Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-08-2024 19:09

General

  • Target

    bbaa6d9a443b8d2c74ac44dc498347db9b1286a931dc0f7c900e0570352af52c.exe

  • Size

    1.8MB

  • MD5

    51f1d63e0011310e16b9cc937dff061c

  • SHA1

    689bfbd2b6fc118f96bb10ab74ab486685ffa2ea

  • SHA256

    bbaa6d9a443b8d2c74ac44dc498347db9b1286a931dc0f7c900e0570352af52c

  • SHA512

    b8a349620081882e69cdbddabf3c4add96e4397fdfc5c3c4548c678a435ae250614bae90d4e1c199c913d229e3c4fe1dba694851ee991462537b1297f03c114e

  • SSDEEP

    49152:pIqkCmwbn/ZzKQMPs7CdcaogKtw2uFpkQUUz:KqkCPueCto+2KpXU

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

0657d1

C2

http://185.215.113.19

Attributes
  • install_dir

    0d8f5eb8a7

  • install_file

    explorti.exe

  • strings_key

    6c55a5f34bb433fbd933a168577b1838

  • url_paths

    /Vi9leo/index.php

rc4.plain

Extracted

Family

stealc

Botnet

nord

C2

http://185.215.113.100

Attributes
  • url_path

    /e2b1563c6670f193.php

Extracted

Family

stealc

Botnet

kora

C2

http://185.215.113.100

Attributes
  • url_path

    /e2b1563c6670f193.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Stealc

    Stealc is an infostealer written in C++.

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 8 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 6 IoCs
  • Identifies Wine through registry keys 2 TTPs 4 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 2 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • AutoIT Executable 3 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 10 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\bbaa6d9a443b8d2c74ac44dc498347db9b1286a931dc0f7c900e0570352af52c.exe
    "C:\Users\Admin\AppData\Local\Temp\bbaa6d9a443b8d2c74ac44dc498347db9b1286a931dc0f7c900e0570352af52c.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:3556
    • C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
      "C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4528
      • C:\Users\Admin\AppData\Local\Temp\1000036001\9d41b70e48.exe
        "C:\Users\Admin\AppData\Local\Temp\1000036001\9d41b70e48.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2844
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          4⤵
          • Checks computer location settings
          • System Location Discovery: System Language Discovery
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:2796
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:2128
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
              6⤵
              • Checks processor information in registry
              • Modifies registry class
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:2624
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2028 -parentBuildID 20240401114208 -prefsHandle 1956 -prefMapHandle 1948 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7d9f3415-f276-4699-be42-9e2ee2d3d90f} 2624 "\\.\pipe\gecko-crash-server-pipe.2624" gpu
                7⤵
                  PID:3144
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2464 -parentBuildID 20240401114208 -prefsHandle 2460 -prefMapHandle 2456 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {94723443-d4c9-4c26-9f5b-7e9ade616209} 2624 "\\.\pipe\gecko-crash-server-pipe.2624" socket
                  7⤵
                    PID:1028
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2792 -childID 1 -isForBrowser -prefsHandle 2856 -prefMapHandle 2764 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1248 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0382ffa4-72ea-4c2f-897f-d10e40f3ee72} 2624 "\\.\pipe\gecko-crash-server-pipe.2624" tab
                    7⤵
                      PID:832
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3828 -childID 2 -isForBrowser -prefsHandle 3820 -prefMapHandle 2932 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1248 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {873ad807-f7fc-4d8d-ba26-6c807a5905c4} 2624 "\\.\pipe\gecko-crash-server-pipe.2624" tab
                      7⤵
                        PID:1632
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4460 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4428 -prefMapHandle 1556 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b652f143-3492-42dd-8b70-6f0c58ea99f1} 2624 "\\.\pipe\gecko-crash-server-pipe.2624" utility
                        7⤵
                        • Checks processor information in registry
                        PID:5236
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5320 -childID 3 -isForBrowser -prefsHandle 5312 -prefMapHandle 5308 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1248 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8eb2608f-5a5d-4775-b445-3ca648222c91} 2624 "\\.\pipe\gecko-crash-server-pipe.2624" tab
                        7⤵
                          PID:5836
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5544 -childID 4 -isForBrowser -prefsHandle 5468 -prefMapHandle 5472 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1248 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a6029864-0c75-418b-a43b-b4674ba2c1ed} 2624 "\\.\pipe\gecko-crash-server-pipe.2624" tab
                          7⤵
                            PID:5888
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5452 -childID 5 -isForBrowser -prefsHandle 5696 -prefMapHandle 5700 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1248 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dbfb52a6-a538-4cef-88d4-d0130935f023} 2624 "\\.\pipe\gecko-crash-server-pipe.2624" tab
                            7⤵
                              PID:5900
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6268 -childID 6 -isForBrowser -prefsHandle 6256 -prefMapHandle 6260 -prefsLen 27182 -prefMapSize 244658 -jsInitHandle 1248 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e860b107-b1da-4c92-aad8-7e07a66779f6} 2624 "\\.\pipe\gecko-crash-server-pipe.2624" tab
                              7⤵
                                PID:4856
                      • C:\Users\Admin\1000037002\d982bf86bf.exe
                        "C:\Users\Admin\1000037002\d982bf86bf.exe"
                        3⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of WriteProcessMemory
                        PID:636
                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                          4⤵
                          • Loads dropped DLL
                          • System Location Discovery: System Language Discovery
                          • Checks processor information in registry
                          • Suspicious behavior: EnumeratesProcesses
                          PID:4448
                      • C:\Users\Admin\AppData\Local\Temp\1000038001\8a48d19e10.exe
                        "C:\Users\Admin\AppData\Local\Temp\1000038001\8a48d19e10.exe"
                        3⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        PID:404
                  • C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                    C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                    1⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Identifies Wine through registry keys
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • Suspicious behavior: EnumeratesProcesses
                    PID:6028
                  • C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                    C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                    1⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Identifies Wine through registry keys
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • Suspicious behavior: EnumeratesProcesses
                    PID:5828

                  Network

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\ProgramData\AEHIJKKFHIEGCBGCAFIJ

                    Filesize

                    11KB

                    MD5

                    6935d6a41f9f7ad69d3188e9a35c6ce4

                    SHA1

                    ee08beb81769a2b0ddfcf3a932274aa0fa3daf2d

                    SHA256

                    87bc43e0d2a90ef156315cf95497ea93314a86722db9bc834ede78181da530b6

                    SHA512

                    0df3f10b5de2d7679028456060b20f283a9edf70ec10d7723f99e3a62d789a20d4847b98a00f94cda365e7a29e750eec6c473d6bf0ec8f621c7a3424ba8ffad7

                  • C:\ProgramData\mozglue.dll

                    Filesize

                    593KB

                    MD5

                    c8fd9be83bc728cc04beffafc2907fe9

                    SHA1

                    95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                    SHA256

                    ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                    SHA512

                    fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                  • C:\ProgramData\nss3.dll

                    Filesize

                    2.0MB

                    MD5

                    1cc453cdf74f31e4d913ff9c10acdde2

                    SHA1

                    6e85eae544d6e965f15fa5c39700fa7202f3aafe

                    SHA256

                    ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                    SHA512

                    dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                  • C:\Users\Admin\1000037002\d982bf86bf.exe

                    Filesize

                    330KB

                    MD5

                    44f3a5221b50fd602e29fd927f8b6e23

                    SHA1

                    49afe6aea1fa8ce4e6340f0b2a5f9cf50e07ca63

                    SHA256

                    2bc4046f376f48ec3c3456cefa45279a0f187b3d5eef73768b48eafce424b807

                    SHA512

                    c50972890fd2bfcecb6774a0629d16ff55ba0f8a3006cdbcfb088e91cd538b454e23376fe29ac871590336ab54295e7d47b24f2fb67fc24ea6755f66a3316516

                  • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\lirn7gz7.default-release\activity-stream.discovery_stream.json

                    Filesize

                    33KB

                    MD5

                    571184869bd28e8b0668e339ea657053

                    SHA1

                    92a41fb561ec8a9f36a9b0668f1584a5231b9ece

                    SHA256

                    2597f1f29c60cfc79eb36c4d97a1667007404de8bd702b04642d0c3ae137b793

                    SHA512

                    e6eb8a8ddaa0455e8514e2cd6bb42f90799fceeaf5d825e483548605ff7bc730e246deab578d0474342d4439fb446e99abc2058c845b3fa1a3cb9374435c4a00

                  • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\lirn7gz7.default-release\cache2\entries\E449899591A9BC91DFBA673EC0589B51E541A88B

                    Filesize

                    13KB

                    MD5

                    4ca52a7a03ab29c5699c9a1a8f8f76b3

                    SHA1

                    621bdeebfd8bfc12c86869e476a69a2f2840ffff

                    SHA256

                    703c9a2399ab9bd3605534e74cdc2714b1332f224a85a3121c75872ce59f39d9

                    SHA512

                    e7000160f86860a729acab6ad3a5686b636b77ced5dd8ff70d991047687dc8861fa1ec5ad8155c1d50a07c50e913b76d3dcea88c6cb25e5fc8b01546893f3101

                  • C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

                    Filesize

                    1.8MB

                    MD5

                    51f1d63e0011310e16b9cc937dff061c

                    SHA1

                    689bfbd2b6fc118f96bb10ab74ab486685ffa2ea

                    SHA256

                    bbaa6d9a443b8d2c74ac44dc498347db9b1286a931dc0f7c900e0570352af52c

                    SHA512

                    b8a349620081882e69cdbddabf3c4add96e4397fdfc5c3c4548c678a435ae250614bae90d4e1c199c913d229e3c4fe1dba694851ee991462537b1297f03c114e

                  • C:\Users\Admin\AppData\Local\Temp\1000036001\9d41b70e48.exe

                    Filesize

                    1.3MB

                    MD5

                    f8a0a57e59145dbc07e9eea86c379910

                    SHA1

                    d8f641d14b80d262f999b912a8fb1a6735913885

                    SHA256

                    ba43aa294156e377ae6a0aaee5006b9af062533a1a6089ec873d5c091d706934

                    SHA512

                    ec556386c343c6db714b189bb404a1db161aa8d0c75768abff2a0755e21d3ac18b6212af0237dcb141d3b61ae665005bc53dc162a5bf47d49b67fbb27e5e726c

                  • C:\Users\Admin\AppData\Local\Temp\1000038001\8a48d19e10.exe

                    Filesize

                    187KB

                    MD5

                    278ee1426274818874556aa18fd02e3a

                    SHA1

                    185a2761330024dec52134df2c8388c461451acb

                    SHA256

                    37257ddb1a6f309a6e9d147b5fc2551a9cae3a0e52b191b18d9465bfcb5c18eb

                    SHA512

                    07ec6759af5b9a00d8371b9fd9b723012dd0a1614cfcc7cd51975a004f69ffb90083735e9a871a2aa0e8d28799beac53a4748f55f4dd1e7495bc7388ebf4d6a0

                  • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                    Filesize

                    479KB

                    MD5

                    09372174e83dbbf696ee732fd2e875bb

                    SHA1

                    ba360186ba650a769f9303f48b7200fb5eaccee1

                    SHA256

                    c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                    SHA512

                    b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                  • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                    Filesize

                    13.8MB

                    MD5

                    0a8747a2ac9ac08ae9508f36c6d75692

                    SHA1

                    b287a96fd6cc12433adb42193dfe06111c38eaf0

                    SHA256

                    32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                    SHA512

                    59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\AlternateServices.bin

                    Filesize

                    10KB

                    MD5

                    eebeac55424fdb5988998b981a1fd11b

                    SHA1

                    7f5b3e0cb2cf86971456287f24abb329c276b87d

                    SHA256

                    0c010cc6b3781c1e44919cab3e5a38f9d0c4d802f6e4a968a8bdfa52098da816

                    SHA512

                    cedefa09d48136b6f8857905764235c2e1c9b125b2bb4bb6a349de8c684f5fb25ef7de6bcebb3dacb23a26386c413b2f730fd1cbb2ff0e58f0fe0349f8436f09

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\cookies.sqlite-wal

                    Filesize

                    384KB

                    MD5

                    1e5f532023268c9511787e7ab220982a

                    SHA1

                    5a0cbd389ae5411211094a417e93a18e9c121c48

                    SHA256

                    7925b7dc661afa1ca80540c73b41a9a14dc34d2aaa097265d42530967bf3cd01

                    SHA512

                    3032b5c3a4e7287ba5f085a2cdda1965d803959f887a573825fb73bc922ff57129f73eff1389dc3ff0b06c85abfe65bdf627fb96f05fce850fa889a2139467df

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\db\data.safe.tmp

                    Filesize

                    5KB

                    MD5

                    562b5492646acbe60402c5785024c5ce

                    SHA1

                    674151a7455be8b954b26250a775bff062f80d1e

                    SHA256

                    b45d5724ec16ffd4356999ab067b7ab2344af48819e7f3c37c79d4277baa63b2

                    SHA512

                    85bd5d570f831abbaa756006bb8aed1777967f2b1914dd8d7305a00fc33e6e93ace30f046d033afd7bbb1f40c63df5a435520e8330ced624d53cec291fc18f39

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\db\data.safe.tmp

                    Filesize

                    6KB

                    MD5

                    b3465ed433286593725423d4378aff69

                    SHA1

                    fc5ecac9c92cb70b8fc4ac8c5ddd6692b4f90d09

                    SHA256

                    4c67ad7f971c1478f6fdae2d272d47b55dbf84ddd04046d68337a43afc7bb84c

                    SHA512

                    0b828336e47e72ed01ebc09a04cfbc04fa8bd02753b70d6487148e8edad8bac35217e4c2a85d1efba41df344366ff7f8f2b4ef272d46a28418d805a9b26d344b

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\db\data.safe.tmp

                    Filesize

                    16KB

                    MD5

                    e51a1177239efa162dcc04291f06f10e

                    SHA1

                    577f32ce19fb0755aac6843482c99f262f54a413

                    SHA256

                    958eae9b1e6cae8f4630860cf85a9a8411929cf3be870ded749aed9c675ae98e

                    SHA512

                    13f8b47d5f973cf80299ba250cd997fb9939b238a413f1a57fcc3da62517a542a564d098ca40e367837612a84201dd17d77dac9f1f65f5fe1b999c3dcaf0982b

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\db\data.safe.tmp

                    Filesize

                    16KB

                    MD5

                    542042aa98251d96bf44b04354538db7

                    SHA1

                    15318ecc0d29a91f2aebbcc701cb27a3d36cdc99

                    SHA256

                    c955183db615d948378685b1ac19a1aca1d5cfa1ef0b305684bd934465b9d666

                    SHA512

                    5aa2caab2dff7116875ca4301919101c32d75cb187cce19b46c95ef2da3c7f0cec00aa574e2fb121af3937edd19550136f711e28c7986c3f576dce3ceb2615a4

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\db\data.safe.tmp

                    Filesize

                    6KB

                    MD5

                    6d4f3c9d180b306a3bda5b7812c87309

                    SHA1

                    e13eeb61d56aa65cab1f52f4187f025bf4d51c57

                    SHA256

                    cd8b5b97df799d1aa34aead045be78b56d141c5cab7654b8e7633ed1831a26ad

                    SHA512

                    25602f1bd450f773745ba02617d622808e3931a9fdfee002ed9854b7c33f3e3c66bd05a7e5720b68e1e26cb7df588b91974973defd7c04f13cc6f011cd11c365

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\pending_pings\68235e67-8025-4b8d-8b8a-7e78a18c854a

                    Filesize

                    27KB

                    MD5

                    6b37f581acd38d704b9c7d0b7202a270

                    SHA1

                    cc8e77e0372f9420b439ffc5d79ec47c2b1ea536

                    SHA256

                    b3c24fe6ce9c239c61cb369add92332192b781c5608e831533fdb43ac985f751

                    SHA512

                    16aabea91f2f3d782745c98554c1113f28177f8ce1a6a9150e78f8985a3561e9497e57eea623d5b2ca683e7dd1a8fd3688e9bd76a300b4ea680adb5ca6814352

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\pending_pings\c7811470-66a2-4fe2-adba-4a6dcf78294e

                    Filesize

                    982B

                    MD5

                    37154926e2746c2f988f7a1b2ce2213c

                    SHA1

                    7b1c5544db432470fdfc05533a0fd1062654741d

                    SHA256

                    16aee2c3d6bc45dc9e8c1050ea30fab8f1858183e833d2bd53eafef041eb7b12

                    SHA512

                    0fb14744e07bd1c910441ebd03fa14e851448aa66684fab4e1b27c6f55c2ac508ab96f49075b9e282ffd1fd0ec545268d76c37dcf34990d8a41307e3ef2b1cdd

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\pending_pings\f4dca49d-f46a-40b6-ad42-e9f4b237f9de

                    Filesize

                    671B

                    MD5

                    508d25c448cfc3403f8c130d4b32aa80

                    SHA1

                    535398146da047e6dcfec7a0cc0a4dff6aec5878

                    SHA256

                    761a6d094d8330660e469f4fe2c53b7700c9eb4f9a6ef3f063f853a18c4bacd2

                    SHA512

                    fe74f43ff2708d2203e7c9c63731718dfa496e9d06f3c8114f0f74ae703ea92615d9018b77c6ab72a37f948464f48b9994af753f575c857e6b4c000b713caa00

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\formhistory.sqlite

                    Filesize

                    256KB

                    MD5

                    97c1441748d6cc3e5a7030cda7543975

                    SHA1

                    f5598a45b101a5404126cd27fbb7f4b70861ee32

                    SHA256

                    2015b584b844b091d6a6280d45e9a589ea0feacf5f4b19bdd4cc21c60dbaaf91

                    SHA512

                    29d358ec7725038c6648251d8b9c32f3a40458e9c97926e0000ab42f0369b96d1ba5216eeb7c35800c740633dfd3b1e6e6aa73859644bdb9cdccaf2a3516bcb9

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

                    Filesize

                    1.1MB

                    MD5

                    842039753bf41fa5e11b3a1383061a87

                    SHA1

                    3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                    SHA256

                    d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                    SHA512

                    d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

                    Filesize

                    116B

                    MD5

                    2a461e9eb87fd1955cea740a3444ee7a

                    SHA1

                    b10755914c713f5a4677494dbe8a686ed458c3c5

                    SHA256

                    4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                    SHA512

                    34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

                    Filesize

                    372B

                    MD5

                    bf957ad58b55f64219ab3f793e374316

                    SHA1

                    a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                    SHA256

                    bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                    SHA512

                    79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

                    Filesize

                    17.8MB

                    MD5

                    daf7ef3acccab478aaa7d6dc1c60f865

                    SHA1

                    f8246162b97ce4a945feced27b6ea114366ff2ad

                    SHA256

                    bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                    SHA512

                    5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\places.sqlite-wal

                    Filesize

                    1.3MB

                    MD5

                    60fd38d8914bcecd0c6f4041d5e060c0

                    SHA1

                    4de88453da67c1acca247eb71510e9894e276d23

                    SHA256

                    e5e484fa01a5cdc68db8a17b340d4f1e60deb1533dd86e0a49244c61454fb149

                    SHA512

                    9e1e6ee641a4d5343ca51660a208da0d4e5e406d0142be19bae2771230f08e578891a40482d702c3ab1956f8f9a88aff56df62a34606047bd023f53a84a69f9e

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\prefs-1.js

                    Filesize

                    13KB

                    MD5

                    85637f55fb6104400d9c61c107861ac6

                    SHA1

                    a0bb0d071ac57ccdc70cd874fef9bb6014eb6a81

                    SHA256

                    362750e815c4fc84dc3f20db7d0c9924d6f49ebb82d01f2e88c6c370d461cedb

                    SHA512

                    01beb4fb6609c880f61c20de16cc96426391cf91133cbce0eff3c99ab323ba44367d1056a6f7e121f97f5a32b1575a8b1aa4c379dd43bfe4cb9a0de3e9199b77

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\prefs-1.js

                    Filesize

                    16KB

                    MD5

                    3c1cf579a156bf8c70858692e07b964c

                    SHA1

                    3c6e8ab94ecabd1cacda69ff12865a90159371b8

                    SHA256

                    0bcdd8bb637d6dabef15b21c5e9c5e45c4f1ca79d01c2c2e7ecd0cc35be28127

                    SHA512

                    e1c0670b362bc6b5bdfedeb71ade4f2b88ca6f4884dba546df451fabba4713b422ab28a64180fe2c3dd4fe03d0ba25d3d2a77b51128b5d9350e069c0ec0c79d0

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\prefs.js

                    Filesize

                    11KB

                    MD5

                    1e5efce87b3bb424cc6a20d5c73daa94

                    SHA1

                    2ff849e4186cfdbe1a160626588f219895281f7b

                    SHA256

                    5ae2b8a933ae7ea3f5c1e8c105a4824e7c6fff7bff3b671c93f993202721c94f

                    SHA512

                    75bad99e9ae51433a5b835a26abde082aa683d16fa1d9f3697781db9f4b466959bf91f6bec16002a292f374a2b3ebb95453fe56e8d2ca3e533b5d7127e84ef59

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

                    Filesize

                    1.3MB

                    MD5

                    66e96adc83120b7d02ad6b1d6302cd87

                    SHA1

                    a6c4a48ff2d3240928fab8778aceae5636c91f8d

                    SHA256

                    12c4c83c0ba5726d537e4b314942016ec31ece1757dffda982a1cc33775b1066

                    SHA512

                    ca0598909ad459cf4a15fd4d2350fa171abe139cdd3dfcbae1ebff53c98d9a1cfa8fb35945553751771edc9479c0530ffa9056e5aa1037f3293b6df1a08a5ecd

                  • memory/404-537-0x00000000000E0000-0x0000000000323000-memory.dmp

                    Filesize

                    2.3MB

                  • memory/404-87-0x00000000000E0000-0x0000000000323000-memory.dmp

                    Filesize

                    2.3MB

                  • memory/636-67-0x0000000000C20000-0x0000000000C78000-memory.dmp

                    Filesize

                    352KB

                  • memory/2796-46-0x0000000000400000-0x000000000052D000-memory.dmp

                    Filesize

                    1.2MB

                  • memory/2796-48-0x0000000000400000-0x000000000052D000-memory.dmp

                    Filesize

                    1.2MB

                  • memory/2796-44-0x0000000000400000-0x000000000052D000-memory.dmp

                    Filesize

                    1.2MB

                  • memory/2844-42-0x0000000000DE0000-0x0000000000F32000-memory.dmp

                    Filesize

                    1.3MB

                  • memory/2844-41-0x000000007360E000-0x000000007360F000-memory.dmp

                    Filesize

                    4KB

                  • memory/3556-1-0x00000000779F4000-0x00000000779F6000-memory.dmp

                    Filesize

                    8KB

                  • memory/3556-0-0x0000000000E10000-0x00000000012D0000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/3556-3-0x0000000000E10000-0x00000000012D0000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/3556-2-0x0000000000E11000-0x0000000000E3F000-memory.dmp

                    Filesize

                    184KB

                  • memory/3556-17-0x0000000000E10000-0x00000000012D0000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/3556-4-0x0000000000E10000-0x00000000012D0000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/4448-69-0x0000000000400000-0x0000000000643000-memory.dmp

                    Filesize

                    2.3MB

                  • memory/4448-71-0x0000000000400000-0x0000000000643000-memory.dmp

                    Filesize

                    2.3MB

                  • memory/4448-295-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                    Filesize

                    972KB

                  • memory/4528-22-0x0000000000A10000-0x0000000000ED0000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/4528-2650-0x0000000000A10000-0x0000000000ED0000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/4528-526-0x0000000000A10000-0x0000000000ED0000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/4528-525-0x0000000000A10000-0x0000000000ED0000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/4528-18-0x0000000000A10000-0x0000000000ED0000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/4528-19-0x0000000000A10000-0x0000000000ED0000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/4528-20-0x0000000000A10000-0x0000000000ED0000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/4528-500-0x0000000000A10000-0x0000000000ED0000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/4528-468-0x0000000000A10000-0x0000000000ED0000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/4528-21-0x0000000000A10000-0x0000000000ED0000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/4528-1148-0x0000000000A10000-0x0000000000ED0000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/4528-2686-0x0000000000A10000-0x0000000000ED0000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/4528-2685-0x0000000000A10000-0x0000000000ED0000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/4528-538-0x0000000000A10000-0x0000000000ED0000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/4528-2661-0x0000000000A10000-0x0000000000ED0000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/4528-2667-0x0000000000A10000-0x0000000000ED0000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/4528-2671-0x0000000000A10000-0x0000000000ED0000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/4528-2672-0x0000000000A10000-0x0000000000ED0000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/4528-2673-0x0000000000A10000-0x0000000000ED0000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/4528-2679-0x0000000000A10000-0x0000000000ED0000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/4528-2678-0x0000000000A10000-0x0000000000ED0000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/5828-2677-0x0000000000A10000-0x0000000000ED0000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/5828-2675-0x0000000000A10000-0x0000000000ED0000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/6028-1652-0x0000000000A10000-0x0000000000ED0000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/6028-1609-0x0000000000A10000-0x0000000000ED0000-memory.dmp

                    Filesize

                    4.8MB