Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/11/2024, 08:58

General

  • Target

    9b28f484a66dfc0a5ab87cae9a7ce45e3a542c06227cfd28f0db4338f5bc3f15.exe

  • Size

    3.1MB

  • MD5

    e9d77ca53bf0845644dd8b2a6a24f133

  • SHA1

    58700e47b86cf22ca0e0b96ffa10f64fb11f26c9

  • SHA256

    9b28f484a66dfc0a5ab87cae9a7ce45e3a542c06227cfd28f0db4338f5bc3f15

  • SHA512

    1bbc659dcb319fcc71f2953a637e55fed2c7249e83bfd3f3ecf963a34482680906b1add3a422594d4912d9aa57d1748bac51ac64dfaa0d5638ef6fcc2d41435e

  • SSDEEP

    49152:jhcwdV83L1pRMSeKlxFW7uDiXYM1YcXf+:VPdVoL1pRMlKnc70iZ1h+

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

lumma

C2

https://processhol.sbs/api

https://p10tgrace.sbs/api

https://peepburry828.sbs/api

https://3xp3cts1aim.sbs/api

https://p3ar11fter.sbs/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Amadey family
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

  • Lumma family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 9 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 18 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 9 IoCs
  • Identifies Wine through registry keys 2 TTPs 9 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 5 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 25 IoCs
  • Suspicious use of AdjustPrivilegeToken 11 IoCs
  • Suspicious use of FindShellTrayWindow 31 IoCs
  • Suspicious use of SendNotifyMessage 30 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\9b28f484a66dfc0a5ab87cae9a7ce45e3a542c06227cfd28f0db4338f5bc3f15.exe
    "C:\Users\Admin\AppData\Local\Temp\9b28f484a66dfc0a5ab87cae9a7ce45e3a542c06227cfd28f0db4338f5bc3f15.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1116
    • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
      "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1352
      • C:\Users\Admin\AppData\Local\Temp\1006666001\03a6b80412.exe
        "C:\Users\Admin\AppData\Local\Temp\1006666001\03a6b80412.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:4748
      • C:\Users\Admin\AppData\Local\Temp\1006859001\4b3e1ca893.exe
        "C:\Users\Admin\AppData\Local\Temp\1006859001\4b3e1ca893.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:3064
      • C:\Users\Admin\AppData\Local\Temp\1006860001\ddae024620.exe
        "C:\Users\Admin\AppData\Local\Temp\1006860001\ddae024620.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:3108
      • C:\Users\Admin\AppData\Local\Temp\1006861001\b92717cf25.exe
        "C:\Users\Admin\AppData\Local\Temp\1006861001\b92717cf25.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:2188
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM firefox.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:1788
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM chrome.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4348
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM msedge.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4848
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM opera.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:3836
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM brave.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:1876
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3240
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
            5⤵
            • Checks processor information in registry
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:3116
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2004 -parentBuildID 20240401114208 -prefsHandle 1932 -prefMapHandle 1896 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3573c814-92f9-43b0-bd32-9d20f23fc090} 3116 "\\.\pipe\gecko-crash-server-pipe.3116" gpu
              6⤵
                PID:4988
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2436 -parentBuildID 20240401114208 -prefsHandle 2404 -prefMapHandle 2400 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3bd9e72e-ef19-48b3-889d-e34a6995969f} 3116 "\\.\pipe\gecko-crash-server-pipe.3116" socket
                6⤵
                  PID:624
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3220 -childID 1 -isForBrowser -prefsHandle 3032 -prefMapHandle 3028 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1312 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d45c5645-2894-4264-a6eb-647e6479d995} 3116 "\\.\pipe\gecko-crash-server-pipe.3116" tab
                  6⤵
                    PID:4716
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3056 -childID 2 -isForBrowser -prefsHandle 2892 -prefMapHandle 3788 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1312 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {78b67b6f-f63d-4085-8155-351598c00951} 3116 "\\.\pipe\gecko-crash-server-pipe.3116" tab
                    6⤵
                      PID:2528
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4536 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4532 -prefMapHandle 4524 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {44732a27-fc66-4c5f-8519-bde9eaea8cb9} 3116 "\\.\pipe\gecko-crash-server-pipe.3116" utility
                      6⤵
                      • Checks processor information in registry
                      PID:5264
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5024 -childID 3 -isForBrowser -prefsHandle 5616 -prefMapHandle 5620 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1312 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1e5e9f60-b891-4010-9508-be4bc4e226eb} 3116 "\\.\pipe\gecko-crash-server-pipe.3116" tab
                      6⤵
                        PID:2464
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5772 -childID 4 -isForBrowser -prefsHandle 5856 -prefMapHandle 5852 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1312 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {baa3ec6d-cc48-4738-be43-1119ff0221a3} 3116 "\\.\pipe\gecko-crash-server-pipe.3116" tab
                        6⤵
                          PID:5068
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6052 -childID 5 -isForBrowser -prefsHandle 5972 -prefMapHandle 5980 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1312 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b12a43da-0bd9-4247-8c39-a7b9c12f4dc3} 3116 "\\.\pipe\gecko-crash-server-pipe.3116" tab
                          6⤵
                            PID:3724
                    • C:\Users\Admin\AppData\Local\Temp\1006862001\14620c93ed.exe
                      "C:\Users\Admin\AppData\Local\Temp\1006862001\14620c93ed.exe"
                      3⤵
                      • Modifies Windows Defender Real-time Protection settings
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Windows security modification
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:3460
                • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                  C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                  1⤵
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Identifies Wine through registry keys
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • Suspicious behavior: EnumeratesProcesses
                  PID:3588
                • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                  C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                  1⤵
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Identifies Wine through registry keys
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • Suspicious behavior: EnumeratesProcesses
                  PID:3332
                • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                  C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                  1⤵
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Identifies Wine through registry keys
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • Suspicious behavior: EnumeratesProcesses
                  PID:5352

                Network

                      MITRE ATT&CK Enterprise v15

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n4zftpal.default-release\activity-stream.discovery_stream.json

                        Filesize

                        19KB

                        MD5

                        d5b053ac04285be153a2acfc11d57a28

                        SHA1

                        55936ad85df8fdffd3b05d4e6ace4769cb25ff5e

                        SHA256

                        c8a977573a70613996be8b9a713bc6c9fdf5c6d44de19a9724d5fe28e9bf3a47

                        SHA512

                        4b9652ffb8c6385b9f51f3e31f57a24439a6946f5aa6ed486bd62eb1f821a4f8350fffd1ab14e64db658e3d3130361c88cb6ede68f9e22269a165648dad759b0

                      • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n4zftpal.default-release\cache2\entries\39DB9E847E680B765D7B04FCCE6BF5BC0225F878

                        Filesize

                        13KB

                        MD5

                        c356c3d0df65384b6f53f5b736a06c67

                        SHA1

                        5cba374b63290889031f48df7021d1583aef62c9

                        SHA256

                        da8fbcf8b75f1db5f1af34e373ea5e5d087beffad5ba14f9d2a75dfad8c1712f

                        SHA512

                        53aa67fcd28784d39e48e8abea4fd96851d90c299ab9e155c82129bdec701b380a1a3af1f6eed1ab0128f45db5a82e7014eb90418d01eaf7c6857ea59fe82691

                      • C:\Users\Admin\AppData\Local\Temp\1006666001\03a6b80412.exe

                        Filesize

                        4.2MB

                        MD5

                        b1b4153d97719d001aa7c8b9a3f54f1e

                        SHA1

                        3e4cec45fd6cde0e48bc9bae946dc7b165547679

                        SHA256

                        48afa83eea80b88de1f93b429af9992582dccbc3d89181dc352cefceac7629bb

                        SHA512

                        f0688c04cf40f5c1b2e19b2407e48908d4205db62e9283dd433ea3bb65cc4f8a26218b286391391e8881e85ee01765ffea941bc9d65ee3b80ee7a5db7aa4e900

                      • C:\Users\Admin\AppData\Local\Temp\1006859001\4b3e1ca893.exe

                        Filesize

                        1.8MB

                        MD5

                        c3384cbcfd7f594f40fe489f5f67a36f

                        SHA1

                        37f8f298e7ef281a821e38cc08abb72d679c9b2d

                        SHA256

                        dbaa65c338340985131358f76f903a03045da28aaaa6297f37bf8f5123defcf2

                        SHA512

                        e68fc70a6bd04045e13712f95bee04070eeb2fc99cd02703eb15a583dfa49e0ee1e70a08b294072e0a6676cdaeb9e4dbd10fc06e6f3d8d7cf6ded951afc215ea

                      • C:\Users\Admin\AppData\Local\Temp\1006860001\ddae024620.exe

                        Filesize

                        1.7MB

                        MD5

                        a088750a78a264d0204488fe6bec85d6

                        SHA1

                        d7cc85364e6481188de1912ee35692f09a126f44

                        SHA256

                        d165a92f40ed9c2ec60c492ab46e9632e740d1af310215a6b464f82dd8418e21

                        SHA512

                        d00d35fff97f54d304a8f70b6916902987795124e7aeff103c248c2f7663bd61f8d9ed4985ceae8556cff308494c2063235aff7285f0892bea12850e802ca4ea

                      • C:\Users\Admin\AppData\Local\Temp\1006861001\b92717cf25.exe

                        Filesize

                        900KB

                        MD5

                        95821147e42ab35fdaf3ed0147f6e84c

                        SHA1

                        4e8b988e3d461eb5878d6a59b89a079570cec9ef

                        SHA256

                        eea6ddef3eb7b22725ef536cd859593e65ede2edf38955533b85bf0e1f1667f5

                        SHA512

                        5f4203170cab652dc91bdd39f35ca8ad88aa867a3edd089009ecd0ae441709766724e6e20307fe8e77d2a333ceece4db517e9d6e421ff8e129904b4ee7fb54fe

                      • C:\Users\Admin\AppData\Local\Temp\1006862001\14620c93ed.exe

                        Filesize

                        2.6MB

                        MD5

                        20d45eddc965d7714b3412a9bf7ebe7e

                        SHA1

                        888e3f63a63cef84f8b4deb3ef570967725766af

                        SHA256

                        fcc5177127503eb837af31d6d1c483ad753da3c863c415224cc0c3b31911b331

                        SHA512

                        441911b9d3dbdac8a530420b40e7f4ebe7e9a3b68daab44156aa8a0c230267d7c8df9cc3aaf97c485d4969d6d63f33eeff88315dc0026bce68740cd4e977baff

                      • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

                        Filesize

                        3.1MB

                        MD5

                        e9d77ca53bf0845644dd8b2a6a24f133

                        SHA1

                        58700e47b86cf22ca0e0b96ffa10f64fb11f26c9

                        SHA256

                        9b28f484a66dfc0a5ab87cae9a7ce45e3a542c06227cfd28f0db4338f5bc3f15

                        SHA512

                        1bbc659dcb319fcc71f2953a637e55fed2c7249e83bfd3f3ecf963a34482680906b1add3a422594d4912d9aa57d1748bac51ac64dfaa0d5638ef6fcc2d41435e

                      • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                        Filesize

                        479KB

                        MD5

                        09372174e83dbbf696ee732fd2e875bb

                        SHA1

                        ba360186ba650a769f9303f48b7200fb5eaccee1

                        SHA256

                        c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                        SHA512

                        b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                      • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                        Filesize

                        13.8MB

                        MD5

                        0a8747a2ac9ac08ae9508f36c6d75692

                        SHA1

                        b287a96fd6cc12433adb42193dfe06111c38eaf0

                        SHA256

                        32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                        SHA512

                        59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\AlternateServices.bin

                        Filesize

                        6KB

                        MD5

                        f7dfc4e10ab9cef043c5e39f0f0b3a42

                        SHA1

                        4ac827b76bbeaa70b1c662792be00f7328042c8e

                        SHA256

                        89f6d354ccea94ced6d8f79e9c5a10513501822e42a7aded859535c5e9995db0

                        SHA512

                        d52dc22f1374be8b461d256e474601d4c51e4bf9691c70b99614e82cf4eb6a9da13b899306b631fbe97f7b30c5f7215f8d2c46fb5fb6230408e298b678140625

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\AlternateServices.bin

                        Filesize

                        8KB

                        MD5

                        df4d5b80c32745fbc9e7080f5606d57a

                        SHA1

                        ac61cf94b88627a5c22a8e43509003c724698e95

                        SHA256

                        e53a77732ed8bc4c58af28959b58b6566788273b1807ca76577f30721ac29254

                        SHA512

                        1549dfd468fb78ee087b081ec2f20e599bce189e7a36e5cb906f78e2e35ef4e6ccd92c551a3dd1ba11e75ae5e53545870ca9f432cda159f804eb6f9f2e091831

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\AlternateServices.bin

                        Filesize

                        12KB

                        MD5

                        7bfda0b26c6e1ab593c4cf2b04ca8dc2

                        SHA1

                        412b7ae3edf855c7e8871a83d92cc1da3ce0021d

                        SHA256

                        1ee892886fa46319b77c8e6de4f45343f1e849ca6148d104773d7774bf5e52e8

                        SHA512

                        2ce2ec1d85dea153c39ec68b390a18c4a98c6c514ed1a39e55820683425284862d6646a564a551c468a6a974e2f31ddf11b3c84c5701541cc7ea12b567947223

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\datareporting\glean\db\data.safe.tmp

                        Filesize

                        5KB

                        MD5

                        5672599235e08dbd300826223b03362f

                        SHA1

                        b617088f8113af7eedf3ea2975c0395b5bed6a81

                        SHA256

                        d0791da8a1e885d260349c55eda2c62f7f626b74ab515fb9519ac64c657d36a5

                        SHA512

                        9e405b2b7eee364e9d6ef93ab51c3bffacb9c5002270a4b525cc215206d94d86c05172295d835785b9172188ee0172553de9d7ea7563f3f1507c44a3a915f243

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\datareporting\glean\db\data.safe.tmp

                        Filesize

                        15KB

                        MD5

                        6a266b9a6bbbea79cc83adf1b2433f0e

                        SHA1

                        e0f2dc207f414f1a34a2213464f3f7942e63e06b

                        SHA256

                        ccf9ded6cb407cf5d7293406a2d2b1b9ab2956284fffcf83044dbd6a48c036cf

                        SHA512

                        d6065cf40005a4ddb2885ca192e0d1afdb41088cc303aa3096527eaeb78c027c543dd5e84147798df6f29421778219efd7371707dd2b6560737f3fb210e4a8f2

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\datareporting\glean\db\data.safe.tmp

                        Filesize

                        6KB

                        MD5

                        db4be9d784cfc1a73421c009d198976b

                        SHA1

                        f0a25e236d1edbb90c52f14e4283c4712bb1bbca

                        SHA256

                        000d79b107ad2d8d45c846edfa6a8882356a1693425b471838a6c1f2f23892af

                        SHA512

                        b7fb93c7ee0317a17df44f65d7775dd871af2f222e23bf7cc7ff35fc0e48c06fce97ef4daddee243b9ba08ebc17bb1d637dc35c8565593c13b37fd357c95b623

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\datareporting\glean\pending_pings\10e288f9-eb80-440b-b944-86fb56b4132d

                        Filesize

                        671B

                        MD5

                        1f0ef687de67b955aa17f108b4248deb

                        SHA1

                        a02452afc279be5e43d4f74498b41529a913630d

                        SHA256

                        c93985b3533d9378ff0a475d38b44bd4cca2072b080af314f61efe1a1b32b9ef

                        SHA512

                        5a0e5c0fe38f4273bb1ec2987e88be6303fe77c29c8fa208829b71fc3dcf724a702201e7a202af8a0cddc32a5a912b02e91de50516c522148bb4bd46a3a4462e

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\datareporting\glean\pending_pings\3f727ead-5caf-4f3a-a0d6-31a60348ea43

                        Filesize

                        25KB

                        MD5

                        dd7d37835245a6b36c9c4a61084804cf

                        SHA1

                        a4d872495f05d78405206080e4becc2243458f36

                        SHA256

                        51945cb2524f1bfc67186bb8dc91b81befe8baff16803d7c2e5a73d98c1ee786

                        SHA512

                        069b7a600ca90856df4c8544e6a663ab7f8609cf9e4bcd4bbfdf3c979be337e8bb665450c147a3776ecc8fa5e212e2016898efa6b740914e14a99c6d63ca53f2

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\datareporting\glean\pending_pings\e5828543-7ca3-48a8-a590-92c416b01542

                        Filesize

                        982B

                        MD5

                        1a9a3c912322464ff8306b4cd87b1ecb

                        SHA1

                        0d78e4fd9ad9d7aaaa19ac4edc3dddd892d1e581

                        SHA256

                        579e180f6feb40d8c73c3bdbbb1eae8416668c831b108671465d6d69a9c8d129

                        SHA512

                        0711f9d46063d1f99d8d4ffe1ab78c3f90d4e8df96dbd40e41f72129fd8a68c300439d8c53c91c65a3ddcd71da4cd3dad737964ed191025f79d7ce7bc16bd0a4

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

                        Filesize

                        1.1MB

                        MD5

                        842039753bf41fa5e11b3a1383061a87

                        SHA1

                        3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                        SHA256

                        d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                        SHA512

                        d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

                        Filesize

                        116B

                        MD5

                        2a461e9eb87fd1955cea740a3444ee7a

                        SHA1

                        b10755914c713f5a4677494dbe8a686ed458c3c5

                        SHA256

                        4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                        SHA512

                        34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

                        Filesize

                        372B

                        MD5

                        bf957ad58b55f64219ab3f793e374316

                        SHA1

                        a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                        SHA256

                        bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                        SHA512

                        79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

                        Filesize

                        17.8MB

                        MD5

                        daf7ef3acccab478aaa7d6dc1c60f865

                        SHA1

                        f8246162b97ce4a945feced27b6ea114366ff2ad

                        SHA256

                        bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                        SHA512

                        5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\prefs-1.js

                        Filesize

                        16KB

                        MD5

                        9f0d545d143d7bd66121a0222caf0e29

                        SHA1

                        93814a4c0536b56fbd450a179116d545af8d9e5c

                        SHA256

                        db7152141a2766d6cce37f4f917445cab435b684cbffb42e5a1fd84db476dd2f

                        SHA512

                        6d35639cafecb807eebc1db0ed63fb79ed316b4a83936f991293e4b3f43dd84f6533ff99d8912d7910263c7c5b29523145ad45d37ab37914df4825a8be8dbbc1

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\prefs.js

                        Filesize

                        10KB

                        MD5

                        61f2fbf7f90e52ce617766db11941700

                        SHA1

                        ab0df6fac65b0ede03f3281514495758744d56d2

                        SHA256

                        b077945e07f395378d1b9c5958aaa86fcc8a631a66f27c6a9b73dc87c8d92a1f

                        SHA512

                        c2d8b150ee6a7e153a84f6aeab85fc4548b8c62bfd5cccad5b92b948531ebf7ace8ac6c5dc73f72358dc5c8cb0e2a77d27ac4fde7556a52e99c7d1cdd7e4a3f7

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\prefs.js

                        Filesize

                        11KB

                        MD5

                        116e1510f43f6947f6ef55d8c0d29c4d

                        SHA1

                        d58e83529ec8c2eac5b980870e3f7836154909fb

                        SHA256

                        488cde103b478f2d5a3ee6df55d06f652de524f91fd3d6bb352e7bc0b31a9f05

                        SHA512

                        30b76632bdd98d8b3dee37a4662594e21391710958c47bd0964973670b6380df899d0faf153796ff1706ba65d73e65e868e79ec058493463635ff5384ed386d5

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\prefs.js

                        Filesize

                        11KB

                        MD5

                        51f532c97b312ceccf72f107c69c0b51

                        SHA1

                        f1a503088bc7037fa99626637b0b9d43087a6a73

                        SHA256

                        c5bb77f8a23483fbb3e596d43b05a2e8fb74119e44c5182ee58f5aee96adc2bf

                        SHA512

                        2871c22d50a0b4ae495c20952e180cc1f7cfb778dfc59a902f842d0e827c2aa47a12d99c5849b14ab243bdf1e28a1c89abefc262a746f2157117de89f900a984

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\prefs.js

                        Filesize

                        11KB

                        MD5

                        b21f3426e26a62b0363fb49a18889f09

                        SHA1

                        27aea5d75311468452a784a5b450786b5bf2c8fc

                        SHA256

                        54d490d596f56f34f7ae6b19e3e7f0bf827defd7a5246ed911b0e84ccc293ecb

                        SHA512

                        65971ceca2aaa233aa5a20e00c5a7341e1ed5f4fb82d48e2a2da7de644667639c66d2c67654cce8f994e789fc79e193d0fad962d00318767df888ae2d41c8a42

                      • memory/1116-18-0x0000000000E71000-0x0000000000ED9000-memory.dmp

                        Filesize

                        416KB

                      • memory/1116-17-0x0000000000E70000-0x0000000001189000-memory.dmp

                        Filesize

                        3.1MB

                      • memory/1116-1-0x0000000077584000-0x0000000077586000-memory.dmp

                        Filesize

                        8KB

                      • memory/1116-2-0x0000000000E71000-0x0000000000ED9000-memory.dmp

                        Filesize

                        416KB

                      • memory/1116-0-0x0000000000E70000-0x0000000001189000-memory.dmp

                        Filesize

                        3.1MB

                      • memory/1116-3-0x0000000000E70000-0x0000000001189000-memory.dmp

                        Filesize

                        3.1MB

                      • memory/1116-4-0x0000000000E70000-0x0000000001189000-memory.dmp

                        Filesize

                        3.1MB

                      • memory/1352-23-0x0000000000AB0000-0x0000000000DC9000-memory.dmp

                        Filesize

                        3.1MB

                      • memory/1352-3094-0x0000000000AB0000-0x0000000000DC9000-memory.dmp

                        Filesize

                        3.1MB

                      • memory/1352-2841-0x0000000000AB0000-0x0000000000DC9000-memory.dmp

                        Filesize

                        3.1MB

                      • memory/1352-22-0x0000000000AB0000-0x0000000000DC9000-memory.dmp

                        Filesize

                        3.1MB

                      • memory/1352-21-0x0000000000AB0000-0x0000000000DC9000-memory.dmp

                        Filesize

                        3.1MB

                      • memory/1352-1225-0x0000000000AB0000-0x0000000000DC9000-memory.dmp

                        Filesize

                        3.1MB

                      • memory/1352-20-0x0000000000AB1000-0x0000000000B19000-memory.dmp

                        Filesize

                        416KB

                      • memory/1352-38-0x0000000000AB1000-0x0000000000B19000-memory.dmp

                        Filesize

                        416KB

                      • memory/1352-19-0x0000000000AB0000-0x0000000000DC9000-memory.dmp

                        Filesize

                        3.1MB

                      • memory/1352-3086-0x0000000000AB0000-0x0000000000DC9000-memory.dmp

                        Filesize

                        3.1MB

                      • memory/1352-3095-0x0000000000AB0000-0x0000000000DC9000-memory.dmp

                        Filesize

                        3.1MB

                      • memory/1352-3101-0x0000000000AB0000-0x0000000000DC9000-memory.dmp

                        Filesize

                        3.1MB

                      • memory/1352-486-0x0000000000AB0000-0x0000000000DC9000-memory.dmp

                        Filesize

                        3.1MB

                      • memory/1352-40-0x0000000000AB0000-0x0000000000DC9000-memory.dmp

                        Filesize

                        3.1MB

                      • memory/1352-3092-0x0000000000AB0000-0x0000000000DC9000-memory.dmp

                        Filesize

                        3.1MB

                      • memory/1352-502-0x0000000000AB0000-0x0000000000DC9000-memory.dmp

                        Filesize

                        3.1MB

                      • memory/1352-3096-0x0000000000AB0000-0x0000000000DC9000-memory.dmp

                        Filesize

                        3.1MB

                      • memory/1352-43-0x0000000000AB0000-0x0000000000DC9000-memory.dmp

                        Filesize

                        3.1MB

                      • memory/1352-125-0x0000000000AB0000-0x0000000000DC9000-memory.dmp

                        Filesize

                        3.1MB

                      • memory/1352-63-0x0000000000AB0000-0x0000000000DC9000-memory.dmp

                        Filesize

                        3.1MB

                      • memory/1352-3097-0x0000000000AB0000-0x0000000000DC9000-memory.dmp

                        Filesize

                        3.1MB

                      • memory/1352-3100-0x0000000000AB0000-0x0000000000DC9000-memory.dmp

                        Filesize

                        3.1MB

                      • memory/3064-65-0x00000000002B0000-0x0000000000782000-memory.dmp

                        Filesize

                        4.8MB

                      • memory/3064-83-0x00000000002B0000-0x0000000000782000-memory.dmp

                        Filesize

                        4.8MB

                      • memory/3108-81-0x0000000000A70000-0x0000000001105000-memory.dmp

                        Filesize

                        6.6MB

                      • memory/3108-82-0x0000000000A70000-0x0000000001105000-memory.dmp

                        Filesize

                        6.6MB

                      • memory/3332-3085-0x0000000000AB0000-0x0000000000DC9000-memory.dmp

                        Filesize

                        3.1MB

                      • memory/3332-3084-0x0000000000AB0000-0x0000000000DC9000-memory.dmp

                        Filesize

                        3.1MB

                      • memory/3460-139-0x0000000000A30000-0x0000000000CE0000-memory.dmp

                        Filesize

                        2.7MB

                      • memory/3460-497-0x0000000000A30000-0x0000000000CE0000-memory.dmp

                        Filesize

                        2.7MB

                      • memory/3460-488-0x0000000000A30000-0x0000000000CE0000-memory.dmp

                        Filesize

                        2.7MB

                      • memory/3460-327-0x0000000000A30000-0x0000000000CE0000-memory.dmp

                        Filesize

                        2.7MB

                      • memory/3460-126-0x0000000000A30000-0x0000000000CE0000-memory.dmp

                        Filesize

                        2.7MB

                      • memory/3588-47-0x0000000000AB0000-0x0000000000DC9000-memory.dmp

                        Filesize

                        3.1MB

                      • memory/3588-48-0x0000000000AB0000-0x0000000000DC9000-memory.dmp

                        Filesize

                        3.1MB

                      • memory/4748-44-0x00000000000C0000-0x0000000000C6C000-memory.dmp

                        Filesize

                        11.7MB

                      • memory/4748-45-0x00000000000C0000-0x0000000000C6C000-memory.dmp

                        Filesize

                        11.7MB

                      • memory/4748-41-0x00000000000C0000-0x0000000000C6C000-memory.dmp

                        Filesize

                        11.7MB

                      • memory/4748-42-0x00000000000C0000-0x0000000000C6C000-memory.dmp

                        Filesize

                        11.7MB

                      • memory/5352-3099-0x0000000000AB0000-0x0000000000DC9000-memory.dmp

                        Filesize

                        3.1MB