 20240401114208 -prefsHandle 1932 -prefMapHandle 1924 -prefsLen 23602 -prefMapSize 244628 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a36b629c-b193-4627-a20d-84f768002912} 4444 "\\.\pipe\gecko-crash-server-pipe.4444" gpu
                7⤵
                  PID:3492
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2452 -parentBuildID 20240401114208 -prefsHandle 2444 -prefMapHandle 2440 -prefsLen 24522 -prefMapSize 244628 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f385ace4-9bb2-4e39-a901-1fc7fd4d329f} 4444 "\\.\pipe\gecko-crash-server-pipe.4444" socket
                  7⤵
                    PID:2552
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3224 -childID 1 -isForBrowser -prefsHandle 3360 -prefMapHandle 1252 -prefsLen 22590 -prefMapSize 244628 -jsInitHandle 1180 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7067e201-6649-46a1-83c4-3a6682fc7398} 4444 "\\.\pipe\gecko-crash-server-pipe.4444" tab
                    7⤵
                      PID:2200
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4056 -childID 2 -isForBrowser -prefsHandle 4048 -prefMapHandle 4044 -prefsLen 29012 -prefMapSize 244628 -jsInitHandle 1180 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c6e23ec1-fedf-434f-a71d-334357bcc2aa} 4444 "\\.\pipe\gecko-crash-server-pipe.4444" tab
                      7⤵
                        PID:4456
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4764 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4744 -prefMapHandle 4760 -prefsLen 29012 -prefMapSize 244628 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {882167c8-ba94-4a84-9051-f55a73021342} 4444 "\\.\pipe\gecko-crash-server-pipe.4444" utility
                        7⤵
                        • Checks processor information in registry
                        PID:5468
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5392 -childID 3 -isForBrowser -prefsHandle 5400 -prefMapHandle 5396 -prefsLen 27039 -prefMapSize 244628 -jsInitHandle 1180 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2f0af20c-2ee7-4003-80a7-4eddfc5d83db} 4444 "\\.\pipe\gecko-crash-server-pipe.4444" tab
                        7⤵
                          PID:3540
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5532 -childID 4 -isForBrowser -prefsHandle 5540 -prefMapHandle 5544 -prefsLen 27039 -prefMapSize 244628 -jsInitHandle 1180 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {88ca338b-ec51-419a-a461-85bc40c0c601} 4444 "\\.\pipe\gecko-crash-server-pipe.4444" tab
                          7⤵
                            PID:4100
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5724 -childID 5 -isForBrowser -prefsHandle 5732 -prefMapHandle 5404 -prefsLen 27039 -prefMapSize 244628 -jsInitHandle 1180 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a8551ba6-82df-4c72-9f2e-6750cc330ae4} 4444 "\\.\pipe\gecko-crash-server-pipe.4444" tab
                            7⤵
                              PID:3160
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6212 -childID 6 -isForBrowser -prefsHandle 6192 -prefMapHandle 6184 -prefsLen 27039 -prefMapSize 244628 -jsInitHandle 1180 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {28cf2faf-a26c-446e-97e2-8309c30a29fc} 4444 "\\.\pipe\gecko-crash-server-pipe.4444" tab
                              7⤵
                                PID:5336
                      • C:\Users\Admin\1000037002\e8504f641c.exe
                        "C:\Users\Admin\1000037002\e8504f641c.exe"
                        3⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of WriteProcessMemory
                        PID:1512
                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                          4⤵
                            PID:4456
                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                            4⤵
                            • Loads dropped DLL
                            • System Location Discovery: System Language Discovery
                            • Checks processor information in registry
                            • Suspicious behavior: EnumeratesProcesses
                            PID:1680
                        • C:\Users\Admin\AppData\Local\Temp\1000038001\c842ebd6e0.exe
                          "C:\Users\Admin\AppData\Local\Temp\1000038001\c842ebd6e0.exe"
                          3⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          PID:4864
                    • C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                      C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                      1⤵
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • Suspicious behavior: EnumeratesProcesses
                      PID:1532
                    • C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                      C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                      1⤵
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • Suspicious behavior: EnumeratesProcesses
                      PID:5584

                    Network

                    MITRE ATT&CK Enterprise v15

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\ProgramData\mozglue.dll

                      Filesize

                      593KB

                      MD5

                      c8fd9be83bc728cc04beffafc2907fe9

                      SHA1

                      95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                      SHA256

                      ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                      SHA512

                      fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                    • C:\ProgramData\nss3.dll

                      Filesize

                      2.0MB

                      MD5

                      1cc453cdf74f31e4d913ff9c10acdde2

                      SHA1

                      6e85eae544d6e965f15fa5c39700fa7202f3aafe

                      SHA256

                      ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                      SHA512

                      dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                    • C:\Users\Admin\1000037002\e8504f641c.exe

                      Filesize

                      207KB

                      MD5

                      a8d6928ee3efb9ce0d4735bb7fe15d4d

                      SHA1

                      b7588c0db721613d6d878f57a79055f73a14c607

                      SHA256

                      955a439d5bd2b53a05e15f9a8cfcd769ce37e035095e2172030810ebfe46b5a0

                      SHA512

                      1f4d026ace9c9d31a6fcfedebaaed5b508d08dfd080a3e3eb15b86ddb1c89693adaa5e9e4a6edf8d0cd1457cfeb64fab6da3f68bf0f0fd754c34a18bcbf78088

                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\activity-stream.discovery_stream.json

                      Filesize

                      41KB

                      MD5

                      e41aed9d2ab8f1465e06781c9b32f3b3

                      SHA1

                      fdba6ba7be542651c83a9f5344194c98a116667d

                      SHA256

                      5205c14c560bcf735ea6dc74e9dd185758d1d829c6e91e6fc9a7e12544f13e02

                      SHA512

                      10489b9a56f9ff2d92b99991e00ab9f7f9605814362505c54916a3fae2a39d9c6fe218087379850b51a55a3ee123fa2bdb5c8375d4943b10e415ae0175344523

                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\cache2\entries\E449899591A9BC91DFBA673EC0589B51E541A88B

                      Filesize

                      13KB

                      MD5

                      0717b12b58793c3abebdfc2e6a89c154

                      SHA1

                      6774104b05e349754db3b5bc627058ef0a8ebe02

                      SHA256

                      3f6f70219040c6b1813fe3009ba7825760c346cc9aab050673655403427971c3

                      SHA512

                      97439004f38505bd8ba92af27c9d575275b0b16821a67bcfc43e55e047e42ce23b8728c2d6723b1d23e8e4b6e91c57d3d7bbe04b12cc84ea3be527cc17f5a196

                    • C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

                      Filesize

                      1.8MB

                      MD5

                      f0c81b8c2d9d3804826e6c70a7dc11c0

                      SHA1

                      17515f05154788c2c974890c754c5a925b2f54d1

                      SHA256

                      3b1d6e7f53b18c7b220d7017d996716e071ec4616d15cd117d7fc2d6fac0bdc5

                      SHA512

                      3807f57b2154f2e29b78c00e11c0c95ef4f9579251804c7f2279aa63f5f36762c4e22f3f9116b11cd11fdaa8575570533fd83f2422a1317f6037560b325d7ab5

                    • C:\Users\Admin\AppData\Local\Temp\1000036001\08bc458f26.exe

                      Filesize

                      1.2MB

                      MD5

                      75a2d87eafbefb74dc8bab6fec16cac1

                      SHA1

                      c3decd95d7e19c4dbd1d7b9e409eeb4861c6f369

                      SHA256

                      0027e27dcdc31f32e1159f82034ce00169ec7e3b487999d95997c519e0e7d40a

                      SHA512

                      1b6c9ad97b74f639d26fd6d3af7c218f04ef08b77f6d6a67c05350c2965941472592fc6cc9c878644e686532295a20cc23d95ca5db4b62a86ec440000079c5f4

                    • C:\Users\Admin\AppData\Local\Temp\1000038001\c842ebd6e0.exe

                      Filesize

                      187KB

                      MD5

                      278ee1426274818874556aa18fd02e3a

                      SHA1

                      185a2761330024dec52134df2c8388c461451acb

                      SHA256

                      37257ddb1a6f309a6e9d147b5fc2551a9cae3a0e52b191b18d9465bfcb5c18eb

                      SHA512

                      07ec6759af5b9a00d8371b9fd9b723012dd0a1614cfcc7cd51975a004f69ffb90083735e9a871a2aa0e8d28799beac53a4748f55f4dd1e7495bc7388ebf4d6a0

                    • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                      Filesize

                      479KB

                      MD5

                      09372174e83dbbf696ee732fd2e875bb

                      SHA1

                      ba360186ba650a769f9303f48b7200fb5eaccee1

                      SHA256

                      c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                      SHA512

                      b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                    • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                      Filesize

                      13.8MB

                      MD5

                      0a8747a2ac9ac08ae9508f36c6d75692

                      SHA1

                      b287a96fd6cc12433adb42193dfe06111c38eaf0

                      SHA256

                      32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                      SHA512

                      59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\AlternateServices.bin

                      Filesize

                      10KB

                      MD5

                      9d5ba9e87d526396af63dec218fe905a

                      SHA1

                      f068ac59da38a41fa18442f862440d08baed0412

                      SHA256

                      a86c4797ff891782db6612a795171fb240daaaf1fde56ca1d0b3c3def1ae856d

                      SHA512

                      4ec60f017285f3e5cdaca3e89c152ba277d4d4a339b48b4d5fa12ec376394f51133854d9e34d96de1226e33edf145c5085a26891db899d4927ec8b02c517cd34

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\cookies.sqlite

                      Filesize

                      512KB

                      MD5

                      2974d52b8f8a3a53836461fb03acb9e8

                      SHA1

                      79a2bf92863de9eadfa740e0f8efa28a4701774b

                      SHA256

                      e3c367eba4073f3480e0c38fb71fd9703c9ad14eaf8a2160a65368e8f1628749

                      SHA512

                      5af11b90ca0db0f886a9d6ccb5ab4c5e42b768b142aa6abacb6b2d56cb0145687157d6dcd064ffa4260c2802c2322b9abe84a7afc5c865a5aa878ee101155a5d

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\cookies.sqlite-wal

                      Filesize

                      512KB

                      MD5

                      97a46af9d60ac374a5445013a8d2389f

                      SHA1

                      25a99001ed3fde3e105a2b3c06a351199d10878b

                      SHA256

                      98a92311a13feddbb1fbf2ff441c7e4e8639b3a8389f39851b7bf28f7476bc33

                      SHA512

                      ecfde194067c3886d45471246b0119730e9975499149c3d2c01683655497820f898c6c4db3bb7f24f3d598ed7a9cf933f95dfcc81a1364fab07ba7d1ddb0a8b1

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\datareporting\glean\db\data.safe.tmp

                      Filesize

                      16KB

                      MD5

                      be779bdd46415689c3f383bcf5cc9f45

                      SHA1

                      2da1112b127b161f93258b223f01c1798f20e4fd

                      SHA256

                      fe22efba00bd5dc1618f54c613e3c8d3bdeb5604836a94ea21873b4616bd36da

                      SHA512

                      9d173ab4826b14e0351732ff0372ddcf8f604c633b62816a5329d31ae7e6d6cec1453db99db75af0a8a2f470459319f2232a915353c43dd8a5824f348e74a94e

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\datareporting\glean\db\data.safe.tmp

                      Filesize

                      5KB

                      MD5

                      a89887a6d1c91ae6ad1608e2ac1ae5ba

                      SHA1

                      913d52e99d85c27b49e5f7a6e75baebeb58a644b

                      SHA256

                      99531f8e05a91c72d376bbce01164f450c6803f8796e9ef29f54a562354ec7a0

                      SHA512

                      af0e527ad4fc17baa7444d781d8bdc666c15223635800b40fca509b46882bf2f261dca4f699d8b3b3ad14f0d1bef94b19c40800170bb20e37968de5461d77acc

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\datareporting\glean\pending_pings\36d7441e-01c8-4683-8ef2-188c0ce1fa92

                      Filesize

                      982B

                      MD5

                      5aaabcd2569316a7b5d483697efd088e

                      SHA1

                      3cf04b836126f7c997706947f1f6fa40fe4a96b7

                      SHA256

                      32e4f8ccf161b519d1106810c963fbca6cb48bca7704cfe342f56ba3e4a66582

                      SHA512

                      858da76c6b909a17e1fbdecbc8982757aa980d010476d581eac2e72ef6ea0e41b17aed7e84044c528dd43c3e17c86e0a4f4e44de1b54220998af84897233f245

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\datareporting\glean\pending_pings\7789eac8-e1c7-48e7-873d-338d235e5706

                      Filesize

                      671B

                      MD5

                      0ef90b4ff16807d6f73c5afb616b020a

                      SHA1

                      55575525238bca30eb41155de5c578e4a763fd38

                      SHA256

                      0a45cdfaaa37b16e30b72aa6d121bf160bd4caaf3a4b7e2abb46197c1a74d603

                      SHA512

                      49d51148ae7ab834caf3bff5629735d63a7907abf21589d039272d92d9a2d986faa23dbee4b57286756a4b8f272f556f66303480222aa980fb5e033a58057d09

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\datareporting\glean\pending_pings\a48c6efb-dafc-47d5-aad4-c151e85676ee

                      Filesize

                      27KB

                      MD5

                      a6e9f5cae82b56f9380464b0c1f54aa3

                      SHA1

                      1e0598e702cf193bfb075f547c37c1796eaa7d50

                      SHA256

                      2286b7f28b567e83c3ed2927d4629964fca202c2a06a0544b9d26a2efb648fff

                      SHA512

                      8ac7c8e51e9bbdd1d4391474605e19c8dec7a32ce57614a51f6ae2e7bca1f55fd4860fd7c13148aa15e1f3f63e77cdf44ea29e06ff9a8a340d8d50c1c4d2d109

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\formhistory.sqlite

                      Filesize

                      256KB

                      MD5

                      97c1441748d6cc3e5a7030cda7543975

                      SHA1

                      f5598a45b101a5404126cd27fbb7f4b70861ee32

                      SHA256

                      2015b584b844b091d6a6280d45e9a589ea0feacf5f4b19bdd4cc21c60dbaaf91

                      SHA512

                      29d358ec7725038c6648251d8b9c32f3a40458e9c97926e0000ab42f0369b96d1ba5216eeb7c35800c740633dfd3b1e6e6aa73859644bdb9cdccaf2a3516bcb9

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

                      Filesize

                      1.1MB

                      MD5

                      842039753bf41fa5e11b3a1383061a87

                      SHA1

                      3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                      SHA256

                      d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                      SHA512

                      d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

                      Filesize

                      116B

                      MD5

                      2a461e9eb87fd1955cea740a3444ee7a

                      SHA1

                      b10755914c713f5a4677494dbe8a686ed458c3c5

                      SHA256

                      4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                      SHA512

                      34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

                      Filesize

                      372B

                      MD5

                      bf957ad58b55f64219ab3f793e374316

                      SHA1

                      a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                      SHA256

                      bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                      SHA512

                      79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

                      Filesize

                      17.8MB

                      MD5

                      daf7ef3acccab478aaa7d6dc1c60f865

                      SHA1

                      f8246162b97ce4a945feced27b6ea114366ff2ad

                      SHA256

                      bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                      SHA512

                      5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\places.sqlite-wal

                      Filesize

                      1.3MB

                      MD5

                      e1f7f7ad08180a32892fb02626d74aec

                      SHA1

                      9bc2d488b946e6bf223dc8f07883eb7ca9067ce6

                      SHA256

                      4ae0abadb4390ac3ebaa8c92550b5385490952a87a6d75f0246711ca56edb58b

                      SHA512

                      db58a41cb020390d49e9653fe33b16077c771fe6384b7a5488ffb54bb471aa56e36efd524bb870e08c6c0e2f38c8408e92133b00a4f865100a04b2e430928f5e

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\prefs-1.js

                      Filesize

                      11KB

                      MD5

                      f41bd91642310cd2c82247b218adcb29

                      SHA1

                      ff33b40f3ad7ac68c14b8fe3713fe038003390e9

                      SHA256

                      45b8a79fe0e30bb581a4659458a018d1c633d96c459082167f1a47f8f64d7b35

                      SHA512

                      a7a176ba1b511d777509785f952c187428a34b92d2046c3efb2fd5c56001d920e1acca772a3dd6667f34eb25627c0e18c46a4e8c945c9b06b2de24bb4c204fca

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\prefs-1.js

                      Filesize

                      16KB

                      MD5

                      93ff4e854647839c4cb1cf6503e60e45

                      SHA1

                      1ff37dbd1f0ff3db2b0db55d50c16fc6655dc8f6

                      SHA256

                      189544aff4304705ca64cb5b82e044e4bbb6a1e7f4c81140af45625042bd880b

                      SHA512

                      84bcb3a3d4a8f4aa57cafb4862c16149f29e01bfb88623b3503a28fb51942dc9e2709dcd8465a880918f4c3a3d6b630266b29c9e46efff29314f4018fbd6f5c1

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\prefs.js

                      Filesize

                      11KB

                      MD5

                      2762528884c7c063994166752625e130

                      SHA1

                      579de7cf3eaa8552faafeb0304bd567d027f02e7

                      SHA256

                      121218ec29eaf7448261b752aedbf6223cd21bb740ea77d52f759b806551117d

                      SHA512

                      2011a8f52b7dda9d36d6c3ddfade5e1d9e4daf6b76335ebfcd751d91533fa3e0f2307142c72e3fb7911031bdd4a71bff205c899da53c1854143330198741d561

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\prefs.js

                      Filesize

                      11KB

                      MD5

                      fa5c863635e3b1c945b6245fdf0a5c57

                      SHA1

                      8ae4ea5dc6cdb63e742a5bc0316544a18e4ed1d1

                      SHA256

                      63a92478ae4145f6a8af1e3ad71c8dc617401d8e90797f586a408ea84e34544d

                      SHA512

                      b39aca32eee8853df84561816bf25e95cf2e40fcdef90c0cb7ce9230a63b12ef49c302084b98b98a3548cbfa0e4e6bc754d1cac064431574afc83a7b10be4863

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\prefs.js

                      Filesize

                      15KB

                      MD5

                      dda55429916b4d413fbbb34c48ab75c1

                      SHA1

                      77baea4aeb4b59d2dc926216dc4ab7e836df34af

                      SHA256

                      36311851256bf2862a057dde3a03f3e0770b6a4d9d41df1c0f36fc9ba2d7ae6e

                      SHA512

                      057b0e06a15a1e482015fa9606c51e944720232ce9b753a60ca46f68352a6ae1e73530c9eb8e1053e431602ffd9654a556e943ebf995b8bdff066b9f999904bd

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\prefs.js

                      Filesize

                      11KB

                      MD5

                      64b3484d426280deedb3d71bacc4e9a9

                      SHA1

                      9d3be36b11757f2d085cd7f0161d01f65e903da7

                      SHA256

                      68a2ea930ca987b8a03064f8b4b233f8b5a1843f1dc5145a8a0add6cc8a042e2

                      SHA512

                      4152bc0f94b601631296cac14f2519eaf9a4039c6ffa687681af14ec727c8497499b367b512924350806995b614ad0f16e81c8c9802453a00fec6a60394daa74

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\sessionstore-backups\recovery.baklz4

                      Filesize

                      5KB

                      MD5

                      758068509ace5fb27afc822df5a707bf

                      SHA1

                      c6be17f5214b2798b089833f99ff2ec7fcbed12e

                      SHA256

                      3ba8ae4a5543a53b4134e67e6b3fd746285306815b700bebb4600acd3ff03b96

                      SHA512

                      a83417364010aafb0dcae28d8b17180c0dd9b3d132b9c9fb27d1faf909165010f19e34ad4803dcdf9dd9452329611ece6bee0eaf10374730947ed8e8d31b1748

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

                      Filesize

                      1.6MB

                      MD5

                      c2f9362ed2803ad5ca1c013ddc09b12c

                      SHA1

                      cf4c1338c00a42e1a521c82b474ef5c76d35c65c

                      SHA256

                      c277c362e67ab8f50bd0e1256bc574fcd7c3d540f482d0ade238ab7622edd889

                      SHA512

                      e211d5c711b11685f787538c4c2314d6a167d99a489f37369230ea7ec0ff9c70967465602aabfb90c82f74c8dcbcab141c7025dcba5fa22130dacac69693fc67

                    • memory/1468-0-0x0000000000A90000-0x0000000000F4A000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/1468-16-0x0000000000A90000-0x0000000000F4A000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/1468-5-0x0000000000A90000-0x0000000000F4A000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/1468-3-0x0000000000A90000-0x0000000000F4A000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/1468-2-0x0000000000A91000-0x0000000000ABF000-memory.dmp

                      Filesize

                      184KB

                    • memory/1468-1-0x0000000077914000-0x0000000077916000-memory.dmp

                      Filesize

                      8KB

                    • memory/1512-66-0x0000000000FB0000-0x0000000000FEA000-memory.dmp

                      Filesize

                      232KB

                    • memory/1532-487-0x0000000000D50000-0x000000000120A000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/1532-488-0x0000000000D50000-0x000000000120A000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/1680-87-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                      Filesize

                      972KB

                    • memory/1680-68-0x0000000000400000-0x0000000000643000-memory.dmp

                      Filesize

                      2.3MB

                    • memory/1680-70-0x0000000000400000-0x0000000000643000-memory.dmp

                      Filesize

                      2.3MB

                    • memory/1784-40-0x000000007352E000-0x000000007352F000-memory.dmp

                      Filesize

                      4KB

                    • memory/1784-41-0x0000000000D30000-0x0000000000E62000-memory.dmp

                      Filesize

                      1.2MB

                    • memory/2500-17-0x0000000000D50000-0x000000000120A000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/2500-1902-0x0000000000D50000-0x000000000120A000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/2500-2742-0x0000000000D50000-0x000000000120A000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/2500-567-0x0000000000D50000-0x000000000120A000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/2500-554-0x0000000000D50000-0x000000000120A000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/2500-2741-0x0000000000D50000-0x000000000120A000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/2500-2740-0x0000000000D50000-0x000000000120A000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/2500-2737-0x0000000000D50000-0x000000000120A000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/2500-553-0x0000000000D50000-0x000000000120A000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/2500-2553-0x0000000000D50000-0x000000000120A000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/2500-21-0x0000000000D50000-0x000000000120A000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/2500-19-0x0000000000D51000-0x0000000000D7F000-memory.dmp

                      Filesize

                      184KB

                    • memory/2500-20-0x0000000000D50000-0x000000000120A000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/2500-859-0x0000000000D50000-0x000000000120A000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/2500-483-0x0000000000D50000-0x000000000120A000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/2500-1409-0x0000000000D50000-0x000000000120A000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/2500-476-0x0000000000D50000-0x000000000120A000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/4864-552-0x00000000006D0000-0x0000000000913000-memory.dmp

                      Filesize

                      2.3MB

                    • memory/4864-86-0x00000000006D0000-0x0000000000913000-memory.dmp

                      Filesize

                      2.3MB

                    • memory/5088-43-0x0000000000400000-0x000000000052D000-memory.dmp

                      Filesize

                      1.2MB

                    • memory/5088-45-0x0000000000400000-0x000000000052D000-memory.dmp

                      Filesize

                      1.2MB

                    • memory/5088-47-0x0000000000400000-0x000000000052D000-memory.dmp

                      Filesize

                      1.2MB

                    • memory/5584-2706-0x0000000000D50000-0x000000000120A000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/5584-2714-0x0000000000D50000-0x000000000120A000-memory.dmp

                      Filesize

                      4.7MB