Analysis

  • max time kernel
    149s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15-08-2024 06:39

General

  • Target

    fcab4949f2e97dca79e18b8ee9ff5499d4f1840929b158a2e04d03f6ff70dc24.exe

  • Size

    1.8MB

  • MD5

    681684038f5ae0cbb1974d2dd82c345c

  • SHA1

    cef63a7eadae08d4e663e5222e70ecdb04ba54de

  • SHA256

    fcab4949f2e97dca79e18b8ee9ff5499d4f1840929b158a2e04d03f6ff70dc24

  • SHA512

    d9726dfd336e86838fdee5f3588872dd97528e7d33265872c3417f6b98ca4f4e12135de2d9b2a56898f74d25cad73316ffd46451c17c4853ee663bcb2c3a690c

  • SSDEEP

    49152:h1EeaZlsY7/Y12f84uo2Zqj1RtvDh2mCz4i:hyvZlsYTYMfBuHZKlG

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

0657d1

C2

http://185.215.113.19

Attributes
  • install_dir

    0d8f5eb8a7

  • install_file

    explorti.exe

  • strings_key

    6c55a5f34bb433fbd933a168577b1838

  • url_paths

    /Vi9leo/index.php

rc4.plain

Extracted

Family

stealc

Botnet

nord

C2

http://185.215.113.100

Attributes
  • url_path

    /e2b1563c6670f193.php

Extracted

Family

stealc

Botnet

kora

C2

http://185.215.113.100

Attributes
  • url_path

    /e2b1563c6670f193.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Stealc

    Stealc is an infostealer written in C++.

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 10 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 7 IoCs
  • Identifies Wine through registry keys 2 TTPs 5 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 2 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • AutoIT Executable 3 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 10 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\fcab4949f2e97dca79e18b8ee9ff5499d4f1840929b158a2e04d03f6ff70dc24.exe
    "C:\Users\Admin\AppData\Local\Temp\fcab4949f2e97dca79e18b8ee9ff5499d4f1840929b158a2e04d03f6ff70dc24.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:704
    • C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
      "C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:224
      • C:\Users\Admin\AppData\Local\Temp\1000036001\b8dad51ee0.exe
        "C:\Users\Admin\AppData\Local\Temp\1000036001\b8dad51ee0.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1444
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          4⤵
          • Checks computer location settings
          • System Location Discovery: System Language Discovery
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:3988
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:1424
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
              6⤵
              • Checks processor information in registry
              • Modifies registry class
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:2420
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2032 -parentBuildID 20240401114208 -prefsHandle 1960 -prefMapHandle 1952 -prefsLen 23602 -prefMapSize 244628 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1579d669-3217-45d7-a4e8-432945cddab9} 2420 "\\.\pipe\gecko-crash-server-pipe.2420" gpu
                7⤵
                  PID:3804
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2468 -parentBuildID 20240401114208 -prefsHandle 2460 -prefMapHandle 2452 -prefsLen 24522 -prefMapSize 244628 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f0fc9efe-fbe4-4bee-967b-eca2a71e8640} 2420 "\\.\pipe\gecko-crash-server-pipe.2420" socket
                  7⤵
                    PID:3468
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2908 -childID 1 -isForBrowser -prefsHandle 2832 -prefMapHandle 1436 -prefsLen 22590 -prefMapSize 244628 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {90fef7a6-88d4-40d7-89f2-fae59c0823c3} 2420 "\\.\pipe\gecko-crash-server-pipe.2420" tab
                    7⤵
                      PID:4804
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3908 -childID 2 -isForBrowser -prefsHandle 3904 -prefMapHandle 3900 -prefsLen 29012 -prefMapSize 244628 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7bc514b3-2671-4dd6-8925-7ae893554a38} 2420 "\\.\pipe\gecko-crash-server-pipe.2420" tab
                      7⤵
                        PID:1888
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4672 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4696 -prefMapHandle 4692 -prefsLen 29012 -prefMapSize 244628 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f32a953b-179f-4a37-8f1e-8930260c116f} 2420 "\\.\pipe\gecko-crash-server-pipe.2420" utility
                        7⤵
                        • Checks processor information in registry
                        PID:5212
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5400 -childID 3 -isForBrowser -prefsHandle 5416 -prefMapHandle 5432 -prefsLen 26989 -prefMapSize 244628 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b5d782bf-9b7e-41c6-b9df-e6833145a5fb} 2420 "\\.\pipe\gecko-crash-server-pipe.2420" tab
                        7⤵
                          PID:6052
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5556 -childID 4 -isForBrowser -prefsHandle 5632 -prefMapHandle 5628 -prefsLen 26989 -prefMapSize 244628 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5f71c2e6-7bbf-497a-a032-5ae4fc7a8f0a} 2420 "\\.\pipe\gecko-crash-server-pipe.2420" tab
                          7⤵
                            PID:6064
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5784 -childID 5 -isForBrowser -prefsHandle 5372 -prefMapHandle 5360 -prefsLen 26989 -prefMapSize 244628 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4c4267a1-cb64-4f1f-a4dc-a9a28c612d87} 2420 "\\.\pipe\gecko-crash-server-pipe.2420" tab
                            7⤵
                              PID:6080
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6304 -childID 6 -isForBrowser -prefsHandle 6328 -prefMapHandle 6324 -prefsLen 27039 -prefMapSize 244628 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {64e9b890-5f77-4ba4-99e9-66e5a1b0bcf8} 2420 "\\.\pipe\gecko-crash-server-pipe.2420" tab
                              7⤵
                                PID:5264
                      • C:\Users\Admin\1000037002\ecc1975702.exe
                        "C:\Users\Admin\1000037002\ecc1975702.exe"
                        3⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of WriteProcessMemory
                        PID:1940
                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                          4⤵
                            PID:1800
                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                            4⤵
                            • Loads dropped DLL
                            • System Location Discovery: System Language Discovery
                            • Checks processor information in registry
                            • Suspicious behavior: EnumeratesProcesses
                            PID:1456
                        • C:\Users\Admin\AppData\Local\Temp\1000038001\189b776df5.exe
                          "C:\Users\Admin\AppData\Local\Temp\1000038001\189b776df5.exe"
                          3⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          PID:4420
                    • C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                      C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                      1⤵
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • Suspicious behavior: EnumeratesProcesses
                      PID:5444
                    • C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                      C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                      1⤵
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • Suspicious behavior: EnumeratesProcesses
                      PID:4156
                    • C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                      C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                      1⤵
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • Suspicious behavior: EnumeratesProcesses
                      PID:1380

                    Network

                    MITRE ATT&CK Enterprise v15

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\ProgramData\mozglue.dll

                      Filesize

                      593KB

                      MD5

                      c8fd9be83bc728cc04beffafc2907fe9

                      SHA1

                      95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                      SHA256

                      ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                      SHA512

                      fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                    • C:\ProgramData\nss3.dll

                      Filesize

                      2.0MB

                      MD5

                      1cc453cdf74f31e4d913ff9c10acdde2

                      SHA1

                      6e85eae544d6e965f15fa5c39700fa7202f3aafe

                      SHA256

                      ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                      SHA512

                      dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                    • C:\Users\Admin\1000037002\ecc1975702.exe

                      Filesize

                      330KB

                      MD5

                      9b5ce0aad79aa13bb49dac5c65263ad8

                      SHA1

                      e0d347799df48b5c1329fca59ec75f219b71c2de

                      SHA256

                      f4b001e32cc190b798b767b41fa1556a384ee248920b71e8c1bd6e37ec4adb48

                      SHA512

                      b884bbcb15fd5dfb0e03209c5d697396536b4587190cd9bd0de157cf52152382b6ba90ad90b109a42f2d4f2b88a28585bfd01d42ed709085bb2857f065329dfd

                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zrrtvxky.default-release\cache2\entries\E449899591A9BC91DFBA673EC0589B51E541A88B

                      Filesize

                      13KB

                      MD5

                      a43536af5fff5fd2a74c89228d7e02f3

                      SHA1

                      ec772eb9b2e7e061f586e5081883fadc6894efbf

                      SHA256

                      562686ceb3f58fbbb4296e4c7df20ca0790b26eb7d68d1c672a69c1fee7b4947

                      SHA512

                      ecfc45e85118e4412d7a89d02353981664d5b36856bb1b94c7a6c0a7adcf569fa1f601a40a371479a05115fd3f8cf9a04d14078f2477331a9a862ee96adfb6d4

                    • C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

                      Filesize

                      1.8MB

                      MD5

                      681684038f5ae0cbb1974d2dd82c345c

                      SHA1

                      cef63a7eadae08d4e663e5222e70ecdb04ba54de

                      SHA256

                      fcab4949f2e97dca79e18b8ee9ff5499d4f1840929b158a2e04d03f6ff70dc24

                      SHA512

                      d9726dfd336e86838fdee5f3588872dd97528e7d33265872c3417f6b98ca4f4e12135de2d9b2a56898f74d25cad73316ffd46451c17c4853ee663bcb2c3a690c

                    • C:\Users\Admin\AppData\Local\Temp\1000036001\b8dad51ee0.exe

                      Filesize

                      1.3MB

                      MD5

                      980c41e3847ca8442702221633cee6ef

                      SHA1

                      6359f2bdce723290d5e59d75632ee1b34ccbfccb

                      SHA256

                      b334b35ee113fb34996ea6b19e0989865679c484c4efdc4a78e1f2b72dca3aad

                      SHA512

                      2f98d724596b5ab1c96dde899fe3de2549271bdd9fdb4ac586b756d41a40bfb9d9343ea845c52a192d12f1836f879736fc39ca3c0dbfc84cb2be6f40f82912fa

                    • C:\Users\Admin\AppData\Local\Temp\1000038001\189b776df5.exe

                      Filesize

                      187KB

                      MD5

                      278ee1426274818874556aa18fd02e3a

                      SHA1

                      185a2761330024dec52134df2c8388c461451acb

                      SHA256

                      37257ddb1a6f309a6e9d147b5fc2551a9cae3a0e52b191b18d9465bfcb5c18eb

                      SHA512

                      07ec6759af5b9a00d8371b9fd9b723012dd0a1614cfcc7cd51975a004f69ffb90083735e9a871a2aa0e8d28799beac53a4748f55f4dd1e7495bc7388ebf4d6a0

                    • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                      Filesize

                      479KB

                      MD5

                      09372174e83dbbf696ee732fd2e875bb

                      SHA1

                      ba360186ba650a769f9303f48b7200fb5eaccee1

                      SHA256

                      c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                      SHA512

                      b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                    • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                      Filesize

                      13.8MB

                      MD5

                      0a8747a2ac9ac08ae9508f36c6d75692

                      SHA1

                      b287a96fd6cc12433adb42193dfe06111c38eaf0

                      SHA256

                      32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                      SHA512

                      59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\AlternateServices.bin

                      Filesize

                      16KB

                      MD5

                      2826ebd18de0124f82c026867529f226

                      SHA1

                      7b938a79c14a5e5a31322c0c78005a3bceaa6372

                      SHA256

                      60427c2beb5ed5ba385f810f1fece4aa7448736d65df43fc5d824b8c2df01af5

                      SHA512

                      ed69cf8f01849cd127f18ae8709a411ef0b83b6e2c097b38a75bf3964f31c816f9994de484f8de87cacd189c13f5ddfd4cc332bc86293b623600e9f762049383

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\AlternateServices.bin

                      Filesize

                      8KB

                      MD5

                      abf8d8e972aa581f9f6b4c1d36d3e135

                      SHA1

                      3e79fb53a236e88cee9dabc0e71dab325d5aa827

                      SHA256

                      c6ea573e33d642d3b7c71dc51fbcd503343d9698b2ad2635b48e6a836852a445

                      SHA512

                      20e207d3ab66174f6d30df01b5b073559344c6297c80ec6cfb585d4fb6ecbe75808851d09be824e838b689c0db36b39ec6e5b32e1e21058f2051ca69779f2943

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\cookies.sqlite

                      Filesize

                      512KB

                      MD5

                      34c55844cfe7ad14cac73d517afdeba0

                      SHA1

                      0d43d467b6057ae4668397e6f77d0d22caf8f308

                      SHA256

                      67173f15c6999038cab0aae8be054977d0b6cd5daab8d52740f56e569e08e573

                      SHA512

                      21c41cd11d1d06bcaf433bcee7c2a38230c7a34baa502bc37931a8d7fdc7f7fb38619073dbc339d44f8a46ba7f796716fd55996698c540c00ac3f7a9f019b0ed

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\cookies.sqlite-wal

                      Filesize

                      512KB

                      MD5

                      5e76e40a2918ff8cfe2b0c6e9a222e8a

                      SHA1

                      cb979fb7cfc04b9a4f3b2cd9b2a49bb56c8dcc29

                      SHA256

                      9ff8019e02b297aefec8703068713d33d67e46adc72d3d4619086c56d5bb745e

                      SHA512

                      b56d61eced565963195fc0b3fb39bf6637fc112fd19a962da1295ea9999b5dfb6ce6b29c59493389131be345a5d9d9b78182ba7a47a73911f31d0d8f0520af57

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\datareporting\glean\db\data.safe.tmp

                      Filesize

                      16KB

                      MD5

                      a34a50519a33de161bddf197b65bac9e

                      SHA1

                      110028d38899eed63d206182086796482529f3bb

                      SHA256

                      a42f2e6d85d25236090eeb23e236936f7955a6545a67e52cb9c76ffc83b21977

                      SHA512

                      fb3def9a5cb94205820b33be15867bbe6303a1a7b7a0eb4ef5e56ba428ba6f2cbcea05df2be0f2ea370b0d76dd1b2a29d2943c06fb24cf63d6242523535a2e35

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\datareporting\glean\db\data.safe.tmp

                      Filesize

                      16KB

                      MD5

                      59100bd605bc4a70ff6a75945eb10604

                      SHA1

                      ddfef44a34a8c7b5a5898976eb6599cccde8fdee

                      SHA256

                      ec9ea7ea84f93d54eaf0bf83a6589c846819088a53d260593bbb3d80bd11842f

                      SHA512

                      0a40ad59f26c26428770dfd02bb6a89ea57fbae9ecd2e891977628a15e1d2c4c3d3d57465e3aeb3fe6ee2d930181df165e79dd31f6f1aa4615462394302d2bfc

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\datareporting\glean\db\data.safe.tmp

                      Filesize

                      5KB

                      MD5

                      772a4822a22298045232721ecfaf4c40

                      SHA1

                      cf18b7a9298bda89380247f7f1df51577d54c555

                      SHA256

                      9aa9627c05a7a1debdb5f1a2223f81994dea2c451ec05b8fe890e49a40e9b8b6

                      SHA512

                      cc1593b5ad29f2b2f51e07676a63ef2cf552908f16b0496dbad9fee08e9ed3d5fd277b11ba91963384b26fa246d70209d7e4a70306eb2d6d30869a67c89051c3

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\datareporting\glean\pending_pings\72954ad6-27a3-4fa1-83bf-1a72367445bc

                      Filesize

                      27KB

                      MD5

                      44d8ee9870378a33f2c0f5984aa0c5fb

                      SHA1

                      8838baa01702c7b7bd93fbacc6b803257122a43b

                      SHA256

                      2749faba897342c2716404bb6e5b8f8d7e0a271bb0add033b8c390b6fba5a6f1

                      SHA512

                      a168f7fd272a74b6d15aa0798aa202b2c4dac9d246eba6dc0fbe87e72b7c2caa1943405c5ff38cea47d591597094b1722d1da2f30cf2798b0a420ce35c9416c2

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\datareporting\glean\pending_pings\b35a26d7-2348-4d58-bfc0-ae6f462c11c6

                      Filesize

                      982B

                      MD5

                      7c0dc1c9ba49b5b6c994379f5fa7da29

                      SHA1

                      8fac4a46172b0659ad75cf99a6525c567fc6329e

                      SHA256

                      cc761feacceb47e83d115a72d716c0a1c0eb3700632996a40e2cf946a91d60c8

                      SHA512

                      b6a6add800dcc4cc4a33fec912e2bb61b31260206eb14491d1f86d34a7352bf618c13c3a21d3260af3d635bfe18c5efcfb9cfd4bc55e91ed0954d1c58eca980d

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\datareporting\glean\pending_pings\d3e27b53-6053-48b2-bb8c-ad0124ea0230

                      Filesize

                      671B

                      MD5

                      a4d68db10160fda2e8ec36c02e8d48c4

                      SHA1

                      f972a2c216a1455825e37b3c92c5e7210b96d5e5

                      SHA256

                      c7d1bcf2116e29c6c3d07011f7fa43e0c68c39021257760479f3d8e016d932b9

                      SHA512

                      a2d5bfdc66fd9fe5733c37dea20b66f69e97e17d2b9370416b444814349ce1796985fe432ebd450e53f034b2e5bd81b62f79450cc17994e1d323b57d7d323cf3

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\formhistory.sqlite

                      Filesize

                      256KB

                      MD5

                      97c1441748d6cc3e5a7030cda7543975

                      SHA1

                      f5598a45b101a5404126cd27fbb7f4b70861ee32

                      SHA256

                      2015b584b844b091d6a6280d45e9a589ea0feacf5f4b19bdd4cc21c60dbaaf91

                      SHA512

                      29d358ec7725038c6648251d8b9c32f3a40458e9c97926e0000ab42f0369b96d1ba5216eeb7c35800c740633dfd3b1e6e6aa73859644bdb9cdccaf2a3516bcb9

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

                      Filesize

                      1.1MB

                      MD5

                      842039753bf41fa5e11b3a1383061a87

                      SHA1

                      3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                      SHA256

                      d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                      SHA512

                      d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

                      Filesize

                      116B

                      MD5

                      2a461e9eb87fd1955cea740a3444ee7a

                      SHA1

                      b10755914c713f5a4677494dbe8a686ed458c3c5

                      SHA256

                      4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                      SHA512

                      34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

                      Filesize

                      372B

                      MD5

                      bf957ad58b55f64219ab3f793e374316

                      SHA1

                      a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                      SHA256

                      bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                      SHA512

                      79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

                      Filesize

                      17.8MB

                      MD5

                      daf7ef3acccab478aaa7d6dc1c60f865

                      SHA1

                      f8246162b97ce4a945feced27b6ea114366ff2ad

                      SHA256

                      bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                      SHA512

                      5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\places.sqlite-wal

                      Filesize

                      1.3MB

                      MD5

                      a5b51877a51df1146cb61e36a22bdc56

                      SHA1

                      3795a36f06adf9da68b09348f2c070e2125c6600

                      SHA256

                      a0e6e1556ef0a813f8bfa843a0c9b2c89b3a0fae9a4095b63b579ec50fd31eea

                      SHA512

                      db03432990ff111114f2ba6cfbc3d8209b21c75323508df43cf746b3e44d50ce7569abc575d2db8f490c08cfe764af78c66d4eaea8da910d5f7dbf6f3d8aed0c

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\prefs-1.js

                      Filesize

                      13KB

                      MD5

                      f2fe328c0f77621484faab517f14730b

                      SHA1

                      bb0add752a53bd5cf742382f8b47b7deab464b3d

                      SHA256

                      bd20f5eff7fd9d853cdaca80638e73eec1b05b0ea2dac83561b6d02fa35dbf16

                      SHA512

                      2a8517a69bda890cbd326e05d8a48760a3d99d35667af948aac23dbb1dd787bbb1c95895f7bb4416904e34952d9a39fd3521329b62a242f80c45fe7632790486

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\prefs-1.js

                      Filesize

                      14KB

                      MD5

                      0e1ea55db57e1373f6438593e567c483

                      SHA1

                      d5158df677f1690188947a77305c2c0185475e95

                      SHA256

                      32d44e3878ed6ebfba499aff922a309110726964d7c1a34718e655c84664fbbc

                      SHA512

                      f4aa183a7227be1ab88c21d5731964811fcd6f27adbf7bcccc7d100aa7c49c9b37182c292cbb5a671d321af1f77b903d5cac884735a0cff165f9bb4e2a682860

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\prefs-1.js

                      Filesize

                      11KB

                      MD5

                      eb356787c6bb647917eeb139cf4e2200

                      SHA1

                      15fdc64ee490a556dbf2fa15f5b78f9da9373018

                      SHA256

                      3bd6e09f010ef635b0159b8fcffb1507c3165b1d8d77a21297566618bfcca385

                      SHA512

                      f3091aa4112f7fe33a7a07fd7be6633cc06e890e01e81b4e247eab82feeaed71183f5ef852d4f59099eba06359bbd2d57708862db5f07a878c7e2b1bd150d3da

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\prefs-1.js

                      Filesize

                      15KB

                      MD5

                      897b78afa98b261ff5db5f01d7a008cb

                      SHA1

                      41a883912e639f2872c5f72b81ef45e63d1ec527

                      SHA256

                      e474b1b7dc0487a87f64cc5a8b9f99444861659bef2f10d6177375bf441caac2

                      SHA512

                      c1110b08686ccc2b6e0f263f094d22621d56bf1b604ba139b396a0bf28f90a18a91504e0c0961bfed4437b8b905c6144a9f84b4497b4849a1c249aa80ad23d9c

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\prefs.js

                      Filesize

                      11KB

                      MD5

                      e34d35df402f33c3fe2c819df8c2b4c4

                      SHA1

                      41f8a94be694b1d98636cb1173a9fc8ff125afc9

                      SHA256

                      0435b6f75dcbdcdcb808f144ad66bdd83fbc0762986a37fbb11b87559f891129

                      SHA512

                      593657128363e69d84331e667f403f415d84472015df726c62a39c6f97d40ac87a50e37e9a702203cb6c39c35b02f957951374b9f9e382b5d094428298a3022e

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\prefs.js

                      Filesize

                      16KB

                      MD5

                      ae5860c1a9bc7bc4dce77232e67ea28b

                      SHA1

                      396a1c0a6ea9594b6e87413ee1cb27901fe158d8

                      SHA256

                      5a7117c3319729bd6ceafec569792c170ab929e07157d977f9043976c65dea2b

                      SHA512

                      3496cff3190e0adc91be0e816b1cdd86fc32acacbed28c2d0f26211c3a7629ad7b1c2b7277b21f793b71e8da5030c0e37e7b418493eadd225f3501d5df72fa53

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\sessionstore-backups\recovery.baklz4

                      Filesize

                      5KB

                      MD5

                      713e83f533dbb006a8afefffdfc48fe0

                      SHA1

                      d88d78ba68d5728fcc227624aaf3b3a1e85babe7

                      SHA256

                      d489e81a9c34571a418e520948e131b17a5123397e44177a2cc7f970e510b954

                      SHA512

                      0f038ea3c070dffb03daabed475e47d47bc5c67874cbff44496d509b4c465e9fbb2c4663f3021992284cd93c92252fc914600e7e3d16c36348f7143f05fc0f0e

                    • memory/224-511-0x0000000000630000-0x0000000000AF0000-memory.dmp

                      Filesize

                      4.8MB

                    • memory/224-20-0x0000000000630000-0x0000000000AF0000-memory.dmp

                      Filesize

                      4.8MB

                    • memory/224-473-0x0000000000630000-0x0000000000AF0000-memory.dmp

                      Filesize

                      4.8MB

                    • memory/224-510-0x0000000000630000-0x0000000000AF0000-memory.dmp

                      Filesize

                      4.8MB

                    • memory/224-3389-0x0000000000630000-0x0000000000AF0000-memory.dmp

                      Filesize

                      4.8MB

                    • memory/224-518-0x0000000000630000-0x0000000000AF0000-memory.dmp

                      Filesize

                      4.8MB

                    • memory/224-3407-0x0000000000630000-0x0000000000AF0000-memory.dmp

                      Filesize

                      4.8MB

                    • memory/224-411-0x0000000000630000-0x0000000000AF0000-memory.dmp

                      Filesize

                      4.8MB

                    • memory/224-18-0x0000000000630000-0x0000000000AF0000-memory.dmp

                      Filesize

                      4.8MB

                    • memory/224-19-0x0000000000631000-0x000000000065F000-memory.dmp

                      Filesize

                      184KB

                    • memory/224-3382-0x0000000000630000-0x0000000000AF0000-memory.dmp

                      Filesize

                      4.8MB

                    • memory/224-3399-0x0000000000630000-0x0000000000AF0000-memory.dmp

                      Filesize

                      4.8MB

                    • memory/224-3393-0x0000000000630000-0x0000000000AF0000-memory.dmp

                      Filesize

                      4.8MB

                    • memory/224-3392-0x0000000000630000-0x0000000000AF0000-memory.dmp

                      Filesize

                      4.8MB

                    • memory/224-3391-0x0000000000630000-0x0000000000AF0000-memory.dmp

                      Filesize

                      4.8MB

                    • memory/224-3390-0x0000000000630000-0x0000000000AF0000-memory.dmp

                      Filesize

                      4.8MB

                    • memory/224-2697-0x0000000000630000-0x0000000000AF0000-memory.dmp

                      Filesize

                      4.8MB

                    • memory/224-1333-0x0000000000630000-0x0000000000AF0000-memory.dmp

                      Filesize

                      4.8MB

                    • memory/224-779-0x0000000000630000-0x0000000000AF0000-memory.dmp

                      Filesize

                      4.8MB

                    • memory/224-21-0x0000000000630000-0x0000000000AF0000-memory.dmp

                      Filesize

                      4.8MB

                    • memory/704-1-0x0000000077364000-0x0000000077366000-memory.dmp

                      Filesize

                      8KB

                    • memory/704-17-0x0000000000C80000-0x0000000001140000-memory.dmp

                      Filesize

                      4.8MB

                    • memory/704-4-0x0000000000C80000-0x0000000001140000-memory.dmp

                      Filesize

                      4.8MB

                    • memory/704-3-0x0000000000C80000-0x0000000001140000-memory.dmp

                      Filesize

                      4.8MB

                    • memory/704-2-0x0000000000C81000-0x0000000000CAF000-memory.dmp

                      Filesize

                      184KB

                    • memory/704-0-0x0000000000C80000-0x0000000001140000-memory.dmp

                      Filesize

                      4.8MB

                    • memory/1380-3404-0x0000000000630000-0x0000000000AF0000-memory.dmp

                      Filesize

                      4.8MB

                    • memory/1380-3405-0x0000000000630000-0x0000000000AF0000-memory.dmp

                      Filesize

                      4.8MB

                    • memory/1444-40-0x0000000072F7E000-0x0000000072F7F000-memory.dmp

                      Filesize

                      4KB

                    • memory/1444-41-0x0000000000480000-0x00000000005D2000-memory.dmp

                      Filesize

                      1.3MB

                    • memory/1456-68-0x0000000000400000-0x0000000000643000-memory.dmp

                      Filesize

                      2.3MB

                    • memory/1456-70-0x0000000000400000-0x0000000000643000-memory.dmp

                      Filesize

                      2.3MB

                    • memory/1456-87-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                      Filesize

                      972KB

                    • memory/1940-66-0x0000000000900000-0x0000000000958000-memory.dmp

                      Filesize

                      352KB

                    • memory/3988-43-0x0000000000400000-0x000000000052D000-memory.dmp

                      Filesize

                      1.2MB

                    • memory/3988-46-0x0000000000400000-0x000000000052D000-memory.dmp

                      Filesize

                      1.2MB

                    • memory/3988-47-0x0000000000400000-0x000000000052D000-memory.dmp

                      Filesize

                      1.2MB

                    • memory/4156-3385-0x0000000000630000-0x0000000000AF0000-memory.dmp

                      Filesize

                      4.8MB

                    • memory/4156-3386-0x0000000000630000-0x0000000000AF0000-memory.dmp

                      Filesize

                      4.8MB

                    • memory/4420-3379-0x00000000008B0000-0x0000000000AF3000-memory.dmp

                      Filesize

                      2.3MB

                    • memory/4420-86-0x00000000008B0000-0x0000000000AF3000-memory.dmp

                      Filesize

                      2.3MB

                    • memory/5444-470-0x0000000000630000-0x0000000000AF0000-memory.dmp

                      Filesize

                      4.8MB

                    • memory/5444-469-0x0000000000630000-0x0000000000AF0000-memory.dmp

                      Filesize

                      4.8MB