Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-08-2024 10:02

General

  • Target

    9bb50c79fcd5eb36eeacb3977ab999d0b63fcf95c1e3cc54447b9fb3dfe336bf.exe

  • Size

    1.8MB

  • MD5

    8f051507449e73b6415351694009fb14

  • SHA1

    44beb908fb82d6eafd3050544695b6ffde58c50c

  • SHA256

    9bb50c79fcd5eb36eeacb3977ab999d0b63fcf95c1e3cc54447b9fb3dfe336bf

  • SHA512

    d8b4aa25dcb073a09d2ae78de0a9eb50e3ea744a65853ed61e5a6a9c6389495b1979cd9ba6f976b2c2cc4b65c588fa62a8482b3a7ffca83cff1499c1394d6a31

  • SSDEEP

    49152:giC9An4RqHLNifybQPOG15yY7qtS4ai3B9moryzTVNL5:Hf4RqHgmQ2EB2B9DryzBNL5

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

0657d1

C2

http://185.215.113.19

Attributes
  • install_dir

    0d8f5eb8a7

  • install_file

    explorti.exe

  • strings_key

    6c55a5f34bb433fbd933a168577b1838

  • url_paths

    /Vi9leo/index.php

rc4.plain

Extracted

Family

stealc

Botnet

nord

C2

http://185.215.113.100

Attributes
  • url_path

    /e2b1563c6670f193.php

Extracted

Family

stealc

Botnet

kora

C2

http://185.215.113.100

Attributes
  • url_path

    /e2b1563c6670f193.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Stealc

    Stealc is an infostealer written in C++.

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 8 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 6 IoCs
  • Identifies Wine through registry keys 2 TTPs 4 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • AutoIT Executable 3 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\9bb50c79fcd5eb36eeacb3977ab999d0b63fcf95c1e3cc54447b9fb3dfe336bf.exe
    "C:\Users\Admin\AppData\Local\Temp\9bb50c79fcd5eb36eeacb3977ab999d0b63fcf95c1e3cc54447b9fb3dfe336bf.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:1672
    • C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
      "C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2028
      • C:\Users\Admin\AppData\Local\Temp\1000036001\5dc03dbeaa.exe
        "C:\Users\Admin\AppData\Local\Temp\1000036001\5dc03dbeaa.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2136
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          4⤵
            PID:1260
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
            4⤵
            • Checks computer location settings
            • System Location Discovery: System Language Discovery
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of WriteProcessMemory
            PID:4840
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:1712
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
                6⤵
                • Checks processor information in registry
                • Modifies registry class
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:4744
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2032 -parentBuildID 20240401114208 -prefsHandle 1948 -prefMapHandle 1940 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {53cd63bd-7d36-4592-8d1d-f09f8702cf73} 4744 "\\.\pipe\gecko-crash-server-pipe.4744" gpu
                  7⤵
                    PID:2816
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2468 -parentBuildID 20240401114208 -prefsHandle 2460 -prefMapHandle 2456 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cded2ef1-25bc-42b3-bf8d-ccdfae4dd588} 4744 "\\.\pipe\gecko-crash-server-pipe.4744" socket
                    7⤵
                      PID:4964
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2844 -childID 1 -isForBrowser -prefsHandle 2976 -prefMapHandle 1452 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4a8b8e0c-053e-4b43-9f62-de07aea41d70} 4744 "\\.\pipe\gecko-crash-server-pipe.4744" tab
                      7⤵
                        PID:2660
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3856 -childID 2 -isForBrowser -prefsHandle 3848 -prefMapHandle 2928 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1d6a7056-f96a-4cfc-b3b5-3b6838778903} 4744 "\\.\pipe\gecko-crash-server-pipe.4744" tab
                        7⤵
                          PID:60
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4800 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4792 -prefMapHandle 4192 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2ef2c871-5550-41fa-8530-73cc6113471c} 4744 "\\.\pipe\gecko-crash-server-pipe.4744" utility
                          7⤵
                          • Checks processor information in registry
                          PID:5376
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5268 -childID 3 -isForBrowser -prefsHandle 5396 -prefMapHandle 5416 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {110df10c-65ab-474e-bc84-2d98eca79637} 4744 "\\.\pipe\gecko-crash-server-pipe.4744" tab
                          7⤵
                            PID:5872
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5540 -childID 4 -isForBrowser -prefsHandle 5548 -prefMapHandle 5552 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b2ca0008-79ad-4493-a3c3-c8768fc0c0eb} 4744 "\\.\pipe\gecko-crash-server-pipe.4744" tab
                            7⤵
                              PID:5884
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5720 -childID 5 -isForBrowser -prefsHandle 5764 -prefMapHandle 5768 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a68c552d-dfb4-4b63-8094-69c462e71725} 4744 "\\.\pipe\gecko-crash-server-pipe.4744" tab
                              7⤵
                                PID:5896
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6320 -childID 6 -isForBrowser -prefsHandle 6248 -prefMapHandle 6252 -prefsLen 27182 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {90026601-6797-42c9-a5f5-48152472f083} 4744 "\\.\pipe\gecko-crash-server-pipe.4744" tab
                                7⤵
                                  PID:4540
                        • C:\Users\Admin\1000037002\0ae611e92b.exe
                          "C:\Users\Admin\1000037002\0ae611e92b.exe"
                          3⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of WriteProcessMemory
                          PID:4468
                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                            4⤵
                              PID:3096
                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                              4⤵
                                PID:1176
                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                4⤵
                                • System Location Discovery: System Language Discovery
                                PID:1432
                            • C:\Users\Admin\AppData\Local\Temp\1000038001\accebe5e21.exe
                              "C:\Users\Admin\AppData\Local\Temp\1000038001\accebe5e21.exe"
                              3⤵
                              • Executes dropped EXE
                              • System Location Discovery: System Language Discovery
                              PID:3640
                        • C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                          C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                          1⤵
                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                          • Checks BIOS information in registry
                          • Executes dropped EXE
                          • Identifies Wine through registry keys
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          • Suspicious behavior: EnumeratesProcesses
                          PID:5820
                        • C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                          C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                          1⤵
                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                          • Checks BIOS information in registry
                          • Executes dropped EXE
                          • Identifies Wine through registry keys
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          • Suspicious behavior: EnumeratesProcesses
                          PID:1492

                        Network

                        MITRE ATT&CK Enterprise v15

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\Users\Admin\1000037002\0ae611e92b.exe

                          Filesize

                          207KB

                          MD5

                          fa5cd7b86d35c07d61b9251b3d6813f8

                          SHA1

                          d484235241beade85f2ede79d38ba56dce5d59c7

                          SHA256

                          1233bbb7a019e56b109ca8606b713aabce6262fb7ff45ea4c854f15380843a96

                          SHA512

                          572d502952a422f23bf7d5f633833808d710c934df96cebe2d2fdc938cf4bf585e69ce9c492bc2aa06400eaf34e901ca7b18d9893a47dfa811ac3059023af36d

                        • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\lirn7gz7.default-release\activity-stream.discovery_stream.json

                          Filesize

                          44KB

                          MD5

                          7e6b3269e2eec67152ca4d906d948dc2

                          SHA1

                          29a27c679dfe1dec37ef4c048e34e376e7c20241

                          SHA256

                          19e8d54344cf51bf43bf6dbd9534395127d73cfba01ff9671f05266a11db7bc2

                          SHA512

                          2beb916c06cc14f2f832a9bbe18f9ada528341267fcbaf877f2654c1ba6357aa18f1696b032e2d966a4259902f5806def87e71a16dd5f38006d043563c127cb2

                        • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\lirn7gz7.default-release\cache2\entries\E449899591A9BC91DFBA673EC0589B51E541A88B

                          Filesize

                          13KB

                          MD5

                          8653104a1496003ba7bdd0f0fd24ae2a

                          SHA1

                          c29c906516f252bcc0e1cb3bc98250082a96c1ef

                          SHA256

                          f45df1c398c4a6f5cb06434a7e305637152fe990780d60d6ada548b16cfd8bc4

                          SHA512

                          2627fcb1cc97b5558f84cbfe837537123f64bc44c5276bc3e840e60b6cb70695333e9826098b47d7694cda7c497de946d106c85c89963637db3990070919e89e

                        • C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

                          Filesize

                          1.8MB

                          MD5

                          8f051507449e73b6415351694009fb14

                          SHA1

                          44beb908fb82d6eafd3050544695b6ffde58c50c

                          SHA256

                          9bb50c79fcd5eb36eeacb3977ab999d0b63fcf95c1e3cc54447b9fb3dfe336bf

                          SHA512

                          d8b4aa25dcb073a09d2ae78de0a9eb50e3ea744a65853ed61e5a6a9c6389495b1979cd9ba6f976b2c2cc4b65c588fa62a8482b3a7ffca83cff1499c1394d6a31

                        • C:\Users\Admin\AppData\Local\Temp\1000036001\5dc03dbeaa.exe

                          Filesize

                          1.2MB

                          MD5

                          a97c9397775e0bf9e8270435d4a10385

                          SHA1

                          fc5479bffdf093b01b116a5c11afa5d4bbddbcfd

                          SHA256

                          2c84872454e51e5b18e070e7305edf9a164c9e8046d2606335bfe424c748856f

                          SHA512

                          d413e31614513d900c17a9fbbc8b9ae17f87bae0047f344897bebdc1612f2e532be27c165a7675a8410f8626e070ee89e287d173a727d26334ab05168d39e8ed

                        • C:\Users\Admin\AppData\Local\Temp\1000038001\accebe5e21.exe

                          Filesize

                          187KB

                          MD5

                          278ee1426274818874556aa18fd02e3a

                          SHA1

                          185a2761330024dec52134df2c8388c461451acb

                          SHA256

                          37257ddb1a6f309a6e9d147b5fc2551a9cae3a0e52b191b18d9465bfcb5c18eb

                          SHA512

                          07ec6759af5b9a00d8371b9fd9b723012dd0a1614cfcc7cd51975a004f69ffb90083735e9a871a2aa0e8d28799beac53a4748f55f4dd1e7495bc7388ebf4d6a0

                        • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                          Filesize

                          479KB

                          MD5

                          09372174e83dbbf696ee732fd2e875bb

                          SHA1

                          ba360186ba650a769f9303f48b7200fb5eaccee1

                          SHA256

                          c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                          SHA512

                          b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                        • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                          Filesize

                          13.8MB

                          MD5

                          0a8747a2ac9ac08ae9508f36c6d75692

                          SHA1

                          b287a96fd6cc12433adb42193dfe06111c38eaf0

                          SHA256

                          32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                          SHA512

                          59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\AlternateServices.bin

                          Filesize

                          10KB

                          MD5

                          5cee3d2234fa5dece3f77dcdb995e915

                          SHA1

                          6afc08b6064e19c113866a61c8558b3879f2f51e

                          SHA256

                          86da902ed7a948dd803a1fcf694d6ce742a4351621dd6081da7e4aaa2775ef4c

                          SHA512

                          cab7a8a5c7038d341475bf88874136752828818f6bc8b524dbe3912063a5a02c4830ed7be8ff322d466e8d93c3927632e6ad42176fb672344942e269c2e9743d

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\db\data.safe.tmp

                          Filesize

                          5KB

                          MD5

                          5fb58c20572ac69a496706caa2315785

                          SHA1

                          77213f70ebe1a667601c2905395defce7af52309

                          SHA256

                          e66abd12bfd862903defbf020d9467b5d1bf9f49b2fc65b50a45d69215ac70f3

                          SHA512

                          76d6b48159197da3e10e1d9f3604c67dd63faa309d7d0c0659275cfdb27311b05c7be8c2e701ce80727088173d17e4d5e11fec4e68bef75e3158fe4860ca79f1

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\db\data.safe.tmp

                          Filesize

                          16KB

                          MD5

                          9d14af02283d4488bf4529b2900a6f0b

                          SHA1

                          ed6d11195c47b3c5d08ba64f519aa91fa41a7dbb

                          SHA256

                          0ed334463426583113e81b765a64b845986af2c7f7f493ef170fa52eecc68ee5

                          SHA512

                          422dc9b33635ed7d9929aaf0e7c4d1317dd5d697ce04a0dd46c4e529e48580555795e90bd9082d4488237ea494eade974e097ef28242ccc005fb29b2e7032e1c

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\db\data.safe.tmp

                          Filesize

                          16KB

                          MD5

                          756111da4fc5c532cb635ffaa4bca8db

                          SHA1

                          06ef7dd40c5d4e85c11d644f129759fcc153f349

                          SHA256

                          dcef3ffbd4c748c505e47b9d19374fe7441e960c6645d1f898116c7462fd3f45

                          SHA512

                          3411fb86bfbadfdc6497d641fe65eec3cd19e7af22c84e9ddab200150981c18e7e8a6c210e0cab6007076a3bbf4840a6a3e7c8a59f2a2f4846298ab17cc521bc

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\pending_pings\9fea4a10-3057-40a9-90f8-a1f3f28579fd

                          Filesize

                          27KB

                          MD5

                          1c4060bed0d42b614640cd9b8aac946c

                          SHA1

                          b995a82329bce5e81830f91ba701e454ce9b33f7

                          SHA256

                          c76e38ebcaacab6f606cb6e06424a9910fd4d08a67bec4c66538d5f7726354c3

                          SHA512

                          b9310449b370df2630a894bc0de162cd83668926e1ad2de2b4e014be4d5243bd65cbc58995d2cea4866a68c4fb01ea2d233c81649766621271a5a98fdc37ac81

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\pending_pings\ae5cb4ff-e892-4b0a-86b5-d13936e28ebe

                          Filesize

                          982B

                          MD5

                          efc930c48f415ea531d8987563fdb8e1

                          SHA1

                          cbbe7dd2496aa3bbcdc2e5d758dcfa17fcb2c061

                          SHA256

                          3cf3e41ea1f56c330b209374fe55563e01b18a9136a35c56cd837ffc1b3bc99f

                          SHA512

                          f72607a35b59814524917b9c73cdb35f63fd9a55ba4e0f7d921ea8663699a6000abb150a5df62c03f38f76d5cb3cc959228f1bb4cb772fe56236c668727e07bd

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\pending_pings\bd175d18-314f-45e1-9c16-56b5cb2be649

                          Filesize

                          671B

                          MD5

                          6e7b03d91cc96eceda2dea3a0605fcf0

                          SHA1

                          8db9e9677f8df5c75e9614d83778105e3f8f65a1

                          SHA256

                          0da2f355bebadce6b46dc9ea957d09003755b6bfb3d765809fd8569700510781

                          SHA512

                          a15be2d11e0996ba70326ea8aa949611d84fae678c6f91236b6db1e1d8d3429eab54b1844ab22bd312d0dcc8e24197fb0c1044b3c50eb5ad3e3d1f4f7bdc00c0

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

                          Filesize

                          1.1MB

                          MD5

                          842039753bf41fa5e11b3a1383061a87

                          SHA1

                          3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                          SHA256

                          d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                          SHA512

                          d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

                          Filesize

                          116B

                          MD5

                          2a461e9eb87fd1955cea740a3444ee7a

                          SHA1

                          b10755914c713f5a4677494dbe8a686ed458c3c5

                          SHA256

                          4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                          SHA512

                          34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

                          Filesize

                          372B

                          MD5

                          bf957ad58b55f64219ab3f793e374316

                          SHA1

                          a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                          SHA256

                          bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                          SHA512

                          79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

                          Filesize

                          17.8MB

                          MD5

                          daf7ef3acccab478aaa7d6dc1c60f865

                          SHA1

                          f8246162b97ce4a945feced27b6ea114366ff2ad

                          SHA256

                          bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                          SHA512

                          5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\prefs-1.js

                          Filesize

                          11KB

                          MD5

                          0076fdf23f5c7feebdb0107a2192e98e

                          SHA1

                          222402f9d190fb93f68fd28dcbf0526349f68c0d

                          SHA256

                          6506573771271af192410bcab8b451702969943a56b0f3628d6f852871a7d7c0

                          SHA512

                          4dc2abab28878a260e53a8c12f2f19085e603ee9101267b5615124673e6e57ff935e0ebac39b62b906b42d031456af1fcf83dce68d4d2c0aafedace1cfbec3be

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\prefs-1.js

                          Filesize

                          13KB

                          MD5

                          4a0812199810a580a24151d7788aafe7

                          SHA1

                          3f1d35c9fbe34b13a5a45484e27f97951ffa0ce8

                          SHA256

                          dfb34bcfbadefc32f7c661cede992d214add39c53b8b2c3e3e2304b18912b22b

                          SHA512

                          0983c12ae117a2e02291a6a8088e957432c160c269e0bc2ed952b1b7e2324482f87969977870d6f1821b38a3bdae5eb0790e39e73c83d6e35371b1be4f619301

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\prefs-1.js

                          Filesize

                          16KB

                          MD5

                          b8dc72a757f11f8c727a136af1afd534

                          SHA1

                          72f21bd3ea65de67c362304d4d5dee8c5c504da4

                          SHA256

                          6a70b7ab004f977aaeb6904b43ab12e549adb9be08d49dae7f9ecde8c68d52fa

                          SHA512

                          fdf036dc98f1bd5c2f058da124d17a99ca97ec4cd7f747d1e4e8baf324ae0de164249ab974cf47151b72f4d5c7cf0276055ca0cc1f7ab425e93e3f90a8092737

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\prefs.js

                          Filesize

                          11KB

                          MD5

                          e11fdb42a40d05139c422a5bb087c212

                          SHA1

                          e3b1cf39ff206441772eeb28cfdaf2e4bf83cc8c

                          SHA256

                          d79409af475ad0f211bf2b9cf248b71781dacf2278b91130260ad794fb32a23f

                          SHA512

                          5ec91a2f31781172cb60339c37743d43a2fa5947a619fcc7ef28b2dda5064ff28bdc382c10d3f26261152177e74158bf8a5232cf2aa0c7c2802eccec6eec78c3

                        • memory/1432-71-0x0000000000400000-0x0000000000643000-memory.dmp

                          Filesize

                          2.3MB

                        • memory/1432-69-0x0000000000400000-0x0000000000643000-memory.dmp

                          Filesize

                          2.3MB

                        • memory/1492-2670-0x0000000000850000-0x0000000000D04000-memory.dmp

                          Filesize

                          4.7MB

                        • memory/1492-2669-0x0000000000850000-0x0000000000D04000-memory.dmp

                          Filesize

                          4.7MB

                        • memory/1672-17-0x0000000000E90000-0x0000000001344000-memory.dmp

                          Filesize

                          4.7MB

                        • memory/1672-1-0x0000000077354000-0x0000000077356000-memory.dmp

                          Filesize

                          8KB

                        • memory/1672-2-0x0000000000E91000-0x0000000000EBF000-memory.dmp

                          Filesize

                          184KB

                        • memory/1672-3-0x0000000000E90000-0x0000000001344000-memory.dmp

                          Filesize

                          4.7MB

                        • memory/1672-0-0x0000000000E90000-0x0000000001344000-memory.dmp

                          Filesize

                          4.7MB

                        • memory/1672-4-0x0000000000E90000-0x0000000001344000-memory.dmp

                          Filesize

                          4.7MB

                        • memory/2028-424-0x0000000000850000-0x0000000000D04000-memory.dmp

                          Filesize

                          4.7MB

                        • memory/2028-2664-0x0000000000850000-0x0000000000D04000-memory.dmp

                          Filesize

                          4.7MB

                        • memory/2028-446-0x0000000000850000-0x0000000000D04000-memory.dmp

                          Filesize

                          4.7MB

                        • memory/2028-447-0x0000000000850000-0x0000000000D04000-memory.dmp

                          Filesize

                          4.7MB

                        • memory/2028-452-0x0000000000850000-0x0000000000D04000-memory.dmp

                          Filesize

                          4.7MB

                        • memory/2028-2678-0x0000000000850000-0x0000000000D04000-memory.dmp

                          Filesize

                          4.7MB

                        • memory/2028-22-0x0000000000850000-0x0000000000D04000-memory.dmp

                          Filesize

                          4.7MB

                        • memory/2028-21-0x0000000000850000-0x0000000000D04000-memory.dmp

                          Filesize

                          4.7MB

                        • memory/2028-19-0x0000000000851000-0x000000000087F000-memory.dmp

                          Filesize

                          184KB

                        • memory/2028-20-0x0000000000850000-0x0000000000D04000-memory.dmp

                          Filesize

                          4.7MB

                        • memory/2028-2677-0x0000000000850000-0x0000000000D04000-memory.dmp

                          Filesize

                          4.7MB

                        • memory/2028-18-0x0000000000850000-0x0000000000D04000-memory.dmp

                          Filesize

                          4.7MB

                        • memory/2028-2671-0x0000000000850000-0x0000000000D04000-memory.dmp

                          Filesize

                          4.7MB

                        • memory/2028-2668-0x0000000000850000-0x0000000000D04000-memory.dmp

                          Filesize

                          4.7MB

                        • memory/2028-2666-0x0000000000850000-0x0000000000D04000-memory.dmp

                          Filesize

                          4.7MB

                        • memory/2028-2665-0x0000000000850000-0x0000000000D04000-memory.dmp

                          Filesize

                          4.7MB

                        • memory/2028-1075-0x0000000000850000-0x0000000000D04000-memory.dmp

                          Filesize

                          4.7MB

                        • memory/2028-2163-0x0000000000850000-0x0000000000D04000-memory.dmp

                          Filesize

                          4.7MB

                        • memory/2028-445-0x0000000000850000-0x0000000000D04000-memory.dmp

                          Filesize

                          4.7MB

                        • memory/2028-2662-0x0000000000850000-0x0000000000D04000-memory.dmp

                          Filesize

                          4.7MB

                        • memory/2028-2656-0x0000000000850000-0x0000000000D04000-memory.dmp

                          Filesize

                          4.7MB

                        • memory/2136-42-0x0000000000BA0000-0x0000000000CD2000-memory.dmp

                          Filesize

                          1.2MB

                        • memory/2136-41-0x0000000072F6E000-0x0000000072F6F000-memory.dmp

                          Filesize

                          4KB

                        • memory/3640-88-0x0000000000B20000-0x0000000000D63000-memory.dmp

                          Filesize

                          2.3MB

                        • memory/3640-87-0x0000000000B20000-0x0000000000D63000-memory.dmp

                          Filesize

                          2.3MB

                        • memory/4468-67-0x00000000004B0000-0x00000000004EA000-memory.dmp

                          Filesize

                          232KB

                        • memory/4840-48-0x0000000000400000-0x000000000052D000-memory.dmp

                          Filesize

                          1.2MB

                        • memory/4840-46-0x0000000000400000-0x000000000052D000-memory.dmp

                          Filesize

                          1.2MB

                        • memory/4840-44-0x0000000000400000-0x000000000052D000-memory.dmp

                          Filesize

                          1.2MB

                        • memory/5820-2390-0x0000000000850000-0x0000000000D04000-memory.dmp

                          Filesize

                          4.7MB

                        • memory/5820-2347-0x0000000000850000-0x0000000000D04000-memory.dmp

                          Filesize

                          4.7MB