Analysis

  • max time kernel
    142s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    30-10-2024 04:57

General

  • Target

    05fe4628ec1c9b88873bc3f3d3285657cc2b7bb7c380f9587009f09f1e55c6bd.exe

  • Size

    1.8MB

  • MD5

    b3d3107faf89ed1b14eba469e5f6442c

  • SHA1

    8c3ceda065d74eda75374cf6fd10bca04ac9a745

  • SHA256

    05fe4628ec1c9b88873bc3f3d3285657cc2b7bb7c380f9587009f09f1e55c6bd

  • SHA512

    e9f27839f957ad699f4cb6546e66805f47e8e924d576cb8bb200b5235bbf5bc47402177668d2a624b9b5ba5d277f8d69c5414e36a61c40fb91a644bcc536ae86

  • SSDEEP

    24576:zbvASigrLPOWtFShEsrZTD8UeNeDpDV5Wv/YUqivrJ64Pc6p9C+NrTh7K:gzQPFvyfTGNWpOvECE76fFT

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

stealc

Botnet

tale

C2

http://185.215.113.206

Attributes
  • url_path

    /6c4adf523b719729.php

Extracted

Family

lumma

C2

https://necklacedmny.store/api

https://founpiuer.store/api

https://navygenerayk.store/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Amadey family
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

  • Lumma family
  • Stealc

    Stealc is an infostealer written in C++.

  • Stealc family
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Downloads MZ/PE file
  • Uses browser remote debugging 2 TTPs 1 IoCs

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

  • Checks BIOS information in registry 2 TTPs 8 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 7 IoCs
  • Identifies Wine through registry keys 2 TTPs 4 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 14 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Kills process with taskkill 5 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of FindShellTrayWindow 15 IoCs
  • Suspicious use of SendNotifyMessage 13 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\05fe4628ec1c9b88873bc3f3d3285657cc2b7bb7c380f9587009f09f1e55c6bd.exe
    "C:\Users\Admin\AppData\Local\Temp\05fe4628ec1c9b88873bc3f3d3285657cc2b7bb7c380f9587009f09f1e55c6bd.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:1228
    • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
      "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2724
      • C:\Users\Admin\AppData\Local\Temp\1002431001\wintoolsone64.exe
        "C:\Users\Admin\AppData\Local\Temp\1002431001\wintoolsone64.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:2028
      • C:\Users\Admin\AppData\Local\Temp\1002474001\Session.exe
        "C:\Users\Admin\AppData\Local\Temp\1002474001\Session.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2904
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "powershell.exe" powershell -Command "Add-MpPreference -ExclusionPath 'C:\Lipras'; Add-MpPreference -ExclusionPath 'C:\Users'"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2412
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath C:\Lipras
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1132
      • C:\Users\Admin\AppData\Local\Temp\1002539001\c713e3bde0.exe
        "C:\Users\Admin\AppData\Local\Temp\1002539001\c713e3bde0.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:1916
      • C:\Users\Admin\AppData\Local\Temp\1002540001\090e9c32a4.exe
        "C:\Users\Admin\AppData\Local\Temp\1002540001\090e9c32a4.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Loads dropped DLL
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:872
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
          4⤵
          • Uses browser remote debugging
          • Enumerates system info in registry
          • Suspicious use of WriteProcessMemory
          PID:1872
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6809758,0x7fef6809768,0x7fef6809778
            5⤵
              PID:2848
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 872 -s 988
            4⤵
            • Loads dropped DLL
            • Program crash
            PID:3280
        • C:\Users\Admin\AppData\Local\Temp\1002541001\7ef385d5ba.exe
          "C:\Users\Admin\AppData\Local\Temp\1002541001\7ef385d5ba.exe"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:264
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /F /IM firefox.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:568
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /F /IM chrome.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:2040
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /F /IM msedge.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:1640
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /F /IM opera.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:1972
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /F /IM brave.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:2044
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:1144
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
              5⤵
              • Checks processor information in registry
              • Modifies registry class
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              PID:1516
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1516.0.1028746837\623842329" -parentBuildID 20221007134813 -prefsHandle 1216 -prefMapHandle 1208 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {129721a4-ea94-42ff-ac69-d324f883a6eb} 1516 "\\.\pipe\gecko-crash-server-pipe.1516" 1296 121f4858 gpu
                6⤵
                  PID:1628
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1516.1.1557633282\1549024532" -parentBuildID 20221007134813 -prefsHandle 1468 -prefMapHandle 1464 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b78dc440-789c-46db-87cc-77cb461807ef} 1516 "\\.\pipe\gecko-crash-server-pipe.1516" 1480 e72158 socket
                  6⤵
                    PID:3004
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1516.2.1204404382\63348027" -childID 1 -isForBrowser -prefsHandle 2088 -prefMapHandle 2084 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 860 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {39437afe-874b-4986-8d07-d29d679fdd87} 1516 "\\.\pipe\gecko-crash-server-pipe.1516" 2100 1a3d7358 tab
                    6⤵
                      PID:2588
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1516.3.113572283\1903753093" -childID 2 -isForBrowser -prefsHandle 2684 -prefMapHandle 2680 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 860 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {761697ed-7cea-4b67-ba93-423bf8c5ac34} 1516 "\\.\pipe\gecko-crash-server-pipe.1516" 2696 e69558 tab
                      6⤵
                        PID:1360
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1516.4.124173084\800878360" -childID 3 -isForBrowser -prefsHandle 3940 -prefMapHandle 3928 -prefsLen 26531 -prefMapSize 233444 -jsInitHandle 860 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {cabff96b-cab1-4885-81f2-02ad94ba4a73} 1516 "\\.\pipe\gecko-crash-server-pipe.1516" 3944 205a8d58 tab
                        6⤵
                          PID:884
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1516.5.2012167625\1303332837" -childID 4 -isForBrowser -prefsHandle 4040 -prefMapHandle 4048 -prefsLen 26531 -prefMapSize 233444 -jsInitHandle 860 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8f6be1d3-7c22-4d64-80cb-9695b0d11ad7} 1516 "\\.\pipe\gecko-crash-server-pipe.1516" 3960 211d5258 tab
                          6⤵
                            PID:2116
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1516.6.773994443\1329095902" -childID 5 -isForBrowser -prefsHandle 4220 -prefMapHandle 4224 -prefsLen 26531 -prefMapSize 233444 -jsInitHandle 860 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5d3366d6-044c-4241-bfa9-8edb04e93037} 1516 "\\.\pipe\gecko-crash-server-pipe.1516" 4208 211d5e58 tab
                            6⤵
                              PID:2552
                      • C:\Users\Admin\AppData\Local\Temp\1002542001\num.exe
                        "C:\Users\Admin\AppData\Local\Temp\1002542001\num.exe"
                        3⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        PID:1812

                  Network

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bhg31lui.default-release\activity-stream.discovery_stream.json.tmp

                    Filesize

                    35KB

                    MD5

                    2840f0e07f3c80b09430a1271ce30b3d

                    SHA1

                    4f1014424eb44e48cb8c56d4c98416596e5fa27d

                    SHA256

                    6c16d4c0c562c4efe64fafbec3ff3ec0dcaec4629e7a0d7c143e83e3a1480bc6

                    SHA512

                    c1705645ddf46e1f384364b0cdf73a732430f9a700377fa72ee15bb2200f75298c7225d42dd1efb9b8527fa32918cc4417b661f8765d7cd0cc24bc3426a87948

                  • C:\Users\Admin\AppData\Local\Temp\1002431001\wintoolsone64.exe

                    Filesize

                    11.3MB

                    MD5

                    3a408188540d593a618c37ff3b9fa378

                    SHA1

                    7298ef70541efda3185b81dbfada7f8c1998e75c

                    SHA256

                    883170fb01d121dd32d3de0c16f987429da0cf1d137e3ce6a92fef44947ae53a

                    SHA512

                    b2399171504df008ca2d3007d33858002c704cb0d892b78ea41e751051f8ccd96b8e887ba5c393daa4124132dce96daf631808d96e70b4a799b282f9133d477a

                  • C:\Users\Admin\AppData\Local\Temp\1002474001\Session.exe

                    Filesize

                    21KB

                    MD5

                    3ba35e9d091539ec658813e3d15e4b89

                    SHA1

                    3baf91a24418399f05d99206f8f004ae48d6a134

                    SHA256

                    aa133af788a57f91449a01402067a28f744172154f3a5d3f8d0d47f350037ec8

                    SHA512

                    a815b64909b9a81c39385c98f00666644d9f0281dcf53582752f84da1eaab3a76fb16d76ff4b47057bab0a9249eb3263bf7fecf88a554daa986c8935281393cd

                  • C:\Users\Admin\AppData\Local\Temp\1002539001\c713e3bde0.exe

                    Filesize

                    2.9MB

                    MD5

                    7f339d0252f408065abe57ac23eed91c

                    SHA1

                    1f07e6f292500fd235ec540cb56045a3081efa6d

                    SHA256

                    c94e84bee19b31c4663f8df36368ed87dd16e2021b5727a45c973ed8cf04dc0d

                    SHA512

                    b9e8c24fdce5011437d4080baf884065656c1f8d3760914580307ff0ada32b008c5e44e6b0ce4bbfd7f43471ddcd8ee1e82f2dd40d776afbaf7359c54033a4db

                  • C:\Users\Admin\AppData\Local\Temp\1002540001\090e9c32a4.exe

                    Filesize

                    2.0MB

                    MD5

                    0d30eb6a4023a6dce770ce3d6388cb9b

                    SHA1

                    83e8c18d4ad2b7c36d6699e7a9e25a7b552b9779

                    SHA256

                    7ea542ed634733c045e8d30777ae4f1c9a0a87d532f336158d36887483a6af7c

                    SHA512

                    a961fae055e2f8e69e8f0e2501b38d03282c522435e51d1a8c484c2997df0c571aae580d8c1d6e0efdf95fcd32686d0badca1a772250efc9e42941ae8eebe66f

                  • C:\Users\Admin\AppData\Local\Temp\1002541001\7ef385d5ba.exe

                    Filesize

                    898KB

                    MD5

                    90ea7d80c37af043396d189144583971

                    SHA1

                    baf234de90b9fcc4f4a13cad020b854faaecea91

                    SHA256

                    cdb7076e6706a7a45a01db49f26851d9b4682732fbb53f320111c48003d7379b

                    SHA512

                    e37fe88a8ea39d4fd339dbafb7215f68887b28ef3f833d6b2a2a837bbd3609cac523736e2aa5b48c206ea33e84d1689c8f3267913a06f2972a2829d49c2fa327

                  • C:\Users\Admin\AppData\Local\Temp\1002542001\num.exe

                    Filesize

                    868KB

                    MD5

                    f793d9e588c6bf51f1daf523ab2df1ce

                    SHA1

                    f63ce1f9eee9f3ae643e270c7fc854dc51d730d0

                    SHA256

                    a8addc675fcc27c94ff9e4775bb2e090f4da1287aae6b95cecc65ccf533bc61d

                    SHA512

                    4d0d8bf366f4b4793154f31aee4983df307b97edc83608b76628168418d48227eb46f6213469eb4d3a088d891a143b30b3b02acbb194df834da1b61d182607eb

                  • C:\Users\Admin\AppData\Local\Temp\CabE2B3.tmp

                    Filesize

                    70KB

                    MD5

                    49aebf8cbd62d92ac215b2923fb1b9f5

                    SHA1

                    1723be06719828dda65ad804298d0431f6aff976

                    SHA256

                    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

                    SHA512

                    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

                  • C:\Users\Admin\AppData\Local\Temp\TarE2C6.tmp

                    Filesize

                    181KB

                    MD5

                    4ea6026cf93ec6338144661bf1202cd1

                    SHA1

                    a1dec9044f750ad887935a01430bf49322fbdcb7

                    SHA256

                    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

                    SHA512

                    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

                  • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

                    Filesize

                    1.8MB

                    MD5

                    b3d3107faf89ed1b14eba469e5f6442c

                    SHA1

                    8c3ceda065d74eda75374cf6fd10bca04ac9a745

                    SHA256

                    05fe4628ec1c9b88873bc3f3d3285657cc2b7bb7c380f9587009f09f1e55c6bd

                    SHA512

                    e9f27839f957ad699f4cb6546e66805f47e8e924d576cb8bb200b5235bbf5bc47402177668d2a624b9b5ba5d277f8d69c5414e36a61c40fb91a644bcc536ae86

                  • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                    Filesize

                    442KB

                    MD5

                    85430baed3398695717b0263807cf97c

                    SHA1

                    fffbee923cea216f50fce5d54219a188a5100f41

                    SHA256

                    a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

                    SHA512

                    06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

                  • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                    Filesize

                    8.0MB

                    MD5

                    a01c5ecd6108350ae23d2cddf0e77c17

                    SHA1

                    c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

                    SHA256

                    345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

                    SHA512

                    b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

                  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

                    Filesize

                    7KB

                    MD5

                    fba263c60f966913d1c1e66efd1acb4a

                    SHA1

                    9c3440a3f2131794ce46835c6a6af08fd7e704fd

                    SHA256

                    ab9ae388ff9d68b2b4becb4699e0f2e85a30c2ff53cab27801d2d252ea5230d9

                    SHA512

                    7f366b4f05c97fc289bf78406386d90a27096bc5aa94b0e304c72fa29ab529c4cd964ee606c36defaed6f01acf6add975aac080f32385aa871136f0007ac7c8d

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhg31lui.default-release\datareporting\glean\db\data.safe.bin

                    Filesize

                    2KB

                    MD5

                    b3d8452d72530025c76436efa85aec9c

                    SHA1

                    b7aeee0a3057f8e6d2867b46d3303296957cc450

                    SHA256

                    ab11d5efe6e0ac935c07c65589909ca68dd2c0d59bf381df7e5b1cd91e2104bd

                    SHA512

                    9ede7995715048bdebc48df24bf7a42b59599a2f944830806abebee6a2944cda32ed1da7f6a30861a31834a6de12b98b4dfb65b72dad79bd94b87b27585a1756

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhg31lui.default-release\datareporting\glean\pending_pings\995cabd3-701c-4e5f-823c-a3a1eda30a2a

                    Filesize

                    745B

                    MD5

                    b6f4b7005a65f03981ea3d777f1e5531

                    SHA1

                    352ab68c06f68853bf63f8443a4a22279edf7d58

                    SHA256

                    bf15cc45e8b7f52b4c43f7baf413286a8f339cf62ed509a5204306a5445461dd

                    SHA512

                    c92226ad3ff51d6e141765a93338609d59941c21fb4cb8486e235f14321a532e9ed97fa58baa60aa8e261a3876bb32d1343c7cd277ad51fd2b25c151c4abbf42

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhg31lui.default-release\datareporting\glean\pending_pings\9e711724-342f-4b28-aef8-b7af02937228

                    Filesize

                    12KB

                    MD5

                    84f1f67e6f69061f82a8d03b32a0537a

                    SHA1

                    032cd2e92581d0127005fa5bec4952c807d7f1c6

                    SHA256

                    de3c49409cb4bc16993e42edd0b7d4c6a110859874352b4900a986b8b504779b

                    SHA512

                    20a984cfb3b4ec6a6399a57c057b610dc180cb2ddee03fe531a29943883db05a1579293bbfae06c7baaf8af79aa2fe9e1cd129d472e12162862d23573c4126a6

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhg31lui.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

                    Filesize

                    997KB

                    MD5

                    fe3355639648c417e8307c6d051e3e37

                    SHA1

                    f54602d4b4778da21bc97c7238fc66aa68c8ee34

                    SHA256

                    1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

                    SHA512

                    8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhg31lui.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

                    Filesize

                    116B

                    MD5

                    3d33cdc0b3d281e67dd52e14435dd04f

                    SHA1

                    4db88689282fd4f9e9e6ab95fcbb23df6e6485db

                    SHA256

                    f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

                    SHA512

                    a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhg31lui.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

                    Filesize

                    479B

                    MD5

                    49ddb419d96dceb9069018535fb2e2fc

                    SHA1

                    62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

                    SHA256

                    2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

                    SHA512

                    48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhg31lui.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

                    Filesize

                    372B

                    MD5

                    8be33af717bb1b67fbd61c3f4b807e9e

                    SHA1

                    7cf17656d174d951957ff36810e874a134dd49e0

                    SHA256

                    e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

                    SHA512

                    6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhg31lui.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

                    Filesize

                    11.8MB

                    MD5

                    33bf7b0439480effb9fb212efce87b13

                    SHA1

                    cee50f2745edc6dc291887b6075ca64d716f495a

                    SHA256

                    8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

                    SHA512

                    d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhg31lui.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

                    Filesize

                    1KB

                    MD5

                    688bed3676d2104e7f17ae1cd2c59404

                    SHA1

                    952b2cdf783ac72fcb98338723e9afd38d47ad8e

                    SHA256

                    33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

                    SHA512

                    7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhg31lui.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

                    Filesize

                    1KB

                    MD5

                    937326fead5fd401f6cca9118bd9ade9

                    SHA1

                    4526a57d4ae14ed29b37632c72aef3c408189d91

                    SHA256

                    68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

                    SHA512

                    b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhg31lui.default-release\prefs-1.js

                    Filesize

                    7KB

                    MD5

                    d74b8313a431679de8962bfd9a0c40ca

                    SHA1

                    753acd3cac79a45b00fe090dd2ac57a394eefdd5

                    SHA256

                    6d2ebf9b6dcd39687b867d25db10ea97d248d64af56eb6e169f92865b2c797cb

                    SHA512

                    4658c79901cc622a10a751119c001a28e0b55c351e7dfbc03f1ac741dbd0579c6687ea9b489f2e93b40c35414aa5d582e9793234e1f395fe0e5c97ce55ada677

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhg31lui.default-release\prefs.js

                    Filesize

                    6KB

                    MD5

                    c8b5b8ac1c43f0c08e685e2b402ce6d2

                    SHA1

                    5e85998709e73b9b5b0e16ea17ebe3d643cb781c

                    SHA256

                    782a2a3865db3163bbf182d4cb59f61b689fb090c56591bfed9f2d4daa216393

                    SHA512

                    a01c3e574302768c937b8aa4216ecb0e0da26b655961b926a42f3ceee1ec5b82f32be820d5064249d692f041e9c3ac32a41e9377c0e37befda2b67f436a8f6ec

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhg31lui.default-release\sessionstore-backups\recovery.jsonlz4

                    Filesize

                    4KB

                    MD5

                    53c4faa8a068ce7421389a67788f18da

                    SHA1

                    599acc5343f2e85755c048e23fd52564928a267d

                    SHA256

                    87cab3b7c2b5a1c23bf89730714f515625b8e1e223fd4f9df2cc97b5dbaba259

                    SHA512

                    5e4833e2f2f77e71f903a29bca7c4e3c67c662971f8930dd0749ebe2379e8dd0165b9e18ab877a37a86b30a1bcc64a34244276933d1a192a972033fa4eec76c2

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhg31lui.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

                    Filesize

                    184KB

                    MD5

                    0584fa52a0ba3f20c45d1eabf82a1be0

                    SHA1

                    b78423b9dde01c545d3da94b871265005c13c856

                    SHA256

                    d42b41a7f66fb56294218c566a6077276d4bfbfa251cf9d6a0244dd8fc12f3ea

                    SHA512

                    7ba0e21d1258965e3bc60efafebdefda9ab6765028a318b0de223e37ed4fc5f4c3096bdaf91b631d760f9cb1d7cb94c039d43527fad572a230c339ce95152a22

                  • \ProgramData\chrome.dll

                    Filesize

                    676KB

                    MD5

                    eda18948a989176f4eebb175ce806255

                    SHA1

                    ff22a3d5f5fb705137f233c36622c79eab995897

                    SHA256

                    81a4f37c5495800b7cc46aea6535d9180dadb5c151db6f1fd1968d1cd8c1eeb4

                    SHA512

                    160ed9990c37a4753fc0f5111c94414568654afbedc05308308197df2a99594f2d5d8fe511fd2279543a869ed20248e603d88a0b9b8fb119e8e6131b0c52ff85

                  • memory/872-140-0x0000000000860000-0x0000000000F93000-memory.dmp

                    Filesize

                    7.2MB

                  • memory/872-347-0x0000000000860000-0x0000000000F93000-memory.dmp

                    Filesize

                    7.2MB

                  • memory/872-142-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                    Filesize

                    972KB

                  • memory/872-199-0x0000000000860000-0x0000000000F93000-memory.dmp

                    Filesize

                    7.2MB

                  • memory/1228-17-0x0000000000BA0000-0x000000000104C000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/1228-5-0x0000000000BA0000-0x000000000104C000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/1228-9-0x0000000000BA0000-0x000000000104C000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/1228-3-0x0000000000BA0000-0x000000000104C000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/1228-2-0x0000000000BA1000-0x0000000000BCF000-memory.dmp

                    Filesize

                    184KB

                  • memory/1228-1-0x0000000077160000-0x0000000077162000-memory.dmp

                    Filesize

                    8KB

                  • memory/1228-0-0x0000000000BA0000-0x000000000104C000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/1228-15-0x0000000007040000-0x00000000074EC000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/1812-354-0x0000000000A80000-0x0000000000D6D000-memory.dmp

                    Filesize

                    2.9MB

                  • memory/1812-201-0x0000000000A80000-0x0000000000D6D000-memory.dmp

                    Filesize

                    2.9MB

                  • memory/1916-76-0x0000000001110000-0x000000000141F000-memory.dmp

                    Filesize

                    3.1MB

                  • memory/1916-119-0x0000000001110000-0x000000000141F000-memory.dmp

                    Filesize

                    3.1MB

                  • memory/2724-173-0x0000000006B40000-0x0000000007273000-memory.dmp

                    Filesize

                    7.2MB

                  • memory/2724-19-0x0000000000D01000-0x0000000000D2F000-memory.dmp

                    Filesize

                    184KB

                  • memory/2724-200-0x0000000006520000-0x000000000680D000-memory.dmp

                    Filesize

                    2.9MB

                  • memory/2724-466-0x0000000000D00000-0x00000000011AC000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/2724-27-0x0000000000D00000-0x00000000011AC000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/2724-26-0x0000000000D00000-0x00000000011AC000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/2724-25-0x0000000000D00000-0x00000000011AC000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/2724-24-0x0000000000D00000-0x00000000011AC000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/2724-23-0x0000000000D00000-0x00000000011AC000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/2724-337-0x0000000000D00000-0x00000000011AC000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/2724-73-0x0000000006B40000-0x0000000006E4F000-memory.dmp

                    Filesize

                    3.1MB

                  • memory/2724-179-0x0000000006B40000-0x0000000007273000-memory.dmp

                    Filesize

                    7.2MB

                  • memory/2724-358-0x0000000000D00000-0x00000000011AC000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/2724-21-0x0000000000D00000-0x00000000011AC000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/2724-365-0x0000000000D00000-0x00000000011AC000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/2724-198-0x0000000006520000-0x000000000680D000-memory.dmp

                    Filesize

                    2.9MB

                  • memory/2724-20-0x0000000000D00000-0x00000000011AC000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/2724-83-0x0000000000D00000-0x00000000011AC000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/2724-18-0x0000000000D00000-0x00000000011AC000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/2724-141-0x0000000000D00000-0x00000000011AC000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/2724-139-0x0000000006B40000-0x0000000007273000-memory.dmp

                    Filesize

                    7.2MB

                  • memory/2724-137-0x0000000006B40000-0x0000000007273000-memory.dmp

                    Filesize

                    7.2MB

                  • memory/2724-75-0x0000000006B40000-0x0000000006E4F000-memory.dmp

                    Filesize

                    3.1MB

                  • memory/2724-121-0x0000000006B40000-0x0000000006E4F000-memory.dmp

                    Filesize

                    3.1MB

                  • memory/2724-120-0x0000000006B40000-0x0000000006E4F000-memory.dmp

                    Filesize

                    3.1MB

                  • memory/2724-446-0x0000000000D00000-0x00000000011AC000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/2724-450-0x0000000000D00000-0x00000000011AC000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/2724-451-0x0000000000D00000-0x00000000011AC000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/2724-462-0x0000000000D00000-0x00000000011AC000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/2724-464-0x0000000000D00000-0x00000000011AC000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/2724-465-0x0000000006520000-0x000000000680D000-memory.dmp

                    Filesize

                    2.9MB

                  • memory/2904-55-0x0000000000850000-0x000000000085C000-memory.dmp

                    Filesize

                    48KB