Analysis

  • max time kernel
    149s
  • max time network
    148s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    17-08-2024 12:16

General

  • Target

    fe1358ad307faa38e2a7d3e26de443330a6af65499cb1e7490e8f2ba772a8844.exe

  • Size

    196KB

  • MD5

    aa217dbf9cb8080176f0bae19edc6305

  • SHA1

    1753b00e1dddb7d9635ad0e9d285907445cc70b6

  • SHA256

    fe1358ad307faa38e2a7d3e26de443330a6af65499cb1e7490e8f2ba772a8844

  • SHA512

    0beae14810a852de0449675577854fe68947ffe30de89488e71b5ed8c63ac21d88d20b23d3614441aae7de40ad6bea12dbe4278af870defef85457478a6b56ab

  • SSDEEP

    3072:WLu7fYShS0xDMntOaAH7Xwe8nlNay0lGwTlG03SY/9VjAG+sHI:W4YShFxQZAHse8bay0xlrCskG+

Malware Config

Extracted

Family

stealc

Botnet

nord

C2

http://185.215.113.100

Attributes
  • url_path

    /e2b1563c6670f193.php

Extracted

Family

amadey

Version

4.41

Botnet

c7817d

C2

http://31.41.244.10

Attributes
  • install_dir

    0e8d0864aa

  • install_file

    svoutse.exe

  • strings_key

    5481b88a6ef75bcf21333988a4e47048

  • url_paths

    /Dem7kTu/index.php

rc4.plain

Extracted

Family

stealc

Botnet

kora

C2

http://185.215.113.100

Attributes
  • url_path

    /e2b1563c6670f193.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Stealc

    Stealc is an infostealer written in C++.

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 8 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 7 IoCs
  • Identifies Wine through registry keys 2 TTPs 4 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 2 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • AutoIT Executable 3 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 10 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\fe1358ad307faa38e2a7d3e26de443330a6af65499cb1e7490e8f2ba772a8844.exe
    "C:\Users\Admin\AppData\Local\Temp\fe1358ad307faa38e2a7d3e26de443330a6af65499cb1e7490e8f2ba772a8844.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2680
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3992
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\RoamingHJJJDAEGID.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1896
        • C:\Users\Admin\AppData\RoamingHJJJDAEGID.exe
          "C:\Users\Admin\AppData\RoamingHJJJDAEGID.exe"
          4⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:4772
          • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
            "C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe"
            5⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Adds Run key to start application
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:2964
            • C:\Users\Admin\AppData\Local\Temp\1000001001\c6890516f9.exe
              "C:\Users\Admin\AppData\Local\Temp\1000001001\c6890516f9.exe"
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:736
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                7⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                • Suspicious use of WriteProcessMemory
                PID:3076
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
                  8⤵
                  • Suspicious use of WriteProcessMemory
                  PID:3024
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
                    9⤵
                    • Checks processor information in registry
                    • Modifies registry class
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of SetWindowsHookEx
                    PID:3392
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1992 -parentBuildID 20240401114208 -prefsHandle 1908 -prefMapHandle 1900 -prefsLen 23600 -prefMapSize 244628 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4d415ea4-6565-4fc8-afa2-154422a0b73c} 3392 "\\.\pipe\gecko-crash-server-pipe.3392" gpu
                      10⤵
                        PID:3980
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2396 -parentBuildID 20240401114208 -prefsHandle 2388 -prefMapHandle 2384 -prefsLen 24520 -prefMapSize 244628 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ddfc0c33-f038-41c6-8c50-abb8ac752077} 3392 "\\.\pipe\gecko-crash-server-pipe.3392" socket
                        10⤵
                          PID:816
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3316 -childID 1 -isForBrowser -prefsHandle 3308 -prefMapHandle 3304 -prefsLen 22590 -prefMapSize 244628 -jsInitHandle 1240 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {881c3883-9fba-407e-b0d0-4721805e0dd6} 3392 "\\.\pipe\gecko-crash-server-pipe.3392" tab
                          10⤵
                            PID:4448
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3132 -childID 2 -isForBrowser -prefsHandle 3140 -prefMapHandle 3136 -prefsLen 29010 -prefMapSize 244628 -jsInitHandle 1240 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9703ba4f-72e3-4019-8062-5ccfe118c5a9} 3392 "\\.\pipe\gecko-crash-server-pipe.3392" tab
                            10⤵
                              PID:588
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4764 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4748 -prefMapHandle 4708 -prefsLen 29010 -prefMapSize 244628 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c6d9202a-5522-4e81-b751-8a6fe04b4279} 3392 "\\.\pipe\gecko-crash-server-pipe.3392" utility
                              10⤵
                              • Checks processor information in registry
                              PID:5236
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5608 -childID 3 -isForBrowser -prefsHandle 4880 -prefMapHandle 5528 -prefsLen 26989 -prefMapSize 244628 -jsInitHandle 1240 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {eac4a1f3-eb1a-40ab-a307-0cf09ec67dcd} 3392 "\\.\pipe\gecko-crash-server-pipe.3392" tab
                              10⤵
                                PID:5932
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5696 -childID 4 -isForBrowser -prefsHandle 5704 -prefMapHandle 5708 -prefsLen 26989 -prefMapSize 244628 -jsInitHandle 1240 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0c972490-2368-416d-a0b0-5a3327a45158} 3392 "\\.\pipe\gecko-crash-server-pipe.3392" tab
                                10⤵
                                  PID:5948
                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5996 -childID 5 -isForBrowser -prefsHandle 5916 -prefMapHandle 5920 -prefsLen 26989 -prefMapSize 244628 -jsInitHandle 1240 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {75fcd2b4-8f68-462a-a6c8-60c8b8acb2cb} 3392 "\\.\pipe\gecko-crash-server-pipe.3392" tab
                                  10⤵
                                    PID:5964
                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6216 -childID 6 -isForBrowser -prefsHandle 6308 -prefMapHandle 6304 -prefsLen 27039 -prefMapSize 244628 -jsInitHandle 1240 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0b32a036-cd2d-4cfe-9ea2-f75f4da7f995} 3392 "\\.\pipe\gecko-crash-server-pipe.3392" tab
                                    10⤵
                                      PID:1376
                            • C:\Users\Admin\AppData\Local\Temp\1000002001\8bd2c04262.exe
                              "C:\Users\Admin\AppData\Local\Temp\1000002001\8bd2c04262.exe"
                              6⤵
                              • Executes dropped EXE
                              • Suspicious use of SetThreadContext
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of WriteProcessMemory
                              PID:3888
                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                7⤵
                                  PID:2936
                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                  7⤵
                                    PID:2284
                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                    7⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:4688
                                • C:\Users\Admin\1000003002\8efb2a0d6e.exe
                                  "C:\Users\Admin\1000003002\8efb2a0d6e.exe"
                                  6⤵
                                  • Executes dropped EXE
                                  • System Location Discovery: System Language Discovery
                                  PID:1620
                      • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                        C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                        1⤵
                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                        • Checks BIOS information in registry
                        • Executes dropped EXE
                        • Identifies Wine through registry keys
                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                        • Suspicious behavior: EnumeratesProcesses
                        PID:5252
                      • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                        C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                        1⤵
                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                        • Checks BIOS information in registry
                        • Executes dropped EXE
                        • Identifies Wine through registry keys
                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                        • Suspicious behavior: EnumeratesProcesses
                        PID:4712

                      Network

                      MITRE ATT&CK Enterprise v15

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\ProgramData\mozglue.dll

                        Filesize

                        593KB

                        MD5

                        c8fd9be83bc728cc04beffafc2907fe9

                        SHA1

                        95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                        SHA256

                        ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                        SHA512

                        fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                      • C:\ProgramData\nss3.dll

                        Filesize

                        2.0MB

                        MD5

                        1cc453cdf74f31e4d913ff9c10acdde2

                        SHA1

                        6e85eae544d6e965f15fa5c39700fa7202f3aafe

                        SHA256

                        ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                        SHA512

                        dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                      • C:\Users\Admin\1000003002\8efb2a0d6e.exe

                        Filesize

                        187KB

                        MD5

                        278ee1426274818874556aa18fd02e3a

                        SHA1

                        185a2761330024dec52134df2c8388c461451acb

                        SHA256

                        37257ddb1a6f309a6e9d147b5fc2551a9cae3a0e52b191b18d9465bfcb5c18eb

                        SHA512

                        07ec6759af5b9a00d8371b9fd9b723012dd0a1614cfcc7cd51975a004f69ffb90083735e9a871a2aa0e8d28799beac53a4748f55f4dd1e7495bc7388ebf4d6a0

                      • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pzaexue0.default-release\activity-stream.discovery_stream.json

                        Filesize

                        31KB

                        MD5

                        d0f177cf7ff50866f2adabcaf04baf13

                        SHA1

                        a302477743915ea494804f02fd9dfb2ed900426e

                        SHA256

                        198fe738c090197659138f2161d7449397939b7cc9c2d533265906a1ce84300f

                        SHA512

                        2e1505f86837991bd30f9921e93327db883e5c26de22968ace4b23064567f7f2c4494d8a094586fd2adedd511d984a18194425e521a1552d7b4d862d24abd217

                      • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pzaexue0.default-release\cache2\entries\E449899591A9BC91DFBA673EC0589B51E541A88B

                        Filesize

                        13KB

                        MD5

                        20997c9ecaa974b20bc17b6f8919a990

                        SHA1

                        bd4aa1c71ee09ba38cb780079b1c9eb00c9d9397

                        SHA256

                        381965e2a191b500e5ea7a5bbe018e9110144daa6424351ffa1933c4d97d41e1

                        SHA512

                        5384dbdf7ac547f074244e33277d0efa4976c2959058f76fe183b9c8888ec429fceb396a143ed5d620618f108c4423dde20759ac3cab6ad09e4e27d881695711

                      • C:\Users\Admin\AppData\Local\Temp\1000001001\c6890516f9.exe

                        Filesize

                        1.2MB

                        MD5

                        308d0996727a81dfcb72a69e1a132108

                        SHA1

                        9b48220c70d23d2022dd33b142ba6ff8f878c7e6

                        SHA256

                        76a0ee2a9aca627171bad5a4be2029e87eefed2cbb7c63532c3d4f5ca53e2e88

                        SHA512

                        65503827ac96c6a81c6ab6a6428286b6b43fd78ded0ec255e21ca3d6f2f4ce8f2fb4f3167afcfd7c6e9b997dd448c937bea01b676f645f33dfe4fd9b88ad2c25

                      • C:\Users\Admin\AppData\Local\Temp\1000002001\8bd2c04262.exe

                        Filesize

                        196KB

                        MD5

                        aa217dbf9cb8080176f0bae19edc6305

                        SHA1

                        1753b00e1dddb7d9635ad0e9d285907445cc70b6

                        SHA256

                        fe1358ad307faa38e2a7d3e26de443330a6af65499cb1e7490e8f2ba772a8844

                        SHA512

                        0beae14810a852de0449675577854fe68947ffe30de89488e71b5ed8c63ac21d88d20b23d3614441aae7de40ad6bea12dbe4278af870defef85457478a6b56ab

                      • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                        Filesize

                        479KB

                        MD5

                        09372174e83dbbf696ee732fd2e875bb

                        SHA1

                        ba360186ba650a769f9303f48b7200fb5eaccee1

                        SHA256

                        c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                        SHA512

                        b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                      • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                        Filesize

                        13.8MB

                        MD5

                        0a8747a2ac9ac08ae9508f36c6d75692

                        SHA1

                        b287a96fd6cc12433adb42193dfe06111c38eaf0

                        SHA256

                        32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                        SHA512

                        59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                      • C:\Users\Admin\AppData\RoamingHJJJDAEGID.exe

                        Filesize

                        1.8MB

                        MD5

                        f92bc75eb1dd5151fcda78609b39c232

                        SHA1

                        4f1fb77fdd542f67d30cb26acca5747c6e01890e

                        SHA256

                        4915081771c7c2ec5f4154e7ab178a1fb9a4da9af726490b19ddd6c45b1dc379

                        SHA512

                        bca933fb39dc32726ca15f3ae6a3237b9b72f38b5535288d5062bd3b1b9cae8372f3ff1173785d4f7e6914af2a23689d2b41e0a8e2d291cf3c9da16ce6920bf6

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pzaexue0.default-release\AlternateServices.bin

                        Filesize

                        7KB

                        MD5

                        3f3c564e2df8f877334fa58a359a9196

                        SHA1

                        9df5ad5b9ebf44eca71e989ce57c55b59a18cea0

                        SHA256

                        17ec147674c18cfe00cf2ac92d44820c3f952691d805f410944332b57fe4f5f3

                        SHA512

                        64a616898b746a52e53cd884b81c269e81ecb82283ad1e0a0fc32a17fd936f50e4981f6065607efcae6b6ae85c9158b842b6e03789bcd0c22e14d6832d127b3f

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pzaexue0.default-release\AlternateServices.bin

                        Filesize

                        10KB

                        MD5

                        cb9a705e610d956164d07ff991c6c72a

                        SHA1

                        f47c8071fa948ad0d579e9a6e134ec642e391bbf

                        SHA256

                        ad83dfa86df8dfe33c7d4298e7bfe21866901b80e1a50fc5c82bf05608893997

                        SHA512

                        d8416099635095ff7982c4a09a70932a4d8ce55d8c35315e453d8eb6a82ccd4478961a143091ba346ab8a96e4f4d89e4100632263a64206218fa6a5bed965c26

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pzaexue0.default-release\datareporting\glean\db\data.safe.tmp

                        Filesize

                        5KB

                        MD5

                        7d44c04151146e70909871ebcfa2e3be

                        SHA1

                        3ae7b2170dbdb0709fc1933e4092a9b2da52cac4

                        SHA256

                        f041c6e7b9612603e33b996015776a673ff159d6a2577732786458e3a25a2bd3

                        SHA512

                        4b2fee941bb4d7813df2ae9e1f296742150782b122cf2d389e4ec592a6f79f7bb8b1d8144b2e8e7ecc0e10ed6891968a787f7a6f4ab83708ff83aabd104cdb85

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pzaexue0.default-release\datareporting\glean\db\data.safe.tmp

                        Filesize

                        15KB

                        MD5

                        362c40dd9d7c0d2887410cccb91a4a9b

                        SHA1

                        ddcf8485644566048a1c2a3736dd9e860608a75b

                        SHA256

                        48077af2f4a38c3a9132be2fe374d2d14f8cc611d39b189724db8bc5e5263876

                        SHA512

                        53adf103052a48d3fd07da54f501720a4e3f9a196f4be1985f8f7477ace5b7bb1e6fbf5f442a73045b69f0ed7558cb6219e8c8a4dab108186c9a28b2003f0a47

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pzaexue0.default-release\datareporting\glean\pending_pings\03a1553d-02cf-4886-b13d-33a8ba4a8f45

                        Filesize

                        982B

                        MD5

                        8c4c3705a86532e3531934510291b4fa

                        SHA1

                        fe20396c6c25e0e939ab78d62db2daf893eaf43c

                        SHA256

                        7eea207c3708461f5277a25af1c86c3999d42685f62315f7d07c62ece4c1f4af

                        SHA512

                        04eaffe9cf937260cc7764895f8b1904b0d7c6ba7104a96955afbf98f37116bbc11ac3c14591d8c70707179a09642ed4014cd99f1e204395e5a489f38d7a4491

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pzaexue0.default-release\datareporting\glean\pending_pings\91b7cd40-dad0-4480-abd2-a22dcdd9fb63

                        Filesize

                        671B

                        MD5

                        3c6042283d9721ac0cc9f00e80f86d7c

                        SHA1

                        6b2750b68d48f7f605cf7163394d3baa39d98f52

                        SHA256

                        67ab4f0d9e59e6de640c43d7379f038c5299c5efe412e66946a3783226870c70

                        SHA512

                        2d394c6da1eaed625ff7e7e1d181a048d46114dbb05db1c1360550bba6f53e26ca474de0bb4301fb0775bc194db6dcbaffade7311d22e729066c48a2996980c2

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pzaexue0.default-release\datareporting\glean\pending_pings\94349e4f-0200-47fe-b3b2-3a8be812f43d

                        Filesize

                        27KB

                        MD5

                        9602084efd7487f23acd9c2607187560

                        SHA1

                        3d3fb13d91fc97cf3aae44ce20819dd09640342f

                        SHA256

                        6ee8a0887211e1159357b6376c672e7ff06300572b1e4c72a48c242a5cc2139e

                        SHA512

                        1b35e546e486aa62daf04a0939ee80d0ebd5d16169b82afe69cb268fd941830f12740c3a93ff819d61f89fff8f6d5ada5bc82b18b3a98ca12e6838016f9e50aa

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pzaexue0.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

                        Filesize

                        1.1MB

                        MD5

                        842039753bf41fa5e11b3a1383061a87

                        SHA1

                        3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                        SHA256

                        d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                        SHA512

                        d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pzaexue0.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

                        Filesize

                        116B

                        MD5

                        2a461e9eb87fd1955cea740a3444ee7a

                        SHA1

                        b10755914c713f5a4677494dbe8a686ed458c3c5

                        SHA256

                        4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                        SHA512

                        34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pzaexue0.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

                        Filesize

                        372B

                        MD5

                        bf957ad58b55f64219ab3f793e374316

                        SHA1

                        a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                        SHA256

                        bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                        SHA512

                        79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pzaexue0.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

                        Filesize

                        17.8MB

                        MD5

                        daf7ef3acccab478aaa7d6dc1c60f865

                        SHA1

                        f8246162b97ce4a945feced27b6ea114366ff2ad

                        SHA256

                        bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                        SHA512

                        5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pzaexue0.default-release\prefs-1.js

                        Filesize

                        11KB

                        MD5

                        7b72d78563594ff746f8a022579994b1

                        SHA1

                        d7e7ccf5b8b8e36d27ce23de5fdeb43a7f8f951f

                        SHA256

                        62d5474d00f9a9cbd854999805aaa46fff3c1e5f384aa7435de08a05217f0629

                        SHA512

                        2519e0290753317abf71a04ff8ce7564de21608e2c28c62aabec7c45c22f8c22ddb267a74f12084837b0eaf5324baf38d7ea23fb08402138c6b5ea679aa0def9

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pzaexue0.default-release\prefs-1.js

                        Filesize

                        12KB

                        MD5

                        19b112073814baf07088d13c24a0088e

                        SHA1

                        e4a62e062922bbba12044b97bf3004970f60b574

                        SHA256

                        6aa38ac5538575d26cac4c36702ad4a00e34e58d17d4251538cfc4267389e806

                        SHA512

                        23c3707af656f2fda62efb3f3ab34c7f83d46e8c6526801c02d9f0b3481a33895092c0ca7b101a493d201cc2d6012e72f242e33408f30962840567c8ce6106f4

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pzaexue0.default-release\prefs.js

                        Filesize

                        10KB

                        MD5

                        70ae9c387ce55d93f8ac71681aeef294

                        SHA1

                        3d56aa13bdfb324e6c01b9b5cb132096e4d67789

                        SHA256

                        754225a6cd92dcc3a92a022d64305553a0e2564e37dd4cf884d171eed339cc0d

                        SHA512

                        8e76b9ecb2279cd86132cadf77e7f05c8cd6b1404db72d9b15a757c806c0ee8497d665d7736cbe8336b30fa6af3688250e240b45337ab80b7a7f85e4b60aa4c9

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pzaexue0.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

                        Filesize

                        1.2MB

                        MD5

                        2fa181571c8d8192e042a3977920ea2c

                        SHA1

                        5ed3eaa24c0e514154ac0dfecb776ddbe60732fa

                        SHA256

                        e61fdd7e4c00164e8e2157ce895e5b434f29b05175906ffe28a94ee7fc4a2f71

                        SHA512

                        937168a099ac0c795abbdd08a0e29f2bdd1b4da3b204edb5ef6026da4b8fcf55e0057d2ba27e7bbfc263310ab07a6f4576fe17feb3e055f9d63800ffdb09e4ed

                      • memory/736-129-0x0000000000860000-0x0000000000990000-memory.dmp

                        Filesize

                        1.2MB

                      • memory/1620-178-0x0000000000480000-0x00000000006C3000-memory.dmp

                        Filesize

                        2.3MB

                      • memory/1620-177-0x0000000000480000-0x00000000006C3000-memory.dmp

                        Filesize

                        2.3MB

                      • memory/2680-1-0x0000000000480000-0x00000000004B8000-memory.dmp

                        Filesize

                        224KB

                      • memory/2680-11-0x00000000749F0000-0x00000000751A1000-memory.dmp

                        Filesize

                        7.7MB

                      • memory/2680-0-0x00000000749FE000-0x00000000749FF000-memory.dmp

                        Filesize

                        4KB

                      • memory/2680-9-0x00000000749F0000-0x00000000751A1000-memory.dmp

                        Filesize

                        7.7MB

                      • memory/2964-1302-0x0000000000410000-0x00000000008B6000-memory.dmp

                        Filesize

                        4.6MB

                      • memory/2964-2675-0x0000000000410000-0x00000000008B6000-memory.dmp

                        Filesize

                        4.6MB

                      • memory/2964-2684-0x0000000000410000-0x00000000008B6000-memory.dmp

                        Filesize

                        4.6MB

                      • memory/2964-2668-0x0000000000410000-0x00000000008B6000-memory.dmp

                        Filesize

                        4.6MB

                      • memory/2964-2682-0x0000000000410000-0x00000000008B6000-memory.dmp

                        Filesize

                        4.6MB

                      • memory/2964-2681-0x0000000000410000-0x00000000008B6000-memory.dmp

                        Filesize

                        4.6MB

                      • memory/2964-505-0x0000000000410000-0x00000000008B6000-memory.dmp

                        Filesize

                        4.6MB

                      • memory/2964-506-0x0000000000410000-0x00000000008B6000-memory.dmp

                        Filesize

                        4.6MB

                      • memory/2964-555-0x0000000000410000-0x00000000008B6000-memory.dmp

                        Filesize

                        4.6MB

                      • memory/2964-2521-0x0000000000410000-0x00000000008B6000-memory.dmp

                        Filesize

                        4.6MB

                      • memory/2964-2678-0x0000000000410000-0x00000000008B6000-memory.dmp

                        Filesize

                        4.6MB

                      • memory/2964-563-0x0000000000410000-0x00000000008B6000-memory.dmp

                        Filesize

                        4.6MB

                      • memory/2964-2683-0x0000000000410000-0x00000000008B6000-memory.dmp

                        Filesize

                        4.6MB

                      • memory/2964-110-0x0000000000410000-0x00000000008B6000-memory.dmp

                        Filesize

                        4.6MB

                      • memory/3076-132-0x0000000000400000-0x000000000052D000-memory.dmp

                        Filesize

                        1.2MB

                      • memory/3076-135-0x0000000000400000-0x000000000052D000-memory.dmp

                        Filesize

                        1.2MB

                      • memory/3076-137-0x0000000000400000-0x000000000052D000-memory.dmp

                        Filesize

                        1.2MB

                      • memory/3992-10-0x0000000000400000-0x0000000000643000-memory.dmp

                        Filesize

                        2.3MB

                      • memory/3992-6-0x0000000000400000-0x0000000000643000-memory.dmp

                        Filesize

                        2.3MB

                      • memory/3992-7-0x0000000000400000-0x0000000000643000-memory.dmp

                        Filesize

                        2.3MB

                      • memory/3992-97-0x0000000000400000-0x0000000000643000-memory.dmp

                        Filesize

                        2.3MB

                      • memory/3992-12-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                        Filesize

                        972KB

                      • memory/3992-45-0x0000000000400000-0x0000000000643000-memory.dmp

                        Filesize

                        2.3MB

                      • memory/4712-2680-0x0000000000410000-0x00000000008B6000-memory.dmp

                        Filesize

                        4.6MB

                      • memory/4772-96-0x00000000006F0000-0x0000000000B96000-memory.dmp

                        Filesize

                        4.6MB

                      • memory/4772-109-0x00000000006F0000-0x0000000000B96000-memory.dmp

                        Filesize

                        4.6MB

                      • memory/4772-94-0x00000000006F0000-0x0000000000B96000-memory.dmp

                        Filesize

                        4.6MB

                      • memory/4772-91-0x00000000006F0000-0x0000000000B96000-memory.dmp

                        Filesize

                        4.6MB

                      • memory/4772-92-0x0000000077656000-0x0000000077658000-memory.dmp

                        Filesize

                        8KB

                      • memory/4772-93-0x00000000006F1000-0x000000000071F000-memory.dmp

                        Filesize

                        184KB

                      • memory/5252-562-0x0000000000410000-0x00000000008B6000-memory.dmp

                        Filesize

                        4.6MB

                      • memory/5252-561-0x0000000000410000-0x00000000008B6000-memory.dmp

                        Filesize

                        4.6MB