Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/10/2024, 16:05

General

  • Target

    file.exe

  • Size

    2.8MB

  • MD5

    2fd54006eccf616064ee4979b41760b8

  • SHA1

    4bebf7fa013315bac837fd46b2485ff7b55f3216

  • SHA256

    c38886a100f7154572ddbe90a5dd13abf091454cd5ba2defda9111fd6a743b65

  • SHA512

    5097a3832f6e817fd3f1772c05e98a0648e51b6c7ddadeff6cff396e8cf38fb8834b4fc278021cbb9bb85e157770c018d7d3f943569d75312c48d653ea07f829

  • SSDEEP

    49152:7HOBwBPmFd7W15DzNF7zb3S8n0q+ISi+Z+K:SBcmTk5re8n1Si+t

Malware Config

Extracted

Family

lumma

C2

https://clearancek.site

https://licendfilteo.site

https://spirittunek.store

https://bathdoomgaz.store

https://studennotediw.store

https://dissapoiznw.store

https://eaglepawnoy.store

https://mobbipenju.store

Extracted

Family

stealc

Botnet

doma

C2

http://185.215.113.37

Attributes
  • url_path

    /e2b1563c6670f193.php

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 9 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 18 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 9 IoCs
  • Identifies Wine through registry keys 2 TTPs 9 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 27 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of FindShellTrayWindow 22 IoCs
  • Suspicious use of SendNotifyMessage 20 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1408
    • C:\Users\Admin\AppData\Local\Temp\WS73QESDCSIV5YPP0A4BBGD.exe
      "C:\Users\Admin\AppData\Local\Temp\WS73QESDCSIV5YPP0A4BBGD.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:2748
    • C:\Users\Admin\AppData\Local\Temp\ZHVZBLYIQ2B94PX940U3.exe
      "C:\Users\Admin\AppData\Local\Temp\ZHVZBLYIQ2B94PX940U3.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:2628
      • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
        "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Checks computer location settings
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Adds Run key to start application
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:2172
        • C:\Users\Admin\AppData\Local\Temp\1000336001\num.exe
          "C:\Users\Admin\AppData\Local\Temp\1000336001\num.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2268
        • C:\Users\Admin\AppData\Local\Temp\1000349001\3d5cf7a029.exe
          "C:\Users\Admin\AppData\Local\Temp\1000349001\3d5cf7a029.exe"
          4⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:4104
        • C:\Users\Admin\1000350002\9dd56ba41a.exe
          "C:\Users\Admin\1000350002\9dd56ba41a.exe"
          4⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:4060
        • C:\Users\Admin\AppData\Local\Temp\1000357001\3f54d1bdbb.exe
          "C:\Users\Admin\AppData\Local\Temp\1000357001\3f54d1bdbb.exe"
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Windows security modification
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3860
        • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
          "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
          4⤵
            PID:1416
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -exec bypass -f "C:\Users\Admin\AppData\Local\Temp\PNQON4VI35X271AL8FWH9.ps1"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3988
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1236
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd
            4⤵
            • Checks processor information in registry
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:4988
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2004 -parentBuildID 20240401114208 -prefsHandle 1940 -prefMapHandle 1896 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {784842f2-c736-40df-81b7-3298e77817c8} 4988 "\\.\pipe\gecko-crash-server-pipe.4988" gpu
              5⤵
                PID:2696
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2448 -parentBuildID 20240401114208 -prefsHandle 2440 -prefMapHandle 2436 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1e863d54-4c65-4cd7-b30c-6c6d0d1bb4c5} 4988 "\\.\pipe\gecko-crash-server-pipe.4988" socket
                5⤵
                  PID:3812
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3360 -childID 1 -isForBrowser -prefsHandle 3492 -prefMapHandle 3516 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1276 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7d4ec14b-8ca3-4caa-9f56-3f731531d9e5} 4988 "\\.\pipe\gecko-crash-server-pipe.4988" tab
                  5⤵
                    PID:3480
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3020 -childID 2 -isForBrowser -prefsHandle 3688 -prefMapHandle 3684 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1276 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {51d88174-cb22-4797-b59a-64bc52d6f9ea} 4988 "\\.\pipe\gecko-crash-server-pipe.4988" tab
                    5⤵
                      PID:4512
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4528 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4712 -prefMapHandle 4792 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7b149b37-48c3-411e-869d-62bae5af4ed1} 4988 "\\.\pipe\gecko-crash-server-pipe.4988" utility
                      5⤵
                      • Checks processor information in registry
                      PID:4940
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5384 -childID 3 -isForBrowser -prefsHandle 5376 -prefMapHandle 5372 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1276 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {67e64b21-c33a-415b-94ce-395af441cc0b} 4988 "\\.\pipe\gecko-crash-server-pipe.4988" tab
                      5⤵
                        PID:3644
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5524 -childID 4 -isForBrowser -prefsHandle 5352 -prefMapHandle 5392 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1276 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {907847bd-3b60-4d3a-9ffc-4bbb6f14769e} 4988 "\\.\pipe\gecko-crash-server-pipe.4988" tab
                        5⤵
                          PID:4976
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5788 -childID 5 -isForBrowser -prefsHandle 5708 -prefMapHandle 5712 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1276 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {493ad646-6d74-4b9a-a75b-6d706092459d} 4988 "\\.\pipe\gecko-crash-server-pipe.4988" tab
                          5⤵
                            PID:5012
                  • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                    C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                    1⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Identifies Wine through registry keys
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • Suspicious behavior: EnumeratesProcesses
                    PID:4184
                  • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                    C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                    1⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Identifies Wine through registry keys
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • Suspicious behavior: EnumeratesProcesses
                    PID:4052

                  Network

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\lhmx4teg.default-release\activity-stream.discovery_stream.json

                    Filesize

                    19KB

                    MD5

                    9695f38bea31bcceca4ef969e6c69f7a

                    SHA1

                    3dd3e856c17061d3fe077f43f906ee7379b86859

                    SHA256

                    4eb98f740e318d9ff6f73f1a19b0342ac8ba27610d2417ec211c99c424573a76

                    SHA512

                    07dcd9156fdf697752d8d90606cfe737d2737c03833de239a6a32600c561fedb2da7abb78f686e5668721a3e68247e79b053f50882fe32b7e1cce911e10a430b

                  • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\lhmx4teg.default-release\cache2\entries\0305BF7FE660AF5F32B4319E4C7EF7A7B70257A3

                    Filesize

                    13KB

                    MD5

                    0b833f18b8b8befe82b865f42ff07155

                    SHA1

                    49bb8ff493eaa4c4c2046b87e38963a6c090b1d6

                    SHA256

                    dc92167bb759b05a58eac722cfbfe3a55045061b483b309124e11196de355abe

                    SHA512

                    0e2c9c20cd2c9b667db4129f83c029b005aaa33e32f41156059b8b8bc7b62a3490e61f7dd221345e25885dcd54ccf73e60f4373711fdcb6a4982aef035892e3e

                  • C:\Users\Admin\AppData\Local\Temp\1000336001\num.exe

                    Filesize

                    307KB

                    MD5

                    791fcee57312d4a20cc86ae1cea8dfc4

                    SHA1

                    04a88c60ae1539a63411fe4765e9b931e8d2d992

                    SHA256

                    27e4a3627d7df2b22189dd4bebc559ae1986d49a8f4e35980b428fadb66cf23d

                    SHA512

                    2771d4e7b272bf770efad22c9fb1dfafe10cbbf009df931f091fb543e3132c0efda16acb5b515452e9e67e8b1fc8fe8aedd1376c236061385f026865cdc28d2c

                  • C:\Users\Admin\AppData\Local\Temp\1000349001\3d5cf7a029.exe

                    Filesize

                    2.8MB

                    MD5

                    2fd54006eccf616064ee4979b41760b8

                    SHA1

                    4bebf7fa013315bac837fd46b2485ff7b55f3216

                    SHA256

                    c38886a100f7154572ddbe90a5dd13abf091454cd5ba2defda9111fd6a743b65

                    SHA512

                    5097a3832f6e817fd3f1772c05e98a0648e51b6c7ddadeff6cff396e8cf38fb8834b4fc278021cbb9bb85e157770c018d7d3f943569d75312c48d653ea07f829

                  • C:\Users\Admin\AppData\Local\Temp\1000357001\3f54d1bdbb.exe

                    Filesize

                    1.7MB

                    MD5

                    113687df6ca6e8c095e3e825c96dc913

                    SHA1

                    a0ac404cf93307659109b7f2562a94872367c9cb

                    SHA256

                    24a8e73da64f6db65d5efeea2cec3cea1c4e84047be81f624ab99da95352e5e8

                    SHA512

                    cfffb14cf7ab7a86dd2d24bc40cfadd25a43bba0125c2c9ca7a98a454922a7f1164f554fdbdb8b008f303eb2dba09db6d697dd46b371004540a7e2539462bdfd

                  • C:\Users\Admin\AppData\Local\Temp\PNQON4VI35X271AL8FWH9.ps1

                    Filesize

                    2KB

                    MD5

                    65d1b33f6758ea511e3ed01f2cb74e53

                    SHA1

                    efa0e4d34c0d9bc719ef98ed5e145d8e50164916

                    SHA256

                    233dc91536e57adbb2153512f56f098db701e43a7768508c9e9f290c952f1319

                    SHA512

                    2772e2659aa2ffb6f86b1198d2a1652d7cb7a07ccfb249a96f7cb649594ba5ab1cc44389d505c9aca9f6ad9afda59d2abc565db5ae89b77f675155afe069103d

                  • C:\Users\Admin\AppData\Local\Temp\WS73QESDCSIV5YPP0A4BBGD.exe

                    Filesize

                    1.8MB

                    MD5

                    c624b00a72136d050eef71725725bf69

                    SHA1

                    7d840eef1b45eac617a1e4edb336cb57d66af662

                    SHA256

                    63956c5f5dc0bf055f901d4663b0714668654ef4f15002db5b5fb30fb9cb7ed1

                    SHA512

                    6e7d4a6d95b50ca97df05604e33b11bcf911198704711d49c8f0e7d7246e13bb61eda8a44373416afa69a36c57285c80bd9137f9b36c249bc1c39076d3d2fbb9

                  • C:\Users\Admin\AppData\Local\Temp\ZHVZBLYIQ2B94PX940U3.exe

                    Filesize

                    1.8MB

                    MD5

                    79ca7361906a5892d57b7d01f1821438

                    SHA1

                    92f3437c94cdf864a163355b66ba7fd3edbc0873

                    SHA256

                    c62fe595a10754207aacf8f8b1dedc66da50bedbd171b2f5c1aa1ca10b850b05

                    SHA512

                    889d8d3e686371b673f8f78fe3504bd5d191aefab3e7f5def36369d403ab93d5115be3f952b41ba6571844e3895303cc3d418656dcdde26d5cdbcf2cff13027f

                  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ntkb4hnv.ctc.ps1

                    Filesize

                    60B

                    MD5

                    d17fe0a3f47be24a6453e9ef58c94641

                    SHA1

                    6ab83620379fc69f80c0242105ddffd7d98d5d9d

                    SHA256

                    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                    SHA512

                    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                  • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                    Filesize

                    479KB

                    MD5

                    09372174e83dbbf696ee732fd2e875bb

                    SHA1

                    ba360186ba650a769f9303f48b7200fb5eaccee1

                    SHA256

                    c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                    SHA512

                    b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                  • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                    Filesize

                    13.8MB

                    MD5

                    0a8747a2ac9ac08ae9508f36c6d75692

                    SHA1

                    b287a96fd6cc12433adb42193dfe06111c38eaf0

                    SHA256

                    32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                    SHA512

                    59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\AlternateServices.bin

                    Filesize

                    7KB

                    MD5

                    cabd7f4d55ae3ca23f48ebde81eda114

                    SHA1

                    5dc368665935bd2b2c28fcdf4f1b0be415dbf9da

                    SHA256

                    7255ee60f8604595a0e7863b61a765fa33e58bb13029e160a0a456ad84a429c8

                    SHA512

                    08074d69f11fe98ad6ab6791fa52f18da4faa788ffeecd0730b15514515c780af43391c1c03e70e07c3967c7827b6f2b0ab9b3d4ac9cc37f8ebdd38ea6a7a4a3

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\AlternateServices.bin

                    Filesize

                    13KB

                    MD5

                    0534bf57687c846202dbb4729a6ca8eb

                    SHA1

                    52572677ce063c0addea36f84abd58a1e695dd02

                    SHA256

                    25b15f564c0122f1eb5ff2f89d6b1ede2070289063c828811c9bd8b912be4582

                    SHA512

                    cd7cabd1fefb0f84c620f3e27fa1ba7c569631a9616e2349a65a31959554a9aa03f4ad6edab5a7ec014505c664f9c9940bd615b5263753accec0ec0909744a42

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\datareporting\glean\db\data.safe.tmp

                    Filesize

                    5KB

                    MD5

                    f29e58a09e05ea5653b8a2f2f1237b13

                    SHA1

                    cf75ef2d647e703ee8f85ec65b25724c51027637

                    SHA256

                    c19793324fc6292c9326a41fdb71a79471d433e82202c31bfaffc262bef14893

                    SHA512

                    33c4c62e8879a664efdd62f8566262e249aea0e2d248d22b0508f9a3db05ece4770322c1e9e97c74b8b5f99dffeb0d86b7add6e01e46f14bd4f8a68ccae2cac9

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\datareporting\glean\db\data.safe.tmp

                    Filesize

                    6KB

                    MD5

                    d89aceac59cf57a011305fe4887902b7

                    SHA1

                    17f39cf79ca860815382323bda81cf17752566ce

                    SHA256

                    f601031013775964efd38a20098011ba028864e09bf329d0205fb02b5cd72368

                    SHA512

                    e0db3b8c3084d285917208b51e57256b64ef19406743df9d4eb697e90814de5b9ebc7ad61a046f5af9191da998c7743ae7f8c8f69777eaf55264e4390651abe7

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\datareporting\glean\db\data.safe.tmp

                    Filesize

                    15KB

                    MD5

                    370c8b9d92d4984f2668938f67f1bcb6

                    SHA1

                    8c6504c5e18485f42a4ff17c84b5340483c7f78d

                    SHA256

                    436c3e328a511e6fdff269a62d9f0fcf34e33220e4a9c9fd05c1b111dd923709

                    SHA512

                    aa2af2356e590de7e00416e54557c044931ebe342dfc118bb2bcbeefb9eb8595224bcfc6d64361257ff0495167c7a187e561a1ac482b6fa605e5e795c07f699f

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\datareporting\glean\pending_pings\0f7f96a6-afdb-4d5a-a55f-9f62cc6ec8b1

                    Filesize

                    671B

                    MD5

                    706cf5940d318fe1f7b32aeeaea4c8e6

                    SHA1

                    e035370fe95df0d6cfac4ab7c265f66c6fb6144b

                    SHA256

                    8bd9adc2b6c3213c84c0d18823c693652ca218d4505a981a3a517b6900e52600

                    SHA512

                    aff1c6e7f020fd2843bbf47a95978a129d3cf9ccacd9c230dee8751bffe5f6d2b03d04a3c685ad4468431165e0d9c92022e1943b02e1adc4236ee2fd5e8da7d3

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\datareporting\glean\pending_pings\54290ea1-0361-4267-8340-8ef0a358ce83

                    Filesize

                    982B

                    MD5

                    098dc0631b73ae28298d8e43de80c461

                    SHA1

                    e669f4965f4cbef26f9c78726f55a72cccbec95a

                    SHA256

                    5193d8cef68353e5d0b61b5a91b297cd53764077f47549970172e29a70a62fb6

                    SHA512

                    ef38f31777907ed69247f4685c805ac3e6a6866e7266b6626c6c5e987a601acefd54fc7a45af20458c4922ff2385cee95c62b66bdd56d4651956f806195195d1

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\datareporting\glean\pending_pings\e4308f11-3da1-4970-9a0d-a2e26b99729e

                    Filesize

                    26KB

                    MD5

                    ea349e3a267390550b448fa6950fbf1f

                    SHA1

                    b96b8962940bb35ab87924db0fe4be3076050054

                    SHA256

                    0ab4263e5ed148babf3f1386fdcecd8bac3d7a4aea1d2ec8da46aff43807c63f

                    SHA512

                    84a3f1841efdd35c923ea292cbaf90b1010f42a150d6a73b42f5822b45d950f96629f52b279b90e3c1280d63a4296e79910f7aa0b38227c09f446ded83af358b

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

                    Filesize

                    1.1MB

                    MD5

                    842039753bf41fa5e11b3a1383061a87

                    SHA1

                    3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                    SHA256

                    d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                    SHA512

                    d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

                    Filesize

                    116B

                    MD5

                    2a461e9eb87fd1955cea740a3444ee7a

                    SHA1

                    b10755914c713f5a4677494dbe8a686ed458c3c5

                    SHA256

                    4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                    SHA512

                    34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

                    Filesize

                    372B

                    MD5

                    bf957ad58b55f64219ab3f793e374316

                    SHA1

                    a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                    SHA256

                    bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                    SHA512

                    79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

                    Filesize

                    17.8MB

                    MD5

                    daf7ef3acccab478aaa7d6dc1c60f865

                    SHA1

                    f8246162b97ce4a945feced27b6ea114366ff2ad

                    SHA256

                    bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                    SHA512

                    5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\prefs-1.js

                    Filesize

                    12KB

                    MD5

                    b134aa9503094b885ad399151f63b5a5

                    SHA1

                    44a8acf959dc004b28f47d36ab3f8d2baca38f82

                    SHA256

                    a90bd371731b74e4f0a5ebb3e815125655d627a9c3e0e5b70645cad58b4ed5e4

                    SHA512

                    f009e288de7172be9bdcb6cb738776b52adfb71c8505492de1d67fc6f4410a079c0c3cbe76abdc9656d1e1c995d151521b75130da2cda5aced93822b2d5b384d

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\prefs-1.js

                    Filesize

                    16KB

                    MD5

                    eeeb4bb663cbb4eff65cb0a010e57782

                    SHA1

                    407cf9ace2d980948edd9846a0ff8b30bd407ac8

                    SHA256

                    ae182730b9fa85802c9bc3190cb030e10c54d0df5964246543263339fcb2b794

                    SHA512

                    00a67177897bda23d0ca2c09728910b3b9af601c81ae5ee310609ef10b90bafbd8489a1d4fe0a2e04fa5e46c579bea70ea971e28a3bd7bd5dbf2c9a90634b1ab

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\prefs.js

                    Filesize

                    10KB

                    MD5

                    50905dd04afad1b12524ee9990565525

                    SHA1

                    755dbc93e2d4a94607b639ab7490355d8246c28b

                    SHA256

                    489e6b6e6243ac17a8e53c64b23862f442de73d6b2b6786c038c63a98dd852f9

                    SHA512

                    c07c5fd38a689158faa647f665f832ce5ef04da76f0d19c48102177df3fc8a57b8f751ebc37f0207b48d6bfa9a69f443a0c9214640acd71a52f0cba48af14247

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

                    Filesize

                    2.3MB

                    MD5

                    30b19b821de17c3760945beed059d843

                    SHA1

                    b0390c9bbd43b766a0dbb23fd68775044e1e2dd8

                    SHA256

                    72bac5c4cb8b462df9cbc00efc244574bc7ae6676e102b3884fd58547921bea5

                    SHA512

                    ffbcbc3da7307842d72df69c6fefafc82bed495702d20880c3cdd79031c1a81f14a5636bfe195a26b12846a353512a3d1128c65e4d4c68fdbfe5cd889ac496ca

                  • memory/1408-9-0x0000000000310000-0x0000000000623000-memory.dmp

                    Filesize

                    3.1MB

                  • memory/1408-10-0x0000000000310000-0x0000000000623000-memory.dmp

                    Filesize

                    3.1MB

                  • memory/1408-8-0x0000000000310000-0x0000000000623000-memory.dmp

                    Filesize

                    3.1MB

                  • memory/1408-4-0x0000000000310000-0x0000000000623000-memory.dmp

                    Filesize

                    3.1MB

                  • memory/1408-7-0x0000000000310000-0x0000000000623000-memory.dmp

                    Filesize

                    3.1MB

                  • memory/1408-3-0x0000000000310000-0x0000000000623000-memory.dmp

                    Filesize

                    3.1MB

                  • memory/1408-5-0x0000000000310000-0x0000000000623000-memory.dmp

                    Filesize

                    3.1MB

                  • memory/1408-6-0x0000000000310000-0x0000000000623000-memory.dmp

                    Filesize

                    3.1MB

                  • memory/1408-26-0x0000000000310000-0x0000000000623000-memory.dmp

                    Filesize

                    3.1MB

                  • memory/1408-1-0x0000000077854000-0x0000000077856000-memory.dmp

                    Filesize

                    8KB

                  • memory/1408-0-0x0000000000310000-0x0000000000623000-memory.dmp

                    Filesize

                    3.1MB

                  • memory/1408-2-0x0000000000311000-0x0000000000337000-memory.dmp

                    Filesize

                    152KB

                  • memory/2172-3123-0x0000000000620000-0x0000000000AEF000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/2172-1062-0x0000000000620000-0x0000000000AEF000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/2172-479-0x0000000000620000-0x0000000000AEF000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/2172-2741-0x0000000000620000-0x0000000000AEF000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/2172-3134-0x0000000000620000-0x0000000000AEF000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/2172-3117-0x0000000000620000-0x0000000000AEF000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/2172-61-0x0000000000620000-0x0000000000AEF000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/2172-3133-0x0000000000620000-0x0000000000AEF000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/2172-3125-0x0000000000620000-0x0000000000AEF000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/2172-3132-0x0000000000620000-0x0000000000AEF000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/2172-3126-0x0000000000620000-0x0000000000AEF000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/2172-3127-0x0000000000620000-0x0000000000AEF000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/2172-441-0x0000000000620000-0x0000000000AEF000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/2268-428-0x0000000000F80000-0x00000000011E1000-memory.dmp

                    Filesize

                    2.4MB

                  • memory/2268-427-0x0000000000F80000-0x00000000011E1000-memory.dmp

                    Filesize

                    2.4MB

                  • memory/2628-29-0x0000000000570000-0x0000000000A3F000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/2628-60-0x0000000000570000-0x0000000000A3F000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/2628-23-0x0000000000570000-0x0000000000A3F000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/2628-28-0x0000000000571000-0x000000000059F000-memory.dmp

                    Filesize

                    184KB

                  • memory/2628-32-0x0000000000570000-0x0000000000A3F000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/2748-18-0x0000000000C10000-0x00000000012AC000-memory.dmp

                    Filesize

                    6.6MB

                  • memory/2748-14-0x0000000000C10000-0x00000000012AC000-memory.dmp

                    Filesize

                    6.6MB

                  • memory/2748-16-0x0000000000C11000-0x0000000000C34000-memory.dmp

                    Filesize

                    140KB

                  • memory/2748-17-0x0000000000C10000-0x00000000012AC000-memory.dmp

                    Filesize

                    6.6MB

                  • memory/3860-741-0x0000000000290000-0x00000000006F2000-memory.dmp

                    Filesize

                    4.4MB

                  • memory/3860-761-0x0000000000290000-0x00000000006F2000-memory.dmp

                    Filesize

                    4.4MB

                  • memory/3860-762-0x0000000000290000-0x00000000006F2000-memory.dmp

                    Filesize

                    4.4MB

                  • memory/3860-2220-0x0000000000290000-0x00000000006F2000-memory.dmp

                    Filesize

                    4.4MB

                  • memory/3860-2372-0x0000000000290000-0x00000000006F2000-memory.dmp

                    Filesize

                    4.4MB

                  • memory/3988-67-0x00000000062A0000-0x00000000062C2000-memory.dmp

                    Filesize

                    136KB

                  • memory/3988-65-0x0000000006CC0000-0x0000000006D56000-memory.dmp

                    Filesize

                    600KB

                  • memory/3988-35-0x00000000027E0000-0x00000000027F0000-memory.dmp

                    Filesize

                    64KB

                  • memory/3988-34-0x0000000004EC0000-0x00000000054E8000-memory.dmp

                    Filesize

                    6.2MB

                  • memory/3988-33-0x00000000027E0000-0x00000000027F0000-memory.dmp

                    Filesize

                    64KB

                  • memory/3988-27-0x0000000074CFE000-0x0000000074CFF000-memory.dmp

                    Filesize

                    4KB

                  • memory/3988-68-0x0000000007310000-0x00000000078B4000-memory.dmp

                    Filesize

                    5.6MB

                  • memory/3988-36-0x0000000004E60000-0x0000000004E82000-memory.dmp

                    Filesize

                    136KB

                  • memory/3988-38-0x00000000056D0000-0x0000000005736000-memory.dmp

                    Filesize

                    408KB

                  • memory/3988-30-0x0000000002720000-0x0000000002756000-memory.dmp

                    Filesize

                    216KB

                  • memory/3988-66-0x0000000006250000-0x000000000626A000-memory.dmp

                    Filesize

                    104KB

                  • memory/3988-37-0x0000000005660000-0x00000000056C6000-memory.dmp

                    Filesize

                    408KB

                  • memory/3988-62-0x0000000005D00000-0x0000000005D1E000-memory.dmp

                    Filesize

                    120KB

                  • memory/3988-63-0x0000000005D50000-0x0000000005D9C000-memory.dmp

                    Filesize

                    304KB

                  • memory/3988-48-0x0000000005840000-0x0000000005B94000-memory.dmp

                    Filesize

                    3.3MB

                  • memory/4052-3129-0x0000000000620000-0x0000000000AEF000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/4052-3131-0x0000000000620000-0x0000000000AEF000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/4060-624-0x0000000000C20000-0x00000000012BC000-memory.dmp

                    Filesize

                    6.6MB

                  • memory/4060-481-0x0000000000C20000-0x00000000012BC000-memory.dmp

                    Filesize

                    6.6MB

                  • memory/4104-457-0x0000000000BD0000-0x0000000000EE3000-memory.dmp

                    Filesize

                    3.1MB

                  • memory/4104-464-0x0000000000BD0000-0x0000000000EE3000-memory.dmp

                    Filesize

                    3.1MB

                  • memory/4184-1162-0x0000000000620000-0x0000000000AEF000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/4184-1104-0x0000000000620000-0x0000000000AEF000-memory.dmp

                    Filesize

                    4.8MB