Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15-08-2024 03:45

General

  • Target

    b6fc70434c7ed986b972b80c4b19ead943118d05b9b3fcc97882c9a74e4e7b09.exe

  • Size

    1.9MB

  • MD5

    b0793df68563b6c6e89ec848478ad0e7

  • SHA1

    0d4d1e949a624613448d2e8c8007185823408234

  • SHA256

    b6fc70434c7ed986b972b80c4b19ead943118d05b9b3fcc97882c9a74e4e7b09

  • SHA512

    fc4cd0a359b91d8e9d5c07572abb57e6b0be58f502432018b6657615eceb7a3bbc633bf6b3ca8b40ba77899e3ac839b0d98b7adc160fbdb04226675548bad42e

  • SSDEEP

    24576:aJmQl5FsB1PyY8FE9ThJJhsz8jFv9/LuDCeN4OqTKr4M+XNinNvP8zZnW8TIkEFW:Ojk8i9JhT6H7qe4jintPiWUAufqDU

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

0657d1

C2

http://185.215.113.19

Attributes
  • install_dir

    0d8f5eb8a7

  • install_file

    explorti.exe

  • strings_key

    6c55a5f34bb433fbd933a168577b1838

  • url_paths

    /Vi9leo/index.php

rc4.plain

Extracted

Family

stealc

Botnet

nord

C2

http://185.215.113.100

Attributes
  • url_path

    /e2b1563c6670f193.php

Extracted

Family

stealc

Botnet

kora

C2

http://185.215.113.100

Attributes
  • url_path

    /e2b1563c6670f193.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Stealc

    Stealc is an infostealer written in C++.

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 10 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 7 IoCs
  • Identifies Wine through registry keys 2 TTPs 5 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 2 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • AutoIT Executable 3 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 10 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\b6fc70434c7ed986b972b80c4b19ead943118d05b9b3fcc97882c9a74e4e7b09.exe
    "C:\Users\Admin\AppData\Local\Temp\b6fc70434c7ed986b972b80c4b19ead943118d05b9b3fcc97882c9a74e4e7b09.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:3768
    • C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
      "C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2384
      • C:\Users\Admin\AppData\Local\Temp\1000036001\f1639a9e5e.exe
        "C:\Users\Admin\AppData\Local\Temp\1000036001\f1639a9e5e.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3908
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          4⤵
            PID:2256
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
            4⤵
            • Checks computer location settings
            • System Location Discovery: System Language Discovery
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of WriteProcessMemory
            PID:3580
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:4504
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
                6⤵
                • Checks processor information in registry
                • Modifies registry class
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:552
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1984 -parentBuildID 20240401114208 -prefsHandle 1912 -prefMapHandle 1904 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {31b69980-9354-4994-92fd-132cda0fa662} 552 "\\.\pipe\gecko-crash-server-pipe.552" gpu
                  7⤵
                    PID:4360
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2428 -parentBuildID 20240401114208 -prefsHandle 2396 -prefMapHandle 2392 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7280f82c-10ea-46f6-96fa-87b03fb25cf5} 552 "\\.\pipe\gecko-crash-server-pipe.552" socket
                    7⤵
                      PID:2984
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2848 -childID 1 -isForBrowser -prefsHandle 2856 -prefMapHandle 2796 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1260 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {79b33016-d727-495a-99b2-b132d7e508a0} 552 "\\.\pipe\gecko-crash-server-pipe.552" tab
                      7⤵
                        PID:2364
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4036 -childID 2 -isForBrowser -prefsHandle 4020 -prefMapHandle 4016 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1260 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f8a11ae8-9882-43d1-b387-119f54ba5c1f} 552 "\\.\pipe\gecko-crash-server-pipe.552" tab
                        7⤵
                          PID:4384
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4788 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4780 -prefMapHandle 4776 -prefsLen 29197 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f3f512bd-c38b-44e1-83f8-e386ae34a3ed} 552 "\\.\pipe\gecko-crash-server-pipe.552" utility
                          7⤵
                          • Checks processor information in registry
                          PID:5476
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5476 -childID 3 -isForBrowser -prefsHandle 5468 -prefMapHandle 5464 -prefsLen 27182 -prefMapSize 244658 -jsInitHandle 1260 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b273ff56-c47c-4061-8697-522c55c73ed1} 552 "\\.\pipe\gecko-crash-server-pipe.552" tab
                          7⤵
                            PID:1724
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5780 -childID 4 -isForBrowser -prefsHandle 5776 -prefMapHandle 5784 -prefsLen 27182 -prefMapSize 244658 -jsInitHandle 1260 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d654a484-4465-4370-89d8-a489d4a9f3e4} 552 "\\.\pipe\gecko-crash-server-pipe.552" tab
                            7⤵
                              PID:516
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5944 -childID 5 -isForBrowser -prefsHandle 6024 -prefMapHandle 6020 -prefsLen 27182 -prefMapSize 244658 -jsInitHandle 1260 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {506ab9b3-43ac-40f4-9391-4f73d717af69} 552 "\\.\pipe\gecko-crash-server-pipe.552" tab
                              7⤵
                                PID:1784
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6040 -childID 6 -isForBrowser -prefsHandle 6140 -prefMapHandle 5936 -prefsLen 27182 -prefMapSize 244658 -jsInitHandle 1260 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c03f90ff-3e5b-4446-9763-17e25feb0266} 552 "\\.\pipe\gecko-crash-server-pipe.552" tab
                                7⤵
                                  PID:5124
                        • C:\Users\Admin\1000037002\b6920fe10b.exe
                          "C:\Users\Admin\1000037002\b6920fe10b.exe"
                          3⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of WriteProcessMemory
                          PID:808
                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                            4⤵
                            • Loads dropped DLL
                            • System Location Discovery: System Language Discovery
                            • Checks processor information in registry
                            • Suspicious behavior: EnumeratesProcesses
                            PID:4848
                        • C:\Users\Admin\AppData\Local\Temp\1000038001\4ee08a0885.exe
                          "C:\Users\Admin\AppData\Local\Temp\1000038001\4ee08a0885.exe"
                          3⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          PID:3524
                    • C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                      C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                      1⤵
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • Suspicious behavior: EnumeratesProcesses
                      PID:5684
                    • C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                      C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                      1⤵
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • Suspicious behavior: EnumeratesProcesses
                      PID:1916
                    • C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                      C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                      1⤵
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • Suspicious behavior: EnumeratesProcesses
                      PID:2916

                    Network

                    MITRE ATT&CK Enterprise v15

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\ProgramData\BKFIJJEGHDAEBGCAKJKF

                      Filesize

                      11KB

                      MD5

                      ecd0b592afbd81e9d524229413e73918

                      SHA1

                      0c28ed6f0bc19075a4d8cdd8dad4c8eac1e96999

                      SHA256

                      23fe0adc370ab28e440ff5094afe9a303e5d79cd725a3a54c16d879467d30275

                      SHA512

                      14c00dbb19708d99f38962649a8f49fdf0bf7990bd4f7d83049dc0deb1b2b4bee97143d309e331feabf8e53c603cc783808586ac581103030930aa4c40eadf0c

                    • C:\ProgramData\mozglue.dll

                      Filesize

                      593KB

                      MD5

                      c8fd9be83bc728cc04beffafc2907fe9

                      SHA1

                      95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                      SHA256

                      ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                      SHA512

                      fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                    • C:\ProgramData\nss3.dll

                      Filesize

                      2.0MB

                      MD5

                      1cc453cdf74f31e4d913ff9c10acdde2

                      SHA1

                      6e85eae544d6e965f15fa5c39700fa7202f3aafe

                      SHA256

                      ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                      SHA512

                      dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                    • C:\Users\Admin\1000037002\b6920fe10b.exe

                      Filesize

                      330KB

                      MD5

                      b9725e6125233dee3e1feb1a5877850b

                      SHA1

                      fa69edc44d562ede0c1dbafe263a847c638dad60

                      SHA256

                      dd6aca77dc5c84918250f8c681a3a7391d0b6e512c763f9eaf4eb7e4c3695fd4

                      SHA512

                      5b1a9520b5dc10085756fd72a20de62f6f6ed48f1d76f7a93ebbf847a6c699c03121ebe56dadc1b0bf90855b7d446af47a46b3ce8527a07abd7457d62b4271d9

                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\activity-stream.discovery_stream.json

                      Filesize

                      42KB

                      MD5

                      d6e4635e35a6b3206748529893af64de

                      SHA1

                      e67256d0a546eb6e0f8cb4febb6eb448ce4a4d68

                      SHA256

                      7c19990d1cff86304f1a5baaf5c9baa55c1a3b5021eb786db0c068259eafaa0a

                      SHA512

                      87d3594c935e51de2d6c08fb2614f2107f29877727c6f5321425890566d974a0963755b880a9fe6c66162fc560d6b1e20ef22245200cf054337a0cd0ae77182d

                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\cache2\entries\E449899591A9BC91DFBA673EC0589B51E541A88B

                      Filesize

                      13KB

                      MD5

                      d1fc6e2380cf8493df7df7ba1c133e06

                      SHA1

                      19baf1ea8b7f0beef08fb947cf4b78ff2837ae7d

                      SHA256

                      0e9b34962737f79e0c2106ee50b9c04b9ef1d7ee00eddb3499db9681e79101cd

                      SHA512

                      9551f356dde35749536f1ae3cb19844f1dec1d347f284b17c6c7d0d56bc304831107fc9d40340119cce7bab3149c1c7edfb0ce95c5809925cc86142aa3a382ef

                    • C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

                      Filesize

                      1.9MB

                      MD5

                      b0793df68563b6c6e89ec848478ad0e7

                      SHA1

                      0d4d1e949a624613448d2e8c8007185823408234

                      SHA256

                      b6fc70434c7ed986b972b80c4b19ead943118d05b9b3fcc97882c9a74e4e7b09

                      SHA512

                      fc4cd0a359b91d8e9d5c07572abb57e6b0be58f502432018b6657615eceb7a3bbc633bf6b3ca8b40ba77899e3ac839b0d98b7adc160fbdb04226675548bad42e

                    • C:\Users\Admin\AppData\Local\Temp\1000036001\f1639a9e5e.exe

                      Filesize

                      1.3MB

                      MD5

                      03dea3374e443f985819c31eca10560c

                      SHA1

                      44b963d221b2b52835ac389b41754873a7a48779

                      SHA256

                      6fbef0d57502a0dcbebe0c8bb1d592bbb03c605ec403dc67fc2f972e4fb91c05

                      SHA512

                      df33d2d8561895417f486ac6264bec591324f8e2083dab2783c5ad18035013478599b080d193bab601bcb77324502deebe01a44da4f413e335a0de91a45fc489

                    • C:\Users\Admin\AppData\Local\Temp\1000038001\4ee08a0885.exe

                      Filesize

                      187KB

                      MD5

                      278ee1426274818874556aa18fd02e3a

                      SHA1

                      185a2761330024dec52134df2c8388c461451acb

                      SHA256

                      37257ddb1a6f309a6e9d147b5fc2551a9cae3a0e52b191b18d9465bfcb5c18eb

                      SHA512

                      07ec6759af5b9a00d8371b9fd9b723012dd0a1614cfcc7cd51975a004f69ffb90083735e9a871a2aa0e8d28799beac53a4748f55f4dd1e7495bc7388ebf4d6a0

                    • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                      Filesize

                      479KB

                      MD5

                      09372174e83dbbf696ee732fd2e875bb

                      SHA1

                      ba360186ba650a769f9303f48b7200fb5eaccee1

                      SHA256

                      c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                      SHA512

                      b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                    • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                      Filesize

                      13.8MB

                      MD5

                      0a8747a2ac9ac08ae9508f36c6d75692

                      SHA1

                      b287a96fd6cc12433adb42193dfe06111c38eaf0

                      SHA256

                      32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                      SHA512

                      59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\AlternateServices.bin

                      Filesize

                      10KB

                      MD5

                      99ca8774c26116d52d00be3a8117ddeb

                      SHA1

                      3b7304468928d120cdbb2be9cce8350d8f6c7554

                      SHA256

                      fa718557e0b88c097681a1f4a36f7d49597c00885cfc0bcb60c1e546d0504329

                      SHA512

                      c5760478176beca3117593f6b676cb0a1ca1d14c35421bf038ba6a466cf88a9d5990497daa65b04b8fa12b607c0191dd3737b70852f1d0d250230a6be4e88b9a

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\cookies.sqlite-wal

                      Filesize

                      384KB

                      MD5

                      76a222f3fbad467ec31b820a50d28c9e

                      SHA1

                      19c8319ded64c91c3337e1cb729c3ab634996c97

                      SHA256

                      f81d0f4c67514eaab86f1417a24a701c4299d7bff645a0ec65f512aea16c9cd6

                      SHA512

                      018e50ded9b2262c6ab3237f980865e4556f9882afda253e01cf44de7088666d2d91a2a693c16c9ab6b04187f380763cef0314733cd91bc5b59615aa6355a056

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\datareporting\glean\db\data.safe.tmp

                      Filesize

                      22KB

                      MD5

                      5cb7fc1322e25b63bc0bf45b43391384

                      SHA1

                      9aa0ade99da3c8bb15aa4e1cf4a62f81517f3699

                      SHA256

                      043f94c0f9367f2dd1cc95f846d67334a5b4a616145dceda1271232202e37cf6

                      SHA512

                      78d3ef4b777ee888f4b3c02f5bec7a9703712b1b50c37b45f67694635d5cc62d2a05c6b1134de195463fcabffc20c236c7df0712bf980fdae2f59f9c2c1c60f6

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\datareporting\glean\db\data.safe.tmp

                      Filesize

                      24KB

                      MD5

                      a1d47364aadbad4316828dce5eb9ab4a

                      SHA1

                      d32afacfa3712ac3d4e29210bba0353a1de5343f

                      SHA256

                      701d2c467a8d1600d0c4d1687baf5842ae5b9e8c8e5cc8a3bc7a4b94b02accba

                      SHA512

                      9e1bf2c9d549b54a7299aec089599e66fd58a68a4174e05bb1190a4470269a693eac2d82c783b43ebb08ec7332cfaf4aa93c3b00afaded4e67fade29ef5a82a4

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\datareporting\glean\db\data.safe.tmp

                      Filesize

                      25KB

                      MD5

                      a33e8713c134cff4b28992e287ed500a

                      SHA1

                      b66453f6acbc4dd6c18fd1d778eb2ac78f1079c4

                      SHA256

                      18028ffd64a4d87eb340acd07fff22b8c2c98a547e6b37bc0c5988ea8fe4ff64

                      SHA512

                      4c2782aeba1e4d184f328159bc0d684ec9d005443911738aad46023a81b6c515c1f0d89f060cf89c2e1983ddb35be1b72e1aab02191f2608e907742d1a4fc534

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\datareporting\glean\db\data.safe.tmp

                      Filesize

                      22KB

                      MD5

                      6a9879ba5f12fd1e972744f54577fa95

                      SHA1

                      07eae9c3a4f7fa413f0ff85e3da3cab192eeb17f

                      SHA256

                      6d3bb07261ffa6375626c47e213bf1c5b709d4a461991a4d2a5605261fffbcc8

                      SHA512

                      f1f31cd69c78af11bbc2aa4c1c973173c9f1252c10f8b4b6267fdaa5d230d2c4b6cf713ed7b3fc9be5d88abbe8f8e90e7cfafc1d9515c97c0ca0e5a2abf2533b

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\datareporting\glean\db\data.safe.tmp

                      Filesize

                      22KB

                      MD5

                      54f288557cbd07e68e223066016a2617

                      SHA1

                      c289d4caaf8a5b77ff7c96d757e331d50dbe416d

                      SHA256

                      1e5f35edaba9a833bb66ac8bdd17ee989f9ae9f9969d72dadfc427c189753105

                      SHA512

                      ae482d4d096663cae9fc05c3f66c0e89b4735189cb0c2cfd08159e4ff0d5884bfc6afce99b9b6e8b80d231a9e9d15c829c3ab144a459e0fee4cb9adbe8910d61

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\datareporting\glean\db\data.safe.tmp

                      Filesize

                      22KB

                      MD5

                      844dfa82fea602a34ba1ff74dbdebdc0

                      SHA1

                      024ae5598cae880f1a814f995a98c30771837cb6

                      SHA256

                      a6202c6a7169a3201a86f56e4450e842b0518a251ad381395546038df9d83b26

                      SHA512

                      11ed3ffcbb5b530797c54d5bc7e45335a8d379b7f33fb3247f638630f256f5654cce8f390e58e6a0cc8e976e555feae6454eee1390e522f64c70318718a72d41

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\datareporting\glean\pending_pings\1e9b1115-7a69-43ef-844f-2468aa3f4b2c

                      Filesize

                      659B

                      MD5

                      e1cadd12b1bc1e7cb4e5b4aa205b68e8

                      SHA1

                      0ff358d63a7b6d959f637f0fa57d1b5b4a27f5c2

                      SHA256

                      8e8c00eb2e02cbf3ed719ce8d1c33d2762e6eaff95a7cc1a58949f23d8a5fb58

                      SHA512

                      d93a5cc4726741da84ed41432a9c54244d41dfdfa696ecaa2b587df1384f2aae4ee83dc6f4b92e63e4fd4e122f4aaf6438cd209bf0f7bdcd380ad9072d3f937b

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\datareporting\glean\pending_pings\97577f74-cc78-4340-82b5-4b5eb18e1eab

                      Filesize

                      982B

                      MD5

                      94e38f38e7b3922560da68b6d39a0808

                      SHA1

                      add2e17b59c272da187a7e5614ac2196db9f158c

                      SHA256

                      cae61a2cc0ffe67d51ccba96d35182f37344cded71177114dffd9973731074fc

                      SHA512

                      f033d8a3e6d73017adb27aab9969173639d6fdd396f6b8e8fe7d74a72d9409a7707f37e5cb25acf48f46f2dcecd3ac4b9cacbceb9e7fa4a5413461d3b29e48d6

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\formhistory.sqlite

                      Filesize

                      256KB

                      MD5

                      97c1441748d6cc3e5a7030cda7543975

                      SHA1

                      f5598a45b101a5404126cd27fbb7f4b70861ee32

                      SHA256

                      2015b584b844b091d6a6280d45e9a589ea0feacf5f4b19bdd4cc21c60dbaaf91

                      SHA512

                      29d358ec7725038c6648251d8b9c32f3a40458e9c97926e0000ab42f0369b96d1ba5216eeb7c35800c740633dfd3b1e6e6aa73859644bdb9cdccaf2a3516bcb9

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

                      Filesize

                      1.1MB

                      MD5

                      842039753bf41fa5e11b3a1383061a87

                      SHA1

                      3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                      SHA256

                      d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                      SHA512

                      d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

                      Filesize

                      116B

                      MD5

                      2a461e9eb87fd1955cea740a3444ee7a

                      SHA1

                      b10755914c713f5a4677494dbe8a686ed458c3c5

                      SHA256

                      4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                      SHA512

                      34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

                      Filesize

                      372B

                      MD5

                      bf957ad58b55f64219ab3f793e374316

                      SHA1

                      a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                      SHA256

                      bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                      SHA512

                      79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

                      Filesize

                      17.8MB

                      MD5

                      daf7ef3acccab478aaa7d6dc1c60f865

                      SHA1

                      f8246162b97ce4a945feced27b6ea114366ff2ad

                      SHA256

                      bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                      SHA512

                      5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\places.sqlite-wal

                      Filesize

                      1.3MB

                      MD5

                      4cc8d2b0c701118ba8a54b30211b315d

                      SHA1

                      50bb73979ca4a49ff052dcbca639d746fe744950

                      SHA256

                      ff475d904328eec00b6eec7a59009c396d00821cc1822218c85badfaf92f4f69

                      SHA512

                      f8844fa15c6f9f0a1fc6bae751acd22346988a7fe37f5a3368d59bb968fc946ea409f27400be5ed7a8faa39335e48771a5a7eacd779a8c43fdeac7f907ee8067

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\prefs-1.js

                      Filesize

                      13KB

                      MD5

                      55e369a80a66a4a63a51a2bed8915f30

                      SHA1

                      8beef179425b62b1ad4eb0c5e84ca40049751aa2

                      SHA256

                      685b676698b321abc2f86498a4e37889088a4a03c45d8a65d1a99b761bc5c315

                      SHA512

                      15bde06a8f694ef7de2ac250b7aba59608bf71112a832f51e487f05e18d42a9055c6454b4836c825f231ab449776e1bc3b75941371f5aaf55bc9b4bc6cd9d84a

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\prefs-1.js

                      Filesize

                      16KB

                      MD5

                      b04297b43937f07b632b193bec353d45

                      SHA1

                      0b30ef3a8a2c387a79f2f86e86d8320d0764d5c4

                      SHA256

                      dae433c42d9cb51b2bcd3b601329c87986111a1ba78d758d5fa6c2d6ba9fcbd7

                      SHA512

                      a21e1c8a7b3d4359f87bf211f0875d41dea3099e71113077703e7696275834e1adafb3971a3495afc5db662dffd267cc5a478cb309cbdbfad1201ec892644627

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\prefs.js

                      Filesize

                      11KB

                      MD5

                      a7ebec34c18bd2506062d4444d62544d

                      SHA1

                      08437a9470e7d35d27ba2bf78677cf3bd4ebc83a

                      SHA256

                      060138c812efb8c53e4d4fae96da95da9204d133746f830bd9128d2855b5bfe7

                      SHA512

                      dcc8e00485ee91712fcfdb5f282369fe11ff35be370d28eea0c3e9a56cef7c6bd63b687826112a0b45319ef5d15769079115f8aa1af817f9960fb14093554f25

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

                      Filesize

                      952KB

                      MD5

                      ad4dd2252fb454aa0ed9f4b7b82745a9

                      SHA1

                      5329588a2025100b48f64b5c311c439d5ff6fa49

                      SHA256

                      458c1d70d904136ee530bf83f6ac93dff7d11f2ae9240d0b5d834c4dbcc5eae2

                      SHA512

                      00a4ce8e1ef9a60fbaf2fccfb98ffad20a66275ad98247ad59b1207ca2ecc40c0255f3e7ab2906cc3306327e9ab5bc17e0779a8c0c7a581e11a28b10b1ae6193

                    • memory/808-66-0x00000000009F0000-0x0000000000A48000-memory.dmp

                      Filesize

                      352KB

                    • memory/1916-2765-0x0000000000500000-0x00000000009D0000-memory.dmp

                      Filesize

                      4.8MB

                    • memory/1916-2764-0x0000000000500000-0x00000000009D0000-memory.dmp

                      Filesize

                      4.8MB

                    • memory/2384-1151-0x0000000000500000-0x00000000009D0000-memory.dmp

                      Filesize

                      4.8MB

                    • memory/2384-508-0x0000000000500000-0x00000000009D0000-memory.dmp

                      Filesize

                      4.8MB

                    • memory/2384-2786-0x0000000000500000-0x00000000009D0000-memory.dmp

                      Filesize

                      4.8MB

                    • memory/2384-2785-0x0000000000500000-0x00000000009D0000-memory.dmp

                      Filesize

                      4.8MB

                    • memory/2384-2759-0x0000000000500000-0x00000000009D0000-memory.dmp

                      Filesize

                      4.8MB

                    • memory/2384-452-0x0000000000500000-0x00000000009D0000-memory.dmp

                      Filesize

                      4.8MB

                    • memory/2384-21-0x0000000000500000-0x00000000009D0000-memory.dmp

                      Filesize

                      4.8MB

                    • memory/2384-19-0x0000000000501000-0x000000000052F000-memory.dmp

                      Filesize

                      184KB

                    • memory/2384-495-0x0000000000500000-0x00000000009D0000-memory.dmp

                      Filesize

                      4.8MB

                    • memory/2384-2776-0x0000000000500000-0x00000000009D0000-memory.dmp

                      Filesize

                      4.8MB

                    • memory/2384-505-0x0000000000500000-0x00000000009D0000-memory.dmp

                      Filesize

                      4.8MB

                    • memory/2384-2296-0x0000000000500000-0x00000000009D0000-memory.dmp

                      Filesize

                      4.8MB

                    • memory/2384-509-0x0000000000500000-0x00000000009D0000-memory.dmp

                      Filesize

                      4.8MB

                    • memory/2384-510-0x0000000000500000-0x00000000009D0000-memory.dmp

                      Filesize

                      4.8MB

                    • memory/2384-20-0x0000000000500000-0x00000000009D0000-memory.dmp

                      Filesize

                      4.8MB

                    • memory/2384-528-0x0000000000500000-0x00000000009D0000-memory.dmp

                      Filesize

                      4.8MB

                    • memory/2384-2775-0x0000000000500000-0x00000000009D0000-memory.dmp

                      Filesize

                      4.8MB

                    • memory/2384-16-0x0000000000500000-0x00000000009D0000-memory.dmp

                      Filesize

                      4.8MB

                    • memory/2384-2774-0x0000000000500000-0x00000000009D0000-memory.dmp

                      Filesize

                      4.8MB

                    • memory/2384-2773-0x0000000000500000-0x00000000009D0000-memory.dmp

                      Filesize

                      4.8MB

                    • memory/2384-2772-0x0000000000500000-0x00000000009D0000-memory.dmp

                      Filesize

                      4.8MB

                    • memory/2384-2770-0x0000000000500000-0x00000000009D0000-memory.dmp

                      Filesize

                      4.8MB

                    • memory/2916-2783-0x0000000000500000-0x00000000009D0000-memory.dmp

                      Filesize

                      4.8MB

                    • memory/2916-2784-0x0000000000500000-0x00000000009D0000-memory.dmp

                      Filesize

                      4.8MB

                    • memory/3524-86-0x0000000000780000-0x00000000009C3000-memory.dmp

                      Filesize

                      2.3MB

                    • memory/3524-496-0x0000000000780000-0x00000000009C3000-memory.dmp

                      Filesize

                      2.3MB

                    • memory/3580-47-0x0000000000400000-0x000000000052D000-memory.dmp

                      Filesize

                      1.2MB

                    • memory/3580-46-0x0000000000400000-0x000000000052D000-memory.dmp

                      Filesize

                      1.2MB

                    • memory/3580-43-0x0000000000400000-0x000000000052D000-memory.dmp

                      Filesize

                      1.2MB

                    • memory/3768-3-0x0000000000490000-0x0000000000960000-memory.dmp

                      Filesize

                      4.8MB

                    • memory/3768-1-0x0000000077A94000-0x0000000077A96000-memory.dmp

                      Filesize

                      8KB

                    • memory/3768-2-0x0000000000491000-0x00000000004BF000-memory.dmp

                      Filesize

                      184KB

                    • memory/3768-0-0x0000000000490000-0x0000000000960000-memory.dmp

                      Filesize

                      4.8MB

                    • memory/3768-4-0x0000000000490000-0x0000000000960000-memory.dmp

                      Filesize

                      4.8MB

                    • memory/3768-18-0x0000000000490000-0x0000000000960000-memory.dmp

                      Filesize

                      4.8MB

                    • memory/3908-40-0x00000000736AE000-0x00000000736AF000-memory.dmp

                      Filesize

                      4KB

                    • memory/3908-41-0x0000000000E40000-0x0000000000F92000-memory.dmp

                      Filesize

                      1.3MB

                    • memory/4848-87-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                      Filesize

                      972KB

                    • memory/4848-68-0x0000000000400000-0x0000000000643000-memory.dmp

                      Filesize

                      2.3MB

                    • memory/4848-70-0x0000000000400000-0x0000000000643000-memory.dmp

                      Filesize

                      2.3MB

                    • memory/5684-398-0x0000000000500000-0x00000000009D0000-memory.dmp

                      Filesize

                      4.8MB

                    • memory/5684-365-0x0000000000500000-0x00000000009D0000-memory.dmp

                      Filesize

                      4.8MB