Analysis

  • max time kernel
    141s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05-11-2024 05:43

General

  • Target

    file.exe

  • Size

    3.1MB

  • MD5

    112cf61b5fdf72b3996262baecbe9fef

  • SHA1

    eb1e4b94cc3e8f6dbe425473526154802d126e8e

  • SHA256

    23621d59cc4f6e323e95e9f17ad90e380b71964b28f4b669f1038289dc9f2131

  • SHA512

    a093ea6ad1134509c1650faa25372f5986751d36aca5fd558a5b5958e29bd449ef78ebdacba399d01ebd22466fff64948a225c8239a795fb3e8893bd3db60b94

  • SSDEEP

    49152:kO432MbH0Py+DUQDH2DJTd6P5Po4HxlRrd9MH:kOI2MbH06+Df7uJT6z7

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

stealc

Botnet

tale

C2

http://185.215.113.206

Attributes
  • url_path

    /6c4adf523b719729.php

Extracted

Family

lumma

C2

https://founpiuer.store/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Amadey family
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

  • Lumma family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

  • Stealc family
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 8 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 16 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 8 IoCs
  • Identifies Wine through registry keys 2 TTPs 8 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 5 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 23 IoCs
  • Suspicious use of AdjustPrivilegeToken 11 IoCs
  • Suspicious use of FindShellTrayWindow 32 IoCs
  • Suspicious use of SendNotifyMessage 31 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3624
    • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
      "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2148
      • C:\Users\Admin\AppData\Local\Temp\1004029001\97ef2ac5ee.exe
        "C:\Users\Admin\AppData\Local\Temp\1004029001\97ef2ac5ee.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:4460
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4460 -s 1484
          4⤵
          • Program crash
          PID:2476
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4460 -s 1504
          4⤵
          • Program crash
          PID:1348
      • C:\Users\Admin\AppData\Local\Temp\1004030001\e3a3f5ad79.exe
        "C:\Users\Admin\AppData\Local\Temp\1004030001\e3a3f5ad79.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:4976
      • C:\Users\Admin\AppData\Local\Temp\1004031001\b4faf29564.exe
        "C:\Users\Admin\AppData\Local\Temp\1004031001\b4faf29564.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:4380
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM firefox.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4932
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM chrome.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:3156
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM msedge.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:852
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM opera.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4532
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM brave.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4328
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:440
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
            5⤵
            • Checks processor information in registry
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2696
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2000 -parentBuildID 20240401114208 -prefsHandle 1928 -prefMapHandle 1920 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {57192c16-f9e8-41b4-b753-dd0c922844e2} 2696 "\\.\pipe\gecko-crash-server-pipe.2696" gpu
              6⤵
                PID:4376
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2436 -parentBuildID 20240401114208 -prefsHandle 2428 -prefMapHandle 2416 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d6e24d0d-531e-48ef-9514-a4af310a1bc5} 2696 "\\.\pipe\gecko-crash-server-pipe.2696" socket
                6⤵
                  PID:2676
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2936 -childID 1 -isForBrowser -prefsHandle 2980 -prefMapHandle 3008 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7572eb4f-835c-48d2-ab7d-03c0367e0e00} 2696 "\\.\pipe\gecko-crash-server-pipe.2696" tab
                  6⤵
                    PID:232
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2776 -childID 2 -isForBrowser -prefsHandle 3740 -prefMapHandle 3768 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3889ebc0-1c86-4565-abbd-f801843b73dc} 2696 "\\.\pipe\gecko-crash-server-pipe.2696" tab
                    6⤵
                      PID:4268
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4568 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4564 -prefMapHandle 4560 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9d95a802-a77a-4eaa-8497-837c6d74c90c} 2696 "\\.\pipe\gecko-crash-server-pipe.2696" utility
                      6⤵
                      • Checks processor information in registry
                      PID:5564
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5552 -childID 3 -isForBrowser -prefsHandle 5568 -prefMapHandle 5564 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2a5f2646-219c-4b87-bf51-4c8ecae601cc} 2696 "\\.\pipe\gecko-crash-server-pipe.2696" tab
                      6⤵
                        PID:5292
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5428 -childID 4 -isForBrowser -prefsHandle 5432 -prefMapHandle 5440 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e5f8f8eb-d822-4906-a461-83b3b2315980} 2696 "\\.\pipe\gecko-crash-server-pipe.2696" tab
                        6⤵
                          PID:5328
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5416 -childID 5 -isForBrowser -prefsHandle 5832 -prefMapHandle 5836 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3c2e4aa7-dfaa-49b5-96fe-bb13d999cb81} 2696 "\\.\pipe\gecko-crash-server-pipe.2696" tab
                          6⤵
                            PID:5340
                    • C:\Users\Admin\AppData\Local\Temp\1004032001\266630cf46.exe
                      "C:\Users\Admin\AppData\Local\Temp\1004032001\266630cf46.exe"
                      3⤵
                      • Modifies Windows Defender Real-time Protection settings
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Windows security modification
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:428
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4460 -ip 4460
                  1⤵
                    PID:2284
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4460 -ip 4460
                    1⤵
                      PID:3028
                    • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                      C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                      1⤵
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • Suspicious behavior: EnumeratesProcesses
                      PID:4596
                    • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                      C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                      1⤵
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • Suspicious behavior: EnumeratesProcesses
                      PID:5668
                    • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                      C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                      1⤵
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • Suspicious behavior: EnumeratesProcesses
                      PID:2032

                    Network

                    MITRE ATT&CK Enterprise v15

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\activity-stream.discovery_stream.json

                      Filesize

                      24KB

                      MD5

                      7b0c64fda2a55a2e2e3e89c124f94136

                      SHA1

                      17d80612977caaa6b089916768235a31e5ada4a3

                      SHA256

                      e6795d8b7d760e3619f1f7138aedbf94038fbdb0c90f893092cfa5cc4c75a74d

                      SHA512

                      3540174dd6c07f5b5a56f69dd04a26c97559ffe8ec3840fbc5c305fed4e356f3011845dd80140ac2b09f110d2f04b525687da93f755b4e450ae133a1da80d294

                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\cache2\entries\D500AD994A7515157BB2A6ADD5B18B754E4D2F99

                      Filesize

                      13KB

                      MD5

                      9e7537aba991ea02dd47068b2a982dc1

                      SHA1

                      317ab41c554e9620aef45019a19eeb28753e058a

                      SHA256

                      6e1fb848dffa9a6f8c4146c62c933ec79b5d9d1da13c3a910f3e915749f2dc1f

                      SHA512

                      80ff7603f6fbc7af10c2de3a434a5f8caed23f0a6f7e97e9b397b12e36ae79e9594307fca987f2079ba6d7bac58dae3dc638f8607a77f8d1cb842033fa5ec80d

                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\cache2\entries\F8CBD54DDA10F4286A41EC6A537240712D6C2308

                      Filesize

                      9KB

                      MD5

                      af36bc56b41f215710863156fb46bd36

                      SHA1

                      7ee454628bcb82aecaef40763fbd78ed1ea96aa5

                      SHA256

                      750b781e2dd1361762614a904e98202cdfdbbf42bc097d4105d708ba34b0a144

                      SHA512

                      1ae622ee753dba8793b66e012e3164692893252715260623c0ca2632ecf33a7ca3338515751a1388e328943c3187f506e027b87a3ed2372ea3454f7c56532044

                    • C:\Users\Admin\AppData\Local\Temp\1004029001\97ef2ac5ee.exe

                      Filesize

                      2.8MB

                      MD5

                      fa9cb3030ba1bc095ac7f84ece81159d

                      SHA1

                      178a344a4e41bb66d1441bc1a70f6444defe8c3c

                      SHA256

                      4e456175bc7e71209b47ba72449f2ec31719cbd9e64387b77d0f5d819747b68f

                      SHA512

                      5dc0888468ee7a4b92205eb2fec33fe39b9913d375ed358fa01e72d2161e4f43783aadcda79ce0eb577a86b2306dbb6c31b541dbd0dbaa4fc069cae439973894

                    • C:\Users\Admin\AppData\Local\Temp\1004030001\e3a3f5ad79.exe

                      Filesize

                      2.0MB

                      MD5

                      649b30a03ce978366e6c5189a1f3ce1c

                      SHA1

                      0815ec58e255ac4659fc5cc62438ef009955b6e9

                      SHA256

                      935236bed1b5f179782f75b32cf4a7e66fafba9b9e3b4be4bacd2f1ad2cef8ad

                      SHA512

                      7381db1186e171e294e3449f3478b43e2f96706565b4ebfb2e224441259388382d114d225147d44a7fd9036926e54ffdc7d905d163dc06dc4fd8ab98bb1b774b

                    • C:\Users\Admin\AppData\Local\Temp\1004031001\b4faf29564.exe

                      Filesize

                      898KB

                      MD5

                      8ca4b0a008e0bb5cb6530bfadacc876c

                      SHA1

                      b2c906d580a640acafe788265afb4ec6c8d50ddf

                      SHA256

                      4046e003425711a55d624a7a89eccbe7354ae09e580754f3b0444bb822e4964a

                      SHA512

                      0d77e6ce39a0ba185c64d28c92607ef37fd3842e7fd06b7ff2e7ee29a822eecc09c6f367a918f4ea73a69681394316258cfefe4f03736c8bd5ce86f28a4ef29e

                    • C:\Users\Admin\AppData\Local\Temp\1004032001\266630cf46.exe

                      Filesize

                      2.7MB

                      MD5

                      5af3ca07cc3dbc6744663fbf0e653a8d

                      SHA1

                      7e0d1b266e3e1bd2f511d466ca5f00338e9b6332

                      SHA256

                      5862865799f158dce084650d09013e4070d89fdc3e3c01ddb6e6213124a76ef4

                      SHA512

                      5af1146bfc9b7f2b8b3cdd37d0b676b22c0ad3c9fb3eb88c9d60350ffebcda18fb1b5ccfae2616d235ff1e09ff5ea5e10c44919e71f84e131d2c2525808a974a

                    • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

                      Filesize

                      3.1MB

                      MD5

                      112cf61b5fdf72b3996262baecbe9fef

                      SHA1

                      eb1e4b94cc3e8f6dbe425473526154802d126e8e

                      SHA256

                      23621d59cc4f6e323e95e9f17ad90e380b71964b28f4b669f1038289dc9f2131

                      SHA512

                      a093ea6ad1134509c1650faa25372f5986751d36aca5fd558a5b5958e29bd449ef78ebdacba399d01ebd22466fff64948a225c8239a795fb3e8893bd3db60b94

                    • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                      Filesize

                      479KB

                      MD5

                      09372174e83dbbf696ee732fd2e875bb

                      SHA1

                      ba360186ba650a769f9303f48b7200fb5eaccee1

                      SHA256

                      c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                      SHA512

                      b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                    • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                      Filesize

                      13.8MB

                      MD5

                      0a8747a2ac9ac08ae9508f36c6d75692

                      SHA1

                      b287a96fd6cc12433adb42193dfe06111c38eaf0

                      SHA256

                      32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                      SHA512

                      59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\AlternateServices.bin

                      Filesize

                      8KB

                      MD5

                      94363582ca27a39d3f9867942a8dab6d

                      SHA1

                      eb9b0902fa8972a5567b12c228f78cd51ca607a5

                      SHA256

                      56fce522702b7e63e0fb86b5d0c634e1e0721208d72bd321c3d0af0970270853

                      SHA512

                      22bd8cae78dc1a859952e9d85cc36300a359180b8fc106ee11fa44774917d1ad3aef5217321a43d9bc9d6a9354b83a5b0fd77fd2fbaeed11e8e35e4a895cab3a

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\db\data.safe.tmp

                      Filesize

                      5KB

                      MD5

                      dc12fbf221e38b4f0f3a35cd5ce7b8c0

                      SHA1

                      88db6686788627f6d313d51f808b1dc925c8f36d

                      SHA256

                      4efbc2080ccf67cc2337a5d98e5aef77997219c68e37aef35b0fedbed4f6086c

                      SHA512

                      b50fce90557a590c0ecbf38a0b30d3fe910e2d2ec40a00f5074b88b7e8fa99a9ed8a01c1c1acdb30a39d0dc54c96365f4eacb4c3e08d7e271dcd0595ad0624a2

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\db\data.safe.tmp

                      Filesize

                      15KB

                      MD5

                      1f8799b772f250aacc4911a9dc90c75c

                      SHA1

                      48b9025cd5f07ee03da866501884637cd88afca2

                      SHA256

                      263e628ee5c6a1376f2c5119c709ea02e35d55f1f71e69057d8db3d8c1d11737

                      SHA512

                      b802345a4e17dd1f6a59195a047a1d4a5737ea2e2c6d651ee363f23b3dab580e250fe6627706b53f2176f199330b8fb572e5eb15987df39b6beb5602455d93f7

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\db\data.safe.tmp

                      Filesize

                      15KB

                      MD5

                      f4a51579675606672ad22315e3d99bd4

                      SHA1

                      07fff4e5570d755a3d720ddb9c77dc153fbdd3bf

                      SHA256

                      35e7fce29edb850a6bcb9652863ad67f9d171cb21a749a764d38dea339057045

                      SHA512

                      c2568f105d2d27349b84b08123d3dd656f6972225c4464a4da73db744bb371a4c668838d1c2d6290006658092b2663557558798ec5392a7755fe760a71667fc8

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\pending_pings\3c2615eb-4e94-4978-a283-1edfc35e4a5d

                      Filesize

                      671B

                      MD5

                      5df9e32bc662299d751cfdfbce2a2d6b

                      SHA1

                      5b053f5ba85bf58866b3115aa8c4c8a16fb0e1b9

                      SHA256

                      ca336cfcabefd4b6331fcbbdf81e0ee364a08915873ca7fe9855bc9f8cf709bf

                      SHA512

                      b120678fc4564dffc49f084e6b6eb0e1c71c90de4e960df8dbae44cdfc97260db150da26064ff6a66957d258bf6739132f74435360ad9ea60cdeae25c4afc859

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\pending_pings\459bcfd2-b09c-4d8c-bfca-1725b84ea356

                      Filesize

                      25KB

                      MD5

                      dd136e6974686f4cac50a7eb92c888df

                      SHA1

                      30f0d3013d7ffe86948d6181d3a11f312ae6029a

                      SHA256

                      1d13bb30f72cfd0dd002c4a7714dc7c411ffb9e1d52a9b475f53f1002fac423a

                      SHA512

                      f5d8f36a651a1a5cae16e7dae6d8d032b80f3b98d3c580f0601248ddb14366ff2309453da31478f7d6f975a0a7f19325a988cfa11f17fea9941de02e1e24d2d0

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\pending_pings\615c1d7a-239c-4443-aceb-4410e55ef50d

                      Filesize

                      982B

                      MD5

                      0e380f9bbdfb9f1add0ad1066c6a0381

                      SHA1

                      087dace32d344e27a8dcceab880a105b78c7d3eb

                      SHA256

                      f4515a12f704591d0078dda2f8e700d0101e0e4c7ee892c5478ba7e64eb1fb1f

                      SHA512

                      c06bbdf505e4d302facd15f1c6f94c59c6370cdcb04445a7562e1502e4aba08577af229b6068b92023d12eb6ec1a752473df134a4eb99cb7df7cd0c3acc50bed

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

                      Filesize

                      1.1MB

                      MD5

                      842039753bf41fa5e11b3a1383061a87

                      SHA1

                      3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                      SHA256

                      d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                      SHA512

                      d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

                      Filesize

                      116B

                      MD5

                      2a461e9eb87fd1955cea740a3444ee7a

                      SHA1

                      b10755914c713f5a4677494dbe8a686ed458c3c5

                      SHA256

                      4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                      SHA512

                      34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

                      Filesize

                      372B

                      MD5

                      bf957ad58b55f64219ab3f793e374316

                      SHA1

                      a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                      SHA256

                      bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                      SHA512

                      79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

                      Filesize

                      17.8MB

                      MD5

                      daf7ef3acccab478aaa7d6dc1c60f865

                      SHA1

                      f8246162b97ce4a945feced27b6ea114366ff2ad

                      SHA256

                      bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                      SHA512

                      5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\prefs-1.js

                      Filesize

                      12KB

                      MD5

                      2395bbff1c44a4db8a2ef8081a1aa77f

                      SHA1

                      89badcc2402bfd83b6979c39ff5d2dbeb8b66039

                      SHA256

                      501c4fcdf09d69a9004f9703597c9573ea0fc528f403bdccfab824c230b62f9d

                      SHA512

                      f27326b84d4fd90e054b09ad1958bc426d4ba94eba04ada49ae5b2f818f940b9fd6cef93f7cb60fa785f070716e0d82cdeb60d4f93ff84b2a29b7ca01e2a3d28

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\prefs-1.js

                      Filesize

                      15KB

                      MD5

                      45b841cfbe7bbc4cdd6fa45e8cb9672a

                      SHA1

                      05eaaf896e660383f335259911782c3c6e3d49c2

                      SHA256

                      d17f002dacda3695a04e466204b9c2b4512595d7571055d1f03d3a6c0ad52774

                      SHA512

                      65d9082a56fd8d8598488f845f36d0bea6e9b7d8305212d6ce689152ff0195a9b450130381fab57b6d2484d921064aa689969ca5baa4e5d3f61d14d113d513ba

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\prefs.js

                      Filesize

                      10KB

                      MD5

                      112aa561cd146780a3a85e1ffe9f774e

                      SHA1

                      04c646adff23ebbc3847b6b054ce930b5f08a579

                      SHA256

                      7632d50f3f6d43f63d6974686a18fe08fcf2226e5ab77dbf09da58230c4bdc96

                      SHA512

                      2c24ed4b2a166634b95bbbb7fa964c488a368dcc19bc46d523cbf28955e3af183651cf1659635cb9be1843bfc9c2f32fe06b596ef7b8c4f615f531080c5a873b

                    • memory/428-467-0x0000000000050000-0x0000000000312000-memory.dmp

                      Filesize

                      2.8MB

                    • memory/428-464-0x0000000000050000-0x0000000000312000-memory.dmp

                      Filesize

                      2.8MB

                    • memory/428-442-0x0000000000050000-0x0000000000312000-memory.dmp

                      Filesize

                      2.8MB

                    • memory/428-443-0x0000000000050000-0x0000000000312000-memory.dmp

                      Filesize

                      2.8MB

                    • memory/428-393-0x0000000000050000-0x0000000000312000-memory.dmp

                      Filesize

                      2.8MB

                    • memory/2032-3857-0x0000000000440000-0x000000000075B000-memory.dmp

                      Filesize

                      3.1MB

                    • memory/2148-19-0x0000000000440000-0x000000000075B000-memory.dmp

                      Filesize

                      3.1MB

                    • memory/2148-3842-0x0000000000440000-0x000000000075B000-memory.dmp

                      Filesize

                      3.1MB

                    • memory/2148-31-0x0000000000440000-0x000000000075B000-memory.dmp

                      Filesize

                      3.1MB

                    • memory/2148-22-0x0000000000440000-0x000000000075B000-memory.dmp

                      Filesize

                      3.1MB

                    • memory/2148-20-0x0000000000441000-0x00000000004A9000-memory.dmp

                      Filesize

                      416KB

                    • memory/2148-39-0x0000000000441000-0x00000000004A9000-memory.dmp

                      Filesize

                      416KB

                    • memory/2148-3863-0x0000000000440000-0x000000000075B000-memory.dmp

                      Filesize

                      3.1MB

                    • memory/2148-392-0x0000000000440000-0x000000000075B000-memory.dmp

                      Filesize

                      3.1MB

                    • memory/2148-42-0x0000000000440000-0x000000000075B000-memory.dmp

                      Filesize

                      3.1MB

                    • memory/2148-47-0x0000000000440000-0x000000000075B000-memory.dmp

                      Filesize

                      3.1MB

                    • memory/2148-3855-0x0000000000440000-0x000000000075B000-memory.dmp

                      Filesize

                      3.1MB

                    • memory/2148-462-0x0000000000440000-0x000000000075B000-memory.dmp

                      Filesize

                      3.1MB

                    • memory/2148-3854-0x0000000000440000-0x000000000075B000-memory.dmp

                      Filesize

                      3.1MB

                    • memory/2148-21-0x0000000000440000-0x000000000075B000-memory.dmp

                      Filesize

                      3.1MB

                    • memory/2148-3853-0x0000000000440000-0x000000000075B000-memory.dmp

                      Filesize

                      3.1MB

                    • memory/2148-3852-0x0000000000440000-0x000000000075B000-memory.dmp

                      Filesize

                      3.1MB

                    • memory/2148-3851-0x0000000000440000-0x000000000075B000-memory.dmp

                      Filesize

                      3.1MB

                    • memory/2148-3849-0x0000000000440000-0x000000000075B000-memory.dmp

                      Filesize

                      3.1MB

                    • memory/2148-40-0x0000000000440000-0x000000000075B000-memory.dmp

                      Filesize

                      3.1MB

                    • memory/2148-569-0x0000000000440000-0x000000000075B000-memory.dmp

                      Filesize

                      3.1MB

                    • memory/2148-3839-0x0000000000440000-0x000000000075B000-memory.dmp

                      Filesize

                      3.1MB

                    • memory/2148-2488-0x0000000000440000-0x000000000075B000-memory.dmp

                      Filesize

                      3.1MB

                    • memory/3624-4-0x00000000007A0000-0x0000000000ABB000-memory.dmp

                      Filesize

                      3.1MB

                    • memory/3624-2-0x00000000007A1000-0x0000000000809000-memory.dmp

                      Filesize

                      416KB

                    • memory/3624-1-0x0000000076F34000-0x0000000076F36000-memory.dmp

                      Filesize

                      8KB

                    • memory/3624-18-0x00000000007A1000-0x0000000000809000-memory.dmp

                      Filesize

                      416KB

                    • memory/3624-0-0x00000000007A0000-0x0000000000ABB000-memory.dmp

                      Filesize

                      3.1MB

                    • memory/3624-3-0x00000000007A0000-0x0000000000ABB000-memory.dmp

                      Filesize

                      3.1MB

                    • memory/3624-17-0x00000000007A0000-0x0000000000ABB000-memory.dmp

                      Filesize

                      3.1MB

                    • memory/4460-46-0x0000000000100000-0x0000000000408000-memory.dmp

                      Filesize

                      3.0MB

                    • memory/4460-44-0x0000000000100000-0x0000000000408000-memory.dmp

                      Filesize

                      3.0MB

                    • memory/4460-43-0x0000000000101000-0x0000000000129000-memory.dmp

                      Filesize

                      160KB

                    • memory/4460-41-0x0000000000100000-0x0000000000408000-memory.dmp

                      Filesize

                      3.0MB

                    • memory/4596-84-0x0000000000440000-0x000000000075B000-memory.dmp

                      Filesize

                      3.1MB

                    • memory/4596-85-0x0000000000440000-0x000000000075B000-memory.dmp

                      Filesize

                      3.1MB

                    • memory/4976-64-0x00000000004B0000-0x0000000000BD8000-memory.dmp

                      Filesize

                      7.2MB

                    • memory/4976-63-0x00000000004B0000-0x0000000000BD8000-memory.dmp

                      Filesize

                      7.2MB

                    • memory/5668-3848-0x0000000000440000-0x000000000075B000-memory.dmp

                      Filesize

                      3.1MB

                    • memory/5668-3847-0x0000000000440000-0x000000000075B000-memory.dmp

                      Filesize

                      3.1MB