Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15-08-2024 15:00

General

  • Target

    6dc00b02c91a51431b4d9bafbf70bf204de2152ae1391a4e374205939f81c5bf.exe

  • Size

    1.8MB

  • MD5

    6d0f73b4a2b84bef406470efcd79a990

  • SHA1

    3e76cd04a8655c14330a7392bbeedb2e17f2e015

  • SHA256

    6dc00b02c91a51431b4d9bafbf70bf204de2152ae1391a4e374205939f81c5bf

  • SHA512

    54ba08bb0194c37dbbcf0f017ba9f7a87f370b9378e6191c6f4654c479c89de398e4b467d7506dc93f580d4cb773563eaa3c4da97c46e0b10feda0a82a9a627d

  • SSDEEP

    49152:HfpD+gCvPwVQBncS0hkViHM+aWKdya3dW:HxKgMw6cS8kEHfaWIyaN

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

0657d1

C2

http://185.215.113.19

Attributes
  • install_dir

    0d8f5eb8a7

  • install_file

    explorti.exe

  • strings_key

    6c55a5f34bb433fbd933a168577b1838

  • url_paths

    /Vi9leo/index.php

rc4.plain

Extracted

Family

stealc

Botnet

nord

C2

http://185.215.113.100

Attributes
  • url_path

    /e2b1563c6670f193.php

Extracted

Family

stealc

Botnet

kora

C2

http://185.215.113.100

Attributes
  • url_path

    /e2b1563c6670f193.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Stealc

    Stealc is an infostealer written in C++.

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 8 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 6 IoCs
  • Identifies Wine through registry keys 2 TTPs 4 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • AutoIT Executable 3 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\6dc00b02c91a51431b4d9bafbf70bf204de2152ae1391a4e374205939f81c5bf.exe
    "C:\Users\Admin\AppData\Local\Temp\6dc00b02c91a51431b4d9bafbf70bf204de2152ae1391a4e374205939f81c5bf.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:4032
    • C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
      "C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2276
      • C:\Users\Admin\AppData\Local\Temp\1000036001\f54a68e4b7.exe
        "C:\Users\Admin\AppData\Local\Temp\1000036001\f54a68e4b7.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2076
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          4⤵
          • Checks computer location settings
          • System Location Discovery: System Language Discovery
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:2352
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:2636
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
              6⤵
              • Checks processor information in registry
              • Modifies registry class
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:3200
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1972 -parentBuildID 20240401114208 -prefsHandle 1908 -prefMapHandle 1900 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5ff5a678-ce06-40c2-b75e-db90c2d18fcf} 3200 "\\.\pipe\gecko-crash-server-pipe.3200" gpu
                7⤵
                  PID:1936
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2416 -parentBuildID 20240401114208 -prefsHandle 2408 -prefMapHandle 2404 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {07b9caa3-7540-4b53-9a67-65899fe1abde} 3200 "\\.\pipe\gecko-crash-server-pipe.3200" socket
                  7⤵
                    PID:2228
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1040 -childID 1 -isForBrowser -prefsHandle 952 -prefMapHandle 2812 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 948 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7eeb7850-069f-458d-bba6-eb4b3bd55603} 3200 "\\.\pipe\gecko-crash-server-pipe.3200" tab
                    7⤵
                      PID:4732
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4000 -childID 2 -isForBrowser -prefsHandle 3992 -prefMapHandle 3984 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 948 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {99c8949a-f09d-40ff-903d-b7a7cf044761} 3200 "\\.\pipe\gecko-crash-server-pipe.3200" tab
                      7⤵
                        PID:3076
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4736 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4764 -prefMapHandle 4760 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c20342c6-94ea-4bdd-b629-92ef6e499f46} 3200 "\\.\pipe\gecko-crash-server-pipe.3200" utility
                        7⤵
                        • Checks processor information in registry
                        PID:5248
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5216 -childID 3 -isForBrowser -prefsHandle 5208 -prefMapHandle 5152 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 948 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {40e7df2a-af41-42ff-af32-3ece76e1ace0} 3200 "\\.\pipe\gecko-crash-server-pipe.3200" tab
                        7⤵
                          PID:5900
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5364 -childID 4 -isForBrowser -prefsHandle 5372 -prefMapHandle 5380 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 948 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {413f1909-8f93-4d1c-ac84-73e42eabfeb5} 3200 "\\.\pipe\gecko-crash-server-pipe.3200" tab
                          7⤵
                            PID:5912
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5556 -childID 5 -isForBrowser -prefsHandle 5560 -prefMapHandle 5544 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 948 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b5d438dc-84f3-48d3-b510-59385fa41fcb} 3200 "\\.\pipe\gecko-crash-server-pipe.3200" tab
                            7⤵
                              PID:5940
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6116 -childID 6 -isForBrowser -prefsHandle 5896 -prefMapHandle 6104 -prefsLen 27182 -prefMapSize 244658 -jsInitHandle 948 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1315c751-cb77-4289-bc90-b350ddbcdaa5} 3200 "\\.\pipe\gecko-crash-server-pipe.3200" tab
                              7⤵
                                PID:4396
                      • C:\Users\Admin\1000037002\83baa72830.exe
                        "C:\Users\Admin\1000037002\83baa72830.exe"
                        3⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of WriteProcessMemory
                        PID:1804
                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                          4⤵
                            PID:796
                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                            4⤵
                            • System Location Discovery: System Language Discovery
                            PID:964
                        • C:\Users\Admin\AppData\Local\Temp\1000038001\6a6c2648f4.exe
                          "C:\Users\Admin\AppData\Local\Temp\1000038001\6a6c2648f4.exe"
                          3⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          PID:1636
                    • C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                      C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                      1⤵
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • Suspicious behavior: EnumeratesProcesses
                      PID:5984
                    • C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                      C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                      1⤵
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • Suspicious behavior: EnumeratesProcesses
                      PID:2380

                    Network

                    MITRE ATT&CK Enterprise v15

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Admin\1000037002\83baa72830.exe

                      Filesize

                      196KB

                      MD5

                      6e9fc400fc9748327378354da7b3d022

                      SHA1

                      8bad09df89fc51f0cfb3209e1b39e15063f5c5e6

                      SHA256

                      7dd2c5bf200354ec22205f04d5eb6c3e336f49bf2d09809f68ba2ed7f9826f32

                      SHA512

                      daa0ed49c72b481f4bd898f048f8e9ba47285e845d3e43d8bd17e2801ade49e2d8c4c82bc797723deb8f2914aa9f6e4d0e7ff58bcc0b0195b4499bc5d9ac18a9

                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\activity-stream.discovery_stream.json.tmp

                      Filesize

                      28KB

                      MD5

                      1c436c5a2b11fee1cb52e9cda4d31f9b

                      SHA1

                      846cd4051211593985b6b64962810f6a3007a84a

                      SHA256

                      d3249b02bf42f33b917a65bde86de5c661e60867c1c13a85fda2e9aedd0be696

                      SHA512

                      c3b369d5d222253defc25aa4f775e0c894a70abfdb35f8d63b209d8b78fa2905d7b5201c0836621b74c4fba6ccf2ff6c5047c293f2dbe1092bc730a548e05878

                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\cache2\entries\E449899591A9BC91DFBA673EC0589B51E541A88B

                      Filesize

                      13KB

                      MD5

                      b2118ec98a1b3c34240d06cddac5b4a2

                      SHA1

                      8659a1477dead8108e6798a87779fa5d1bf2abde

                      SHA256

                      d446f246f41c3798dc9c44422e28bd7f84fc77d83e0a47cf32b4aaffcc4b556a

                      SHA512

                      b8daf61e0bd72e3a3d25264bec5d6d838b3473976f7e6ea7d04870204ce0847f59319af552882dd14edcd04877bb8ccedf757b894c86539ee759f965b2846377

                    • C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

                      Filesize

                      1.8MB

                      MD5

                      6d0f73b4a2b84bef406470efcd79a990

                      SHA1

                      3e76cd04a8655c14330a7392bbeedb2e17f2e015

                      SHA256

                      6dc00b02c91a51431b4d9bafbf70bf204de2152ae1391a4e374205939f81c5bf

                      SHA512

                      54ba08bb0194c37dbbcf0f017ba9f7a87f370b9378e6191c6f4654c479c89de398e4b467d7506dc93f580d4cb773563eaa3c4da97c46e0b10feda0a82a9a627d

                    • C:\Users\Admin\AppData\Local\Temp\1000036001\f54a68e4b7.exe

                      Filesize

                      1.2MB

                      MD5

                      d1be0f6f034c55fc17558f2ae445f1b2

                      SHA1

                      6b7f7599af54f730451f8344906acc7d0a206af7

                      SHA256

                      21a8a20a3cf2e59afeea5b810da2fd7b132780a8167ab28b0bf8da4d7061478e

                      SHA512

                      3e96bbee8cb19b3dc7c45d302f5321122722562f2ad41ce9d61bb34d2fdd65c7eaf133bdb097445df327629b2fea78caa22041ca122884a9ec1758da0288f465

                    • C:\Users\Admin\AppData\Local\Temp\1000038001\6a6c2648f4.exe

                      Filesize

                      187KB

                      MD5

                      278ee1426274818874556aa18fd02e3a

                      SHA1

                      185a2761330024dec52134df2c8388c461451acb

                      SHA256

                      37257ddb1a6f309a6e9d147b5fc2551a9cae3a0e52b191b18d9465bfcb5c18eb

                      SHA512

                      07ec6759af5b9a00d8371b9fd9b723012dd0a1614cfcc7cd51975a004f69ffb90083735e9a871a2aa0e8d28799beac53a4748f55f4dd1e7495bc7388ebf4d6a0

                    • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                      Filesize

                      479KB

                      MD5

                      09372174e83dbbf696ee732fd2e875bb

                      SHA1

                      ba360186ba650a769f9303f48b7200fb5eaccee1

                      SHA256

                      c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                      SHA512

                      b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                    • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                      Filesize

                      13.8MB

                      MD5

                      0a8747a2ac9ac08ae9508f36c6d75692

                      SHA1

                      b287a96fd6cc12433adb42193dfe06111c38eaf0

                      SHA256

                      32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                      SHA512

                      59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\AlternateServices.bin

                      Filesize

                      8KB

                      MD5

                      5cb156a069d3563ff9b577101e596d9f

                      SHA1

                      c97c0eefdb681843b42ae5593d69adc0260097c0

                      SHA256

                      f1bef5ce7948c68333ac21f725a1e814f5e7cd380c22f05dc9a5ba46de4fa837

                      SHA512

                      97c80a90cd08edfbb88b01a9dcd81d1141ca3edcaf23f5cfe2c471c6b99a2d13ac3d48c6ff6ab0113e9d373fe7335f53e58b19a530b51d683259aec5d9a982f7

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\AlternateServices.bin

                      Filesize

                      10KB

                      MD5

                      4603ea4a81cfa3d9f50c107cd63c5f55

                      SHA1

                      7dc03e1428f4bdd008286e7b3127136efdba3a97

                      SHA256

                      de3517491936adf55058a590add932feb02032a3f4d239c6fc90cf07b218cec8

                      SHA512

                      190d75f69d3eb7fbec54edccc54ff6396fe54bad16bd60704eb0a4a7b6f96836898cd36395cb882b0e8a2a3f965eb669d31b736f5d0be8c5fbd40070ad3b1ac1

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\datareporting\glean\db\data.safe.tmp

                      Filesize

                      5KB

                      MD5

                      b977f336a1b2c8e20e621118c0f96c49

                      SHA1

                      db29e1e5d64d3af912a8338bd631a5b6bbe4b59a

                      SHA256

                      c944ffddfcc9dce88edd7f4179a710512d673662119c3deaeef01b3d25252572

                      SHA512

                      1b1c887a482956fae2123866c8384aafbd68b980d9871a4b0cbb1c4d29eafc322d17f6ed4e119430a013ac01b7e297664b618ad10dc8eb85c8cec4bc68096916

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\datareporting\glean\db\data.safe.tmp

                      Filesize

                      6KB

                      MD5

                      b8efbe03d9a2bb9ecde28c4777d2ee92

                      SHA1

                      3fa103abfe50330459bf1e31c00c5fa2693535cd

                      SHA256

                      8aa993bb4f84d2f25d577f25c0367f0f75414b47add7124d116b416995f5c547

                      SHA512

                      71659fd2800824ee7eeb7ceadbae258c5becdb3949ba113a655a0808ad28d7238249e3a81963a148f14e7c3d9c75c7b95dda87e647093edb488856f4d10bdafd

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\datareporting\glean\db\data.safe.tmp

                      Filesize

                      16KB

                      MD5

                      a3fac90a51044a3660cd63c1f727d8b8

                      SHA1

                      d4e271aac48d0341ec91185d252e85a5498643a9

                      SHA256

                      9942524c7aab23ea48987b6d88d51fba8c8947799e1361661f8fdc2702fdb76e

                      SHA512

                      76d9db811174cd65a82d52c7d369b13f667d8fff51b706cda4d84d634310d6c4cfe547b0e6e7d155cc5f253007c11cf9ab000ff9de50c8b7690fb21fc05db314

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\datareporting\glean\pending_pings\6e6cdc46-d4c9-4f9b-9c0e-16225760b8c5

                      Filesize

                      671B

                      MD5

                      5bf28932fb72dcc6c960d027a1b94463

                      SHA1

                      489096edcc46023bd2a0c4a00c2ed622c18eb171

                      SHA256

                      42d2e57fab89fbfa04dc489294a33e0efcfe7ccded22507f905dbc6e79c8ae99

                      SHA512

                      cd93274e7e2dbebfcc19fb3da9fa76ffab12f4b3b9766b43c82a435527addfd2260404b19a337bac4a585de722e87fa08ebba55dde5a7222efc993f39ed3ad41

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\datareporting\glean\pending_pings\6eb108bf-9950-45df-a8ca-d650e498d0e6

                      Filesize

                      27KB

                      MD5

                      f58066910b76d14470635f7113dcb1a9

                      SHA1

                      821f123d04d0dfdb10a31275e89a4dcf453d7fa6

                      SHA256

                      c3fc4b37d28f58625e6c75bcc7a4fbf60952de366198dc4a1cbded3eca1e12d4

                      SHA512

                      929d89915e375a64c8589a8377a7022719d041e2fc42a16f44ea27c4d78a9a2ed8f32f153e36b92bfd566bc5855d7ae7a406e8cf4868f6bbf5655d33fc7b767a

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\datareporting\glean\pending_pings\97e3f38c-1ad6-4075-bf9b-6c0b021ae9df

                      Filesize

                      982B

                      MD5

                      f46833c6f9cacf3e9497830fa30b496c

                      SHA1

                      fef830d3bba846353fc58e92476021f4ca32b482

                      SHA256

                      be705ef9067f807618f3ff80bf14c564695c027d057596b1cec5a38a2dc50fe8

                      SHA512

                      a8dcffb58c4895605d23b3015be3a505c4212a2e213701dbb8661929b4581103a5a1603d68c3b1566b97c69800659b514cd2790381a98cd82c9d248ba1b27b9f

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

                      Filesize

                      1.1MB

                      MD5

                      842039753bf41fa5e11b3a1383061a87

                      SHA1

                      3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                      SHA256

                      d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                      SHA512

                      d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

                      Filesize

                      116B

                      MD5

                      2a461e9eb87fd1955cea740a3444ee7a

                      SHA1

                      b10755914c713f5a4677494dbe8a686ed458c3c5

                      SHA256

                      4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                      SHA512

                      34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

                      Filesize

                      372B

                      MD5

                      bf957ad58b55f64219ab3f793e374316

                      SHA1

                      a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                      SHA256

                      bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                      SHA512

                      79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

                      Filesize

                      17.8MB

                      MD5

                      daf7ef3acccab478aaa7d6dc1c60f865

                      SHA1

                      f8246162b97ce4a945feced27b6ea114366ff2ad

                      SHA256

                      bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                      SHA512

                      5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\prefs-1.js

                      Filesize

                      13KB

                      MD5

                      686ad9efb0425fad4a4a9ca43eedc36e

                      SHA1

                      4f3ac9a0066a25c4aec5c17e821ca75e204bf7c6

                      SHA256

                      12e23e9d18a7aeba4b600d444331a6d94a8767e5233cedc192774237bc13bf66

                      SHA512

                      3bdda6d194cdb90ce2316a82b7d55cde3566cd5cb35ce5b745695e6b44d3c93ac26f7525dde9346368954da0312fb1da840ac406af8477b13e1c3020931b2076

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\prefs.js

                      Filesize

                      11KB

                      MD5

                      5e65cf50ce669af1495ab893df20e38d

                      SHA1

                      7cd41ee92323632690f7365eea4e6200564c49e7

                      SHA256

                      02230f6ff7ad4247b5de8bd2339ad06008f737cafe4f41140c22821c37071b21

                      SHA512

                      48950122e16c20b3ddad244afb6ed26351882ee5fc7586ce35b61863e8153c9e9d7d9d5623f252254b5179768f936e6d1bc7f85e5838acdd83883fab127c101c

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\prefs.js

                      Filesize

                      11KB

                      MD5

                      59d81ffa22853345c39e64afc0a12b7d

                      SHA1

                      b4ea5629a6e754c86fc7eb5888c07884eaeaad43

                      SHA256

                      95a1e6bd28a3021e518192dc3075a1adeaa46e08e096d202b75e88799898096e

                      SHA512

                      0e3cc071c67e83da8e0ec612262f11e41655713aa7199f990a11784ac0aad2daa498c9f1c0c569ccc1340e7fde9bd665096c20683269997215d0fac105df14be

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\prefs.js

                      Filesize

                      16KB

                      MD5

                      a0e5ff0eba3076308a345f353a78a32f

                      SHA1

                      5290fc4629c2e01f637557ece575c5dc301db78e

                      SHA256

                      2c008ceb03c9937f1f392de370cca93907fd2e4fc4ac3c2ed609395c0db968ab

                      SHA512

                      80bf79cba107222f09129639456bd09ddacf6db133f17cd9d0154ea746d7ca2cd59ab96553f8ff73ee5fdf9fd73db2d657c0b1f1dc7ec622151b956004a5613f

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\prefs.js

                      Filesize

                      16KB

                      MD5

                      10edd356df5e13d42883394d6e5bf141

                      SHA1

                      4253361dd3dc07adb6ad75be9e0405f33793f703

                      SHA256

                      0251e88a4d67ed432e8a41519eb4904a1aeae2c158213379392e7b4932f12d17

                      SHA512

                      c207345d5121e74eed94cd17637352a8e0cfe289559868ed25685fe7e420c899c881fd15084029a338e423324c8d2ba16da2ebaa5c7428e3e31b83d831cd924b

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

                      Filesize

                      960KB

                      MD5

                      128700f20ce55acb234c140a8227ade1

                      SHA1

                      cdb4b1d3ba34154a62824d4d241d2bfb6d85371e

                      SHA256

                      7ac8591a4dad9f8b6258c69456fd0bd393c6d0eea780541c92634f76651d3f84

                      SHA512

                      affcae1177d9b71c8613bd0b6665ddf7c083fffa2b3279515847f551245545ea4b3f48dc2bbaa33ac0bb0f1c354d579c1cc2247df691a534827e6dd5a21a2fcb

                    • memory/964-74-0x0000000000400000-0x0000000000643000-memory.dmp

                      Filesize

                      2.3MB

                    • memory/964-72-0x0000000000400000-0x0000000000643000-memory.dmp

                      Filesize

                      2.3MB

                    • memory/1636-93-0x0000000000D70000-0x0000000000FB3000-memory.dmp

                      Filesize

                      2.3MB

                    • memory/1636-92-0x0000000000D70000-0x0000000000FB3000-memory.dmp

                      Filesize

                      2.3MB

                    • memory/1804-69-0x0000000000730000-0x0000000000768000-memory.dmp

                      Filesize

                      224KB

                    • memory/2076-42-0x00000000006B0000-0x00000000007E0000-memory.dmp

                      Filesize

                      1.2MB

                    • memory/2076-41-0x0000000072E0E000-0x0000000072E0F000-memory.dmp

                      Filesize

                      4KB

                    • memory/2276-2571-0x0000000000ED0000-0x000000000137C000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/2276-2577-0x0000000000ED0000-0x000000000137C000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/2276-2596-0x0000000000ED0000-0x000000000137C000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/2276-418-0x0000000000ED0000-0x000000000137C000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/2276-426-0x0000000000ED0000-0x000000000137C000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/2276-453-0x0000000000ED0000-0x000000000137C000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/2276-458-0x0000000000ED0000-0x000000000137C000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/2276-21-0x0000000000ED0000-0x000000000137C000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/2276-22-0x0000000000ED0000-0x000000000137C000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/2276-19-0x0000000000ED1000-0x0000000000EFF000-memory.dmp

                      Filesize

                      184KB

                    • memory/2276-20-0x0000000000ED0000-0x000000000137C000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/2276-2590-0x0000000000ED0000-0x000000000137C000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/2276-17-0x0000000000ED0000-0x000000000137C000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/2276-2589-0x0000000000ED0000-0x000000000137C000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/2276-2588-0x0000000000ED0000-0x000000000137C000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/2276-2587-0x0000000000ED0000-0x000000000137C000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/2276-2582-0x0000000000ED0000-0x000000000137C000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/2276-2581-0x0000000000ED0000-0x000000000137C000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/2276-91-0x0000000000ED0000-0x000000000137C000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/2276-100-0x0000000000ED0000-0x000000000137C000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/2276-2161-0x0000000000ED0000-0x000000000137C000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/2276-956-0x0000000000ED0000-0x000000000137C000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/2352-48-0x0000000000400000-0x000000000052D000-memory.dmp

                      Filesize

                      1.2MB

                    • memory/2352-45-0x0000000000400000-0x000000000052D000-memory.dmp

                      Filesize

                      1.2MB

                    • memory/2352-50-0x0000000000400000-0x000000000052D000-memory.dmp

                      Filesize

                      1.2MB

                    • memory/2380-2584-0x0000000000ED0000-0x000000000137C000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/2380-2586-0x0000000000ED0000-0x000000000137C000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/4032-0-0x0000000000320000-0x00000000007CC000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/4032-1-0x00000000771F4000-0x00000000771F6000-memory.dmp

                      Filesize

                      8KB

                    • memory/4032-2-0x0000000000321000-0x000000000034F000-memory.dmp

                      Filesize

                      184KB

                    • memory/4032-3-0x0000000000320000-0x00000000007CC000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/4032-4-0x0000000000320000-0x00000000007CC000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/4032-18-0x0000000000320000-0x00000000007CC000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/5984-860-0x0000000000ED0000-0x000000000137C000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/5984-897-0x0000000000ED0000-0x000000000137C000-memory.dmp

                      Filesize

                      4.7MB