Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/11/2024, 03:30

General

  • Target

    6d466d1d251413c12eea858fb6632f05321720d64212b98b92b68a7190627261.exe

  • Size

    3.1MB

  • MD5

    36cde0f98ab8a93df2c3134ab9771502

  • SHA1

    d778b355d36d12d05562bed3f78af22c944eb575

  • SHA256

    6d466d1d251413c12eea858fb6632f05321720d64212b98b92b68a7190627261

  • SHA512

    a79ef6f322657769550e03f1734b88c1a3b330ec6523f5fa444066cea7bc1dfd2df41833d9c99380209f2e25d1685c81dbc9eee948aa30678ff8a54a3b4c5d80

  • SSDEEP

    49152:og8DDIyU/xbvZJzwSmaOLxmeHpEeeJxs18eM9C:ogGDIyU/xbvXzwSmBtzHp8zs8eM9C

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

stealc

Botnet

tale

C2

http://185.215.113.206

Attributes
  • url_path

    /6c4adf523b719729.php

Extracted

Family

lumma

C2

https://founpiuer.store/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Amadey family
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

  • Lumma family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

  • Stealc family
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 14 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 7 IoCs
  • Identifies Wine through registry keys 2 TTPs 7 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 5 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 21 IoCs
  • Suspicious use of AdjustPrivilegeToken 11 IoCs
  • Suspicious use of FindShellTrayWindow 33 IoCs
  • Suspicious use of SendNotifyMessage 31 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\6d466d1d251413c12eea858fb6632f05321720d64212b98b92b68a7190627261.exe
    "C:\Users\Admin\AppData\Local\Temp\6d466d1d251413c12eea858fb6632f05321720d64212b98b92b68a7190627261.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:5012
    • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
      "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4692
      • C:\Users\Admin\AppData\Local\Temp\1004005001\73b0de9fdf.exe
        "C:\Users\Admin\AppData\Local\Temp\1004005001\73b0de9fdf.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:3408
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3408 -s 1492
          4⤵
          • Program crash
          PID:612
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3408 -s 1472
          4⤵
          • Program crash
          PID:4628
      • C:\Users\Admin\AppData\Local\Temp\1004006001\808ede0696.exe
        "C:\Users\Admin\AppData\Local\Temp\1004006001\808ede0696.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:4396
      • C:\Users\Admin\AppData\Local\Temp\1004007001\2bba1c5b53.exe
        "C:\Users\Admin\AppData\Local\Temp\1004007001\2bba1c5b53.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:2740
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM firefox.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:220
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM chrome.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2252
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM msedge.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:3264
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM opera.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:1652
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM brave.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4708
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3068
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
            5⤵
            • Checks processor information in registry
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:3572
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1988 -parentBuildID 20240401114208 -prefsHandle 1928 -prefMapHandle 1920 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3f4ecc70-e2e7-4fdc-adb9-f913e0a6794e} 3572 "\\.\pipe\gecko-crash-server-pipe.3572" gpu
              6⤵
                PID:2888
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2436 -parentBuildID 20240401114208 -prefsHandle 2412 -prefMapHandle 2408 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b1b700e1-17b5-4a68-ac67-652d723c90a1} 3572 "\\.\pipe\gecko-crash-server-pipe.3572" socket
                6⤵
                  PID:3168
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3156 -childID 1 -isForBrowser -prefsHandle 3188 -prefMapHandle 3004 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1192 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1a5ab89c-8b50-48f3-8d32-b1f982984445} 3572 "\\.\pipe\gecko-crash-server-pipe.3572" tab
                  6⤵
                    PID:3076
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4144 -childID 2 -isForBrowser -prefsHandle 4136 -prefMapHandle 4132 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1192 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9b2410b2-b1f3-4335-8109-b6bff7ca9c05} 3572 "\\.\pipe\gecko-crash-server-pipe.3572" tab
                    6⤵
                      PID:3608
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5008 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4972 -prefMapHandle 4936 -prefsLen 29197 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {98bccd1c-8d35-4e72-8740-02106131c47c} 3572 "\\.\pipe\gecko-crash-server-pipe.3572" utility
                      6⤵
                      • Checks processor information in registry
                      PID:5696
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5316 -childID 3 -isForBrowser -prefsHandle 5284 -prefMapHandle 5288 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1192 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cf6893fa-2099-421d-8362-405617822da7} 3572 "\\.\pipe\gecko-crash-server-pipe.3572" tab
                      6⤵
                        PID:6052
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5416 -childID 4 -isForBrowser -prefsHandle 5424 -prefMapHandle 5428 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1192 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0e082d8f-15b4-47f7-8c1e-359c13abb021} 3572 "\\.\pipe\gecko-crash-server-pipe.3572" tab
                        6⤵
                          PID:6080
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5712 -childID 5 -isForBrowser -prefsHandle 5724 -prefMapHandle 5720 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1192 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {abaeb067-5bba-4947-8f25-ef7cbc3cc288} 3572 "\\.\pipe\gecko-crash-server-pipe.3572" tab
                          6⤵
                            PID:6100
                    • C:\Users\Admin\AppData\Local\Temp\1004008001\d29be7edf5.exe
                      "C:\Users\Admin\AppData\Local\Temp\1004008001\d29be7edf5.exe"
                      3⤵
                      • Modifies Windows Defender Real-time Protection settings
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Windows security modification
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:5300
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3408 -ip 3408
                  1⤵
                    PID:3516
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 196 -p 3408 -ip 3408
                    1⤵
                      PID:3136
                    • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                      C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                      1⤵
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • Suspicious behavior: EnumeratesProcesses
                      PID:4124
                    • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                      C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                      1⤵
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • Suspicious behavior: EnumeratesProcesses
                      PID:1564

                    Network

                    MITRE ATT&CK Enterprise v15

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\85mw8mk9.default-release\activity-stream.discovery_stream.json

                      Filesize

                      24KB

                      MD5

                      81c1f3c4536800f3f9c33498f3da3d6a

                      SHA1

                      3f50644167af401e21a03019e53ea48faf16ed33

                      SHA256

                      145ab6a2128ca0e2b95ed8ecfa0eae21a436f42cb8ed43bbe5b59104649847e5

                      SHA512

                      c6c25a6bb5b0a056a476153407b83eaf5bab236bf8dc49f9228d955ab64c951e83d93b97c27eb1715b0ffe513319c2afbd43b65d249f4e44d832348f8fed2752

                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\85mw8mk9.default-release\cache2\entries\D500AD994A7515157BB2A6ADD5B18B754E4D2F99

                      Filesize

                      13KB

                      MD5

                      8642bcff7c0b89c8531e7e11c385d555

                      SHA1

                      debe62910739c44c56d27e787ecd482283557b75

                      SHA256

                      199f1b2da1a04cf6f0c45edfa3dfb0463050fce8cacf5b6d9dde4d46de832058

                      SHA512

                      cf2ffff4669e833cf62068d2c12f2012ef01e4e34283e8680ad0e8c3c4455daad6a0f2ffd1afe55993c0e07ada6e4ae6b1cd727ad3a609239f7e2df5ceb92223

                    • C:\Users\Admin\AppData\Local\Temp\1004005001\73b0de9fdf.exe

                      Filesize

                      2.9MB

                      MD5

                      cf60ed449e8668f8ee28985018351b0d

                      SHA1

                      4558c970a77f0650c06992b958fcae59153aa70c

                      SHA256

                      63cf66b3f95e4d1c2e5032967b691eb371046bac41ddbb9166e9b146a090421e

                      SHA512

                      bfb123fc0fcfcca329d5feb416e7d55ca02f52189bbe52876de8e9d7312a2b45c6432228b194ea3bd1b1fd4a9b6df76c7c90e6f6c5e52e5e9f56abe6ae544e26

                    • C:\Users\Admin\AppData\Local\Temp\1004006001\808ede0696.exe

                      Filesize

                      2.0MB

                      MD5

                      3080c431ba635ab40c0bea78645be17e

                      SHA1

                      e38d82e5f7d12fd180c18ddfd7cdbb5b3fcda553

                      SHA256

                      dda1026bd3b7331d8bcd84d9766fb1623bf48d879905444c2809e09766729b06

                      SHA512

                      740d68d68eb267c33777bf0517e856ce8b800d74f0f1a08f983ffbfd5cb015a4ea0e2793713ef3b2dbae74f588d5ff5ff4f90ce43894452b398799f5a678ba6a

                    • C:\Users\Admin\AppData\Local\Temp\1004007001\2bba1c5b53.exe

                      Filesize

                      898KB

                      MD5

                      fbc125173c935d3a74aa2a1a3908cba2

                      SHA1

                      50c7d961cd3ff761854439944ee304e11f0874e8

                      SHA256

                      4f895492a98dbdfbb6c02c2bcded323ce363511d183e0d4fc3e9ec856445fe2f

                      SHA512

                      a237225cca9330fde86e7107628642dedfa5c2ddec7226615ca8396114455129f98a4db6fd3b18198f1e3918193d965cf4ee0635a20dbd0e736931261bbf0ac3

                    • C:\Users\Admin\AppData\Local\Temp\1004008001\d29be7edf5.exe

                      Filesize

                      2.6MB

                      MD5

                      02d2fcab91e6dc7756d9be5317c9506b

                      SHA1

                      a10aa93039af20fdacb0f04d2d357f4f60bcc2fa

                      SHA256

                      d42846ac158ea49c2efd90ef76a56c0bceac96158a215415187d4164f4a2161a

                      SHA512

                      024de5d18f13e68f273bab3e350dd035c6398ea4888ca7bb249b681400dcb4d20604fdaaddfc2b45ef111335adcc5abe630d97b7654cddd2131902390496a19c

                    • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

                      Filesize

                      3.1MB

                      MD5

                      36cde0f98ab8a93df2c3134ab9771502

                      SHA1

                      d778b355d36d12d05562bed3f78af22c944eb575

                      SHA256

                      6d466d1d251413c12eea858fb6632f05321720d64212b98b92b68a7190627261

                      SHA512

                      a79ef6f322657769550e03f1734b88c1a3b330ec6523f5fa444066cea7bc1dfd2df41833d9c99380209f2e25d1685c81dbc9eee948aa30678ff8a54a3b4c5d80

                    • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                      Filesize

                      479KB

                      MD5

                      09372174e83dbbf696ee732fd2e875bb

                      SHA1

                      ba360186ba650a769f9303f48b7200fb5eaccee1

                      SHA256

                      c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                      SHA512

                      b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                    • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                      Filesize

                      13.8MB

                      MD5

                      0a8747a2ac9ac08ae9508f36c6d75692

                      SHA1

                      b287a96fd6cc12433adb42193dfe06111c38eaf0

                      SHA256

                      32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                      SHA512

                      59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\AlternateServices.bin

                      Filesize

                      10KB

                      MD5

                      1105f768973ac0e078a3cb9a4251011d

                      SHA1

                      c9e3831d0f234ce29ed6ae5a36a239744a005dc1

                      SHA256

                      92fa2fabc032b75602b39b1e14ce3a3d0fe9754ce5530c267ca732caf2916bed

                      SHA512

                      1b6973e0cc9204667cf6845e17e55b32dda5c11ec080d84b054a0d78e9123af2102579a9a2d5e9777d28b01204a42e6ddb551cda2b59ac283aa7834e9008ad98

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\datareporting\glean\db\data.safe.tmp

                      Filesize

                      25KB

                      MD5

                      330b293df5f18679050ebc3fbeceff89

                      SHA1

                      3905838555f469da6432e895c1144df198b19026

                      SHA256

                      70d4ff40a18967b78cffe2639f059b66e161a03f55fd467c4792a60422c64622

                      SHA512

                      2c453967388deff121916dd6c1436d13038467f893e191e750b55a1773a1d349896bbb38df07f6af74e95428d98058b27cd96bc3ae616b2f7503ce5ca01e6808

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\datareporting\glean\db\data.safe.tmp

                      Filesize

                      23KB

                      MD5

                      621f8aaa3255a4ff374ecfb0506a048f

                      SHA1

                      5c643311460a24b51af3183932a3fd57834bcb38

                      SHA256

                      39061d1a989f2a630714f6dd8c63709b702fc96b57db90d4f1099a8d6daef35a

                      SHA512

                      12da862b0c04ec1e705d2507e29d306c069d2d7e34840adbe161d1a5fe96ed03717bf97d0074240293f6f1348237edb8dd5df63d4b841676a6969950dde0c75f

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\datareporting\glean\db\data.safe.tmp

                      Filesize

                      25KB

                      MD5

                      1c4b4d24b2480a380545790ccaf4ae6c

                      SHA1

                      302354703c29567ac1315eecc9d5396c7eb26ff9

                      SHA256

                      fa2567762b37bb0ccc7aae891f20f960e6aaaccb96d549d3ca40a72cd115d878

                      SHA512

                      2bde5064178daea0a01c855070cca8119f3f161380912a1e0b53617b654c4a4858c626f8081b345366cd679494df6da583762bab07e59d6e1bc5b60ee5432b9c

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\datareporting\glean\db\data.safe.tmp

                      Filesize

                      21KB

                      MD5

                      66c54e26ad93de663c5c599fa2a8ee1c

                      SHA1

                      bbde1ffc0cd0ebd53c50a9a702265cc543900db8

                      SHA256

                      a031f23aa0015d57f150f38d367f9c6a60f161c68b5930ce453c292eda0e57ab

                      SHA512

                      599a1ffa95b4f74005e2d923dbb691b1810606e2c642073833a53006ecaea5c7d675c70ad6b4a785acfe26f667662f4a86648d2e2581f2edd5595a71a4bc58cf

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\datareporting\glean\pending_pings\1ad40603-4166-4ee8-895b-c71b54133c78

                      Filesize

                      659B

                      MD5

                      b8b5cd7fec501a17f303c712408a81c5

                      SHA1

                      4b46f7299e35af62de797509ac4ec12ffbb9b28d

                      SHA256

                      b52eed310319cf0c45f35cfc537fe83511de62c61867cf91365ac21ca1c82ec3

                      SHA512

                      bc76ee7ba89c6a4e683844c19e40f90914be4f16b8d04cb9e01b1075d8ea9253066ae1297aa1e496a3236337063db2aea850fd5f0f1dd601edfba950a15ea186

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\datareporting\glean\pending_pings\ea59762b-a745-4347-9eaa-a09c4dc11c24

                      Filesize

                      982B

                      MD5

                      896bcfcb4014b9a6e13aa749af772d20

                      SHA1

                      b405a7eabfa2c063b019f7067c0278a1c6b77b0a

                      SHA256

                      8870fc8db1a8797cb810b863f18253cc6981cacb6c4abca55f7e85d190263a80

                      SHA512

                      2f12bbd324a1ab5010a5220db21097b5e3962beae76a4f519dda880e87ef9e04d33240671fea2b4d2a15864c51f4eba1e3ac2d8de39c15350bab1e57d302e55e

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

                      Filesize

                      1.1MB

                      MD5

                      842039753bf41fa5e11b3a1383061a87

                      SHA1

                      3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                      SHA256

                      d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                      SHA512

                      d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

                      Filesize

                      116B

                      MD5

                      2a461e9eb87fd1955cea740a3444ee7a

                      SHA1

                      b10755914c713f5a4677494dbe8a686ed458c3c5

                      SHA256

                      4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                      SHA512

                      34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

                      Filesize

                      372B

                      MD5

                      bf957ad58b55f64219ab3f793e374316

                      SHA1

                      a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                      SHA256

                      bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                      SHA512

                      79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

                      Filesize

                      17.8MB

                      MD5

                      daf7ef3acccab478aaa7d6dc1c60f865

                      SHA1

                      f8246162b97ce4a945feced27b6ea114366ff2ad

                      SHA256

                      bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                      SHA512

                      5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\prefs-1.js

                      Filesize

                      15KB

                      MD5

                      d37ab32790b54ae655f9241173866fdb

                      SHA1

                      4fa019b8320664f7bab962caca0020c6c80ae2dc

                      SHA256

                      3e9eaf46abf06ce0f853c37d51b9054441425825bd378e005758829134ae6019

                      SHA512

                      522739ea48799a9a8f66a517f7ef2d635b94ed9c07826a11cc79b27fb87fa9022d3dc259bea51b9574957048a7a17655650af8b5e9943ffed5b49af87a04a507

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\prefs-1.js

                      Filesize

                      10KB

                      MD5

                      af7c56583731a842d840aa90f148256e

                      SHA1

                      9d32424d0cd8ab5feeb263ce13f79723ccc0d8a2

                      SHA256

                      21a211fcd9fb0c6b9691e625cc44e7597529e1c586426812a4f6538a97449df9

                      SHA512

                      d5503f9ed2d0a6cc3dd5870e3e37e2b5f0b1cf91335f5d51d4f017f821b24908154013894250172f1d90b72442b247116ab04cd27650c8135de905a023eb401b

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\prefs.js

                      Filesize

                      10KB

                      MD5

                      c55da435e0ea2d56496ec05dbaadf4a3

                      SHA1

                      a08300672d26574852bccce93b7310807c2a81e9

                      SHA256

                      7ade460705fc0d50924af73cdd6afb776b3722325174ba724df314209d5da1c3

                      SHA512

                      729e222fd129e8a9e7af05f7c8c88c579076205ea6e2dc3048ce83add418dc2f038e5a75bf2bd8a200a30d3730dab135a42d4875f5addf4c7777544b81232219

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\prefs.js

                      Filesize

                      11KB

                      MD5

                      ced9ae941e1e91d11df8077a4ed0391a

                      SHA1

                      19501a08895c81902c841c85097086ff14864ce3

                      SHA256

                      14b687dd39022c2d2ace97f7778768fad39ccad23c92cf4c7d89d3a6d2b60003

                      SHA512

                      baa0ed301989056da5b8fd637231ec1e6c332e36b45057bc42917a5afaf85f1087f9dfe3941b4be27374f4873e1a1f6993cb40700c18b786859d4b145dbd961f

                    • memory/1564-3197-0x0000000000090000-0x00000000003B7000-memory.dmp

                      Filesize

                      3.2MB

                    • memory/3408-42-0x0000000000321000-0x0000000000349000-memory.dmp

                      Filesize

                      160KB

                    • memory/3408-45-0x0000000000320000-0x0000000000630000-memory.dmp

                      Filesize

                      3.1MB

                    • memory/3408-43-0x0000000000320000-0x0000000000630000-memory.dmp

                      Filesize

                      3.1MB

                    • memory/3408-38-0x0000000000320000-0x0000000000630000-memory.dmp

                      Filesize

                      3.1MB

                    • memory/4124-733-0x0000000000090000-0x00000000003B7000-memory.dmp

                      Filesize

                      3.2MB

                    • memory/4124-744-0x0000000000090000-0x00000000003B7000-memory.dmp

                      Filesize

                      3.2MB

                    • memory/4396-64-0x0000000000AD0000-0x00000000011EC000-memory.dmp

                      Filesize

                      7.1MB

                    • memory/4396-62-0x0000000000AD0000-0x00000000011EC000-memory.dmp

                      Filesize

                      7.1MB

                    • memory/4692-610-0x0000000000090000-0x00000000003B7000-memory.dmp

                      Filesize

                      3.2MB

                    • memory/4692-3186-0x0000000000090000-0x00000000003B7000-memory.dmp

                      Filesize

                      3.2MB

                    • memory/4692-435-0x0000000000090000-0x00000000003B7000-memory.dmp

                      Filesize

                      3.2MB

                    • memory/4692-3200-0x0000000000090000-0x00000000003B7000-memory.dmp

                      Filesize

                      3.2MB

                    • memory/4692-3199-0x0000000000090000-0x00000000003B7000-memory.dmp

                      Filesize

                      3.2MB

                    • memory/4692-3198-0x0000000000090000-0x00000000003B7000-memory.dmp

                      Filesize

                      3.2MB

                    • memory/4692-457-0x0000000000090000-0x00000000003B7000-memory.dmp

                      Filesize

                      3.2MB

                    • memory/4692-37-0x0000000000090000-0x00000000003B7000-memory.dmp

                      Filesize

                      3.2MB

                    • memory/4692-3195-0x0000000000090000-0x00000000003B7000-memory.dmp

                      Filesize

                      3.2MB

                    • memory/4692-3194-0x0000000000090000-0x00000000003B7000-memory.dmp

                      Filesize

                      3.2MB

                    • memory/4692-3192-0x0000000000090000-0x00000000003B7000-memory.dmp

                      Filesize

                      3.2MB

                    • memory/4692-16-0x0000000000090000-0x00000000003B7000-memory.dmp

                      Filesize

                      3.2MB

                    • memory/4692-3178-0x0000000000090000-0x00000000003B7000-memory.dmp

                      Filesize

                      3.2MB

                    • memory/4692-20-0x0000000000091000-0x00000000000F9000-memory.dmp

                      Filesize

                      416KB

                    • memory/4692-1953-0x0000000000090000-0x00000000003B7000-memory.dmp

                      Filesize

                      3.2MB

                    • memory/4692-40-0x0000000000090000-0x00000000003B7000-memory.dmp

                      Filesize

                      3.2MB

                    • memory/4692-65-0x0000000000090000-0x00000000003B7000-memory.dmp

                      Filesize

                      3.2MB

                    • memory/4692-21-0x0000000000090000-0x00000000003B7000-memory.dmp

                      Filesize

                      3.2MB

                    • memory/4692-22-0x0000000000090000-0x00000000003B7000-memory.dmp

                      Filesize

                      3.2MB

                    • memory/4692-41-0x0000000000091000-0x00000000000F9000-memory.dmp

                      Filesize

                      416KB

                    • memory/4692-46-0x0000000000090000-0x00000000003B7000-memory.dmp

                      Filesize

                      3.2MB

                    • memory/5012-1-0x00000000777E4000-0x00000000777E6000-memory.dmp

                      Filesize

                      8KB

                    • memory/5012-2-0x0000000000A51000-0x0000000000AB9000-memory.dmp

                      Filesize

                      416KB

                    • memory/5012-3-0x0000000000A50000-0x0000000000D77000-memory.dmp

                      Filesize

                      3.2MB

                    • memory/5012-17-0x0000000000A50000-0x0000000000D77000-memory.dmp

                      Filesize

                      3.2MB

                    • memory/5012-19-0x0000000000A51000-0x0000000000AB9000-memory.dmp

                      Filesize

                      416KB

                    • memory/5012-4-0x0000000000A50000-0x0000000000D77000-memory.dmp

                      Filesize

                      3.2MB

                    • memory/5012-0-0x0000000000A50000-0x0000000000D77000-memory.dmp

                      Filesize

                      3.2MB

                    • memory/5300-462-0x0000000000060000-0x0000000000310000-memory.dmp

                      Filesize

                      2.7MB

                    • memory/5300-459-0x0000000000060000-0x0000000000310000-memory.dmp

                      Filesize

                      2.7MB

                    • memory/5300-439-0x0000000000060000-0x0000000000310000-memory.dmp

                      Filesize

                      2.7MB

                    • memory/5300-438-0x0000000000060000-0x0000000000310000-memory.dmp

                      Filesize

                      2.7MB

                    • memory/5300-437-0x0000000000060000-0x0000000000310000-memory.dmp

                      Filesize

                      2.7MB