Analysis

  • max time kernel
    142s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-11-2024 02:56

General

  • Target

    c3d0427b8bc9d084ac65b881ec50f55be52650f60850ac05010ccc8d56e3d1cb.exe

  • Size

    1.8MB

  • MD5

    1daa3a0aa5ed7e06b400a47309ba5003

  • SHA1

    8d475fd4be28ee701dbe5e2fe489fe9e9b3e826d

  • SHA256

    c3d0427b8bc9d084ac65b881ec50f55be52650f60850ac05010ccc8d56e3d1cb

  • SHA512

    bc671cd250579413e693d2a61c2873a776a7c39125addd78b7a39a268c508fb638cd7c552faabd3ac9a53baf4b97086173af09264dd68e2f5a7516b55a3f2ed8

  • SSDEEP

    49152:PMGDMQEgEDs8SLI5GQ3+l1cxRGPfyJgSuOB3X:PMLZuIgQuxpSbF

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

stealc

Botnet

mars

C2

http://185.215.113.206

Attributes
  • url_path

    /c4becf79229cb002.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Amadey family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

  • Stealc family
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 8 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 16 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 8 IoCs
  • Identifies Wine through registry keys 2 TTPs 8 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 5 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 23 IoCs
  • Suspicious use of AdjustPrivilegeToken 11 IoCs
  • Suspicious use of FindShellTrayWindow 31 IoCs
  • Suspicious use of SendNotifyMessage 30 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\c3d0427b8bc9d084ac65b881ec50f55be52650f60850ac05010ccc8d56e3d1cb.exe
    "C:\Users\Admin\AppData\Local\Temp\c3d0427b8bc9d084ac65b881ec50f55be52650f60850ac05010ccc8d56e3d1cb.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1916
    • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
      "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:456
      • C:\Users\Admin\AppData\Local\Temp\1008331001\9dbc7180e7.exe
        "C:\Users\Admin\AppData\Local\Temp\1008331001\9dbc7180e7.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:2892
      • C:\Users\Admin\AppData\Local\Temp\1008332001\89fcf15962.exe
        "C:\Users\Admin\AppData\Local\Temp\1008332001\89fcf15962.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:3408
      • C:\Users\Admin\AppData\Local\Temp\1008333001\78dd4d4077.exe
        "C:\Users\Admin\AppData\Local\Temp\1008333001\78dd4d4077.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:4252
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM firefox.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:3840
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM chrome.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2700
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM msedge.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4228
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM opera.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:3140
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM brave.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4840
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2088
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
            5⤵
            • Checks processor information in registry
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:3800
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1984 -parentBuildID 20240401114208 -prefsHandle 1912 -prefMapHandle 1872 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7aa952d8-b5e6-4bd9-90ed-705f53f1062a} 3800 "\\.\pipe\gecko-crash-server-pipe.3800" gpu
              6⤵
                PID:4040
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2420 -parentBuildID 20240401114208 -prefsHandle 2412 -prefMapHandle 2408 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d5d3568c-7842-473a-9c82-3639651d8cac} 3800 "\\.\pipe\gecko-crash-server-pipe.3800" socket
                6⤵
                  PID:1720
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3244 -childID 1 -isForBrowser -prefsHandle 3112 -prefMapHandle 3200 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1272 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {39116e61-7ef7-4dbc-b948-bd2b0abbb23b} 3800 "\\.\pipe\gecko-crash-server-pipe.3800" tab
                  6⤵
                    PID:2860
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4044 -childID 2 -isForBrowser -prefsHandle 4032 -prefMapHandle 4024 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1272 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {35d6839c-da68-405c-9bea-cbae12a6563c} 3800 "\\.\pipe\gecko-crash-server-pipe.3800" tab
                    6⤵
                      PID:1712
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4728 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4672 -prefMapHandle 4668 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {36f4b79e-4cc8-41b6-a152-ceee5655604a} 3800 "\\.\pipe\gecko-crash-server-pipe.3800" utility
                      6⤵
                      • Checks processor information in registry
                      PID:4956
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4180 -childID 3 -isForBrowser -prefsHandle 5472 -prefMapHandle 5468 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1272 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {00f6fd7e-5aaa-48c6-bb7e-f85e81dcfc75} 3800 "\\.\pipe\gecko-crash-server-pipe.3800" tab
                      6⤵
                        PID:5652
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5604 -childID 4 -isForBrowser -prefsHandle 5688 -prefMapHandle 5684 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1272 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d655183a-ac84-4602-b5c6-891f92a7adcc} 3800 "\\.\pipe\gecko-crash-server-pipe.3800" tab
                        6⤵
                          PID:5664
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5896 -childID 5 -isForBrowser -prefsHandle 5776 -prefMapHandle 5604 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1272 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b16edbfc-b035-4195-9a3e-2b72b86981d6} 3800 "\\.\pipe\gecko-crash-server-pipe.3800" tab
                          6⤵
                            PID:5720
                    • C:\Users\Admin\AppData\Local\Temp\1008334001\fad3c52383.exe
                      "C:\Users\Admin\AppData\Local\Temp\1008334001\fad3c52383.exe"
                      3⤵
                      • Modifies Windows Defender Real-time Protection settings
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Windows security modification
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2592
                • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                  C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                  1⤵
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Identifies Wine through registry keys
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • Suspicious behavior: EnumeratesProcesses
                  PID:3544
                • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                  C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                  1⤵
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Identifies Wine through registry keys
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • Suspicious behavior: EnumeratesProcesses
                  PID:1492
                • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                  C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                  1⤵
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Identifies Wine through registry keys
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • Suspicious behavior: EnumeratesProcesses
                  PID:2376

                Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\7fmsgkth.default-release\activity-stream.discovery_stream.json

                  Filesize

                  28KB

                  MD5

                  264abbbe482c7f8b5937adcee144df97

                  SHA1

                  3b1e50a27b574b2822cb0ca46447eb62a311442d

                  SHA256

                  2947f4ddbf4820530833c3ac5431bb75d599cf66c89d619a02404d82d70ac6bb

                  SHA512

                  aa745b0dda82dc5fd65358d5e05284f7685d2a22147f8cf8b8f7cba77be31b1033777cc552a70c0e949cde7e00562ab07c38183d1587d7024c6d8d417b90078c

                • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\7fmsgkth.default-release\cache2\entries\39DB9E847E680B765D7B04FCCE6BF5BC0225F878

                  Filesize

                  13KB

                  MD5

                  3e8f64457ce9ec827dc45b1be9045903

                  SHA1

                  dbb82876360129f00ad9e6932ac88a91a3d517a2

                  SHA256

                  dea1426d595fa2c7ec9c9c81600e56e6141ffb51b6ec73bd6825abc8f51732ad

                  SHA512

                  79656d195ac7f835afbef7c3608b533d6fc8ff46e4596d95fd351d4470a5fe2f031400601434ea36c17f8a9680d05d6f7d591e186386194bf26616ab4cc3b41c

                • C:\Users\Admin\AppData\Local\Temp\1008331001\9dbc7180e7.exe

                  Filesize

                  1.8MB

                  MD5

                  3fd8fbf9d0d8926b7accf16c4926e8d5

                  SHA1

                  ee55c5ca14d44195cc01a8096a34d7a65f99e48f

                  SHA256

                  2b479995dd51e8fe91a803ad304efe336588ca5ef5cd43f87cecb04af9bd7358

                  SHA512

                  da0ecc60bb83d69bf71b7cb2fb3844369fecbcb21ef7eee98aea37f6dfe68899782c98eff90fab85338240c2b1c0ea6aacadb22c732bc5fe20a9589f600284d4

                • C:\Users\Admin\AppData\Local\Temp\1008332001\89fcf15962.exe

                  Filesize

                  1.7MB

                  MD5

                  dfb6af33800aab569fd4dd7a73da61b5

                  SHA1

                  8d3e452a836ea93963fa01e4c74a4be70709cf2a

                  SHA256

                  20144301e57eefe989e898adb603a138cd92badd5c238236d21028f99ee99780

                  SHA512

                  9774a70182d8133e5241984aee29a55f673c447ad71507f8915c3e7b63fb2a2ee7fe47c2289e51501a2aaf17fa84a4e973c01e2a94701a725163b90cd43c1440

                • C:\Users\Admin\AppData\Local\Temp\1008333001\78dd4d4077.exe

                  Filesize

                  900KB

                  MD5

                  8eb4ec0df45ae7c7fba0f660615f7bf5

                  SHA1

                  d4442af8c569012800bbfdf22b9885cb1073c496

                  SHA256

                  e5fca9f7d4e548dcefb305cca3a69ead145c2917e56e2016099eeaba2117ff32

                  SHA512

                  ba9d7444295c9277c628447b8ac5d05c1993f12ada11af1c5583ef5ba7d6231048a2a984a6c74597010db61dc520065be6831df3bbf56622de90c4df9dbb860e

                • C:\Users\Admin\AppData\Local\Temp\1008334001\fad3c52383.exe

                  Filesize

                  2.7MB

                  MD5

                  f415a54b4baeea41fbfcd1bc42be393a

                  SHA1

                  fb3a6737319bba6bad65963f37b2ddaaae91c7ae

                  SHA256

                  7174a7e1e24698f51fb1d56c57f187d2e3fd659eae980a8b335090db8c6f5683

                  SHA512

                  68172bc005ca512aad5868cea5659ecffcd2992d1185e7d5811ed95315a33d5fb12b87d203bd95fda7457e577dc1933d2b425a925f051d6e26fba9752f41c609

                • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

                  Filesize

                  1.8MB

                  MD5

                  1daa3a0aa5ed7e06b400a47309ba5003

                  SHA1

                  8d475fd4be28ee701dbe5e2fe489fe9e9b3e826d

                  SHA256

                  c3d0427b8bc9d084ac65b881ec50f55be52650f60850ac05010ccc8d56e3d1cb

                  SHA512

                  bc671cd250579413e693d2a61c2873a776a7c39125addd78b7a39a268c508fb638cd7c552faabd3ac9a53baf4b97086173af09264dd68e2f5a7516b55a3f2ed8

                • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                  Filesize

                  479KB

                  MD5

                  09372174e83dbbf696ee732fd2e875bb

                  SHA1

                  ba360186ba650a769f9303f48b7200fb5eaccee1

                  SHA256

                  c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                  SHA512

                  b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                  Filesize

                  13.8MB

                  MD5

                  0a8747a2ac9ac08ae9508f36c6d75692

                  SHA1

                  b287a96fd6cc12433adb42193dfe06111c38eaf0

                  SHA256

                  32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                  SHA512

                  59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\AlternateServices.bin

                  Filesize

                  10KB

                  MD5

                  628aa0d82a3c280c0ffe5f107682ec35

                  SHA1

                  9130ab13f7c9df35439a6564a97bc95144db22f7

                  SHA256

                  7b21711709ffebe58fc3689b4b960328c0949251833a0adff799be30ce945c44

                  SHA512

                  6f40b26448e44527a3f4de1b568d248f3948c1a8e88e800832948f5ce8dd93f3a6dd1efb73ae506251d5a9943e438f7639c9f82f34da9474c1c63a0820852bde

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\datareporting\glean\db\data.safe.tmp

                  Filesize

                  21KB

                  MD5

                  ab3e0501567e4abedc8234c863461468

                  SHA1

                  796f5d3fbc0f33fd325f3564eeceaaab010bd26a

                  SHA256

                  c511048807737bc1239b564f1ff1ff4dad2c12854a51360c8b6c6e294eb45c3c

                  SHA512

                  578e0383726574dc74697c966690e590cbb419c23333f18ece547ab09acdc8fd049f64623feebbc01dd69309bff611eebdf696903bc5a5d9557b142b40deab9a

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\datareporting\glean\db\data.safe.tmp

                  Filesize

                  22KB

                  MD5

                  adffe16facdd0d74bf620c5dba204adf

                  SHA1

                  5763297cb555e11e85da8722d57dd6e437df8c97

                  SHA256

                  793a9fbabd73e25ab8be3d1298304d5f13e32ccc111b13241f10c049237da946

                  SHA512

                  2e6fefbe056b1b5b315d04d11f971778fff7f33529e261a28719881c6e8ab24da65a7e07e663f2e353186b17397a647f871fd3e2fde97837cd9823633a2b0798

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\datareporting\glean\db\data.safe.tmp

                  Filesize

                  25KB

                  MD5

                  c327cd823e9f82f1fc26afbc8e2c7cb4

                  SHA1

                  d141b035d8dc7ae32715731f4acea2ffeb7ca5a5

                  SHA256

                  03bd505e0f406b3ecd1d6ca3763c79fe1c4495cd29943d948ad96d2444eb9640

                  SHA512

                  150bc16bd2fd8ffdf943a4ee2f6e055c931a4e1bdd3974385e79b1221a75d4cd2cd40e203dd274322f88d2188e6bdc574a97e148e65a50e163504f9f8b222f65

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\datareporting\glean\db\data.safe.tmp

                  Filesize

                  24KB

                  MD5

                  b2f3495f4e587d86f5d92864025ab47b

                  SHA1

                  0ad18cb00f8d19177f455d63a2e7305f7eaa33d2

                  SHA256

                  8500cb59ac78e3d90d3d691af5445cda0a6af67982531f50fb6f304a6c6f7b65

                  SHA512

                  21b2a85b1443c35d87aad647ded5c17219073ac9c5a246d1bd2ace75d4c632a8046a3579b0a082f1d4a262513cf882c745a8c3759d4927e20c0a64999ceb9213

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\datareporting\glean\db\data.safe.tmp

                  Filesize

                  22KB

                  MD5

                  03e0fb7166df635a446a70392ba09354

                  SHA1

                  b78da757c53fd5e4f8b25f200da3a468603ec3fe

                  SHA256

                  368641367dc32720e7f6721fe4bfcedf74a27cccb1cd7ecda0731b9c9c8db608

                  SHA512

                  532958b0b53ca10d13ddf80249e2fca46bd3e3407e0fcdfb696286f5488df217a0d690fd4251443310b88da4e02110060e4f3912594a47c404f2bf954f871084

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\datareporting\glean\pending_pings\1f273050-e74d-4d4f-b05e-a0f33287cfe8

                  Filesize

                  659B

                  MD5

                  977d9d3f963a19f334299a80f525142d

                  SHA1

                  ce7026a2b3aebd0ba9513d9c0b6f5dab98eb4fa2

                  SHA256

                  85d941897bac9b4eec379f0e9a16f24dc487128b6a8e11323d7d962e4b7d5d6b

                  SHA512

                  c02e8b0c057dd7d2643f4b2a7995478fb4550f17807afe4eed1cb8d30b777d823246ea38e77644f90e879151b7907e699c55d7fdb9a396a43038c6573ef6aee1

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\datareporting\glean\pending_pings\73c6dfd5-664b-464d-a266-ee290f66e667

                  Filesize

                  982B

                  MD5

                  c6886a50b15569e9867f8ea7606d4aa6

                  SHA1

                  d6041280d642bf69462c08825ecff76d29cc2714

                  SHA256

                  4aecf6f6d0d9808e567c8b7880958f7093c383c0adb8a8d86241340a5e2328a4

                  SHA512

                  11f73afd44489ca08f0df62731987a995c9bcf659a015218bc787f1877a6ae75582abfb17b13ab7c9aa8a36c20a0210579ab73d15a7ab913bbc9b84d969fcd7a

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

                  Filesize

                  1.1MB

                  MD5

                  842039753bf41fa5e11b3a1383061a87

                  SHA1

                  3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                  SHA256

                  d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                  SHA512

                  d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

                  Filesize

                  116B

                  MD5

                  2a461e9eb87fd1955cea740a3444ee7a

                  SHA1

                  b10755914c713f5a4677494dbe8a686ed458c3c5

                  SHA256

                  4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                  SHA512

                  34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

                  Filesize

                  372B

                  MD5

                  bf957ad58b55f64219ab3f793e374316

                  SHA1

                  a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                  SHA256

                  bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                  SHA512

                  79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

                  Filesize

                  17.8MB

                  MD5

                  daf7ef3acccab478aaa7d6dc1c60f865

                  SHA1

                  f8246162b97ce4a945feced27b6ea114366ff2ad

                  SHA256

                  bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                  SHA512

                  5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\prefs-1.js

                  Filesize

                  11KB

                  MD5

                  a20ab62f51c761924a69dce22b5023c5

                  SHA1

                  0ccbc0d3f29a3fba2fffef60649db41d69636173

                  SHA256

                  8337b35da143271985e14365541899281e50d82e29f50b49e3ca07f2dd00e8f2

                  SHA512

                  7af2882023fb606acdbbbeda7f6730c8cf7061790f4190af8ce142828d154ca3dbb51793a124628701be16f8b8e2ab757cff1f44a71a3965eb646637b000f579

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\prefs-1.js

                  Filesize

                  15KB

                  MD5

                  f2dea41fd7a5b2871ce814907e89c188

                  SHA1

                  6deeed2641e25406bdf2f3f8f40bf019ffa8bf25

                  SHA256

                  059f47778d0f22b6756aed3e85c7928cfc57a7e3a5713550103527e55f14a7b6

                  SHA512

                  988c46462aee4386895dcc84cb1822557c78649b9bc4e77de8e2d430e0c38ec70ff6481a37dbf385cb2f073c9eeb97e2877020f195719e2a8b15b22e26812025

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\prefs.js

                  Filesize

                  11KB

                  MD5

                  98e5abbbdd0196b50afb1b8eaec859f8

                  SHA1

                  c30bbf0f3982ead5f631e5b2cad8cafe2cbc3b22

                  SHA256

                  22db5a1c51ccf0f597ebfac68c961ac78a6785f0d2d8d2888397c3c393ab3e4e

                  SHA512

                  95a73012d7950cb9d2e2e069a6fd3aac744143c074ae6acdfd540e98e9338ff3e010726314726922409678ae311cde41467564c6d5982ea087d15763399b10e5

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\prefs.js

                  Filesize

                  10KB

                  MD5

                  06a1e4b47a6324f0ce7b1a7d8e0ba30e

                  SHA1

                  0d1f0e1158e5b889e32a22df3ab3f23e667dc71a

                  SHA256

                  bb8bef93937bebd9410ec913a90d3f08b325ceeb10a8ffa44a720c46a881bcb7

                  SHA512

                  48aed253f2c39fcde368c03189ba314fcdebe5398c14c3fc85c9eec96efca6c9a5a895da42ce80e0eb679d8f94728e2b9ab91de46d8c96e2be0f6e35f2b5e2eb

                • memory/456-1801-0x0000000000F00000-0x00000000013A8000-memory.dmp

                  Filesize

                  4.7MB

                • memory/456-2906-0x0000000000F00000-0x00000000013A8000-memory.dmp

                  Filesize

                  4.7MB

                • memory/456-61-0x0000000000F00000-0x00000000013A8000-memory.dmp

                  Filesize

                  4.7MB

                • memory/456-2910-0x0000000000F00000-0x00000000013A8000-memory.dmp

                  Filesize

                  4.7MB

                • memory/456-20-0x0000000000F00000-0x00000000013A8000-memory.dmp

                  Filesize

                  4.7MB

                • memory/456-19-0x0000000000F01000-0x0000000000F2F000-memory.dmp

                  Filesize

                  184KB

                • memory/456-46-0x0000000000F00000-0x00000000013A8000-memory.dmp

                  Filesize

                  4.7MB

                • memory/456-18-0x0000000000F00000-0x00000000013A8000-memory.dmp

                  Filesize

                  4.7MB

                • memory/456-2909-0x0000000000F00000-0x00000000013A8000-memory.dmp

                  Filesize

                  4.7MB

                • memory/456-2908-0x0000000000F00000-0x00000000013A8000-memory.dmp

                  Filesize

                  4.7MB

                • memory/456-45-0x0000000000F00000-0x00000000013A8000-memory.dmp

                  Filesize

                  4.7MB

                • memory/456-634-0x0000000000F00000-0x00000000013A8000-memory.dmp

                  Filesize

                  4.7MB

                • memory/456-44-0x0000000000F00000-0x00000000013A8000-memory.dmp

                  Filesize

                  4.7MB

                • memory/456-2900-0x0000000000F00000-0x00000000013A8000-memory.dmp

                  Filesize

                  4.7MB

                • memory/456-444-0x0000000000F00000-0x00000000013A8000-memory.dmp

                  Filesize

                  4.7MB

                • memory/456-65-0x0000000000F00000-0x00000000013A8000-memory.dmp

                  Filesize

                  4.7MB

                • memory/456-2789-0x0000000000F00000-0x00000000013A8000-memory.dmp

                  Filesize

                  4.7MB

                • memory/456-32-0x0000000000F00000-0x00000000013A8000-memory.dmp

                  Filesize

                  4.7MB

                • memory/456-22-0x0000000000F00000-0x00000000013A8000-memory.dmp

                  Filesize

                  4.7MB

                • memory/456-2911-0x0000000000F00000-0x00000000013A8000-memory.dmp

                  Filesize

                  4.7MB

                • memory/456-467-0x0000000000F00000-0x00000000013A8000-memory.dmp

                  Filesize

                  4.7MB

                • memory/456-21-0x0000000000F00000-0x00000000013A8000-memory.dmp

                  Filesize

                  4.7MB

                • memory/456-2914-0x0000000000F00000-0x00000000013A8000-memory.dmp

                  Filesize

                  4.7MB

                • memory/456-2920-0x0000000000F00000-0x00000000013A8000-memory.dmp

                  Filesize

                  4.7MB

                • memory/1492-2899-0x0000000000F00000-0x00000000013A8000-memory.dmp

                  Filesize

                  4.7MB

                • memory/1492-2897-0x0000000000F00000-0x00000000013A8000-memory.dmp

                  Filesize

                  4.7MB

                • memory/1916-1-0x0000000077C04000-0x0000000077C06000-memory.dmp

                  Filesize

                  8KB

                • memory/1916-2-0x0000000000C81000-0x0000000000CAF000-memory.dmp

                  Filesize

                  184KB

                • memory/1916-3-0x0000000000C80000-0x0000000001128000-memory.dmp

                  Filesize

                  4.7MB

                • memory/1916-17-0x0000000000C80000-0x0000000001128000-memory.dmp

                  Filesize

                  4.7MB

                • memory/1916-4-0x0000000000C80000-0x0000000001128000-memory.dmp

                  Filesize

                  4.7MB

                • memory/1916-0-0x0000000000C80000-0x0000000001128000-memory.dmp

                  Filesize

                  4.7MB

                • memory/2376-2913-0x0000000000F00000-0x00000000013A8000-memory.dmp

                  Filesize

                  4.7MB

                • memory/2592-463-0x0000000000010000-0x00000000002C8000-memory.dmp

                  Filesize

                  2.7MB

                • memory/2592-466-0x0000000000010000-0x00000000002C8000-memory.dmp

                  Filesize

                  2.7MB

                • memory/2592-438-0x0000000000010000-0x00000000002C8000-memory.dmp

                  Filesize

                  2.7MB

                • memory/2592-419-0x0000000000010000-0x00000000002C8000-memory.dmp

                  Filesize

                  2.7MB

                • memory/2592-437-0x0000000000010000-0x00000000002C8000-memory.dmp

                  Filesize

                  2.7MB

                • memory/2892-66-0x0000000000670000-0x0000000000B0F000-memory.dmp

                  Filesize

                  4.6MB

                • memory/2892-41-0x0000000000670000-0x0000000000B0F000-memory.dmp

                  Filesize

                  4.6MB

                • memory/3408-62-0x0000000000680000-0x0000000000D25000-memory.dmp

                  Filesize

                  6.6MB

                • memory/3408-64-0x0000000000680000-0x0000000000D25000-memory.dmp

                  Filesize

                  6.6MB

                • memory/3544-33-0x0000000000F00000-0x00000000013A8000-memory.dmp

                  Filesize

                  4.7MB

                • memory/3544-43-0x0000000000F00000-0x00000000013A8000-memory.dmp

                  Filesize

                  4.7MB