Analysis

  • max time kernel
    142s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12-12-2024 09:15

General

  • Target

    ae55b79e19c6c52a9716daea842579ee4a765604c6fa227e3ac3e3a3fe66215f.exe

  • Size

    3.1MB

  • MD5

    c55e38d57fef9812269597d2f23d0d3f

  • SHA1

    cb868ad16bdcefecc9392bdf494f62775d4547fd

  • SHA256

    ae55b79e19c6c52a9716daea842579ee4a765604c6fa227e3ac3e3a3fe66215f

  • SHA512

    911acba5f1f0a71fdb7f47dd07ec1698ce4eaea34a3ce642701344ac9df18e6a5a6ea372f07e94bbc8e2ab819ee0c00288536c5cea574ca64204eb8cb949d530

  • SSDEEP

    49152:QAtsmbew+zi12NFJ/O665qI+1MZxHWdh9zC385lYuLR:ftLKw+zi2NFJ/O665qz1MZxy+38LYuF

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

stealc

Botnet

stok

C2

http://185.215.113.206

Attributes
  • url_path

    /c4becf79229cb002.php

Extracted

Family

lumma

C2

https://impend-differ.biz/api

https://print-vexer.biz/api

https://dare-curbys.biz/api

https://covery-mover.biz/api

https://formy-spill.biz/api

https://dwell-exclaim.biz/api

https://zinc-sneark.biz/api

https://se-blurry.biz/api

Extracted

Family

lumma

C2

https://covery-mover.biz/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Amadey family
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

  • Lumma family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

  • Stealc family
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 12 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 7 IoCs
  • Identifies Wine through registry keys 2 TTPs 6 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 5 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 19 IoCs
  • Suspicious use of AdjustPrivilegeToken 11 IoCs
  • Suspicious use of FindShellTrayWindow 34 IoCs
  • Suspicious use of SendNotifyMessage 32 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\ae55b79e19c6c52a9716daea842579ee4a765604c6fa227e3ac3e3a3fe66215f.exe
    "C:\Users\Admin\AppData\Local\Temp\ae55b79e19c6c52a9716daea842579ee4a765604c6fa227e3ac3e3a3fe66215f.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:3672
    • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
      "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2604
      • C:\Users\Admin\AppData\Local\Temp\1014337001\0598c0c7a7.exe
        "C:\Users\Admin\AppData\Local\Temp\1014337001\0598c0c7a7.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:3160
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM firefox.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:692
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM chrome.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2932
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM msedge.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:3444
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM opera.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2668
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM brave.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:752
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4036
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
            5⤵
            • Checks processor information in registry
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:1364
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2032 -parentBuildID 20240401114208 -prefsHandle 1948 -prefMapHandle 1940 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b2f0fde7-9937-4dac-8be0-0e1c2c6a9b29} 1364 "\\.\pipe\gecko-crash-server-pipe.1364" gpu
              6⤵
                PID:4160
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2468 -parentBuildID 20240401114208 -prefsHandle 2444 -prefMapHandle 2440 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1af7bd4f-cf20-4341-8716-21112e149406} 1364 "\\.\pipe\gecko-crash-server-pipe.1364" socket
                6⤵
                  PID:3724
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2960 -childID 1 -isForBrowser -prefsHandle 3152 -prefMapHandle 3040 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1252 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9dd30900-595d-43be-8c8c-4b1d2a29bf59} 1364 "\\.\pipe\gecko-crash-server-pipe.1364" tab
                  6⤵
                    PID:3224
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3928 -childID 2 -isForBrowser -prefsHandle 3920 -prefMapHandle 3916 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1252 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {418b3b78-7975-4c49-98c6-058164e85bcc} 1364 "\\.\pipe\gecko-crash-server-pipe.1364" tab
                    6⤵
                      PID:3172
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4744 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4736 -prefMapHandle 4560 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d92e4979-b53b-47eb-a69e-887ba688c1d7} 1364 "\\.\pipe\gecko-crash-server-pipe.1364" utility
                      6⤵
                      • Checks processor information in registry
                      PID:1992
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5596 -childID 3 -isForBrowser -prefsHandle 5576 -prefMapHandle 5572 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1252 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dca36aa5-7c98-4cde-a4f7-4dec1b343028} 1364 "\\.\pipe\gecko-crash-server-pipe.1364" tab
                      6⤵
                        PID:6024
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5256 -childID 4 -isForBrowser -prefsHandle 5724 -prefMapHandle 5728 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1252 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6ea6180f-05cd-42c7-bc2a-88f8e1d974e8} 1364 "\\.\pipe\gecko-crash-server-pipe.1364" tab
                        6⤵
                          PID:6036
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5568 -childID 5 -isForBrowser -prefsHandle 5900 -prefMapHandle 5904 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1252 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0ed8af6d-ec1c-4ed8-bad0-fbe29d71d791} 1364 "\\.\pipe\gecko-crash-server-pipe.1364" tab
                          6⤵
                            PID:6064
                    • C:\Users\Admin\AppData\Local\Temp\1014338001\1fbfa50aaa.exe
                      "C:\Users\Admin\AppData\Local\Temp\1014338001\1fbfa50aaa.exe"
                      3⤵
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: EnumeratesProcesses
                      PID:4300
                    • C:\Users\Admin\AppData\Local\Temp\1014339001\3e5aa71677.exe
                      "C:\Users\Admin\AppData\Local\Temp\1014339001\3e5aa71677.exe"
                      3⤵
                      • Modifies Windows Defender Real-time Protection settings
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Windows security modification
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:3384
                    • C:\Users\Admin\AppData\Local\Temp\1014340001\ae913001c1.exe
                      "C:\Users\Admin\AppData\Local\Temp\1014340001\ae913001c1.exe"
                      3⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      PID:5080
                • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                  C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                  1⤵
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Identifies Wine through registry keys
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • Suspicious behavior: EnumeratesProcesses
                  PID:5688
                • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                  C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                  1⤵
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Identifies Wine through registry keys
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • Suspicious behavior: EnumeratesProcesses
                  PID:4148

                Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\lhmx4teg.default-release\activity-stream.discovery_stream.json

                  Filesize

                  22KB

                  MD5

                  a1d447a26db7d8f9e1eb974b622a494c

                  SHA1

                  67c4e5b48099ad0e2a9a09d2b4b8858da6e2faee

                  SHA256

                  fe2245c50574390d5c31c30f17b2dffab0eb4fd450737251998468e719961041

                  SHA512

                  84dd7f553739f09ec4d4e482d531537f85ac6f34db52ef5818d0e9f468ff05641149947d9f5750c9d080288bd5377b14106a96700237fabea3132198cd64664a

                • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\lhmx4teg.default-release\cache2\entries\92F4D5A4F9CED6E2E644D803AEE3647A0EA4D984

                  Filesize

                  13KB

                  MD5

                  01bcbb0eafe8b0b9965960367896cdf2

                  SHA1

                  bf8854f610f86b9479b553fcb917e5299a1249e6

                  SHA256

                  4162425ef656c446243147d22f50ab3db20d53c8373244c7757924a2680da5d5

                  SHA512

                  8754037bf92d228f1f3b57c4b7026f8a14cfc2e8f77f966bb82759e650e474aafe54b9dbe0089baf10132d1963979c876bfc0bfb902e9bc46fdbb782d8ad4b24

                • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\lhmx4teg.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

                  Filesize

                  15KB

                  MD5

                  96c542dec016d9ec1ecc4dddfcbaac66

                  SHA1

                  6199f7648bb744efa58acf7b96fee85d938389e4

                  SHA256

                  7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

                  SHA512

                  cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

                • C:\Users\Admin\AppData\Local\Temp\1014337001\0598c0c7a7.exe

                  Filesize

                  949KB

                  MD5

                  0f47fcde37bf99983f14b406fe58f131

                  SHA1

                  6f6ba643fa07d97be4c0a1c5250dff3a6b67a0ff

                  SHA256

                  e93220353bc583c6c042a2bd0f3b404a77da4b5d1781051bef8132e22abc12c2

                  SHA512

                  ddf01c9bb332edee6c3cd4c803ac48ae388389b5ed9e7e294664f4a4b12f823d86099cb831745d6bea8f562c7a59d61e59ff78870d2eedd64f549c48fb345aa4

                • C:\Users\Admin\AppData\Local\Temp\1014338001\1fbfa50aaa.exe

                  Filesize

                  1.7MB

                  MD5

                  6731bd7e893f440a5f73edfd40b73112

                  SHA1

                  8e396ca101830e0116881c8d8c81c6d5e7918afe

                  SHA256

                  599399619509681016345f5e4e50f6edd38a70496201d1a9fbfe5c53d7f4690b

                  SHA512

                  d0247ad0a1392a9b622d08e22feee7d79854c8f1492f0b4d5d5e669f7efce409e3a3961f8229ebb40aca97ed6e36066b40393b3e9cb78d7356d34d530c125110

                • C:\Users\Admin\AppData\Local\Temp\1014339001\3e5aa71677.exe

                  Filesize

                  2.7MB

                  MD5

                  9aa3e28acbd0b5a2e045a6d513c93b6b

                  SHA1

                  9381e49745b0e1c2fab053f8d4d2a59bc61988f1

                  SHA256

                  2f1568be0dd8f9a154b003441a09464578fc012d81f60faab98f8ba9c1913898

                  SHA512

                  994aacaaafb7a60400aa05ad2524eac325b50b46109a75a71e2907e0dc08b5147ad7f63d308c72b92dc70d232335134815b461b00c18c722a365e6e0f8491471

                • C:\Users\Admin\AppData\Local\Temp\1014340001\ae913001c1.exe

                  Filesize

                  2.5MB

                  MD5

                  2a78ce9f3872f5e591d643459cabe476

                  SHA1

                  9ac947dfc71a868bc9c2eb2bd78dfb433067682e

                  SHA256

                  21a2ac44acd7a640735870eebfd04b8dc57bc66877cb5be3b929299e86a43dae

                  SHA512

                  03e2cd8161a1394ee535a2ea7d197791ab715d69a02ffab98121ec5ac8150d2b17a9a32a59307042c4bbeffad7425b55efa047651de6ed39277dba80711454f9

                • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

                  Filesize

                  3.1MB

                  MD5

                  c55e38d57fef9812269597d2f23d0d3f

                  SHA1

                  cb868ad16bdcefecc9392bdf494f62775d4547fd

                  SHA256

                  ae55b79e19c6c52a9716daea842579ee4a765604c6fa227e3ac3e3a3fe66215f

                  SHA512

                  911acba5f1f0a71fdb7f47dd07ec1698ce4eaea34a3ce642701344ac9df18e6a5a6ea372f07e94bbc8e2ab819ee0c00288536c5cea574ca64204eb8cb949d530

                • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                  Filesize

                  479KB

                  MD5

                  09372174e83dbbf696ee732fd2e875bb

                  SHA1

                  ba360186ba650a769f9303f48b7200fb5eaccee1

                  SHA256

                  c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                  SHA512

                  b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                  Filesize

                  13.8MB

                  MD5

                  0a8747a2ac9ac08ae9508f36c6d75692

                  SHA1

                  b287a96fd6cc12433adb42193dfe06111c38eaf0

                  SHA256

                  32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                  SHA512

                  59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\AlternateServices.bin

                  Filesize

                  8KB

                  MD5

                  0b61c0b26de31bbb9a274ab8ef7fa9c3

                  SHA1

                  7f836b03bf2ec3d1fa4fe93de65338a63ed174a0

                  SHA256

                  fa9b69abb8ed63321debbe324a94b32a38a770e0085ea6a2811212cf70a7b998

                  SHA512

                  027668a5f89e3c77aaf737f89b3903edb401ea3ce7b43200798f6aaf690ce8311064f324f90a267dfd06363190ebc5f1cf78071f925c6198a69c48f3aee86182

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\AlternateServices.bin

                  Filesize

                  10KB

                  MD5

                  e1247f79b72095eccc54cdaf8940cec6

                  SHA1

                  b9e34529019d7aed7490e501856193b67a0b0acc

                  SHA256

                  fe470023ce13e9c38a4577724e744b087b2382a58faa8b1f94683650d65983a6

                  SHA512

                  3364c6355b6f33180cc72d55acb6a807b242d7714ce74c1476d2d3e5cb70bdcc2d81333e0b79eb4631d0ca8071063e662be31d669d708a65d706984983e46b4f

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\AlternateServices.bin

                  Filesize

                  6KB

                  MD5

                  6f6d6770ca4d6c26e575c6b8acad3e64

                  SHA1

                  5cf38e20759f387f28046f64c42811f4129733ab

                  SHA256

                  72d6c4c30d714f0ab37464b470560568c797573054e535bcc2c17408d57c6068

                  SHA512

                  8c55f4098567a8812f42134b11ea48b448b8f7cee6291ca6c50d4d644b45e5cbbbfb63907b99a200d144e005ecd2a488dceaa847353bbc2fb0be3aa65d922ccd

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\datareporting\glean\db\data.safe.tmp

                  Filesize

                  15KB

                  MD5

                  ecb5ce68bdec03d23e20ada2e6a39f1f

                  SHA1

                  e0331dc62c9da2cd81f1b57a65fa7c98e5673c0f

                  SHA256

                  c54c62e12e0a4ce2311f35afedaadaa033ea6a65ac9f562113a764a85085f1f6

                  SHA512

                  d79bc8942a49e0d1e3581a1044191d4436ac9483ea3b236f1b090fe76a4a787d52696d321909fc6b63b55ceaa7d08ada2db8e9b3f1c991e7452cb18e358b8c3e

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\datareporting\glean\db\data.safe.tmp

                  Filesize

                  5KB

                  MD5

                  272adbcca3adadabe7cc5e4d218c1019

                  SHA1

                  04c55909fe7dd467e7900b04228579dabfd7aab5

                  SHA256

                  7394b00170c3933a8fa588b48602e33c6add956e62ce69d81018c97e77cb6efa

                  SHA512

                  b34e5717e7d984992f717e920b80102fe65e1d5dd5251d37a1845cd8cc2ddcac18638a640f6d10848252524b8584822066a5699e260031601630bf306520e5ca

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\datareporting\glean\pending_pings\493688f9-096c-490d-8a2d-8a1467319e32

                  Filesize

                  28KB

                  MD5

                  e66b9195a96c5b004df973b89136df6f

                  SHA1

                  e54b73af50de78ef81e76de9967f63a0ce7c7866

                  SHA256

                  21a26956ad92b2cedc32b91a0fa9fe11dc08cb9b6b239cf753e94f295c36d8b3

                  SHA512

                  ee03e5fabfc239554a07782a137a9408aa4d280469112eb35ec563cb19f226271a765fb5e0888a62b44ed41b9e193468b58cee7fa94f894530a8d2021eda4852

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\datareporting\glean\pending_pings\c99b1f8b-51a4-429a-b7c7-9dd47f1fef1f

                  Filesize

                  671B

                  MD5

                  8ff1edf071186913196e2404ef6e26f3

                  SHA1

                  d7904191c624424abe81291fa48efb6e8ccd3fb5

                  SHA256

                  fdd40ec5856cbe7c6d1a5a2702c7ecc0faf100c4ae1f83292e9de803cfd0d227

                  SHA512

                  3d92596430cb67387d4ca7ea8860d7cd015820a594ffb9c956eef7d530aaaa48ab5285d4df121302da212050a3d5edd8281bbfd4777ff914dfef03278f11029b

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\datareporting\glean\pending_pings\e2b1b521-469c-47b6-a8a0-1665c94751a3

                  Filesize

                  982B

                  MD5

                  a3af9a68dd4facb2865fa9ec98ab70f4

                  SHA1

                  70f2d6dc6bdf3c4b66bef51a4d1667dd4f66b287

                  SHA256

                  51fe21c2ddb287b447057651032cc071262f5cb1b5269d258d73ddd2725b94af

                  SHA512

                  f5a4269f19995b6bd09d1da63da42cb8635501391411742e3e523c986898f90c5539b019a1203b6165034489a93f0d868a50c919d9a67fcfb6eea94bcc363e0e

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

                  Filesize

                  1.1MB

                  MD5

                  842039753bf41fa5e11b3a1383061a87

                  SHA1

                  3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                  SHA256

                  d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                  SHA512

                  d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

                  Filesize

                  116B

                  MD5

                  2a461e9eb87fd1955cea740a3444ee7a

                  SHA1

                  b10755914c713f5a4677494dbe8a686ed458c3c5

                  SHA256

                  4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                  SHA512

                  34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

                  Filesize

                  372B

                  MD5

                  bf957ad58b55f64219ab3f793e374316

                  SHA1

                  a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                  SHA256

                  bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                  SHA512

                  79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

                  Filesize

                  17.8MB

                  MD5

                  daf7ef3acccab478aaa7d6dc1c60f865

                  SHA1

                  f8246162b97ce4a945feced27b6ea114366ff2ad

                  SHA256

                  bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                  SHA512

                  5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\prefs-1.js

                  Filesize

                  12KB

                  MD5

                  88ef2cc2b1d8a4b4e1971df34444d4ba

                  SHA1

                  fc4292a7302fc0e00e1fe87b8b473f2bb5d66370

                  SHA256

                  c522a2cf0cbcd2732a6b8fcb5bd714bc1cd486101257d1b000709d602a0b4beb

                  SHA512

                  f8fe1ec058fb3624781ff161ed4516c7f48b9158c21fb96305317c23730a160018baefbcef69306fe9ef8591339992cb7558d0c88bc8b4c7f6f61b73cbf5c103

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\prefs-1.js

                  Filesize

                  15KB

                  MD5

                  1844b30df03d0658bf8b78cc9c37aedb

                  SHA1

                  3588fc419e2e3cdf8f840f7e28369fcdb0959f94

                  SHA256

                  ffd0147df29b49374605172d658ef61da9e1af20fdd3b13ab5ab26e85914e01d

                  SHA512

                  f73b78e5c6636ee8a4f8f1f8fec15806ea2a3d3ce3cfd67e97f5d013bda4a28b29e2f85978953794a0928b359373b007d983c4c0122d38d913b4a4e50d0a80e4

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\prefs.js

                  Filesize

                  10KB

                  MD5

                  e25e04807b16ec452eb0a2978162e6a1

                  SHA1

                  bdfe76f9f3d8ae4900698c6b41d0a34a46a4eb03

                  SHA256

                  474b7a4a0b861f904749f924cfabe1d07ec0bc947934e820b57be5663fd2ffc3

                  SHA512

                  f7621719ff2f8877defc3356c595721276dbf2513edfa613c63b4489a31edce32b06b1c905a7b0d502fa9ba7fc5bdffc5967bfd7016735ebab4c4138a68db1b5

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\prefs.js

                  Filesize

                  10KB

                  MD5

                  54dcc3eaf0321f11008f314229bb595e

                  SHA1

                  1f64e0d40855a5576da85a61fd5b74d2ca9e6be8

                  SHA256

                  ec791b6a302648ff211fbe6ef30b037d86a4892b0adf26c24ecfc01b36726aee

                  SHA512

                  bd8865ea7ccd6f62a03ab935fe319aec830be8c783f276b06f7ebaaa43104f223eca5db8dc3d021a1381c1ee07dcc57ff8ff04a328cd49b7c0e8217a0edc3bfd

                • memory/2604-44-0x0000000000F30000-0x000000000124B000-memory.dmp

                  Filesize

                  3.1MB

                • memory/2604-20-0x0000000000F31000-0x0000000000F99000-memory.dmp

                  Filesize

                  416KB

                • memory/2604-2940-0x0000000000F30000-0x000000000124B000-memory.dmp

                  Filesize

                  3.1MB

                • memory/2604-67-0x0000000000F30000-0x000000000124B000-memory.dmp

                  Filesize

                  3.1MB

                • memory/2604-2934-0x0000000000F30000-0x000000000124B000-memory.dmp

                  Filesize

                  3.1MB

                • memory/2604-60-0x0000000000F30000-0x000000000124B000-memory.dmp

                  Filesize

                  3.1MB

                • memory/2604-2933-0x0000000000F30000-0x000000000124B000-memory.dmp

                  Filesize

                  3.1MB

                • memory/2604-43-0x0000000000F31000-0x0000000000F99000-memory.dmp

                  Filesize

                  416KB

                • memory/2604-2932-0x0000000000F30000-0x000000000124B000-memory.dmp

                  Filesize

                  3.1MB

                • memory/2604-2931-0x0000000000F30000-0x000000000124B000-memory.dmp

                  Filesize

                  3.1MB

                • memory/2604-2928-0x0000000000F30000-0x000000000124B000-memory.dmp

                  Filesize

                  3.1MB

                • memory/2604-24-0x0000000000F30000-0x000000000124B000-memory.dmp

                  Filesize

                  3.1MB

                • memory/2604-487-0x0000000000F30000-0x000000000124B000-memory.dmp

                  Filesize

                  3.1MB

                • memory/2604-2926-0x0000000000F30000-0x000000000124B000-memory.dmp

                  Filesize

                  3.1MB

                • memory/2604-2924-0x0000000000F30000-0x000000000124B000-memory.dmp

                  Filesize

                  3.1MB

                • memory/2604-504-0x0000000000F30000-0x000000000124B000-memory.dmp

                  Filesize

                  3.1MB

                • memory/2604-2918-0x0000000000F30000-0x000000000124B000-memory.dmp

                  Filesize

                  3.1MB

                • memory/2604-2363-0x0000000000F30000-0x000000000124B000-memory.dmp

                  Filesize

                  3.1MB

                • memory/2604-23-0x0000000000F30000-0x000000000124B000-memory.dmp

                  Filesize

                  3.1MB

                • memory/2604-22-0x0000000000F30000-0x000000000124B000-memory.dmp

                  Filesize

                  3.1MB

                • memory/2604-21-0x0000000000F30000-0x000000000124B000-memory.dmp

                  Filesize

                  3.1MB

                • memory/2604-274-0x0000000000F30000-0x000000000124B000-memory.dmp

                  Filesize

                  3.1MB

                • memory/2604-1056-0x0000000000F30000-0x000000000124B000-memory.dmp

                  Filesize

                  3.1MB

                • memory/2604-16-0x0000000000F30000-0x000000000124B000-memory.dmp

                  Filesize

                  3.1MB

                • memory/3384-450-0x0000000000C50000-0x0000000000F08000-memory.dmp

                  Filesize

                  2.7MB

                • memory/3384-454-0x0000000000C50000-0x0000000000F08000-memory.dmp

                  Filesize

                  2.7MB

                • memory/3384-498-0x0000000000C50000-0x0000000000F08000-memory.dmp

                  Filesize

                  2.7MB

                • memory/3384-495-0x0000000000C50000-0x0000000000F08000-memory.dmp

                  Filesize

                  2.7MB

                • memory/3384-455-0x0000000000C50000-0x0000000000F08000-memory.dmp

                  Filesize

                  2.7MB

                • memory/3672-19-0x0000000000461000-0x00000000004C9000-memory.dmp

                  Filesize

                  416KB

                • memory/3672-4-0x0000000000460000-0x000000000077B000-memory.dmp

                  Filesize

                  3.1MB

                • memory/3672-3-0x0000000000460000-0x000000000077B000-memory.dmp

                  Filesize

                  3.1MB

                • memory/3672-2-0x0000000000461000-0x00000000004C9000-memory.dmp

                  Filesize

                  416KB

                • memory/3672-18-0x0000000000460000-0x000000000077B000-memory.dmp

                  Filesize

                  3.1MB

                • memory/3672-1-0x0000000077794000-0x0000000077796000-memory.dmp

                  Filesize

                  8KB

                • memory/3672-0-0x0000000000460000-0x000000000077B000-memory.dmp

                  Filesize

                  3.1MB

                • memory/4148-2929-0x0000000000F30000-0x000000000124B000-memory.dmp

                  Filesize

                  3.1MB

                • memory/4148-2930-0x0000000000F30000-0x000000000124B000-memory.dmp

                  Filesize

                  3.1MB

                • memory/4300-61-0x0000000000210000-0x00000000008A0000-memory.dmp

                  Filesize

                  6.6MB

                • memory/4300-71-0x0000000000210000-0x00000000008A0000-memory.dmp

                  Filesize

                  6.6MB

                • memory/5080-1740-0x0000000000400000-0x0000000000457000-memory.dmp

                  Filesize

                  348KB

                • memory/5688-505-0x0000000000F30000-0x000000000124B000-memory.dmp

                  Filesize

                  3.1MB

                • memory/5688-507-0x0000000000F30000-0x000000000124B000-memory.dmp

                  Filesize

                  3.1MB