Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/08/2024, 13:03

General

  • Target

    10afb5f99e9f494907a0b47823e69573301e7715ab389457bdcd391d8e9cf090.exe

  • Size

    1.8MB

  • MD5

    8bcd388ed9e8762c812ec36614f17982

  • SHA1

    fae03863e3f80e04271b7835bcc9ff4865f2c219

  • SHA256

    10afb5f99e9f494907a0b47823e69573301e7715ab389457bdcd391d8e9cf090

  • SHA512

    1e979e850a172431f7b4c814f336cebbf16072b38a6bd8ebb686dfddbbd056a3cd59aae09f7790641b871e6080d1cf357ae3cc2d2771739e7248c3eb86a08764

  • SSDEEP

    49152:Z+WmGAH90soxYipeD4FMVlKpPBhwLqINUAyADXnfw7NB3ZynYczB:Z++A6zPpeU+VloP/zA5DXo7NVoYc

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

c7817d

C2

http://31.41.244.10

Attributes
  • install_dir

    0e8d0864aa

  • install_file

    svoutse.exe

  • strings_key

    5481b88a6ef75bcf21333988a4e47048

  • url_paths

    /Dem7kTu/index.php

rc4.plain

Extracted

Family

stealc

Botnet

nord

C2

http://185.215.113.100

Attributes
  • url_path

    /e2b1563c6670f193.php

Extracted

Family

stealc

Botnet

kora

C2

http://185.215.113.100

Attributes
  • url_path

    /e2b1563c6670f193.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Stealc

    Stealc is an infostealer written in C++.

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 10 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 7 IoCs
  • Identifies Wine through registry keys 2 TTPs 5 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • AutoIT Executable 3 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\10afb5f99e9f494907a0b47823e69573301e7715ab389457bdcd391d8e9cf090.exe
    "C:\Users\Admin\AppData\Local\Temp\10afb5f99e9f494907a0b47823e69573301e7715ab389457bdcd391d8e9cf090.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4288
    • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
      "C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2056
      • C:\Users\Admin\AppData\Local\Temp\1000001001\bd71fc592e.exe
        "C:\Users\Admin\AppData\Local\Temp\1000001001\bd71fc592e.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3940
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          4⤵
            PID:1120
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
            4⤵
            • Checks computer location settings
            • System Location Discovery: System Language Discovery
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of WriteProcessMemory
            PID:3952
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:1540
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
                6⤵
                • Checks processor information in registry
                • Modifies registry class
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:2200
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2032 -parentBuildID 20240401114208 -prefsHandle 1960 -prefMapHandle 1856 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {09efa548-c21d-445a-be4d-40021628d512} 2200 "\\.\pipe\gecko-crash-server-pipe.2200" gpu
                  7⤵
                    PID:2560
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2380 -parentBuildID 20240401114208 -prefsHandle 2472 -prefMapHandle 2468 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d7390049-4dac-41b7-bce0-a0e6a8533ab4} 2200 "\\.\pipe\gecko-crash-server-pipe.2200" socket
                    7⤵
                      PID:1200
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3252 -childID 1 -isForBrowser -prefsHandle 3264 -prefMapHandle 3280 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5f19758d-8045-462e-b2e5-a37aba04942e} 2200 "\\.\pipe\gecko-crash-server-pipe.2200" tab
                      7⤵
                        PID:2872
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3772 -childID 2 -isForBrowser -prefsHandle 3104 -prefMapHandle 1784 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9d90a923-7e68-4c82-98c2-ea63df4dfb83} 2200 "\\.\pipe\gecko-crash-server-pipe.2200" tab
                        7⤵
                          PID:1620
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4776 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4768 -prefMapHandle 4764 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ef8a9c83-a01b-4c6c-a7eb-27673ab75080} 2200 "\\.\pipe\gecko-crash-server-pipe.2200" utility
                          7⤵
                          • Checks processor information in registry
                          PID:5520
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5652 -childID 3 -isForBrowser -prefsHandle 5636 -prefMapHandle 5632 -prefsLen 27182 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7d937ca3-00f3-414b-8502-39f920e88477} 2200 "\\.\pipe\gecko-crash-server-pipe.2200" tab
                          7⤵
                            PID:2104
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5984 -childID 4 -isForBrowser -prefsHandle 6000 -prefMapHandle 5996 -prefsLen 27182 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dd609c55-2cd5-41e4-86f1-018818d1e262} 2200 "\\.\pipe\gecko-crash-server-pipe.2200" tab
                            7⤵
                              PID:5268
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5968 -childID 5 -isForBrowser -prefsHandle 6012 -prefMapHandle 6008 -prefsLen 27182 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {589f0f52-4786-462c-bbb2-3c40ceb23fe2} 2200 "\\.\pipe\gecko-crash-server-pipe.2200" tab
                              7⤵
                                PID:5276
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6208 -childID 6 -isForBrowser -prefsHandle 6200 -prefMapHandle 6108 -prefsLen 27182 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e756a005-bbe7-4d85-bf43-b1b4e7b915ca} 2200 "\\.\pipe\gecko-crash-server-pipe.2200" tab
                                7⤵
                                  PID:5292
                        • C:\Users\Admin\AppData\Local\Temp\1000002001\b83edef87e.exe
                          "C:\Users\Admin\AppData\Local\Temp\1000002001\b83edef87e.exe"
                          3⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of WriteProcessMemory
                          PID:1068
                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                            4⤵
                            • System Location Discovery: System Language Discovery
                            PID:3640
                        • C:\Users\Admin\1000003002\6e42bae7ef.exe
                          "C:\Users\Admin\1000003002\6e42bae7ef.exe"
                          3⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          PID:2000
                    • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                      C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                      1⤵
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • Suspicious behavior: EnumeratesProcesses
                      PID:3584
                    • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                      C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                      1⤵
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • Suspicious behavior: EnumeratesProcesses
                      PID:1672
                    • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                      C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                      1⤵
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • Suspicious behavior: EnumeratesProcesses
                      PID:5596

                    Network

                    MITRE ATT&CK Enterprise v15

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Admin\1000003002\6e42bae7ef.exe

                      Filesize

                      187KB

                      MD5

                      278ee1426274818874556aa18fd02e3a

                      SHA1

                      185a2761330024dec52134df2c8388c461451acb

                      SHA256

                      37257ddb1a6f309a6e9d147b5fc2551a9cae3a0e52b191b18d9465bfcb5c18eb

                      SHA512

                      07ec6759af5b9a00d8371b9fd9b723012dd0a1614cfcc7cd51975a004f69ffb90083735e9a871a2aa0e8d28799beac53a4748f55f4dd1e7495bc7388ebf4d6a0

                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\lirn7gz7.default-release\activity-stream.discovery_stream.json

                      Filesize

                      33KB

                      MD5

                      5e6226544d87deb2ca038150909d84d8

                      SHA1

                      7f0bc7e1e15d0dad89fc33e32996e50c21e97eeb

                      SHA256

                      2490e187b2b10b4236df9a23aef676fdca0e06bcb489fe08423afea4620a401c

                      SHA512

                      0dfb142871a1a74dee97befd8a35b557abb3800736ab1dfe5addc5d401a51a53f1890327e3b3d4b6f560b51c618c778a2a7b2200aafc6961021f9fe70a375777

                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\lirn7gz7.default-release\cache2\entries\E449899591A9BC91DFBA673EC0589B51E541A88B

                      Filesize

                      13KB

                      MD5

                      64084f83970f6d564c83b654b05d9af9

                      SHA1

                      596a103a15fc47a7c65b2f3aa7ea60a7b328581a

                      SHA256

                      e2d08f19e3ff1e1f07dbfbf4a05fa31530770e159bfba82da55ed8121dd36d15

                      SHA512

                      2e15d5034ca3391a1e801b1d77239640ab78494ebd470509b416687f237e055aec3b04a40cc9fe231f04d0e8119bd1048985c03bc312ac5e5a65440c175458c5

                    • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe

                      Filesize

                      1.8MB

                      MD5

                      8bcd388ed9e8762c812ec36614f17982

                      SHA1

                      fae03863e3f80e04271b7835bcc9ff4865f2c219

                      SHA256

                      10afb5f99e9f494907a0b47823e69573301e7715ab389457bdcd391d8e9cf090

                      SHA512

                      1e979e850a172431f7b4c814f336cebbf16072b38a6bd8ebb686dfddbbd056a3cd59aae09f7790641b871e6080d1cf357ae3cc2d2771739e7248c3eb86a08764

                    • C:\Users\Admin\AppData\Local\Temp\1000001001\bd71fc592e.exe

                      Filesize

                      1.2MB

                      MD5

                      fa41e9c2abdb638e8d84e9d7d66631b9

                      SHA1

                      074348d5018587278822ed0245c02c523af163f6

                      SHA256

                      9a3c9d1a6a14599ec2423d06c9cd7fc1fff83113fce5149f9b80d9b19377d79f

                      SHA512

                      d9e90d162fa10da02d579d0c6bb84b0681e603996c11d9ba1f1e6d2df46358bcef3afc0e0e5601efb8f295a440f7fe4fba108b4e0b1c308802e483e7d42f5a91

                    • C:\Users\Admin\AppData\Local\Temp\1000002001\b83edef87e.exe

                      Filesize

                      206KB

                      MD5

                      228ea9e6c6e69e92e3436e79b2679589

                      SHA1

                      3330a33ebfc1a7bd60dfda68fb4a53f39006ddea

                      SHA256

                      68131366f09cfa12a3614bb48ece152d49de8b13465396cd0fc7ff17208e95b3

                      SHA512

                      6371037377e768144961be670a44a412c7e7bb26ed1f3dabed889d89318890cd8d1a4ee06a5bc06b241076f39693491b029b94079ed8d44b20a6e9f39113fb29

                    • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                      Filesize

                      479KB

                      MD5

                      09372174e83dbbf696ee732fd2e875bb

                      SHA1

                      ba360186ba650a769f9303f48b7200fb5eaccee1

                      SHA256

                      c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                      SHA512

                      b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                    • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                      Filesize

                      13.8MB

                      MD5

                      0a8747a2ac9ac08ae9508f36c6d75692

                      SHA1

                      b287a96fd6cc12433adb42193dfe06111c38eaf0

                      SHA256

                      32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                      SHA512

                      59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\AlternateServices.bin

                      Filesize

                      10KB

                      MD5

                      b7744cf185906ad93bb675d4addf3fe6

                      SHA1

                      e939c3ac4b62bfb8fd3da83cac1dc0c4b8092ac8

                      SHA256

                      06ecc9fd9beaa52d049efb5cc2795878697665d7c285e1083e28bbc9395a743e

                      SHA512

                      e10d5c07cbedde134a60cba89be030d1dbaf3865e9334aad84e74ab057073617c6ff45f17bb342e781ad38a6d769b3b12fffcc0c848c48ecb1fa34da540ad820

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\db\data.safe.tmp

                      Filesize

                      5KB

                      MD5

                      a1cccc9840c99fe1e72278a3c9c0bff2

                      SHA1

                      bb40a4ec4d93a87223c0aebd736713a60e42d091

                      SHA256

                      1288a2fbbe8bb202b2fb4673b2ad277b27667b67a0713d68586a9e01a53739b4

                      SHA512

                      aa55ebaace4e053f8e8b3ffcb7ab0d1f488d30c6d09e43dc0e05b18948b2bfe424985c0d3dcb0e1d222f60e0b446f38a8dd64faa6bca5f2e65c0ee68e1e43edf

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\db\data.safe.tmp

                      Filesize

                      16KB

                      MD5

                      ef13403eb96280a186310190d5cf9a8d

                      SHA1

                      d18e1749f849041fcce6b30c5bfb882b3ad566ad

                      SHA256

                      ec95be4cd81e915e18555707e758e56b28b868dbd3fcfd441dda3e7434596ff3

                      SHA512

                      6bf9af4ef4eeb8b37bd4be7c0d194701caa0b38e0362073322d295396aec38a579de94b6f036782fd3654aaef2065ad8733c9601960f6be9f1876c8a17295992

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\db\data.safe.tmp

                      Filesize

                      16KB

                      MD5

                      ccc0b1ecc5cbf083d7d1ce981ba59b76

                      SHA1

                      02f211cb3bfd21c16698ec975c49471fe53097ce

                      SHA256

                      288cc83eadeb8a8df423cecac3da3a8860d1fdc762f1a67bc5c01f529d1990b0

                      SHA512

                      89ec390393d6278831fe06953f41af8df1c13185b22b6ac93bb556588311156e5341e06e57bfff72774b422d083657f74db706c24af2d10cfbb0b34f9eb86dba

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\pending_pings\07e39b49-d7d6-4880-b6c9-c019dadcfcfc

                      Filesize

                      671B

                      MD5

                      2dfcd715f2502244bcf44ef6c3f8da01

                      SHA1

                      cc7e3191bb6714169c6056588687577ef303905d

                      SHA256

                      99322f783be4f54cf733061e4ce0f4d03d906ba1bf9ec3add35c55b9a2e17ac6

                      SHA512

                      bf3ea9dd2b919e9bb1710bef626377e2ba86a9f43f00701c3c2e717347a151cc68051d5b16d98f080194ee3408363d7b499a4d4408ff472e6e437865a2837b12

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\pending_pings\556b479a-c5c1-43be-9e72-631f0355bab1

                      Filesize

                      26KB

                      MD5

                      44faafe27e5fa2711baf2558a27d9a91

                      SHA1

                      8b544a4b1e7d267645fad1f7a77c797b6a36f97d

                      SHA256

                      c21cdaa38b52725e08b3e2983f72bf31257b69b41bf9dd01d8c84eb9540e31be

                      SHA512

                      a57e7e4917d4d50d59d700d46c5dbcb612fc38d4db7ef2a7edfbfe2543fe4a6b376490cb4577796ef1b820f61ca0c4994edd3cad6e7195f866aeeabf8e71e4f6

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\pending_pings\a649ba94-3442-4ad8-8551-c53e08038bef

                      Filesize

                      982B

                      MD5

                      520943e3498b473e7a1a5f1e5fe431d5

                      SHA1

                      5ed476457c8ab18ff1de5a91c0d70163119bda14

                      SHA256

                      2f37a653489ac7b87947b04c7bd1640dc972f393752255717d5c757177754ec8

                      SHA512

                      f87df3ac263e4103c2bcc7e919e0fbbfbcea1899e19e013d45147eaaca680a0394c8dcc739e842221ed8e5cc09a33a938e7aece1be4008039c21437f14cb8bac

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

                      Filesize

                      1.1MB

                      MD5

                      842039753bf41fa5e11b3a1383061a87

                      SHA1

                      3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                      SHA256

                      d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                      SHA512

                      d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

                      Filesize

                      116B

                      MD5

                      2a461e9eb87fd1955cea740a3444ee7a

                      SHA1

                      b10755914c713f5a4677494dbe8a686ed458c3c5

                      SHA256

                      4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                      SHA512

                      34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

                      Filesize

                      372B

                      MD5

                      bf957ad58b55f64219ab3f793e374316

                      SHA1

                      a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                      SHA256

                      bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                      SHA512

                      79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

                      Filesize

                      17.8MB

                      MD5

                      daf7ef3acccab478aaa7d6dc1c60f865

                      SHA1

                      f8246162b97ce4a945feced27b6ea114366ff2ad

                      SHA256

                      bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                      SHA512

                      5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\prefs-1.js

                      Filesize

                      11KB

                      MD5

                      9a060ff15c0a0ae38189baf44fcabfac

                      SHA1

                      f2562ca2a0dffcde7b51c35f4d172fc15f316682

                      SHA256

                      66c464133661fe1d6d51fad0087a88f9544fbcc270df1f2547433aaf74393589

                      SHA512

                      25b0542c3561debb34d3dc53f3547b9e6dad4cfd54b945848ba4b133575e37dce73415f968692237d195325441301162fe6e5561d37e3ca2d087373e3050e1e4

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\prefs-1.js

                      Filesize

                      13KB

                      MD5

                      0b448fd5e1b31e2dd86057da8dc59c4d

                      SHA1

                      dced4a19ad9a86673e282b7c71145660840b7aa5

                      SHA256

                      45dd839f1a5a9db856c24fdd295d384aa5c46256006fc0bb50b56981ac140bf0

                      SHA512

                      1fe0e4a43c4693c237b3da00e59b00e0299a4202baee903a1375e10b8f779896ce3ad925cdfe352608307c6cea5b448da1b5029448a445bf9c0f013a6fb8ae23

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\prefs.js

                      Filesize

                      11KB

                      MD5

                      e1a1317701e9bcbaf0a17e7280979f58

                      SHA1

                      b55ba46926ab3120df78ce3ad69c7bf5c19a704c

                      SHA256

                      de1660e306d7518af788f7cd30002a21cbde14300b660159b2d3af7d3159603b

                      SHA512

                      1650c234582ebb6a19a582ba49aed11a77f8d14e52ed52e9420d3bb49a0a3b2c836000c2d6ee6db627f2ce4674d6b148a2b923ba6bdfc27ac0306040d2d00550

                    • memory/1068-70-0x0000000000210000-0x0000000000248000-memory.dmp

                      Filesize

                      224KB

                    • memory/1672-2608-0x0000000000EC0000-0x0000000001375000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/1672-2607-0x0000000000EC0000-0x0000000001375000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/2000-91-0x0000000000D10000-0x0000000000F53000-memory.dmp

                      Filesize

                      2.3MB

                    • memory/2000-92-0x0000000000D10000-0x0000000000F53000-memory.dmp

                      Filesize

                      2.3MB

                    • memory/2056-2606-0x0000000000EC0000-0x0000000001375000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/2056-2616-0x0000000000EC0000-0x0000000001375000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/2056-2630-0x0000000000EC0000-0x0000000001375000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/2056-2624-0x0000000000EC0000-0x0000000001375000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/2056-26-0x0000000000EC0000-0x0000000001375000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/2056-2621-0x0000000000EC0000-0x0000000001375000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/2056-2619-0x0000000000EC0000-0x0000000001375000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/2056-22-0x0000000000EC0000-0x0000000001375000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/2056-93-0x0000000000EC0000-0x0000000001375000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/2056-89-0x0000000000EC0000-0x0000000001375000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/2056-452-0x0000000000EC0000-0x0000000001375000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/2056-467-0x0000000000EC0000-0x0000000001375000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/2056-21-0x0000000000EC1000-0x0000000000EEF000-memory.dmp

                      Filesize

                      184KB

                    • memory/2056-2618-0x0000000000EC0000-0x0000000001375000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/2056-18-0x0000000000EC0000-0x0000000001375000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/2056-2617-0x0000000000EC0000-0x0000000001375000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/2056-96-0x0000000000EC0000-0x0000000001375000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/2056-2614-0x0000000000EC0000-0x0000000001375000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/2056-2089-0x0000000000EC0000-0x0000000001375000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/2056-773-0x0000000000EC0000-0x0000000001375000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/3584-20-0x0000000000EC0000-0x0000000001375000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/3584-25-0x0000000000EC0000-0x0000000001375000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/3584-23-0x0000000000EC0000-0x0000000001375000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/3640-74-0x0000000000400000-0x0000000000643000-memory.dmp

                      Filesize

                      2.3MB

                    • memory/3640-72-0x0000000000400000-0x0000000000643000-memory.dmp

                      Filesize

                      2.3MB

                    • memory/3940-45-0x0000000000E40000-0x0000000000F70000-memory.dmp

                      Filesize

                      1.2MB

                    • memory/3952-49-0x0000000000400000-0x000000000052D000-memory.dmp

                      Filesize

                      1.2MB

                    • memory/3952-51-0x0000000000400000-0x000000000052D000-memory.dmp

                      Filesize

                      1.2MB

                    • memory/3952-47-0x0000000000400000-0x000000000052D000-memory.dmp

                      Filesize

                      1.2MB

                    • memory/4288-2-0x0000000000991000-0x00000000009BF000-memory.dmp

                      Filesize

                      184KB

                    • memory/4288-17-0x0000000000990000-0x0000000000E45000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/4288-3-0x0000000000990000-0x0000000000E45000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/4288-0-0x0000000000990000-0x0000000000E45000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/4288-4-0x0000000000990000-0x0000000000E45000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/4288-1-0x0000000077BE4000-0x0000000077BE6000-memory.dmp

                      Filesize

                      8KB

                    • memory/5596-2622-0x0000000000EC0000-0x0000000001375000-memory.dmp

                      Filesize

                      4.7MB

                    • memory/5596-2623-0x0000000000EC0000-0x0000000001375000-memory.dmp

                      Filesize

                      4.7MB