Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15-08-2024 14:37

General

  • Target

    6dc00b02c91a51431b4d9bafbf70bf204de2152ae1391a4e374205939f81c5bf.exe

  • Size

    1.8MB

  • MD5

    6d0f73b4a2b84bef406470efcd79a990

  • SHA1

    3e76cd04a8655c14330a7392bbeedb2e17f2e015

  • SHA256

    6dc00b02c91a51431b4d9bafbf70bf204de2152ae1391a4e374205939f81c5bf

  • SHA512

    54ba08bb0194c37dbbcf0f017ba9f7a87f370b9378e6191c6f4654c479c89de398e4b467d7506dc93f580d4cb773563eaa3c4da97c46e0b10feda0a82a9a627d

  • SSDEEP

    49152:HfpD+gCvPwVQBncS0hkViHM+aWKdya3dW:HxKgMw6cS8kEHfaWIyaN

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

0657d1

C2

http://185.215.113.19

Attributes
  • install_dir

    0d8f5eb8a7

  • install_file

    explorti.exe

  • strings_key

    6c55a5f34bb433fbd933a168577b1838

  • url_paths

    /Vi9leo/index.php

rc4.plain

Extracted

Family

stealc

Botnet

nord

C2

http://185.215.113.100

Attributes
  • url_path

    /e2b1563c6670f193.php

Extracted

Family

stealc

Botnet

kora

C2

http://185.215.113.100

Attributes
  • url_path

    /e2b1563c6670f193.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Stealc

    Stealc is an infostealer written in C++.

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 8 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 6 IoCs
  • Identifies Wine through registry keys 2 TTPs 4 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 2 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • AutoIT Executable 3 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 10 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\6dc00b02c91a51431b4d9bafbf70bf204de2152ae1391a4e374205939f81c5bf.exe
    "C:\Users\Admin\AppData\Local\Temp\6dc00b02c91a51431b4d9bafbf70bf204de2152ae1391a4e374205939f81c5bf.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:688
    • C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
      "C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1376
      • C:\Users\Admin\AppData\Local\Temp\1000036001\d3d2958541.exe
        "C:\Users\Admin\AppData\Local\Temp\1000036001\d3d2958541.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3228
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          4⤵
          • Checks computer location settings
          • System Location Discovery: System Language Discovery
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:1248
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:448
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
              6⤵
              • Checks processor information in registry
              • Modifies registry class
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:60
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2032 -parentBuildID 20240401114208 -prefsHandle 1960 -prefMapHandle 1952 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8c74cd3a-5ec7-4967-ab26-512405cb266a} 60 "\\.\pipe\gecko-crash-server-pipe.60" gpu
                7⤵
                  PID:736
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2452 -parentBuildID 20240401114208 -prefsHandle 2444 -prefMapHandle 2440 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {78ed8fed-bc81-4f27-ae34-8c08214f4f3b} 60 "\\.\pipe\gecko-crash-server-pipe.60" socket
                  7⤵
                    PID:3180
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3284 -childID 1 -isForBrowser -prefsHandle 3296 -prefMapHandle 3292 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1220 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7c3007a0-c066-4567-8c60-44ffa6625dee} 60 "\\.\pipe\gecko-crash-server-pipe.60" tab
                    7⤵
                      PID:4988
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3672 -childID 2 -isForBrowser -prefsHandle 3664 -prefMapHandle 2944 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1220 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a7a78360-5a3d-4781-a5ff-cc6d73d81ec2} 60 "\\.\pipe\gecko-crash-server-pipe.60" tab
                      7⤵
                        PID:3924
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4516 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4528 -prefMapHandle 4536 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8c7907c8-3c5d-46c3-9a29-bbd1399cdb9f} 60 "\\.\pipe\gecko-crash-server-pipe.60" utility
                        7⤵
                        • Checks processor information in registry
                        PID:5356
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5324 -childID 3 -isForBrowser -prefsHandle 5312 -prefMapHandle 5308 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1220 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {02c991ea-751d-4815-8a5e-20db1306b2c1} 60 "\\.\pipe\gecko-crash-server-pipe.60" tab
                        7⤵
                          PID:5952
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5552 -childID 4 -isForBrowser -prefsHandle 5472 -prefMapHandle 5480 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1220 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8dcfe548-4342-4961-adbe-56f2d9d35fc3} 60 "\\.\pipe\gecko-crash-server-pipe.60" tab
                          7⤵
                            PID:5968
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5476 -childID 5 -isForBrowser -prefsHandle 5340 -prefMapHandle 5444 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1220 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {17c6d41b-bb08-4d01-ba4c-9b13f0dcdeca} 60 "\\.\pipe\gecko-crash-server-pipe.60" tab
                            7⤵
                              PID:6004
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6204 -childID 6 -isForBrowser -prefsHandle 6212 -prefMapHandle 6256 -prefsLen 27182 -prefMapSize 244658 -jsInitHandle 1220 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e150296e-6491-4fff-9451-abd25eef4787} 60 "\\.\pipe\gecko-crash-server-pipe.60" tab
                              7⤵
                                PID:5216
                      • C:\Users\Admin\1000037002\b86952c565.exe
                        "C:\Users\Admin\1000037002\b86952c565.exe"
                        3⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of WriteProcessMemory
                        PID:4204
                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                          4⤵
                          • Loads dropped DLL
                          • System Location Discovery: System Language Discovery
                          • Checks processor information in registry
                          • Suspicious behavior: EnumeratesProcesses
                          PID:1492
                      • C:\Users\Admin\AppData\Local\Temp\1000038001\a8675ae254.exe
                        "C:\Users\Admin\AppData\Local\Temp\1000038001\a8675ae254.exe"
                        3⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        PID:536
                  • C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                    C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                    1⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Identifies Wine through registry keys
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • Suspicious behavior: EnumeratesProcesses
                    PID:4484
                  • C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                    C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                    1⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Identifies Wine through registry keys
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • Suspicious behavior: EnumeratesProcesses
                    PID:2440

                  Network

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\ProgramData\mozglue.dll

                    Filesize

                    593KB

                    MD5

                    c8fd9be83bc728cc04beffafc2907fe9

                    SHA1

                    95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                    SHA256

                    ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                    SHA512

                    fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                  • C:\ProgramData\nss3.dll

                    Filesize

                    2.0MB

                    MD5

                    1cc453cdf74f31e4d913ff9c10acdde2

                    SHA1

                    6e85eae544d6e965f15fa5c39700fa7202f3aafe

                    SHA256

                    ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                    SHA512

                    dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                  • C:\Users\Admin\1000037002\b86952c565.exe

                    Filesize

                    196KB

                    MD5

                    c98386f4432190c0c37be9ebc2e19eda

                    SHA1

                    fad3e282c5987117de21508674eb3f0f28f958c7

                    SHA256

                    6d47e2a31348815e467a4e421edc44abbc0080393e0a9c32608e74757f038bab

                    SHA512

                    262864defaf0bc2f8b1e20967725e741fad90b288ea640b33f77305bc69357cf85648264902b03f581f4de95bc7b06ffabf897410efe4abf0b28201f6e1fbca7

                  • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\illkw0pr.default-release\activity-stream.discovery_stream.json

                    Filesize

                    33KB

                    MD5

                    2ba9f79c5533f2e3767ead19a86e1bdb

                    SHA1

                    1bf5cbf9906fbca74ed482be3a00cbc23e298a37

                    SHA256

                    3b7dbb777cf1e4cc9813482d1f83b89fef5c239e1fc1158ec533e62a606c3888

                    SHA512

                    4eb40c8b847c1e811294581726e045a671c1ff27d029f5007c685c7107acc77b281be73abad03549b1445f4d6dba34056ecd2e6eaf6fba768f059a4c37ad33f6

                  • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\illkw0pr.default-release\cache2\entries\E449899591A9BC91DFBA673EC0589B51E541A88B

                    Filesize

                    13KB

                    MD5

                    ecc9c2c647906a798f5ca79055b9a1db

                    SHA1

                    6235bb2c6f91aeb6c0a92778e5749042559ff409

                    SHA256

                    2cbe52ccbe125bccc0c1c9bc445f73a7d6daaa1d81e1b32582f6cd54ce62bbe0

                    SHA512

                    41cca4cd7989603fcf9858cc802b55139b4ec5c31c92afcd8de88d4ea3ca8ebf33ed24e00b4fc62591f8fb9d23f2463cf1dd80201b9008f4f4b906c8deef2f26

                  • C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

                    Filesize

                    1.8MB

                    MD5

                    6d0f73b4a2b84bef406470efcd79a990

                    SHA1

                    3e76cd04a8655c14330a7392bbeedb2e17f2e015

                    SHA256

                    6dc00b02c91a51431b4d9bafbf70bf204de2152ae1391a4e374205939f81c5bf

                    SHA512

                    54ba08bb0194c37dbbcf0f017ba9f7a87f370b9378e6191c6f4654c479c89de398e4b467d7506dc93f580d4cb773563eaa3c4da97c46e0b10feda0a82a9a627d

                  • C:\Users\Admin\AppData\Local\Temp\1000036001\d3d2958541.exe

                    Filesize

                    1.2MB

                    MD5

                    d1be0f6f034c55fc17558f2ae445f1b2

                    SHA1

                    6b7f7599af54f730451f8344906acc7d0a206af7

                    SHA256

                    21a8a20a3cf2e59afeea5b810da2fd7b132780a8167ab28b0bf8da4d7061478e

                    SHA512

                    3e96bbee8cb19b3dc7c45d302f5321122722562f2ad41ce9d61bb34d2fdd65c7eaf133bdb097445df327629b2fea78caa22041ca122884a9ec1758da0288f465

                  • C:\Users\Admin\AppData\Local\Temp\1000038001\a8675ae254.exe

                    Filesize

                    187KB

                    MD5

                    278ee1426274818874556aa18fd02e3a

                    SHA1

                    185a2761330024dec52134df2c8388c461451acb

                    SHA256

                    37257ddb1a6f309a6e9d147b5fc2551a9cae3a0e52b191b18d9465bfcb5c18eb

                    SHA512

                    07ec6759af5b9a00d8371b9fd9b723012dd0a1614cfcc7cd51975a004f69ffb90083735e9a871a2aa0e8d28799beac53a4748f55f4dd1e7495bc7388ebf4d6a0

                  • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                    Filesize

                    479KB

                    MD5

                    09372174e83dbbf696ee732fd2e875bb

                    SHA1

                    ba360186ba650a769f9303f48b7200fb5eaccee1

                    SHA256

                    c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                    SHA512

                    b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                  • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                    Filesize

                    13.8MB

                    MD5

                    0a8747a2ac9ac08ae9508f36c6d75692

                    SHA1

                    b287a96fd6cc12433adb42193dfe06111c38eaf0

                    SHA256

                    32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                    SHA512

                    59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\illkw0pr.default-release\AlternateServices.bin

                    Filesize

                    7KB

                    MD5

                    0f623a5b728f095949dbc8a40b3c4d08

                    SHA1

                    aa51013c0bdbf57166bf0efc17ccaa3242354b5b

                    SHA256

                    b765c8713f91405b22325b99e8111291515ddac5fd84f77f52e9a1a479202861

                    SHA512

                    b8bc3700b1650f7c3855de0f005946e8b0af7c3ea94ac360d533f413b72f0319acda99d05fad91f1c48661ecc6a0706f93168c99d2529247b4618b9ab9dc74f3

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\illkw0pr.default-release\AlternateServices.bin

                    Filesize

                    10KB

                    MD5

                    762196716223ee84b67e1a30e6c8ef0e

                    SHA1

                    d12477eb3b917202701375d3ed4bcd2a66043307

                    SHA256

                    242c1f829963a8d5081eed418cb9a1661e3bc76e22659df6c7aa0cef00ba9773

                    SHA512

                    c96b1da3a86b4548270f32fce746c04850559f95dd918afde6a2e900894f7ff658f4171ddffbc27e298ca59f4fe65160b483ca1615fa891db88bf324c89b84a8

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\illkw0pr.default-release\AlternateServices.bin

                    Filesize

                    11KB

                    MD5

                    d66de4cc0284075c24d2c010bab96a79

                    SHA1

                    32e90af7d0a2eb7911cb659a195286b4335b8af5

                    SHA256

                    b2d26626ab0d00d72651f2193e79b64fcfdb4429a992a919d9b3f93073ed2088

                    SHA512

                    a8abfc1f49d75426115f9a921187ecf4577d4cc8cac278b57d00078fc5ec4b9622d30fd2d2a8a993e2321a3370a82b19df17701d02bb6cfd0078786a68d78314

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\illkw0pr.default-release\cookies.sqlite

                    Filesize

                    512KB

                    MD5

                    21d0f942482c98b32ba7a00921528928

                    SHA1

                    514193ac1aee5c6152d5c708618cb81a23c6524c

                    SHA256

                    19eb2497cc68436a2cf772b77299d2a3dc0dd517a2a9bdaa68134258361bf89c

                    SHA512

                    85e771497634d3f18c4492971f99d1cccb21bdaa1c8c47747ae9276d2023d35393ec9c5a858a94ad6275c4040f5ccb948e486d2a37f8a9ed34a3eb457ca47f72

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\illkw0pr.default-release\cookies.sqlite-wal

                    Filesize

                    512KB

                    MD5

                    e16479165509ba9909027a952fdf3692

                    SHA1

                    6cdb221e098499a5d74d09b0287cbc005ce9bf52

                    SHA256

                    6d1e2e27c78e5bfd2dcb268efd2cbbebffe658bdaeaf3df171377e9bb589a68a

                    SHA512

                    11e1074b58f2203a333b2ab08d7308df4acec6318377bd290727f3d229e969748f83d4316a0bb20191c576de74b89d27b66dedc78ab2c8cf86ea7907958e1cf0

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\illkw0pr.default-release\datareporting\glean\db\data.safe.tmp

                    Filesize

                    5KB

                    MD5

                    8d42565ac748e36f3c7a078f0d1bf66d

                    SHA1

                    8d739ff61776645ef10701da6f2ffc946f526be3

                    SHA256

                    638b0b61388b633a323f416364b9fe2362712405818490b2b5be23610ccb90d0

                    SHA512

                    9f4be9d5fbc49dc05b4566f6d28cc1f937fcca6bd425f98a4ce0b6bf8b1d821761e9e5110bc6c9eea8f31fe431b71cc9dfb2bfee994c3919fc1b670362f60451

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\illkw0pr.default-release\datareporting\glean\db\data.safe.tmp

                    Filesize

                    16KB

                    MD5

                    2218cc1f1f0f40ba5bf85b22474374bf

                    SHA1

                    59c5461e44c84d33143ac9b7b7160271c455df25

                    SHA256

                    2daf4f3c10158af1352a2f1877ed79c3ed46f170b8e685abf1e401b2a9fc8499

                    SHA512

                    7105da7ccd5435e0c2eba545ec314e870dc3b0fa063cfc697d328400c443e6fb2cc37e32e316af82e4096f4f11038aaab31859148c1bdeaac7bf1aeaa5d99fa3

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\illkw0pr.default-release\datareporting\glean\db\data.safe.tmp

                    Filesize

                    16KB

                    MD5

                    f82dc331995330562cbe733a69dc7721

                    SHA1

                    518abb0a69d13832f7ee908352109d1ee905924b

                    SHA256

                    ed5009c008f7ef1e8ec5b569bdc63f4edf6c1d41a0ffd617fdab00eef82def2c

                    SHA512

                    cf1ce2fe577b2f866cb2fd93aad08871606e8e71e65102996559e53449ec3dc268ee12b67840d71c7a5b4dba65c7680095992e1ffcee1edaea17c331e4590f4e

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\illkw0pr.default-release\datareporting\glean\pending_pings\50b86f08-cb29-4a59-b12c-830fa84a61a5

                    Filesize

                    26KB

                    MD5

                    dffb80849f79fa8ecefaa76e1af68a12

                    SHA1

                    40bf4bc8d2df4b5e626a00e4cde979917978eaf8

                    SHA256

                    8545ede8f04310c36ac7ee9bd5862a55ee2f05e8cd8aa7f4b126269c79bad9be

                    SHA512

                    71655c106092ead0d1ba2049035514138e329a33c183e876024dfbb273447380cfc7a48d29362b7015d97c52a53e46b9f3b00ede0cf06f901df08cb4f0d9b16d

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\illkw0pr.default-release\datareporting\glean\pending_pings\61902ff6-73b0-40b0-98d7-67154fc88ed1

                    Filesize

                    671B

                    MD5

                    eaafb0e11d3a034198c54ec6aec08ed1

                    SHA1

                    d3bcf74dbbb9a1e9696e0a8e38c20b7ee1e419f3

                    SHA256

                    fd9611418ba41ceb60b6eedd3a29920078b9150e77ba6ee28ef5fc7243d6b902

                    SHA512

                    36c5bc6cd5bb9acd70fef1df857f73a4eb170af91c1b8760db849fc9a22fe9366a990c451e9c8cab115efae626a6298e4be905cfab6e3fa78a6dc053b8f1d5e1

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\illkw0pr.default-release\datareporting\glean\pending_pings\f0ba6f94-5938-4762-9348-d4d8de486448

                    Filesize

                    982B

                    MD5

                    7de4e2f62081e6d3e512501032a55fff

                    SHA1

                    64ab0898eea0578ab50b25eee63f2fd866e359f1

                    SHA256

                    8502fe7c48cf974e198e5750febfa5834b92e5f5feec887a0cecdb32b50a7491

                    SHA512

                    c1377c77081a51a01628864915cd3497d6361f3881d549363b10be17e4cc8f8bb72c0f5cc30ab6d3811fe8ab42a256ab699286729e778f32f5d967e0b4f3c0be

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\illkw0pr.default-release\formhistory.sqlite

                    Filesize

                    256KB

                    MD5

                    97c1441748d6cc3e5a7030cda7543975

                    SHA1

                    f5598a45b101a5404126cd27fbb7f4b70861ee32

                    SHA256

                    2015b584b844b091d6a6280d45e9a589ea0feacf5f4b19bdd4cc21c60dbaaf91

                    SHA512

                    29d358ec7725038c6648251d8b9c32f3a40458e9c97926e0000ab42f0369b96d1ba5216eeb7c35800c740633dfd3b1e6e6aa73859644bdb9cdccaf2a3516bcb9

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\illkw0pr.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

                    Filesize

                    1.1MB

                    MD5

                    842039753bf41fa5e11b3a1383061a87

                    SHA1

                    3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                    SHA256

                    d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                    SHA512

                    d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\illkw0pr.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

                    Filesize

                    116B

                    MD5

                    2a461e9eb87fd1955cea740a3444ee7a

                    SHA1

                    b10755914c713f5a4677494dbe8a686ed458c3c5

                    SHA256

                    4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                    SHA512

                    34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\illkw0pr.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

                    Filesize

                    372B

                    MD5

                    bf957ad58b55f64219ab3f793e374316

                    SHA1

                    a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                    SHA256

                    bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                    SHA512

                    79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\illkw0pr.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

                    Filesize

                    17.8MB

                    MD5

                    daf7ef3acccab478aaa7d6dc1c60f865

                    SHA1

                    f8246162b97ce4a945feced27b6ea114366ff2ad

                    SHA256

                    bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                    SHA512

                    5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\illkw0pr.default-release\places.sqlite-wal

                    Filesize

                    1.3MB

                    MD5

                    6732445c44182a5d1623a6ccd7e46ea0

                    SHA1

                    1578bf1f49a1de7f6636ec3f739d58bbfadf19cd

                    SHA256

                    d1a5fc2cf7592eca9072de5d50552177b25b4f4cb2879b18550bb8ac576ba624

                    SHA512

                    f3c492a6518a6151e9fac0e857a466b81c23729a1cc78935ec6001d65a73940979707b117c8be67bfb737a9be05e40576fbf059f2ed4618f2890a5a01ac1cf76

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\illkw0pr.default-release\prefs-1.js

                    Filesize

                    11KB

                    MD5

                    6aada7538bf03468ce8ae6e1799b664b

                    SHA1

                    402254037115bcddeca953a7537b35e84609f31d

                    SHA256

                    c60b1217a83526d71574c52abb680d36fe1fc13dbe9988732ec4fcfe5ddab58c

                    SHA512

                    53370952c1b439f0191b645c7135a761ab9a7685e3cc9e4cf84e9f75bcfd6c771c4997fd26b363948c1840678beb374bd6fc09295b639a7beb5ab101c3e1e62b

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\illkw0pr.default-release\prefs-1.js

                    Filesize

                    12KB

                    MD5

                    52c435efd42abcfaa574e46bf24fb141

                    SHA1

                    7c208c1876c8583d8aa6cc53be1ec74392814424

                    SHA256

                    8c42335a3fb585ee25616ba8fab1184ec390174a2848fc82e6e10b016ac854a0

                    SHA512

                    443feb7b17506b26ebbfc93ea4ccf0cb6278cf077648ae6dee96832b4d5ca63129e9814127ee1823be924df4623294ebd98b255d2f3958ced7d176c654921fba

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\illkw0pr.default-release\prefs-1.js

                    Filesize

                    13KB

                    MD5

                    8d60d7a6915ef5dff96ecfa616177dfa

                    SHA1

                    8353eaaf7e66eb7fd7fa1c9943dce0daeb9983e1

                    SHA256

                    f9a713b9ae49af2c488d5936b46d25023f0b0ef834ba24272e9491367c95fe7c

                    SHA512

                    141326ae42e7994439ab8262a2db3f0013bbaa110460e3d6ba84280ceadb48317f641a775f54750a6101dca941119b08395a09491e785cff4faa8d55e67922bf

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\illkw0pr.default-release\prefs-1.js

                    Filesize

                    14KB

                    MD5

                    f2ecbe8d9091bdeda09c978f102f2c08

                    SHA1

                    6c6bb0e7a23e101d7dc676835b13af25b02acfec

                    SHA256

                    fb2240334dd7280b44e24a73a229315656f571daa58b5e1c32d47265b5ca2779

                    SHA512

                    771ea4db28c62dc4c11f595bc9450597f2335f4bda0adc589386a5422e05c68e1e8bc40a654ac72ebcfcda55429c8ac7b4f00fb98359d1f702960a3e7d0b575d

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\illkw0pr.default-release\sessionstore-backups\recovery.baklz4

                    Filesize

                    5KB

                    MD5

                    88d94d8201f571e140038e192e669710

                    SHA1

                    703d3b16f0b4f0d681ed8377d5275eed22616223

                    SHA256

                    cb73f3985b99510dbd73138734194e72b82ecd4d47599c1e1d184c39a6ba136f

                    SHA512

                    20fb68eb1e7d05edf73b664695ce905eb101dfe283d55ebcbb4d92cbfa1363555a5b472f4084c00f23a792ce5e70603754c8ccceeb8500e2014b7eca5c5da3b6

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\illkw0pr.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

                    Filesize

                    2.2MB

                    MD5

                    df831737dbacf99f9638f3e24b8eb58c

                    SHA1

                    f91e5f1d9924fcd1275fd3051211b74dad20ede5

                    SHA256

                    602b0745eee44c281a30adcbda92c7e1c9a9f2ae6f40b9b2abccfaee007504d9

                    SHA512

                    17252a5e854bc057445f5e5b2b18115b3fc737f6af710b7eab1e4b8cc1c1ef8ae6c701a487c6bda01603d5a61514539c76e5ea9f5aa52c76799e2471dc2e8cfb

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\illkw0pr.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

                    Filesize

                    2.8MB

                    MD5

                    bae059a1950026a0219d6d124f563908

                    SHA1

                    c4121c040cbf2bece6a2aecd5ede9ff6ee8b0654

                    SHA256

                    b8fa8d31021418d5f5411fd8a30f526fba884be4894d8ed7f33fc01da10444be

                    SHA512

                    62d495132c14c36eaf5de5c3ea263d4797b2c401426e557ad4efb5c7b0b1158e0c16f82ba3e6a23d152ea90a7b58400889fcf26ee4919515aa5c1dcfdc755c56

                  • memory/536-527-0x0000000000430000-0x0000000000673000-memory.dmp

                    Filesize

                    2.3MB

                  • memory/536-90-0x0000000000430000-0x0000000000673000-memory.dmp

                    Filesize

                    2.3MB

                  • memory/688-3-0x0000000000B30000-0x0000000000FDC000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/688-2-0x0000000000B31000-0x0000000000B5F000-memory.dmp

                    Filesize

                    184KB

                  • memory/688-4-0x0000000000B30000-0x0000000000FDC000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/688-0-0x0000000000B30000-0x0000000000FDC000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/688-17-0x0000000000B30000-0x0000000000FDC000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/688-1-0x0000000077DF4000-0x0000000077DF6000-memory.dmp

                    Filesize

                    8KB

                  • memory/1248-44-0x0000000000400000-0x000000000052D000-memory.dmp

                    Filesize

                    1.2MB

                  • memory/1248-47-0x0000000000400000-0x000000000052D000-memory.dmp

                    Filesize

                    1.2MB

                  • memory/1248-49-0x0000000000400000-0x000000000052D000-memory.dmp

                    Filesize

                    1.2MB

                  • memory/1376-16-0x00000000004C0000-0x000000000096C000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/1376-1049-0x00000000004C0000-0x000000000096C000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/1376-2983-0x00000000004C0000-0x000000000096C000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/1376-2982-0x00000000004C0000-0x000000000096C000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/1376-21-0x00000000004C0000-0x000000000096C000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/1376-20-0x00000000004C0000-0x000000000096C000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/1376-19-0x00000000004C1000-0x00000000004EF000-memory.dmp

                    Filesize

                    184KB

                  • memory/1376-377-0x00000000004C0000-0x000000000096C000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/1376-526-0x00000000004C0000-0x000000000096C000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/1376-2976-0x00000000004C0000-0x000000000096C000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/1376-708-0x00000000004C0000-0x000000000096C000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/1376-2973-0x00000000004C0000-0x000000000096C000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/1376-2956-0x00000000004C0000-0x000000000096C000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/1376-428-0x00000000004C0000-0x000000000096C000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/1376-468-0x00000000004C0000-0x000000000096C000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/1376-532-0x00000000004C0000-0x000000000096C000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/1376-1466-0x00000000004C0000-0x000000000096C000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/1376-1783-0x00000000004C0000-0x000000000096C000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/1376-2114-0x00000000004C0000-0x000000000096C000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/1376-2511-0x00000000004C0000-0x000000000096C000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/1376-107-0x00000000004C0000-0x000000000096C000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/1492-91-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                    Filesize

                    972KB

                  • memory/1492-74-0x0000000000400000-0x0000000000643000-memory.dmp

                    Filesize

                    2.3MB

                  • memory/1492-71-0x0000000000400000-0x0000000000643000-memory.dmp

                    Filesize

                    2.3MB

                  • memory/2440-2969-0x00000000004C0000-0x000000000096C000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/3228-40-0x0000000073A0E000-0x0000000073A0F000-memory.dmp

                    Filesize

                    4KB

                  • memory/3228-41-0x0000000000EF0000-0x0000000001020000-memory.dmp

                    Filesize

                    1.2MB

                  • memory/4204-68-0x0000000000490000-0x00000000004C8000-memory.dmp

                    Filesize

                    224KB

                  • memory/4484-735-0x00000000004C0000-0x000000000096C000-memory.dmp

                    Filesize

                    4.7MB