Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22/11/2024, 05:10
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20241010-en
General
-
Target
file.exe
-
Size
1.8MB
-
MD5
9b8db0a71bea0503b72502f6b7e9cc55
-
SHA1
2ea420bde7b1d202670292af13649b840e02eed8
-
SHA256
fabcaffe12bb450540c927b2579527ccee45730225ecd1ef7bc8b2d64ec1aecc
-
SHA512
d2a509269644c94b10e3bd4990810523747b113ec0d56a0d22b61402cf9870b4a6bde3f03943548e7ef228e77af07a735c5f556e367f62908a3b545d96d6754c
-
SSDEEP
49152:MJIHxJWafHTLPggPxcREfAOXxXLP6FxgMRbp:pHxJpHTDZcREvXF6FyE
Malware Config
Extracted
amadey
4.42
9c9aa5
http://185.215.113.43
-
install_dir
abc3bc1985
-
install_file
skotes.exe
-
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
-
url_paths
/Zu7JuNko/index.php
Extracted
stealc
mars
http://185.215.113.206
-
url_path
/c4becf79229cb002.php
Signatures
-
Amadey family
-
Cryptbot family
-
Detects CryptBot payload 1 IoCs
CryptBot is a C++ stealer distributed widely in bundle with other software.
resource yara_rule behavioral2/memory/3404-97-0x0000000069CC0000-0x000000006A71B000-memory.dmp family_cryptbot_v3 -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 99956aa797.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 99956aa797.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 99956aa797.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection 99956aa797.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 99956aa797.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" 99956aa797.exe -
Stealc family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 8 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 99956aa797.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ file.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 80ce0480d2.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 7ea547997b.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ f2e631c050.exe -
Downloads MZ/PE file
-
Uses browser remote debugging 2 TTPs 4 IoCs
Can be used control the browser and steal sensitive information such as credentials and session cookies.
pid Process 5172 chrome.exe 6080 chrome.exe 5980 chrome.exe 2792 chrome.exe -
Checks BIOS information in registry 2 TTPs 16 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion file.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 7ea547997b.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion file.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 80ce0480d2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 99956aa797.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion f2e631c050.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion f2e631c050.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 80ce0480d2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 7ea547997b.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 99956aa797.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation file.exe Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation skotes.exe Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation 80ce0480d2.exe -
Executes dropped EXE 10 IoCs
pid Process 1468 skotes.exe 3404 80ce0480d2.exe 3164 7ea547997b.exe 3564 f2e631c050.exe 2496 2aed2cd892.exe 4044 99956aa797.exe 1960 skotes.exe 1428 service123.exe 1564 skotes.exe 6108 service123.exe -
Identifies Wine through registry keys 2 TTPs 8 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Wine 7ea547997b.exe Key opened \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Wine f2e631c050.exe Key opened \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Wine 99956aa797.exe Key opened \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Wine skotes.exe Key opened \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Wine skotes.exe Key opened \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Wine file.exe Key opened \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Wine skotes.exe Key opened \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Wine 80ce0480d2.exe -
Loads dropped DLL 2 IoCs
pid Process 1428 service123.exe 6108 service123.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features 99956aa797.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" 99956aa797.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\7ea547997b.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1008113001\\7ea547997b.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\f2e631c050.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1008114001\\f2e631c050.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\2aed2cd892.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1008115001\\2aed2cd892.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\99956aa797.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1008116001\\99956aa797.exe" skotes.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/files/0x000a000000023b83-81.dat autoit_exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs
pid Process 4548 file.exe 1468 skotes.exe 3404 80ce0480d2.exe 3164 7ea547997b.exe 3564 f2e631c050.exe 4044 99956aa797.exe 1960 skotes.exe 1564 skotes.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\skotes.job file.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 5520 3404 WerFault.exe 93 -
System Location Discovery: System Language Discovery 1 TTPs 14 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language skotes.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f2e631c050.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2aed2cd892.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 99956aa797.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 80ce0480d2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ea547997b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language service123.exe -
Checks processor information in registry 2 TTPs 10 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 80ce0480d2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 80ce0480d2.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Kills process with taskkill 5 IoCs
pid Process 4760 taskkill.exe 4476 taskkill.exe 4392 taskkill.exe 2664 taskkill.exe 3880 taskkill.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings firefox.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 5220 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 26 IoCs
pid Process 4548 file.exe 4548 file.exe 1468 skotes.exe 1468 skotes.exe 3404 80ce0480d2.exe 3404 80ce0480d2.exe 3164 7ea547997b.exe 3164 7ea547997b.exe 3564 f2e631c050.exe 3564 f2e631c050.exe 2496 2aed2cd892.exe 2496 2aed2cd892.exe 2496 2aed2cd892.exe 2496 2aed2cd892.exe 4044 99956aa797.exe 4044 99956aa797.exe 5172 chrome.exe 5172 chrome.exe 5172 chrome.exe 4044 99956aa797.exe 4044 99956aa797.exe 4044 99956aa797.exe 1960 skotes.exe 1960 skotes.exe 1564 skotes.exe 1564 skotes.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 5172 chrome.exe 5172 chrome.exe 5172 chrome.exe -
Suspicious use of AdjustPrivilegeToken 15 IoCs
description pid Process Token: SeDebugPrivilege 4392 taskkill.exe Token: SeDebugPrivilege 2664 taskkill.exe Token: SeDebugPrivilege 3880 taskkill.exe Token: SeDebugPrivilege 4760 taskkill.exe Token: SeDebugPrivilege 4476 taskkill.exe Token: SeDebugPrivilege 3412 firefox.exe Token: SeDebugPrivilege 3412 firefox.exe Token: SeDebugPrivilege 4044 99956aa797.exe Token: SeShutdownPrivilege 5172 chrome.exe Token: SeCreatePagefilePrivilege 5172 chrome.exe Token: SeShutdownPrivilege 5172 chrome.exe Token: SeCreatePagefilePrivilege 5172 chrome.exe Token: SeDebugPrivilege 3412 firefox.exe Token: SeDebugPrivilege 3412 firefox.exe Token: SeDebugPrivilege 3412 firefox.exe -
Suspicious use of FindShellTrayWindow 60 IoCs
pid Process 4548 file.exe 2496 2aed2cd892.exe 2496 2aed2cd892.exe 2496 2aed2cd892.exe 2496 2aed2cd892.exe 2496 2aed2cd892.exe 2496 2aed2cd892.exe 2496 2aed2cd892.exe 2496 2aed2cd892.exe 3412 firefox.exe 3412 firefox.exe 3412 firefox.exe 3412 firefox.exe 3412 firefox.exe 3412 firefox.exe 3412 firefox.exe 3412 firefox.exe 3412 firefox.exe 3412 firefox.exe 3412 firefox.exe 3412 firefox.exe 3412 firefox.exe 3412 firefox.exe 3412 firefox.exe 3412 firefox.exe 2496 2aed2cd892.exe 3412 firefox.exe 3412 firefox.exe 3412 firefox.exe 3412 firefox.exe 3412 firefox.exe 2496 2aed2cd892.exe 2496 2aed2cd892.exe 2496 2aed2cd892.exe 5172 chrome.exe 5172 chrome.exe 5172 chrome.exe 5172 chrome.exe 5172 chrome.exe 5172 chrome.exe 5172 chrome.exe 5172 chrome.exe 5172 chrome.exe 5172 chrome.exe 5172 chrome.exe 5172 chrome.exe 5172 chrome.exe 5172 chrome.exe 5172 chrome.exe 5172 chrome.exe 5172 chrome.exe 5172 chrome.exe 5172 chrome.exe 5172 chrome.exe 5172 chrome.exe 5172 chrome.exe 5172 chrome.exe 5172 chrome.exe 5172 chrome.exe 5172 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
pid Process 2496 2aed2cd892.exe 2496 2aed2cd892.exe 2496 2aed2cd892.exe 2496 2aed2cd892.exe 2496 2aed2cd892.exe 2496 2aed2cd892.exe 2496 2aed2cd892.exe 2496 2aed2cd892.exe 3412 firefox.exe 3412 firefox.exe 3412 firefox.exe 3412 firefox.exe 3412 firefox.exe 3412 firefox.exe 3412 firefox.exe 3412 firefox.exe 3412 firefox.exe 3412 firefox.exe 3412 firefox.exe 3412 firefox.exe 3412 firefox.exe 3412 firefox.exe 3412 firefox.exe 3412 firefox.exe 2496 2aed2cd892.exe 3412 firefox.exe 3412 firefox.exe 3412 firefox.exe 3412 firefox.exe 2496 2aed2cd892.exe 2496 2aed2cd892.exe 2496 2aed2cd892.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3412 firefox.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4548 wrote to memory of 1468 4548 file.exe 83 PID 4548 wrote to memory of 1468 4548 file.exe 83 PID 4548 wrote to memory of 1468 4548 file.exe 83 PID 1468 wrote to memory of 3404 1468 skotes.exe 93 PID 1468 wrote to memory of 3404 1468 skotes.exe 93 PID 1468 wrote to memory of 3404 1468 skotes.exe 93 PID 1468 wrote to memory of 3164 1468 skotes.exe 98 PID 1468 wrote to memory of 3164 1468 skotes.exe 98 PID 1468 wrote to memory of 3164 1468 skotes.exe 98 PID 1468 wrote to memory of 3564 1468 skotes.exe 100 PID 1468 wrote to memory of 3564 1468 skotes.exe 100 PID 1468 wrote to memory of 3564 1468 skotes.exe 100 PID 1468 wrote to memory of 2496 1468 skotes.exe 101 PID 1468 wrote to memory of 2496 1468 skotes.exe 101 PID 1468 wrote to memory of 2496 1468 skotes.exe 101 PID 2496 wrote to memory of 4392 2496 2aed2cd892.exe 102 PID 2496 wrote to memory of 4392 2496 2aed2cd892.exe 102 PID 2496 wrote to memory of 4392 2496 2aed2cd892.exe 102 PID 2496 wrote to memory of 2664 2496 2aed2cd892.exe 104 PID 2496 wrote to memory of 2664 2496 2aed2cd892.exe 104 PID 2496 wrote to memory of 2664 2496 2aed2cd892.exe 104 PID 2496 wrote to memory of 3880 2496 2aed2cd892.exe 106 PID 2496 wrote to memory of 3880 2496 2aed2cd892.exe 106 PID 2496 wrote to memory of 3880 2496 2aed2cd892.exe 106 PID 2496 wrote to memory of 4760 2496 2aed2cd892.exe 108 PID 2496 wrote to memory of 4760 2496 2aed2cd892.exe 108 PID 2496 wrote to memory of 4760 2496 2aed2cd892.exe 108 PID 2496 wrote to memory of 4476 2496 2aed2cd892.exe 110 PID 2496 wrote to memory of 4476 2496 2aed2cd892.exe 110 PID 2496 wrote to memory of 4476 2496 2aed2cd892.exe 110 PID 2496 wrote to memory of 3988 2496 2aed2cd892.exe 112 PID 2496 wrote to memory of 3988 2496 2aed2cd892.exe 112 PID 3988 wrote to memory of 3412 3988 firefox.exe 113 PID 3988 wrote to memory of 3412 3988 firefox.exe 113 PID 3988 wrote to memory of 3412 3988 firefox.exe 113 PID 3988 wrote to memory of 3412 3988 firefox.exe 113 PID 3988 wrote to memory of 3412 3988 firefox.exe 113 PID 3988 wrote to memory of 3412 3988 firefox.exe 113 PID 3988 wrote to memory of 3412 3988 firefox.exe 113 PID 3988 wrote to memory of 3412 3988 firefox.exe 113 PID 3988 wrote to memory of 3412 3988 firefox.exe 113 PID 3988 wrote to memory of 3412 3988 firefox.exe 113 PID 3988 wrote to memory of 3412 3988 firefox.exe 113 PID 3412 wrote to memory of 2904 3412 firefox.exe 114 PID 3412 wrote to memory of 2904 3412 firefox.exe 114 PID 3412 wrote to memory of 2904 3412 firefox.exe 114 PID 3412 wrote to memory of 2904 3412 firefox.exe 114 PID 3412 wrote to memory of 2904 3412 firefox.exe 114 PID 3412 wrote to memory of 2904 3412 firefox.exe 114 PID 3412 wrote to memory of 2904 3412 firefox.exe 114 PID 3412 wrote to memory of 2904 3412 firefox.exe 114 PID 3412 wrote to memory of 2904 3412 firefox.exe 114 PID 3412 wrote to memory of 2904 3412 firefox.exe 114 PID 3412 wrote to memory of 2904 3412 firefox.exe 114 PID 3412 wrote to memory of 2904 3412 firefox.exe 114 PID 3412 wrote to memory of 2904 3412 firefox.exe 114 PID 3412 wrote to memory of 2904 3412 firefox.exe 114 PID 3412 wrote to memory of 2904 3412 firefox.exe 114 PID 3412 wrote to memory of 2904 3412 firefox.exe 114 PID 3412 wrote to memory of 2904 3412 firefox.exe 114 PID 3412 wrote to memory of 2904 3412 firefox.exe 114 PID 3412 wrote to memory of 2904 3412 firefox.exe 114 PID 3412 wrote to memory of 2904 3412 firefox.exe 114 PID 3412 wrote to memory of 2904 3412 firefox.exe 114 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\1008112001\80ce0480d2.exe"C:\Users\Admin\AppData\Local\Temp\1008112001\80ce0480d2.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:3404 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"4⤵
- Uses browser remote debugging
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5172 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffe559acc40,0x7ffe559acc4c,0x7ffe559acc585⤵PID:5188
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2028,i,12673068041719389215,10058985080924388873,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2024 /prefetch:25⤵PID:5612
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1880,i,12673068041719389215,10058985080924388873,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2168 /prefetch:35⤵PID:5632
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2276,i,12673068041719389215,10058985080924388873,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2284 /prefetch:85⤵PID:5652
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3196,i,12673068041719389215,10058985080924388873,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3216 /prefetch:15⤵
- Uses browser remote debugging
PID:5980
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3220,i,12673068041719389215,10058985080924388873,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3272 /prefetch:15⤵
- Uses browser remote debugging
PID:6080
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4536,i,12673068041719389215,10058985080924388873,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4520 /prefetch:15⤵
- Uses browser remote debugging
PID:2792
-
-
-
C:\Users\Admin\AppData\Local\Temp\service123.exe"C:\Users\Admin\AppData\Local\Temp\service123.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1428
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\Admin\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f4⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:5220
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3404 -s 12844⤵
- Program crash
PID:5520
-
-
-
C:\Users\Admin\AppData\Local\Temp\1008113001\7ea547997b.exe"C:\Users\Admin\AppData\Local\Temp\1008113001\7ea547997b.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3164
-
-
C:\Users\Admin\AppData\Local\Temp\1008114001\f2e631c050.exe"C:\Users\Admin\AppData\Local\Temp\1008114001\f2e631c050.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3564
-
-
C:\Users\Admin\AppData\Local\Temp\1008115001\2aed2cd892.exe"C:\Users\Admin\AppData\Local\Temp\1008115001\2aed2cd892.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM firefox.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4392
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM chrome.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2664
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM msedge.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3880
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM opera.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4760
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM brave.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4476
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking4⤵
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking5⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3412 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2032 -parentBuildID 20240401114208 -prefsHandle 1960 -prefMapHandle 1952 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d0d00ac7-2241-4026-9521-0222dd5ef8f0} 3412 "\\.\pipe\gecko-crash-server-pipe.3412" gpu6⤵PID:2904
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2468 -parentBuildID 20240401114208 -prefsHandle 2444 -prefMapHandle 2432 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1ae437eb-5c1c-4209-909c-6288309ebe28} 3412 "\\.\pipe\gecko-crash-server-pipe.3412" socket6⤵PID:4736
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2952 -childID 1 -isForBrowser -prefsHandle 2996 -prefMapHandle 2948 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1040 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1a2a1c8a-f298-445f-9a57-6077575c96b1} 3412 "\\.\pipe\gecko-crash-server-pipe.3412" tab6⤵PID:3736
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3604 -childID 2 -isForBrowser -prefsHandle 3628 -prefMapHandle 3624 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1040 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ca5c9d77-f4de-452a-8283-add805ac20d2} 3412 "\\.\pipe\gecko-crash-server-pipe.3412" tab6⤵PID:1320
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2608 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4444 -prefMapHandle 4440 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c85e7d96-7951-4ac9-adb4-f8a06cfd205a} 3412 "\\.\pipe\gecko-crash-server-pipe.3412" utility6⤵
- Checks processor information in registry
PID:5288
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5284 -childID 3 -isForBrowser -prefsHandle 5344 -prefMapHandle 5340 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1040 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {74a1d1d1-24cc-491f-8ce1-b2370bffb1d7} 3412 "\\.\pipe\gecko-crash-server-pipe.3412" tab6⤵PID:5792
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5500 -childID 4 -isForBrowser -prefsHandle 5512 -prefMapHandle 5456 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1040 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7eabbd6b-53d0-450d-aade-030a15a8384d} 3412 "\\.\pipe\gecko-crash-server-pipe.3412" tab6⤵PID:5804
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5672 -childID 5 -isForBrowser -prefsHandle 5752 -prefMapHandle 5748 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1040 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {597838fc-46f7-46ae-892f-b6d33d974752} 3412 "\\.\pipe\gecko-crash-server-pipe.3412" tab6⤵PID:5816
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1008116001\99956aa797.exe"C:\Users\Admin\AppData\Local\Temp\1008116001\99956aa797.exe"3⤵
- Modifies Windows Defender Real-time Protection settings
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Windows security modification
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4044
-
-
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵PID:5256
-
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exeC:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1960
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3404 -ip 34041⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exeC:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1564
-
C:\Users\Admin\AppData\Local\Temp\service123.exeC:\Users\Admin\AppData\Local\Temp\/service123.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:6108
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Modify Authentication Process
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Impair Defenses
2Disable or Modify Tools
2Modify Authentication Process
1Modify Registry
3Virtualization/Sandbox Evasion
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Modify Authentication Process
1Steal Web Session Cookie
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\42vejdix.default-release\activity-stream.discovery_stream.json
Filesize28KB
MD5da223f3369d1785d34d8d59f2e35a78d
SHA15d8b4170654102de591cdecc3a1eb56ea6b23fb3
SHA256cfe9c0a85e5c066da2ca8ba6dda390e54c0827caaa895dc5c3696c2ad0fb3b7d
SHA512e2fe154346f75058b4848d48a83030b7f361c9178cc0cb946990083b737f799f6c05f5a8b3d5ab7530509bec885c1df0c97c55e92151997bb644fe0411e73429
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\42vejdix.default-release\cache2\entries\39DB9E847E680B765D7B04FCCE6BF5BC0225F878
Filesize13KB
MD5bac6e6d93ab964c30a275f9a822005c8
SHA1e6264e4329cdf58867c0ecb30ca40b1c86e266c6
SHA25678287f89ad519e6ad027aa9d363b92a5851197f2a1684024d0385a9c95cf1a3b
SHA512572cdd191569e6e6fd330da59506bb2937da2a2b52b03373c574e777b26d496d0c097631acd261fd98e42270265e73794bf8ee3471c42d67b107567c5e2659b3
-
Filesize
4.2MB
MD512cd0d9c479c98fd981eec5c93de5b81
SHA1d6eb3df1e15d86dca156f9e9d57b6faf62559b6c
SHA256b2c5eff51d7f0692f552e043af3f5324cf25dccadda349d59c5dc5e95d265eb3
SHA51274674519f5702f5347be782314b5fe4e68c3e00d0baac6dfe103b3f12d9a97fdd7876d56983d599162beef9d92a3294cfd2c2da00b7f6b7dd96effe9679b752c
-
Filesize
1.8MB
MD5ac933d30f0cad391f7fad37cc15ae685
SHA11f52b9bbb6bd9c183920330fa1cc8e4797b081f5
SHA25697e58900485238b185fd6ce5b822a634a455db4e86739b7b9ab1ad3031828c62
SHA5125e65e77c6aa40f0e319e00530e966790828f89e4744557af4917c1ddda176009b80636fa23d2aaec4531045dd2e640eb89e325f186207b43b56747e76970d4f4
-
Filesize
1.7MB
MD5fcab8c77edd9c235497e92d29b6c028d
SHA15bea36fb1edcb3801f5f7d5dacda5d0ffd5ac020
SHA256ece1bbf67dbee347fca668310d9fcf40f8e736d56bc81fb97e5f12f0d08ab3cb
SHA512a322e25357dbc738e8085deee5d1187ca1a411b5781cb878455e7615b2a7e6f77d70c36a768308c382afe614e5c8618c106155a5a6635c265243714215c83601
-
Filesize
901KB
MD551357ae78c6b77c5901de126fcb38df3
SHA15b94c30c47960dcc2fe2972dfa54e8e96171410d
SHA2562b1dfc50f7374f9cef49b0a56e9aff668ed419dc9a435ba4e03585fab9caf12d
SHA5121bae6e269d1d01c05962ec997e11e2316b4e5bc85f54c2472ec2e261b708e3aa67d3cd7f3bfb9fab48550eed01322c3c4c0cdf3f646eb7a9e5f022bf0d86adb4
-
Filesize
2.8MB
MD50088235be044c8a88124dd1b58b186e7
SHA131107b10e2d6f4d9b928aaf8fc53ec209823c0c4
SHA2569ba473c3f4b60970545a8756d91f2461a84c6236aee185f89f064e0fbc60599e
SHA512795f3faf3ea95e0e796ef62353072a5cb6eaa00884694b62b747e43492dd4591cede7fae2a280711fcd8dc7ee6f509e46259564942d3448c403e2bc31ac85fd2
-
Filesize
1.8MB
MD59b8db0a71bea0503b72502f6b7e9cc55
SHA12ea420bde7b1d202670292af13649b840e02eed8
SHA256fabcaffe12bb450540c927b2579527ccee45730225ecd1ef7bc8b2d64ec1aecc
SHA512d2a509269644c94b10e3bd4990810523747b113ec0d56a0d22b61402cf9870b4a6bde3f03943548e7ef228e77af07a735c5f556e367f62908a3b545d96d6754c
-
Filesize
479KB
MD509372174e83dbbf696ee732fd2e875bb
SHA1ba360186ba650a769f9303f48b7200fb5eaccee1
SHA256c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
SHA512b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
-
Filesize
13.8MB
MD50a8747a2ac9ac08ae9508f36c6d75692
SHA1b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA25632d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
SHA51259521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\AlternateServices.bin
Filesize6KB
MD533e6c890d614ea9cfb20fdcdd070f471
SHA13b092b4681ab42a99839dcef7e3d05edf909edef
SHA256995787cc84fa1ce5ca5cf5314406f1d34fe42a6db98c8a4a9e441fa96a5201f4
SHA5125eedfd3d5215a531a30c11a4072776b6c7ccf913a663368a21abcc67fa9788d1ceec8749feca97c44a8433af5366d9b8dc1266e696a9d6b3befc7516206d8b88
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\AlternateServices.bin
Filesize6KB
MD554a24ae025156802d0a4fb662c734602
SHA17735175f7fd9fd62059e865bf7ade20ddfa4d101
SHA25623b910f6593f0e3437c70db03f464197d5042e9f90b2ce17751dc31e0220b82b
SHA51287b9213d23004de0afa6bccff76af12f18ad216924ceed27a4344ccb3bfa4bf1e77990a3c1d26a0c6d377a54deea61dd4b4f8becd7d74341e1869687ba88cf09
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\db\data.safe.tmp
Filesize5KB
MD5ae77496a3077b23520339bd9b9e0853a
SHA103b23fb6c2f40df7f2d88412a503dbba5b90c3f0
SHA256d1e65c2c7f464fdcec542bc8a9877dd03b6320b82f8ee0bd82b030e173118cc3
SHA512b3adea311609e91666da2b1bc47693c9eda653d2295e016cba5d5463fa43e4d17733f897e75c7318edda09d88df75ebe65ac1be8b6bb3b42fea55a5299c97218
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\db\data.safe.tmp
Filesize15KB
MD524031d871882992af50f36759bc4d134
SHA14c4b826fe265b2093b0426c9f59f924ad39537eb
SHA256a748efdec9ce58b71a1e3b568fc4c71122fd0e41445f57c7b53f0400e83b658e
SHA512051786e7bce5c26013f3108144528a8642a3b39a1f542515cc0cd59a4de7dbcba09b866efef0ac3a0d479a826a72fd8da7e70f1c1c49524f9482dbb6fdd577e9
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\db\data.safe.tmp
Filesize15KB
MD5bdee0aa81619629091ead9f0bf33d157
SHA1b724b0d0dff2f887054625f9016863536538540a
SHA2567e433aac30bf6bba4aa8adde00d0d8c7d4bd9431470b753291684fe31e1bb551
SHA51253ab9f64319c83c27210a44bbe966a8482c9527bae4c227001c63b1b855fe221ffbb80d50297bc44ea4d129dac0fde78cc3a3a7c602cdf02d74181926645d5f1
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\db\data.safe.tmp
Filesize6KB
MD55d484edd984d45a10fee5d034ff22013
SHA18511888d2002117e31a36eab2055299485cf07ac
SHA25688b94ef2c98e1d87858e095082452236c34cfd8162d024e136843f4c37b7b9f6
SHA512dd08bb4554e2d0726ce18521d079c65ca6fa2e99e6b21502ffe941f00921d7259ef61eb70e8bdac03cb47b0a7a3f6fb51c8a059cfde7722057bfdfacbe0fce5a
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\pending_pings\1d6b57fe-0a99-4a8a-a65b-4d6d3c3788e9
Filesize26KB
MD55c0888aa583eb6f6eeec9fdca49a9e33
SHA10dd127f66107e59b028f7a83164d73c05005e48b
SHA256f36b7a54cec1710504fa24d903080dafbaea0ce52335691184acb43608a8340d
SHA5122d50ee4de75990aa691a370e4a8bb61f58f74c1f17cf916c57ecc89523b6b17c004c632079aaefae13b4b2adc463047dabfc877a08d2249c5a86a644e0014935
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\pending_pings\c6f14abd-6cb2-4545-a7ee-611157ce7882
Filesize671B
MD5dce2b8e3c2f6579c4f0d8d8197692237
SHA143d16d259c8048df538d129d6eb2a2cafa4dd7c2
SHA256a8ca900cda6df353c2294acea6fc9e1fda066a57b0de824cfa9a092f36e35d2d
SHA51238c6444b8b90b2bf398a149671943f1ac2cdb9d945a5fa95ef62749ce7d2b8c840dae7e67121ab0a542ff75409e1676afe3acf337240b08188ac9295f7846aaa
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\pending_pings\d160a14d-0780-4ca6-9086-41765a73932e
Filesize982B
MD52d7a29a2bb92b659760231942dd7595e
SHA17282ddb208665f89c6e1e0405f034ee51941f1d1
SHA2564743319efbab4e7e9d99590240ca30b88cc84238a1799c8b93feba91a5a73aec
SHA512da6655a6d822f68f503ce667e1495e7ef023d05d65e8e4e0fc0dca9020a964ec6cc9db8ff72a478ad66a3b22907a497b1b75c981ed570cccd864f526cf6cc41a
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Filesize1.1MB
MD5842039753bf41fa5e11b3a1383061a87
SHA13e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA256d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
SHA512d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Filesize116B
MD52a461e9eb87fd1955cea740a3444ee7a
SHA1b10755914c713f5a4677494dbe8a686ed458c3c5
SHA2564107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
SHA51234f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Filesize372B
MD5bf957ad58b55f64219ab3f793e374316
SHA1a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA256bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
SHA51279c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Filesize17.8MB
MD5daf7ef3acccab478aaa7d6dc1c60f865
SHA1f8246162b97ce4a945feced27b6ea114366ff2ad
SHA256bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
SHA5125840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
-
Filesize
12KB
MD51c12274a9a94416ecc2dbf72df6aefaa
SHA18b42d4e261200e690397518759918bdedf5c339d
SHA256a8fe84ca5233697fb2cfc27e99f5fd2f7d3d349a24b04ff93143b32989116b97
SHA512d0dab5efc9f27648535865ccf226b3badf3b01e1abb16d01648c542d5440008c48219e42e2583a544bed3504b7f4cc22293ca1e0e72f37ccc05b022752542091
-
Filesize
10KB
MD562809b851686bb1cf562fd23d6aba532
SHA148e78d6ef101a7d463d1b81aa6dd99e342629a37
SHA256eba14b7201f17e08c4ae3a676a55c5feef9138e4d0fdb07d118b3a36ca00a3e0
SHA5127ebb6653793ab7d79bf9cd9f1e5c7457bf4bfdda547563caad73f05321a1fc2e99140fad6a91c41ecfd42a1a248710190f0ce2e407cef2adb1031b2eee371092
-
Filesize
10KB
MD5748bc590271299a049b099b39fd5874f
SHA18e7aa0c0590a228e6852573bf8d05d0cc116cf95
SHA2569343de967549dde6750de0ce46dc7815bc65333b30f68981a17eeb2b5e0da753
SHA51249fc517ff2da704fff8e158cf27699a491ce88bce40744655b06757d1b7da7b504359d61db0c5f9ca839594821343e6e45376227820f9b34f885535d751c40bc
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Filesize808KB
MD56a2a9154b2ae4974964d009d2cbcad2f
SHA1939df002c8032ae494b831669fdc79dc45d1cedc
SHA2564e566e30479e20284ef35f54df6b9e35f02e42f4fd9ceb1473c5f325be175677
SHA512c8d6fe4f0ff5dcc6abc017f1b52fda9caa2ed10049f6fd72c6da90acc0613280cd0f7077b90689b1787ba8926e6aa8d17861a961a957b0afdc7c8bcb1370931b
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Filesize2.5MB
MD570c59c03497d5cb207a40a5fc6d72e42
SHA185f1286d1980655de5e3f54b30f60b7bcd0aa25e
SHA2566d3cd2378227483c1591d3e6c7f68ac9ed5b73c167633f4ec37cbc7e966a7ef3
SHA5126610a9b4be8e7f1e3bf95650b31dd9b3f771cec7157b9a7355cfac9e51da47d338faca98653ea6bde099ab633f6c0b3f45f1119f4dd875227d690bbd9cca543f