purelogstealer | c4174541aa2cef599aee7a376e5de3393446f0018a850fcf1c6658da9692bed5

Analysis

max time kernel
150s
max time network
153s
platform
windows10-1703_x64
resource
win10-20240611-en
resource tags

arch:x64arch:x86image:win10-20240611-enlocale:en-usos:windows10-1703-x64system
submitted
20-08-2024 19:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bot_start.exe
Size

197KB
MD5

9c29f4415a735c3d9ee26ca06385d502
SHA1

127b2d6c2e63bf3ff6fb8fb055a272e088fd851d
SHA256

c4174541aa2cef599aee7a376e5de3393446f0018a850fcf1c6658da9692bed5
SHA512

ac2cf91b4ef1dc72c10d5affa83305aa011b733ffc7ce10b87efe8e91d2a9dda72a52a3806f8a20e6bd02a1873677d74a793d5359c8e235bf64fdd23946927d6
SSDEEP

1536:cHc9JW77pHtDEOFYPUh7N9H/sPafochTLZ61tISqS9HwRXBuS7pR72BfLJFBLbbI:ayy9HwSLZ6vTjHwBBybvIJe9

Score

10^/10

purelogstealer credential_access discovery persistence spyware stealer

Malware Config

Signatures

PureLog Stealer
PureLog Stealer is an infostealer written in C#.
stealer purelogstealer

PureLog Stealer payload 1 IoCs

resource	yara_rule
behavioral1/memory/5084-1-0x0000000000C30000-0x0000000000C62000-memory.dmp	family_purelog_stealer

Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003
Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Control Panel\International\Geo\Nation	VC_redistx64.exe

Executes dropped EXE 2 IoCs

pid	Process
5108	sWsmPty.exe
4008	VC_redistx64.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Windows\CurrentVersion\Run\My Program = "C:\\Users\\Admin\\AppData\\Roaming\\MyHiddenFolder\\VC_redistx64.exe"	VC_redistx64.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 13 IoCs

pid	Process
4008	VC_redistx64.exe
4008	VC_redistx64.exe
4008	VC_redistx64.exe
4008	VC_redistx64.exe
4008	VC_redistx64.exe
4008	VC_redistx64.exe
4008	VC_redistx64.exe
4008	VC_redistx64.exe
4008	VC_redistx64.exe
4008	VC_redistx64.exe
4008	VC_redistx64.exe
4008	VC_redistx64.exe
4008	VC_redistx64.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redistx64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bot_start.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings	bot_start.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5084	bot_start.exe
5084	bot_start.exe
5084	bot_start.exe
5084	bot_start.exe
5084	bot_start.exe
5084	bot_start.exe
5084	bot_start.exe
5084	bot_start.exe
5084	bot_start.exe
5084	bot_start.exe
5084	bot_start.exe
5084	bot_start.exe
5084	bot_start.exe
5084	bot_start.exe
5084	bot_start.exe
5084	bot_start.exe
5084	bot_start.exe
5084	bot_start.exe
5084	bot_start.exe
5084	bot_start.exe
5084	bot_start.exe
5084	bot_start.exe
5084	bot_start.exe
5084	bot_start.exe
5084	bot_start.exe
5084	bot_start.exe
5084	bot_start.exe
5084	bot_start.exe
5084	bot_start.exe
5084	bot_start.exe
5084	bot_start.exe
5084	bot_start.exe
5084	bot_start.exe
5084	bot_start.exe
5084	bot_start.exe
5084	bot_start.exe
5084	bot_start.exe
5084	bot_start.exe
5084	bot_start.exe
5084	bot_start.exe
5084	bot_start.exe
5084	bot_start.exe
5084	bot_start.exe
5084	bot_start.exe
5084	bot_start.exe
5084	bot_start.exe
5084	bot_start.exe
5084	bot_start.exe
5084	bot_start.exe
5084	bot_start.exe
5084	bot_start.exe
5084	bot_start.exe
5084	bot_start.exe
5084	bot_start.exe
5084	bot_start.exe
5084	bot_start.exe
5084	bot_start.exe
5084	bot_start.exe
5084	bot_start.exe
5084	bot_start.exe
5084	bot_start.exe
5084	bot_start.exe
5084	bot_start.exe
5084	bot_start.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3852	OpenWith.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	5084	bot_start.exe
Token: SeDebugPrivilege	4480	firefox.exe
Token: SeDebugPrivilege	4480	firefox.exe
Token: SeDebugPrivilege	4480	firefox.exe
Token: SeDebugPrivilege	4480	firefox.exe
Token: SeDebugPrivilege	4480	firefox.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
4480	firefox.exe
4480	firefox.exe
4480	firefox.exe
4480	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4480	firefox.exe
4480	firefox.exe
4480	firefox.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4480	firefox.exe
4480	firefox.exe
4480	firefox.exe
4480	firefox.exe
4008	VC_redistx64.exe
3852	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3740 wrote to memory of 4480	3740	firefox.exe	73
PID 3740 wrote to memory of 4480	3740	firefox.exe	73
PID 3740 wrote to memory of 4480	3740	firefox.exe	73
PID 3740 wrote to memory of 4480	3740	firefox.exe	73
PID 3740 wrote to memory of 4480	3740	firefox.exe	73
PID 3740 wrote to memory of 4480	3740	firefox.exe	73
PID 3740 wrote to memory of 4480	3740	firefox.exe	73
PID 3740 wrote to memory of 4480	3740	firefox.exe	73
PID 3740 wrote to memory of 4480	3740	firefox.exe	73
PID 3740 wrote to memory of 4480	3740	firefox.exe	73
PID 3740 wrote to memory of 4480	3740	firefox.exe	73
PID 4480 wrote to memory of 2084	4480	firefox.exe	74
PID 4480 wrote to memory of 2084	4480	firefox.exe	74
PID 4480 wrote to memory of 4256	4480	firefox.exe	75
PID 4480 wrote to memory of 4256	4480	firefox.exe	75
PID 4480 wrote to memory of 4256	4480	firefox.exe	75
PID 4480 wrote to memory of 4256	4480	firefox.exe	75
PID 4480 wrote to memory of 4256	4480	firefox.exe	75
PID 4480 wrote to memory of 4256	4480	firefox.exe	75
PID 4480 wrote to memory of 4256	4480	firefox.exe	75
PID 4480 wrote to memory of 4256	4480	firefox.exe	75
PID 4480 wrote to memory of 4256	4480	firefox.exe	75
PID 4480 wrote to memory of 4256	4480	firefox.exe	75
PID 4480 wrote to memory of 4256	4480	firefox.exe	75
PID 4480 wrote to memory of 4256	4480	firefox.exe	75
PID 4480 wrote to memory of 4256	4480	firefox.exe	75
PID 4480 wrote to memory of 4256	4480	firefox.exe	75
PID 4480 wrote to memory of 4256	4480	firefox.exe	75
PID 4480 wrote to memory of 4256	4480	firefox.exe	75
PID 4480 wrote to memory of 4256	4480	firefox.exe	75
PID 4480 wrote to memory of 4256	4480	firefox.exe	75
PID 4480 wrote to memory of 4256	4480	firefox.exe	75
PID 4480 wrote to memory of 4256	4480	firefox.exe	75
PID 4480 wrote to memory of 4256	4480	firefox.exe	75
PID 4480 wrote to memory of 4256	4480	firefox.exe	75
PID 4480 wrote to memory of 4256	4480	firefox.exe	75
PID 4480 wrote to memory of 4256	4480	firefox.exe	75
PID 4480 wrote to memory of 4256	4480	firefox.exe	75
PID 4480 wrote to memory of 4256	4480	firefox.exe	75
PID 4480 wrote to memory of 4256	4480	firefox.exe	75
PID 4480 wrote to memory of 4256	4480	firefox.exe	75
PID 4480 wrote to memory of 4256	4480	firefox.exe	75
PID 4480 wrote to memory of 4256	4480	firefox.exe	75
PID 4480 wrote to memory of 4256	4480	firefox.exe	75
PID 4480 wrote to memory of 4256	4480	firefox.exe	75
PID 4480 wrote to memory of 4256	4480	firefox.exe	75
PID 4480 wrote to memory of 4256	4480	firefox.exe	75
PID 4480 wrote to memory of 4256	4480	firefox.exe	75
PID 4480 wrote to memory of 4256	4480	firefox.exe	75
PID 4480 wrote to memory of 4256	4480	firefox.exe	75
PID 4480 wrote to memory of 4256	4480	firefox.exe	75
PID 4480 wrote to memory of 4256	4480	firefox.exe	75
PID 4480 wrote to memory of 4256	4480	firefox.exe	75
PID 4480 wrote to memory of 4256	4480	firefox.exe	75
PID 4480 wrote to memory of 4256	4480	firefox.exe	75
PID 4480 wrote to memory of 4256	4480	firefox.exe	75
PID 4480 wrote to memory of 4256	4480	firefox.exe	75
PID 4480 wrote to memory of 4256	4480	firefox.exe	75
PID 4480 wrote to memory of 4256	4480	firefox.exe	75
PID 4480 wrote to memory of 4256	4480	firefox.exe	75
PID 4480 wrote to memory of 4256	4480	firefox.exe	75
PID 4480 wrote to memory of 4384	4480	firefox.exe	76
PID 4480 wrote to memory of 4384	4480	firefox.exe	76
PID 4480 wrote to memory of 4384	4480	firefox.exe	76

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\bot_start.exe
"C:\Users\Admin\AppData\Local\Temp\bot_start.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5084
- C:\Users\Admin\AppData\Roaming\sWsmPty.exe
  "C:\Users\Admin\AppData\Roaming\sWsmPty.exe"
  2⤵
  - Executes dropped EXE
  PID:5108
- C:\Users\Admin\AppData\Roaming\VC_redistx64.exe
  "C:\Users\Admin\AppData\Roaming\VC_redistx64.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4008

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3740
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4480
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4480.0.41435607\631175479" -parentBuildID 20221007134813 -prefsHandle 1688 -prefMapHandle 1672 -prefsLen 20767 -prefMapSize 233414 -appDir "C:\Program Files\Mozilla Firefox\browser" - {dcd17cff-9301-46be-a1e1-c6d315c96f45} 4480 "\\.\pipe\gecko-crash-server-pipe.4480" 1780 1afec9e4a58 gpu
    3⤵
    PID:2084
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4480.1.2134573329\874335718" -parentBuildID 20221007134813 -prefsHandle 2124 -prefMapHandle 2120 -prefsLen 20848 -prefMapSize 233414 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b672c614-9318-4346-a849-47225d6cc9b3} 4480 "\\.\pipe\gecko-crash-server-pipe.4480" 2136 1afda671f58 socket
    3⤵
    PID:4256
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4480.2.1513599027\1490274000" -childID 1 -isForBrowser -prefsHandle 2696 -prefMapHandle 2992 -prefsLen 20951 -prefMapSize 233414 -jsInitHandle 1252 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b0a4a9e2-f520-47ed-a9e8-1f8b464fc90c} 4480 "\\.\pipe\gecko-crash-server-pipe.4480" 2848 1afec95de58 tab
    3⤵
    PID:4384
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4480.3.1998686217\2069891802" -childID 2 -isForBrowser -prefsHandle 3416 -prefMapHandle 3412 -prefsLen 26136 -prefMapSize 233414 -jsInitHandle 1252 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b5ac236f-9649-42a9-85a6-284a2f3f651d} 4480 "\\.\pipe\gecko-crash-server-pipe.4480" 3428 1aff1b3c558 tab
    3⤵
    PID:2884
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4480.4.586950284\1762168308" -childID 3 -isForBrowser -prefsHandle 4152 -prefMapHandle 4304 -prefsLen 26271 -prefMapSize 233414 -jsInitHandle 1252 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4da5b539-a129-46e3-a9d7-2d15252781ad} 4480 "\\.\pipe\gecko-crash-server-pipe.4480" 4412 1aff284bc58 tab
    3⤵
    PID:4436
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4480.5.1989278699\316973959" -childID 4 -isForBrowser -prefsHandle 5020 -prefMapHandle 4448 -prefsLen 26274 -prefMapSize 233414 -jsInitHandle 1252 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a2cbf54d-3fb6-4e5a-b6cd-eb272ae2b067} 4480 "\\.\pipe\gecko-crash-server-pipe.4480" 5028 1aff2e7ba58 tab
    3⤵
    PID:4240
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4480.6.960567358\513291701" -childID 5 -isForBrowser -prefsHandle 5144 -prefMapHandle 5148 -prefsLen 26274 -prefMapSize 233414 -jsInitHandle 1252 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3c254381-c948-486a-b5f8-9caa01a389b5} 4480 "\\.\pipe\gecko-crash-server-pipe.4480" 5132 1aff378dc58 tab
    3⤵
    PID:4380
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4480.7.790023040\1484022708" -childID 6 -isForBrowser -prefsHandle 5348 -prefMapHandle 5352 -prefsLen 26274 -prefMapSize 233414 -jsInitHandle 1252 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {cb3bea67-58b3-46d1-8317-d2fa6ed31d20} 4480 "\\.\pipe\gecko-crash-server-pipe.4480" 5340 1aff378c758 tab
    3⤵
    PID:4080

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\activity-stream.discovery_stream.json.tmp

Filesize
31KB

MD5
24d67342a11e1fd02b6d0baaede87eb6

SHA1
5b0b891a886de62bf865ad5b143ad1da2a758abd

SHA256
e316d96e5da562c2c65265546b768e9c3eae4d1b993bf21b84963bd74b1f1b09

SHA512
b7d22a494a289ec9819d3b296f837681f9678deeeb2baad4803e8e12c8c205fe9f47a1b9356a4ce30a8a5b965267936079352f2bbf367f4d0be42ce0e64d560d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

Filesize
7KB

MD5
c460716b62456449360b23cf5663f275

SHA1
06573a83d88286153066bae7062cc9300e567d92

SHA256
0ec0f16f92d876a9c1140d4c11e2b346a9292984d9a854360e54e99fdcd99cc0

SHA512
476bc3a333aace4c75d9a971ef202d5889561e10d237792ca89f8d379280262ce98cf3d4728460696f8d7ff429a508237764bf4a9ccb59fd615aee07bdcadf30

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\cert9.db

Filesize
224KB

MD5
3ef0346106c4e42d3436aa43ca2270f4

SHA1
f36284b40f319e65c6707ed05e113012704da449

SHA256
efdd08dd3a11dddb597d2b5c9361048a1f8952975c76a4de5a989397f4cfb7fa

SHA512
a84f4a7e332fed13a845a14126dc9706cc03d18ed82477e786a79c261678dae50118348cb142e70ba59485b4dde0c4466da58d3025698f3cd18ef7dcc0b1f702

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
9a3e5e1421891747c49a676aa90d1eca

SHA1
dca8671885237cdc0280c5c2f16c9fc86d4ea89c

SHA256
f5afb561f6af537179d4554ce08f75a1948996d27a32486509d94cd7ccd24829

SHA512
e941c676e8d0ccd7743aba51c9c88d2c4eb265e200d32bb3a731bdbb4ed1d8cb6d8430ef9c68d51ec2c350a5eff1822c7edbf4ad58f73f6978ecb97e8621222f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\datareporting\glean\pending_pings\2ae0929b-0a52-4e5d-b51d-6c5e0928713d

Filesize
10KB

MD5
39d1be032534fdb0d36b75f2acfc3053

SHA1
0c9b28649a92979ac348f33d01e4f4db7c667950

SHA256
d536c2da092588b893a4a51dbf65e8ee5546ac820f26749135177bfe1e890477

SHA512
c96acfd7bd221333a2de0283938e57a285e99f3af758c0d5939563c11e5d94f07787d628c255b84153c5860b2887cc238a5a3fefc32b71bafaec1c478337ae04

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\datareporting\glean\pending_pings\3a2d56e4-6d47-460a-832f-192cb9e22ee4

Filesize
746B

MD5
5feb36db1c260fb16e5eb175d192da74

SHA1
590252bb28691d681d8184c7bf51ceea65b74547

SHA256
d28f02dc55445f29cd077c165806c6132468c6a26176c348ecb829135fa62126

SHA512
06502624322b3dd903acf5a7a89295bdb101ff249f4625cfc0286ea17be3190800fe0c3b2070222aa27a15f5409c6967a07a40801a4f1c1e073d518a5275df5c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\prefs-1.js

Filesize
6KB

MD5
25e2f7b8a37d1dfc5518a8e57a378cac

SHA1
15712319c526b98d5b129d30b3374d8a0e7a4791

SHA256
f32d8309b3f33623a2c939923494e97ae30a290a90cdfe961e8ca6caecaed339

SHA512
863383be0b0e3d0332897185872b4e6a58e49652c69f961081ed82c90fe792716681e7f410032b5fcfb1fbcf6c2ef3486c82ba17e1dd1b38b6b03d8546c656ab

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\prefs.js

Filesize
6KB

MD5
b0d06e5a00341f8bf22273ded1cf8beb

SHA1
e4d217e3ac5dc96ffdad45b45c4a501777b928df

SHA256
183f6cae9ac1469556cc7d3ab1eb2c9f3de4d206a4b8ba2f43f43de974e965ee

SHA512
8462dcb236d16f83ad5dabf824c3ee3f3243a345e340c78b65767aec3056279ecd46d049969334b68dc9dbdb3084edbfab9095ec2756b679dd5e3b45f3cd9765

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\prefs.js

Filesize
6KB

MD5
018b21c8c10e52d83bf5911d824709a0

SHA1
0bdb91d38377d125e6585ea6ffa59238cb89cc3a

SHA256
5a33589dd2f1022ef0235abd40b780f55c09a2a1b79b2d263b82d48f97ee0606

SHA512
565210f32f577f93552543b5741b210ff6819eb42c0599ed1e46494ab03271761c02084782ed9d6d1e5feb349229652668b234e6d4b4af5fca417607f072697a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
57be3af9d0a72082f43d728d57e1277b

SHA1
e40adba274138cee889544c14709a725af32c393

SHA256
4f23a235094f486d826aaedec81bc66850a065497c80bc5745c7e048e86b754c

SHA512
fd8e108e2901956cac4cfff5b62b0829ac14416a00f2e5cc33b250c175bfb07feb9123d72b852137e1ee50686c5f332a462b4ee08fcdd664054eaec191034901

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
276c6091de924be142fa46710eeb87e9

SHA1
5d68ce58500a9c6ccabb537bda177525db82c473

SHA256
1af5f4114007c98e8be0b2b15533bdcd98c1ea206c1e0096fa7ec1e8058da993

SHA512
83f66f127e363ed36c5a40ba9e36a56dfe91ed1f0deed54ad8e8173c0618a31d23bf075684259a8ab5fee3a86a102158da6656edacf87ad1fb0c5e9791070a3b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
184KB

MD5
e6d3e3af985b0d54d71180c38e18349c

SHA1
765a143b67c7c980b1b54988916bd05f4e8fa7c3

SHA256
341395df618c042b6197c7546f85cb41e2e671f2282b993811fcb36829947442

SHA512
13c4667aca464918efe72de1371a954ed4855315a508a70f96ec262e8e7386084d84109b8fbace53f30926ace3c39af475b029a4fd2efdf5aba447283b38607d

Download Submit
C:\Users\Admin\AppData\Roaming\VC_redistx64.exe

Filesize
2.6MB

MD5
dab13157795e19d8fe050f65ce49401d

SHA1
ecb6f0a864fd92fb7c423d882f9a6ea703096318

SHA256
d8b4ce77f87bfe0b958f01ea30f48cf53e6ff51b425a57abc4f83a71d47f58fc

SHA512
5cdb82bf347dbdae3c8e3f376ad18fb48509af3da91e8d18876ee7adb9db9fa9d2476060bf5de1294d44e86d477486db9efa045bd45a86a0e6739d6cfa9cca89

Download Submit
C:\Users\Admin\AppData\Roaming\sWsmPty.exe

Filesize
13.2MB

MD5
f94352e1545f9b8820885dca9baafcb4

SHA1
710f642efb3e30e5e9a3abc7586997de1aac0852

SHA256
07d614e26f1ab51b36eba12ba11e5deae3415688c6d6989e9a41d387884df763

SHA512
d13ccb3b6ba61db1bc1a03438fda50e617ea531ea568aa86366909fecee01b8979e284552aac2441aa8bdeddf4c1634d1d5e82701697978986294f53196537ab

Download Submit
memory/4008-253-0x00000000001F0000-0x0000000000C4D000-memory.dmp

Filesize
10.4MB

Download
memory/4008-280-0x00000000001F0000-0x0000000000C4D000-memory.dmp

Filesize
10.4MB

Download
memory/4008-211-0x00000000001F0000-0x0000000000C4D000-memory.dmp

Filesize
10.4MB

Download
memory/4008-254-0x00000000001F0000-0x0000000000C4D000-memory.dmp

Filesize
10.4MB

Download
memory/4008-298-0x00000000001F0000-0x0000000000C4D000-memory.dmp

Filesize
10.4MB

Download
memory/4008-296-0x00000000001F0000-0x0000000000C4D000-memory.dmp

Filesize
10.4MB

Download
memory/4008-291-0x00000000001F0000-0x0000000000C4D000-memory.dmp

Filesize
10.4MB

Download
memory/4008-289-0x00000000001F0000-0x0000000000C4D000-memory.dmp

Filesize
10.4MB

Download
memory/4008-288-0x00000000001F0000-0x0000000000C4D000-memory.dmp

Filesize
10.4MB

Download
memory/4008-287-0x00000000001F0000-0x0000000000C4D000-memory.dmp

Filesize
10.4MB

Download
memory/4008-285-0x00000000001F0000-0x0000000000C4D000-memory.dmp

Filesize
10.4MB

Download
memory/4008-256-0x00000000001F0000-0x0000000000C4D000-memory.dmp

Filesize
10.4MB

Download
memory/4008-266-0x00000000001F0000-0x0000000000C4D000-memory.dmp

Filesize
10.4MB

Download
memory/5084-1-0x0000000000C30000-0x0000000000C62000-memory.dmp

Filesize
200KB

Download
memory/5084-3-0x0000000073530000-0x0000000073C1E000-memory.dmp

Filesize
6.9MB

Download
memory/5084-5-0x000000007353E000-0x000000007353F000-memory.dmp

Filesize
4KB

Download
memory/5084-4-0x0000000005460000-0x000000000546A000-memory.dmp

Filesize
40KB

Download
memory/5084-12-0x0000000073530000-0x0000000073C1E000-memory.dmp

Filesize
6.9MB

Download
memory/5084-214-0x0000000073530000-0x0000000073C1E000-memory.dmp

Filesize
6.9MB

Download
memory/5084-170-0x0000000007D00000-0x00000000081FE000-memory.dmp

Filesize
5.0MB

Download
memory/5084-0-0x000000007353E000-0x000000007353F000-memory.dmp

Filesize
4KB

Download
memory/5084-2-0x0000000005440000-0x000000000544C000-memory.dmp

Filesize
48KB

Download
memory/5108-217-0x0000000001270000-0x0000000001271000-memory.dmp

Filesize
4KB

Download
memory/5108-233-0x0000000140000000-0x0000000140273000-memory.dmp

Filesize
2.4MB

Download
memory/5108-227-0x0000000000400000-0x000000000114E000-memory.dmp

Filesize
13.3MB

Download
memory/5108-228-0x00000000038C0000-0x0000000003AC8000-memory.dmp

Filesize
2.0MB

Download
memory/5108-199-0x0000000140000000-0x0000000140273000-memory.dmp

Filesize
2.4MB

Download
memory/5108-182-0x00000000038C0000-0x0000000003AC8000-memory.dmp

Filesize
2.0MB

Download
memory/5108-258-0x0000000140000000-0x0000000140273000-memory.dmp

Filesize
2.4MB

Download
memory/5108-189-0x0000000140000000-0x0000000140273000-memory.dmp

Filesize
2.4MB

Download
memory/5108-267-0x0000000140000000-0x0000000140273000-memory.dmp

Filesize
2.4MB

Download
memory/5108-190-0x0000000140000000-0x0000000140273000-memory.dmp

Filesize
2.4MB

Download
memory/5108-191-0x0000000140000000-0x0000000140273000-memory.dmp

Filesize
2.4MB

Download
memory/5108-192-0x0000000140000000-0x0000000140273000-memory.dmp

Filesize
2.4MB

Download
memory/5108-193-0x0000000140000000-0x0000000140273000-memory.dmp

Filesize
2.4MB

Download
memory/5108-194-0x0000000140000000-0x0000000140273000-memory.dmp

Filesize
2.4MB

Download
memory/5108-196-0x0000000140000000-0x0000000140273000-memory.dmp

Filesize
2.4MB

Download
memory/5108-195-0x0000000140000000-0x0000000140273000-memory.dmp

Filesize
2.4MB

Download
memory/5108-183-0x0000000140000000-0x0000000140273000-memory.dmp

Filesize
2.4MB

Download
memory/5108-181-0x0000000001270000-0x0000000001271000-memory.dmp

Filesize
4KB

Download