Analysis

  • max time kernel
    149s
  • max time network
    155s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    15-08-2024 03:45

General

  • Target

    b6fc70434c7ed986b972b80c4b19ead943118d05b9b3fcc97882c9a74e4e7b09.exe

  • Size

    1.9MB

  • MD5

    b0793df68563b6c6e89ec848478ad0e7

  • SHA1

    0d4d1e949a624613448d2e8c8007185823408234

  • SHA256

    b6fc70434c7ed986b972b80c4b19ead943118d05b9b3fcc97882c9a74e4e7b09

  • SHA512

    fc4cd0a359b91d8e9d5c07572abb57e6b0be58f502432018b6657615eceb7a3bbc633bf6b3ca8b40ba77899e3ac839b0d98b7adc160fbdb04226675548bad42e

  • SSDEEP

    24576:aJmQl5FsB1PyY8FE9ThJJhsz8jFv9/LuDCeN4OqTKr4M+XNinNvP8zZnW8TIkEFW:Ojk8i9JhT6H7qe4jintPiWUAufqDU

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

0657d1

C2

http://185.215.113.19

Attributes
  • install_dir

    0d8f5eb8a7

  • install_file

    explorti.exe

  • strings_key

    6c55a5f34bb433fbd933a168577b1838

  • url_paths

    /Vi9leo/index.php

rc4.plain

Extracted

Family

stealc

Botnet

nord

C2

http://185.215.113.100

Attributes
  • url_path

    /e2b1563c6670f193.php

Extracted

Family

stealc

Botnet

kora

C2

http://185.215.113.100

Attributes
  • url_path

    /e2b1563c6670f193.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Stealc

    Stealc is an infostealer written in C++.

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 10 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 7 IoCs
  • Identifies Wine through registry keys 2 TTPs 5 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • AutoIT Executable 3 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\b6fc70434c7ed986b972b80c4b19ead943118d05b9b3fcc97882c9a74e4e7b09.exe
    "C:\Users\Admin\AppData\Local\Temp\b6fc70434c7ed986b972b80c4b19ead943118d05b9b3fcc97882c9a74e4e7b09.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:4804
    • C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
      "C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:248
      • C:\Users\Admin\AppData\Local\Temp\1000036001\79005ad8df.exe
        "C:\Users\Admin\AppData\Local\Temp\1000036001\79005ad8df.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5044
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:1884
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:1080
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
              6⤵
              • Checks processor information in registry
              • Modifies registry class
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:4012
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1992 -parentBuildID 20240401114208 -prefsHandle 1920 -prefMapHandle 1900 -prefsLen 23678 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8391a761-eff9-4e15-9dcb-912881f7e316} 4012 "\\.\pipe\gecko-crash-server-pipe.4012" gpu
                7⤵
                  PID:4324
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2424 -parentBuildID 20240401114208 -prefsHandle 2416 -prefMapHandle 2404 -prefsLen 24598 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b403a29b-232e-4e87-8a2c-e1a2ea04ef21} 4012 "\\.\pipe\gecko-crash-server-pipe.4012" socket
                  7⤵
                    PID:3248
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3208 -childID 1 -isForBrowser -prefsHandle 3108 -prefMapHandle 2756 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ed872b4f-73c0-4e86-aec0-5707cce083be} 4012 "\\.\pipe\gecko-crash-server-pipe.4012" tab
                    7⤵
                      PID:4656
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4028 -childID 2 -isForBrowser -prefsHandle 4020 -prefMapHandle 4016 -prefsLen 29088 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cbdd4419-2891-41ba-a31f-f8fecaa37521} 4012 "\\.\pipe\gecko-crash-server-pipe.4012" tab
                      7⤵
                        PID:3812
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4904 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4896 -prefMapHandle 4892 -prefsLen 29088 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {38768ed5-2fe5-4f3e-91c6-a05278cac601} 4012 "\\.\pipe\gecko-crash-server-pipe.4012" utility
                        7⤵
                        • Checks processor information in registry
                        PID:428
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5520 -childID 3 -isForBrowser -prefsHandle 5476 -prefMapHandle 5512 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a712341b-eeca-4930-9404-cf26787b5dcd} 4012 "\\.\pipe\gecko-crash-server-pipe.4012" tab
                        7⤵
                          PID:5860
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5692 -childID 4 -isForBrowser -prefsHandle 5772 -prefMapHandle 5768 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3534fbd6-c150-4d77-9c43-5f03a00453c4} 4012 "\\.\pipe\gecko-crash-server-pipe.4012" tab
                          7⤵
                            PID:5876
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5900 -childID 5 -isForBrowser -prefsHandle 5976 -prefMapHandle 5972 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1aaf9843-3bd3-49e1-9f02-3ee2088547aa} 4012 "\\.\pipe\gecko-crash-server-pipe.4012" tab
                            7⤵
                              PID:5888
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5744 -childID 6 -isForBrowser -prefsHandle 6100 -prefMapHandle 6104 -prefsLen 27101 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a89d07ab-3699-4cde-ad79-8daa078c37ba} 4012 "\\.\pipe\gecko-crash-server-pipe.4012" tab
                              7⤵
                                PID:4660
                      • C:\Users\Admin\1000037002\a97ffb87e3.exe
                        "C:\Users\Admin\1000037002\a97ffb87e3.exe"
                        3⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of WriteProcessMemory
                        PID:4428
                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                          4⤵
                          • System Location Discovery: System Language Discovery
                          PID:4360
                      • C:\Users\Admin\AppData\Local\Temp\1000038001\dc1b820db4.exe
                        "C:\Users\Admin\AppData\Local\Temp\1000038001\dc1b820db4.exe"
                        3⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        PID:3452
                  • C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                    C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                    1⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Identifies Wine through registry keys
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • Suspicious behavior: EnumeratesProcesses
                    PID:1132
                  • C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                    C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                    1⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Identifies Wine through registry keys
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • Suspicious behavior: EnumeratesProcesses
                    PID:4220
                  • C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                    C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                    1⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Identifies Wine through registry keys
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • Suspicious behavior: EnumeratesProcesses
                    PID:1524

                  Network

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Users\Admin\1000037002\a97ffb87e3.exe

                    Filesize

                    330KB

                    MD5

                    b9725e6125233dee3e1feb1a5877850b

                    SHA1

                    fa69edc44d562ede0c1dbafe263a847c638dad60

                    SHA256

                    dd6aca77dc5c84918250f8c681a3a7391d0b6e512c763f9eaf4eb7e4c3695fd4

                    SHA512

                    5b1a9520b5dc10085756fd72a20de62f6f6ed48f1d76f7a93ebbf847a6c699c03121ebe56dadc1b0bf90855b7d446af47a46b3ce8527a07abd7457d62b4271d9

                  • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rl5fa9qd.default-release\cache2\entries\E449899591A9BC91DFBA673EC0589B51E541A88B

                    Filesize

                    13KB

                    MD5

                    6d902274d3c48ad4c6e87906170222a5

                    SHA1

                    4aee4d740f8eace33fd2b9a6fb68fc859e36c8c3

                    SHA256

                    c93a208227e66439927fa1b210c7264286a43e493fb8704a48bebba7a85dbe54

                    SHA512

                    500363e2f088e0840c3223d7b601223b5f4691258de0f4f8413212ae9e88750fb9ed28732bd6f9b2d4d67dd020f1f72bde58f6a2e06394c2bc7007c231dc0234

                  • C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

                    Filesize

                    1.9MB

                    MD5

                    b0793df68563b6c6e89ec848478ad0e7

                    SHA1

                    0d4d1e949a624613448d2e8c8007185823408234

                    SHA256

                    b6fc70434c7ed986b972b80c4b19ead943118d05b9b3fcc97882c9a74e4e7b09

                    SHA512

                    fc4cd0a359b91d8e9d5c07572abb57e6b0be58f502432018b6657615eceb7a3bbc633bf6b3ca8b40ba77899e3ac839b0d98b7adc160fbdb04226675548bad42e

                  • C:\Users\Admin\AppData\Local\Temp\1000036001\79005ad8df.exe

                    Filesize

                    1.3MB

                    MD5

                    03dea3374e443f985819c31eca10560c

                    SHA1

                    44b963d221b2b52835ac389b41754873a7a48779

                    SHA256

                    6fbef0d57502a0dcbebe0c8bb1d592bbb03c605ec403dc67fc2f972e4fb91c05

                    SHA512

                    df33d2d8561895417f486ac6264bec591324f8e2083dab2783c5ad18035013478599b080d193bab601bcb77324502deebe01a44da4f413e335a0de91a45fc489

                  • C:\Users\Admin\AppData\Local\Temp\1000038001\dc1b820db4.exe

                    Filesize

                    187KB

                    MD5

                    278ee1426274818874556aa18fd02e3a

                    SHA1

                    185a2761330024dec52134df2c8388c461451acb

                    SHA256

                    37257ddb1a6f309a6e9d147b5fc2551a9cae3a0e52b191b18d9465bfcb5c18eb

                    SHA512

                    07ec6759af5b9a00d8371b9fd9b723012dd0a1614cfcc7cd51975a004f69ffb90083735e9a871a2aa0e8d28799beac53a4748f55f4dd1e7495bc7388ebf4d6a0

                  • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                    Filesize

                    479KB

                    MD5

                    09372174e83dbbf696ee732fd2e875bb

                    SHA1

                    ba360186ba650a769f9303f48b7200fb5eaccee1

                    SHA256

                    c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                    SHA512

                    b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                  • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                    Filesize

                    13.8MB

                    MD5

                    0a8747a2ac9ac08ae9508f36c6d75692

                    SHA1

                    b287a96fd6cc12433adb42193dfe06111c38eaf0

                    SHA256

                    32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                    SHA512

                    59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rl5fa9qd.default-release\AlternateServices.bin

                    Filesize

                    10KB

                    MD5

                    e8cb66fa5e7ea47c2d527613a759f789

                    SHA1

                    05f0fcfee4e489aebb590fdc328728f798bb5292

                    SHA256

                    ae98b7fd44e9b4e24d81d4de0173996a7bfd86ff3cfb980d373b60a02107008f

                    SHA512

                    e05bb8279c70778966c2449362fd0bc51898f9339d0af0b05e631157b84ef26716549d9f853ff5d467488e02ef4b171955e568ab1dfdfbfba932d002100236b1

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rl5fa9qd.default-release\AlternateServices.bin

                    Filesize

                    12KB

                    MD5

                    48f5b9848159511471c06448bf0af945

                    SHA1

                    bc09c144d98b8cbc32ea2453676a1ce86a4d00f8

                    SHA256

                    b5f03725adad6bdb953261d9daaf968f9f15e157961cdf73fc7b43ac66e7b114

                    SHA512

                    0377af524dd0414beda9e52c29ff8c75856d468b6cccd44ca0cb608d8a6d5bb4b9303e45c012f873122b50c5fbc0d364e823aa037544b87d0b16f42a695a5d11

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rl5fa9qd.default-release\datareporting\glean\db\data.safe.tmp

                    Filesize

                    25KB

                    MD5

                    c8b4ab04f2cb0626f2109432b0cf1cce

                    SHA1

                    61860e6c20948398c0adc6a95c85f3180fba3047

                    SHA256

                    79ff4edb6ae7ced74f8ceb5ad665751981689184aa3e1e6ff55cc2df4675edc6

                    SHA512

                    cca6381a8c751155f3289af70d4e230b577637245e726a6c126b775115e377a2c7232ae120f5252af9215d6c68f47aaa85c80327cd29065cf3fea7499b505fc6

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rl5fa9qd.default-release\datareporting\glean\db\data.safe.tmp

                    Filesize

                    22KB

                    MD5

                    ec28abdc9f73abbe17282a090bb581b2

                    SHA1

                    a7cec4a5ab0e174bb87c7b1435c7417689321212

                    SHA256

                    649bf262bc0ba56c8a00eab97a9e39e559b195856a10511bf67115d5f03d9c98

                    SHA512

                    e2fccbfd25d973917e563c2fb605f109158395e9f519c9163886933682a1973b167cb246f2ba9f50b3636e9f99bb5c78597217d68d9a5f14171efa6306427f33

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rl5fa9qd.default-release\datareporting\glean\db\data.safe.tmp

                    Filesize

                    25KB

                    MD5

                    0333783b0751e4e0f192a7225dae0b8a

                    SHA1

                    abc7b4f3df32ba7e3ca6dbaf1108e6fb5f9407c5

                    SHA256

                    1de1073df075f089273c8623ae7e97a6078ca16f4868f82c09f3d9ee70669095

                    SHA512

                    f525e1df05e15bbad2a11ad7a7967c3d91db7b4adc59ab48fca2850d6c2cd0078c3109050c960c71b3365a732c3ec61c9d69bf91b1d0aa1ff33b3f5ab81b93fd

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rl5fa9qd.default-release\datareporting\glean\db\data.safe.tmp

                    Filesize

                    25KB

                    MD5

                    706387e24c549230d3bd629f2c3bd1ea

                    SHA1

                    5e3a7e7645eb67219300d906752902a41a2d1b10

                    SHA256

                    f0d149990b3a75f46b99af35a9cde6056c6ff698fa1586fbadf022d01031e099

                    SHA512

                    812d008538d3c75edf389079c4b09954e3423b35bec62ae6b3c6a96638bb195089a8a85f84039224af1762feaab59c1d5b5e6c4fb0f3cd6ac0d7a929295fd940

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rl5fa9qd.default-release\datareporting\glean\pending_pings\4c25bc39-04ca-48bf-8511-7cab93484900

                    Filesize

                    659B

                    MD5

                    a4b7ef159f5bc24464adfedd8b1166f1

                    SHA1

                    ebd410c404d4ca119e93f8d46f1dbb40d277554b

                    SHA256

                    46a01b63ab8fb2456891a1b06f0d9c218bc6961015e7b0c9fa3a9645de87a663

                    SHA512

                    06cb98a9c0d0d248613c67e8f8d345da9855503845027511e7386b3aa2e72c495934b70b172325fa61cb244bd8d840ab79e4eca9cae0f082a6293036e7be50ce

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rl5fa9qd.default-release\datareporting\glean\pending_pings\692edcee-e6a4-4850-8092-3a2ca5409545

                    Filesize

                    982B

                    MD5

                    cef06387b3b885dffa1c4ebc70aeca39

                    SHA1

                    34375d53bbfa76c20f74092d45bb181778ca626b

                    SHA256

                    05345c327ace3025e56d480f9f95951d1ab5bbe271e0d0f8b8907b9bfb62e57d

                    SHA512

                    34d4f5dcb78e77e5e59164cf0da31de043ee172681ff6c0a36b4cbfa379821d5d95dc22f6c6a90c2bb78a4cbe6735cf2570e544440269922f1890891fe49998c

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rl5fa9qd.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

                    Filesize

                    1.1MB

                    MD5

                    842039753bf41fa5e11b3a1383061a87

                    SHA1

                    3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                    SHA256

                    d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                    SHA512

                    d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rl5fa9qd.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

                    Filesize

                    116B

                    MD5

                    2a461e9eb87fd1955cea740a3444ee7a

                    SHA1

                    b10755914c713f5a4677494dbe8a686ed458c3c5

                    SHA256

                    4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                    SHA512

                    34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rl5fa9qd.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

                    Filesize

                    372B

                    MD5

                    bf957ad58b55f64219ab3f793e374316

                    SHA1

                    a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                    SHA256

                    bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                    SHA512

                    79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rl5fa9qd.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

                    Filesize

                    17.8MB

                    MD5

                    daf7ef3acccab478aaa7d6dc1c60f865

                    SHA1

                    f8246162b97ce4a945feced27b6ea114366ff2ad

                    SHA256

                    bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                    SHA512

                    5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rl5fa9qd.default-release\prefs-1.js

                    Filesize

                    13KB

                    MD5

                    cade517ac00e177bca8d9f04f29aa7e9

                    SHA1

                    02edfb5ab586d8d5ad51d566b0b8b76f85117ee5

                    SHA256

                    4e40976c04081d766c1d23de39a901701c4175444d818adf60f5e2010081a6e4

                    SHA512

                    2d2d14c271494fe2f06300ce691fa56f0ffdc08fe919a9c309e7dffbbd8d7b32fe56a5d1c70412cd6e0403225c7b14069cdf7cb6606c085ff41c56947d24d2eb

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rl5fa9qd.default-release\prefs-1.js

                    Filesize

                    16KB

                    MD5

                    0607c3ff27c2adda08452687f692578c

                    SHA1

                    7f4f369829e778eb5d09947015dbd238fc39e747

                    SHA256

                    e45de415801e207d73f3e8c9941625b192bbcc07069523a57a086db4217f82fd

                    SHA512

                    66324b27cb1af825394933f5ed6ad7f4dc3b8c076aecf224fdda4f0c20f95915e0b13faf556c84fe5bc900adb57dafa93820d5b2d8144e6c9a85211e9e06aa38

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rl5fa9qd.default-release\prefs.js

                    Filesize

                    11KB

                    MD5

                    4ea996795959ece12c4a83d63845ab97

                    SHA1

                    d09241cc52558aa83e318a55eed71d66ceaa7f1d

                    SHA256

                    3a408b9c82750a05d536e202d0370dcd6d56e67a47956498e8e17b13843fe4d7

                    SHA512

                    3ad8b9c934adba7599829a87b63b41813fe31dc310b4997817cf3b7a8c3a06d85f3405e247337bacf9863abe2fd90f7e0e01fc95666356f6fe52790708e1bef3

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rl5fa9qd.default-release\prefs.js

                    Filesize

                    11KB

                    MD5

                    e5ad804db29edd8acfea91c4c2b13f33

                    SHA1

                    27d049697ac01161b524e7767a668cae38a2fef2

                    SHA256

                    11ac016fcee27d9e46082e0b7aada7bddc98743599cf4b2f7c455a7870e0f5fd

                    SHA512

                    eeb87e477759f87f63ebdce63c0beb2f649a6508ec70a5c40f573423a15f5d0cea5d4709dd04d1f2e4bfd5144b11d88ae157544808a8b1dea80cd6ef7639f252

                  • memory/248-22-0x00000000009E0000-0x0000000000EB0000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/248-2623-0x00000000009E0000-0x0000000000EB0000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/248-2617-0x00000000009E0000-0x0000000000EB0000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/248-2614-0x00000000009E0000-0x0000000000EB0000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/248-2612-0x00000000009E0000-0x0000000000EB0000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/248-2611-0x00000000009E0000-0x0000000000EB0000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/248-2610-0x00000000009E0000-0x0000000000EB0000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/248-2609-0x00000000009E0000-0x0000000000EB0000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/248-2605-0x00000000009E0000-0x0000000000EB0000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/248-2596-0x00000000009E0000-0x0000000000EB0000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/248-410-0x00000000009E0000-0x0000000000EB0000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/248-419-0x00000000009E0000-0x0000000000EB0000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/248-420-0x00000000009E0000-0x0000000000EB0000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/248-429-0x00000000009E0000-0x0000000000EB0000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/248-432-0x00000000009E0000-0x0000000000EB0000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/248-437-0x00000000009E0000-0x0000000000EB0000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/248-2412-0x00000000009E0000-0x0000000000EB0000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/248-1062-0x00000000009E0000-0x0000000000EB0000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/248-16-0x00000000009E0000-0x0000000000EB0000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/248-23-0x00000000009E0000-0x0000000000EB0000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/248-21-0x00000000009E0000-0x0000000000EB0000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/1132-20-0x00000000009E0000-0x0000000000EB0000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/1132-24-0x00000000009E0000-0x0000000000EB0000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/1132-26-0x00000000009E1000-0x0000000000A0F000-memory.dmp

                    Filesize

                    184KB

                  • memory/1132-27-0x00000000009E0000-0x0000000000EB0000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/1524-2616-0x00000000009E0000-0x0000000000EB0000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/1524-2615-0x00000000009E0000-0x0000000000EB0000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/1884-48-0x0000000000400000-0x000000000052D000-memory.dmp

                    Filesize

                    1.2MB

                  • memory/1884-50-0x0000000000400000-0x000000000052D000-memory.dmp

                    Filesize

                    1.2MB

                  • memory/1884-52-0x0000000000400000-0x000000000052D000-memory.dmp

                    Filesize

                    1.2MB

                  • memory/3452-91-0x0000000000E90000-0x00000000010D3000-memory.dmp

                    Filesize

                    2.3MB

                  • memory/3452-92-0x0000000000E90000-0x00000000010D3000-memory.dmp

                    Filesize

                    2.3MB

                  • memory/4220-2598-0x00000000009E0000-0x0000000000EB0000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/4220-2599-0x00000000009E0000-0x0000000000EB0000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/4360-75-0x0000000000400000-0x0000000000643000-memory.dmp

                    Filesize

                    2.3MB

                  • memory/4360-73-0x0000000000400000-0x0000000000643000-memory.dmp

                    Filesize

                    2.3MB

                  • memory/4428-71-0x0000000000FE0000-0x0000000001038000-memory.dmp

                    Filesize

                    352KB

                  • memory/4804-0-0x0000000000B40000-0x0000000001010000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/4804-1-0x00000000779C6000-0x00000000779C8000-memory.dmp

                    Filesize

                    8KB

                  • memory/4804-2-0x0000000000B41000-0x0000000000B6F000-memory.dmp

                    Filesize

                    184KB

                  • memory/4804-3-0x0000000000B40000-0x0000000001010000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/4804-5-0x0000000000B40000-0x0000000001010000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/4804-18-0x0000000000B40000-0x0000000001010000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/5044-46-0x0000000000620000-0x0000000000772000-memory.dmp

                    Filesize

                    1.3MB