Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22/11/2024, 05:14
Static task
static1
General
-
Target
file.exe
-
Size
1.8MB
-
MD5
9b8db0a71bea0503b72502f6b7e9cc55
-
SHA1
2ea420bde7b1d202670292af13649b840e02eed8
-
SHA256
fabcaffe12bb450540c927b2579527ccee45730225ecd1ef7bc8b2d64ec1aecc
-
SHA512
d2a509269644c94b10e3bd4990810523747b113ec0d56a0d22b61402cf9870b4a6bde3f03943548e7ef228e77af07a735c5f556e367f62908a3b545d96d6754c
-
SSDEEP
49152:MJIHxJWafHTLPggPxcREfAOXxXLP6FxgMRbp:pHxJpHTDZcREvXF6FyE
Malware Config
Extracted
amadey
4.42
9c9aa5
http://185.215.113.43
-
install_dir
abc3bc1985
-
install_file
skotes.exe
-
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
-
url_paths
/Zu7JuNko/index.php
Extracted
stealc
mars
http://185.215.113.206
-
url_path
/c4becf79229cb002.php
Signatures
-
Amadey family
-
Cryptbot family
-
Detects CryptBot payload 1 IoCs
CryptBot is a C++ stealer distributed widely in bundle with other software.
resource yara_rule behavioral2/memory/4868-81-0x0000000069CC0000-0x000000006A71B000-memory.dmp family_cryptbot_v3 -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection de7819236e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" de7819236e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" de7819236e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" de7819236e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" de7819236e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" de7819236e.exe -
Stealc family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 9 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ file.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ bfe101b4bb.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ fca0806b45.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 08d83fdf2a.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ de7819236e.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe -
Downloads MZ/PE file
-
Uses browser remote debugging 2 TTPs 4 IoCs
Can be used control the browser and steal sensitive information such as credentials and session cookies.
pid Process 5252 chrome.exe 5840 chrome.exe 5856 chrome.exe 4176 chrome.exe -
Checks BIOS information in registry 2 TTPs 18 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion fca0806b45.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 08d83fdf2a.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion de7819236e.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion file.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion fca0806b45.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion de7819236e.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion bfe101b4bb.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion bfe101b4bb.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 08d83fdf2a.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion file.exe -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation file.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation skotes.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation bfe101b4bb.exe -
Executes dropped EXE 12 IoCs
pid Process 2660 skotes.exe 4868 bfe101b4bb.exe 2520 skotes.exe 2600 fca0806b45.exe 3684 08d83fdf2a.exe 3148 11c8b1fdd9.exe 5956 de7819236e.exe 4748 service123.exe 4180 skotes.exe 1292 service123.exe 6012 skotes.exe 2116 service123.exe -
Identifies Wine through registry keys 2 TTPs 9 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Wine fca0806b45.exe Key opened \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Wine skotes.exe Key opened \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Wine skotes.exe Key opened \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Wine bfe101b4bb.exe Key opened \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Wine skotes.exe Key opened \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Wine 08d83fdf2a.exe Key opened \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Wine de7819236e.exe Key opened \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Wine skotes.exe Key opened \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Wine file.exe -
Loads dropped DLL 3 IoCs
pid Process 4748 service123.exe 1292 service123.exe 2116 service123.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features de7819236e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" de7819236e.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\11c8b1fdd9.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1008115001\\11c8b1fdd9.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\de7819236e.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1008116001\\de7819236e.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fca0806b45.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1008113001\\fca0806b45.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\08d83fdf2a.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1008114001\\08d83fdf2a.exe" skotes.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/files/0x0008000000023bbe-95.dat autoit_exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs
pid Process 816 file.exe 2660 skotes.exe 4868 bfe101b4bb.exe 2520 skotes.exe 2600 fca0806b45.exe 3684 08d83fdf2a.exe 5956 de7819236e.exe 4180 skotes.exe 6012 skotes.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\skotes.job file.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 2468 4868 WerFault.exe 94 -
System Location Discovery: System Language Discovery 1 TTPs 14 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11c8b1fdd9.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 08d83fdf2a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bfe101b4bb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language service123.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language skotes.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fca0806b45.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language de7819236e.exe -
Checks processor information in registry 2 TTPs 10 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 bfe101b4bb.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString bfe101b4bb.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Kills process with taskkill 5 IoCs
pid Process 5048 taskkill.exe 4660 taskkill.exe 3020 taskkill.exe 396 taskkill.exe 2828 taskkill.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings firefox.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 5656 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 27 IoCs
pid Process 816 file.exe 816 file.exe 2660 skotes.exe 2660 skotes.exe 4868 bfe101b4bb.exe 4868 bfe101b4bb.exe 2520 skotes.exe 2520 skotes.exe 2600 fca0806b45.exe 2600 fca0806b45.exe 3684 08d83fdf2a.exe 3684 08d83fdf2a.exe 3148 11c8b1fdd9.exe 3148 11c8b1fdd9.exe 5956 de7819236e.exe 5956 de7819236e.exe 3148 11c8b1fdd9.exe 3148 11c8b1fdd9.exe 5956 de7819236e.exe 5956 de7819236e.exe 5956 de7819236e.exe 5252 chrome.exe 5252 chrome.exe 4180 skotes.exe 4180 skotes.exe 6012 skotes.exe 6012 skotes.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 5252 chrome.exe 5252 chrome.exe 5252 chrome.exe -
Suspicious use of AdjustPrivilegeToken 15 IoCs
description pid Process Token: SeDebugPrivilege 2828 taskkill.exe Token: SeDebugPrivilege 5048 taskkill.exe Token: SeDebugPrivilege 4660 taskkill.exe Token: SeDebugPrivilege 3020 taskkill.exe Token: SeDebugPrivilege 396 taskkill.exe Token: SeDebugPrivilege 2936 firefox.exe Token: SeDebugPrivilege 2936 firefox.exe Token: SeDebugPrivilege 5956 de7819236e.exe Token: SeShutdownPrivilege 5252 chrome.exe Token: SeCreatePagefilePrivilege 5252 chrome.exe Token: SeShutdownPrivilege 5252 chrome.exe Token: SeCreatePagefilePrivilege 5252 chrome.exe Token: SeDebugPrivilege 2936 firefox.exe Token: SeDebugPrivilege 2936 firefox.exe Token: SeDebugPrivilege 2936 firefox.exe -
Suspicious use of FindShellTrayWindow 58 IoCs
pid Process 816 file.exe 3148 11c8b1fdd9.exe 3148 11c8b1fdd9.exe 3148 11c8b1fdd9.exe 3148 11c8b1fdd9.exe 3148 11c8b1fdd9.exe 3148 11c8b1fdd9.exe 2936 firefox.exe 2936 firefox.exe 2936 firefox.exe 2936 firefox.exe 3148 11c8b1fdd9.exe 2936 firefox.exe 2936 firefox.exe 2936 firefox.exe 2936 firefox.exe 2936 firefox.exe 2936 firefox.exe 2936 firefox.exe 2936 firefox.exe 2936 firefox.exe 2936 firefox.exe 2936 firefox.exe 2936 firefox.exe 2936 firefox.exe 2936 firefox.exe 2936 firefox.exe 2936 firefox.exe 2936 firefox.exe 3148 11c8b1fdd9.exe 3148 11c8b1fdd9.exe 3148 11c8b1fdd9.exe 5252 chrome.exe 5252 chrome.exe 5252 chrome.exe 5252 chrome.exe 5252 chrome.exe 5252 chrome.exe 5252 chrome.exe 5252 chrome.exe 5252 chrome.exe 5252 chrome.exe 5252 chrome.exe 5252 chrome.exe 5252 chrome.exe 5252 chrome.exe 5252 chrome.exe 5252 chrome.exe 5252 chrome.exe 5252 chrome.exe 5252 chrome.exe 5252 chrome.exe 5252 chrome.exe 5252 chrome.exe 5252 chrome.exe 5252 chrome.exe 5252 chrome.exe 5252 chrome.exe -
Suspicious use of SendNotifyMessage 30 IoCs
pid Process 3148 11c8b1fdd9.exe 3148 11c8b1fdd9.exe 3148 11c8b1fdd9.exe 3148 11c8b1fdd9.exe 3148 11c8b1fdd9.exe 3148 11c8b1fdd9.exe 2936 firefox.exe 2936 firefox.exe 2936 firefox.exe 2936 firefox.exe 3148 11c8b1fdd9.exe 2936 firefox.exe 2936 firefox.exe 2936 firefox.exe 2936 firefox.exe 2936 firefox.exe 2936 firefox.exe 2936 firefox.exe 2936 firefox.exe 2936 firefox.exe 2936 firefox.exe 2936 firefox.exe 2936 firefox.exe 2936 firefox.exe 2936 firefox.exe 2936 firefox.exe 2936 firefox.exe 3148 11c8b1fdd9.exe 3148 11c8b1fdd9.exe 3148 11c8b1fdd9.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2936 firefox.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 816 wrote to memory of 2660 816 file.exe 83 PID 816 wrote to memory of 2660 816 file.exe 83 PID 816 wrote to memory of 2660 816 file.exe 83 PID 2660 wrote to memory of 4868 2660 skotes.exe 94 PID 2660 wrote to memory of 4868 2660 skotes.exe 94 PID 2660 wrote to memory of 4868 2660 skotes.exe 94 PID 2660 wrote to memory of 2600 2660 skotes.exe 100 PID 2660 wrote to memory of 2600 2660 skotes.exe 100 PID 2660 wrote to memory of 2600 2660 skotes.exe 100 PID 2660 wrote to memory of 3684 2660 skotes.exe 102 PID 2660 wrote to memory of 3684 2660 skotes.exe 102 PID 2660 wrote to memory of 3684 2660 skotes.exe 102 PID 2660 wrote to memory of 3148 2660 skotes.exe 103 PID 2660 wrote to memory of 3148 2660 skotes.exe 103 PID 2660 wrote to memory of 3148 2660 skotes.exe 103 PID 3148 wrote to memory of 2828 3148 11c8b1fdd9.exe 104 PID 3148 wrote to memory of 2828 3148 11c8b1fdd9.exe 104 PID 3148 wrote to memory of 2828 3148 11c8b1fdd9.exe 104 PID 3148 wrote to memory of 5048 3148 11c8b1fdd9.exe 106 PID 3148 wrote to memory of 5048 3148 11c8b1fdd9.exe 106 PID 3148 wrote to memory of 5048 3148 11c8b1fdd9.exe 106 PID 3148 wrote to memory of 4660 3148 11c8b1fdd9.exe 108 PID 3148 wrote to memory of 4660 3148 11c8b1fdd9.exe 108 PID 3148 wrote to memory of 4660 3148 11c8b1fdd9.exe 108 PID 3148 wrote to memory of 3020 3148 11c8b1fdd9.exe 110 PID 3148 wrote to memory of 3020 3148 11c8b1fdd9.exe 110 PID 3148 wrote to memory of 3020 3148 11c8b1fdd9.exe 110 PID 3148 wrote to memory of 396 3148 11c8b1fdd9.exe 112 PID 3148 wrote to memory of 396 3148 11c8b1fdd9.exe 112 PID 3148 wrote to memory of 396 3148 11c8b1fdd9.exe 112 PID 3148 wrote to memory of 3520 3148 11c8b1fdd9.exe 114 PID 3148 wrote to memory of 3520 3148 11c8b1fdd9.exe 114 PID 3520 wrote to memory of 2936 3520 firefox.exe 115 PID 3520 wrote to memory of 2936 3520 firefox.exe 115 PID 3520 wrote to memory of 2936 3520 firefox.exe 115 PID 3520 wrote to memory of 2936 3520 firefox.exe 115 PID 3520 wrote to memory of 2936 3520 firefox.exe 115 PID 3520 wrote to memory of 2936 3520 firefox.exe 115 PID 3520 wrote to memory of 2936 3520 firefox.exe 115 PID 3520 wrote to memory of 2936 3520 firefox.exe 115 PID 3520 wrote to memory of 2936 3520 firefox.exe 115 PID 3520 wrote to memory of 2936 3520 firefox.exe 115 PID 3520 wrote to memory of 2936 3520 firefox.exe 115 PID 2936 wrote to memory of 1144 2936 firefox.exe 116 PID 2936 wrote to memory of 1144 2936 firefox.exe 116 PID 2936 wrote to memory of 1144 2936 firefox.exe 116 PID 2936 wrote to memory of 1144 2936 firefox.exe 116 PID 2936 wrote to memory of 1144 2936 firefox.exe 116 PID 2936 wrote to memory of 1144 2936 firefox.exe 116 PID 2936 wrote to memory of 1144 2936 firefox.exe 116 PID 2936 wrote to memory of 1144 2936 firefox.exe 116 PID 2936 wrote to memory of 1144 2936 firefox.exe 116 PID 2936 wrote to memory of 1144 2936 firefox.exe 116 PID 2936 wrote to memory of 1144 2936 firefox.exe 116 PID 2936 wrote to memory of 1144 2936 firefox.exe 116 PID 2936 wrote to memory of 1144 2936 firefox.exe 116 PID 2936 wrote to memory of 1144 2936 firefox.exe 116 PID 2936 wrote to memory of 1144 2936 firefox.exe 116 PID 2936 wrote to memory of 1144 2936 firefox.exe 116 PID 2936 wrote to memory of 1144 2936 firefox.exe 116 PID 2936 wrote to memory of 1144 2936 firefox.exe 116 PID 2936 wrote to memory of 1144 2936 firefox.exe 116 PID 2936 wrote to memory of 1144 2936 firefox.exe 116 PID 2936 wrote to memory of 1144 2936 firefox.exe 116 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:816 -
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\1008112001\bfe101b4bb.exe"C:\Users\Admin\AppData\Local\Temp\1008112001\bfe101b4bb.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:4868 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"4⤵
- Uses browser remote debugging
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5252 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffd3313cc40,0x7ffd3313cc4c,0x7ffd3313cc585⤵PID:5268
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1984,i,8946032782739298197,5070447320683366147,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2016 /prefetch:25⤵PID:5612
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1848,i,8946032782739298197,5070447320683366147,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2072 /prefetch:35⤵PID:5624
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2272,i,8946032782739298197,5070447320683366147,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2592 /prefetch:85⤵PID:5664
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3184,i,8946032782739298197,5070447320683366147,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3208 /prefetch:15⤵
- Uses browser remote debugging
PID:5840
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3216,i,8946032782739298197,5070447320683366147,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3368 /prefetch:15⤵
- Uses browser remote debugging
PID:5856
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4488,i,8946032782739298197,5070447320683366147,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4560 /prefetch:15⤵
- Uses browser remote debugging
PID:4176
-
-
-
C:\Users\Admin\AppData\Local\Temp\service123.exe"C:\Users\Admin\AppData\Local\Temp\service123.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4748
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\Admin\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f4⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:5656
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4868 -s 13004⤵
- Program crash
PID:2468
-
-
-
C:\Users\Admin\AppData\Local\Temp\1008113001\fca0806b45.exe"C:\Users\Admin\AppData\Local\Temp\1008113001\fca0806b45.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2600
-
-
C:\Users\Admin\AppData\Local\Temp\1008114001\08d83fdf2a.exe"C:\Users\Admin\AppData\Local\Temp\1008114001\08d83fdf2a.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3684
-
-
C:\Users\Admin\AppData\Local\Temp\1008115001\11c8b1fdd9.exe"C:\Users\Admin\AppData\Local\Temp\1008115001\11c8b1fdd9.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3148 -
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM firefox.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2828
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM chrome.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5048
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM msedge.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4660
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM opera.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3020
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM brave.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:396
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking4⤵
- Suspicious use of WriteProcessMemory
PID:3520 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking5⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2028 -parentBuildID 20240401114208 -prefsHandle 1944 -prefMapHandle 1936 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {cea97508-ec97-45fb-a17e-9074aa8018e3} 2936 "\\.\pipe\gecko-crash-server-pipe.2936" gpu6⤵PID:1144
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2464 -parentBuildID 20240401114208 -prefsHandle 2456 -prefMapHandle 2452 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c55637d5-c361-44a6-9740-94f1716cb820} 2936 "\\.\pipe\gecko-crash-server-pipe.2936" socket6⤵PID:768
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2872 -childID 1 -isForBrowser -prefsHandle 2984 -prefMapHandle 3048 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1080 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ab33acdd-ab5d-4098-8f53-4c6b8b977631} 2936 "\\.\pipe\gecko-crash-server-pipe.2936" tab6⤵PID:440
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3628 -childID 2 -isForBrowser -prefsHandle 3500 -prefMapHandle 1052 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1080 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fd60251f-38af-4354-9237-056fbc962bf7} 2936 "\\.\pipe\gecko-crash-server-pipe.2936" tab6⤵PID:4276
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4716 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4728 -prefMapHandle 4656 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c0040b10-05f0-4ad4-a29c-f15ec41f9b28} 2936 "\\.\pipe\gecko-crash-server-pipe.2936" utility6⤵
- Checks processor information in registry
PID:5372
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5444 -childID 3 -isForBrowser -prefsHandle 5124 -prefMapHandle 5288 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1080 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {61268bdd-d0f5-451b-a8ab-cc40b783676a} 2936 "\\.\pipe\gecko-crash-server-pipe.2936" tab6⤵PID:6048
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5592 -childID 4 -isForBrowser -prefsHandle 5228 -prefMapHandle 5232 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1080 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f20ceebc-bda0-4d97-816a-144a15e5f679} 2936 "\\.\pipe\gecko-crash-server-pipe.2936" tab6⤵PID:6072
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5220 -childID 5 -isForBrowser -prefsHandle 5680 -prefMapHandle 5684 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1080 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1a248339-4507-4d79-bad5-7a47a3563897} 2936 "\\.\pipe\gecko-crash-server-pipe.2936" tab6⤵PID:6084
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1008116001\de7819236e.exe"C:\Users\Admin\AppData\Local\Temp\1008116001\de7819236e.exe"3⤵
- Modifies Windows Defender Real-time Protection settings
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Windows security modification
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5956
-
-
-
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exeC:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2520
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵PID:6040
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4868 -ip 48681⤵PID:5660
-
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exeC:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4180
-
C:\Users\Admin\AppData\Local\Temp\service123.exeC:\Users\Admin\AppData\Local\Temp\/service123.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1292
-
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exeC:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:6012
-
C:\Users\Admin\AppData\Local\Temp\service123.exeC:\Users\Admin\AppData\Local\Temp\/service123.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2116
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Modify Authentication Process
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Impair Defenses
2Disable or Modify Tools
2Modify Authentication Process
1Modify Registry
3Virtualization/Sandbox Evasion
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Modify Authentication Process
1Steal Web Session Cookie
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\lhmx4teg.default-release\activity-stream.discovery_stream.json
Filesize28KB
MD5c9ab2320f605a2db8d8116af322b0c13
SHA1e7d516a556ca09e9b2e7b6ebdaf41898888e92ad
SHA256b0840eeb98b873fd2f19dfd962a438ba3417fee6960ae6696b5d6f8aa7e0f37f
SHA512ed5ab7c2b8662a05127b19a1b59463a45df4b5b3acc9bcc475ad346ea4cbab7145d4f9e1f6b1ffe4a544426abd793ad9f893d4b769ed7f6013e705e5df473707
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\lhmx4teg.default-release\cache2\entries\39DB9E847E680B765D7B04FCCE6BF5BC0225F878
Filesize13KB
MD53f37fcc24cb0b1f75fb82c5327435f9a
SHA14f2d1eed28a81a285019ebb094ec9e363a382f1e
SHA25672d77eeb57a76f7aca2059f40a9b14997bc73e981f0834c88c85cced5f183073
SHA51239414fc3bd926c637194dce795fedf1a4255651335a19b60610cc6fd40f32ce0fcf97efef22324579bc71427d76ef12a9781b670eabf0d085a1edd566ec659ac
-
Filesize
4.2MB
MD512cd0d9c479c98fd981eec5c93de5b81
SHA1d6eb3df1e15d86dca156f9e9d57b6faf62559b6c
SHA256b2c5eff51d7f0692f552e043af3f5324cf25dccadda349d59c5dc5e95d265eb3
SHA51274674519f5702f5347be782314b5fe4e68c3e00d0baac6dfe103b3f12d9a97fdd7876d56983d599162beef9d92a3294cfd2c2da00b7f6b7dd96effe9679b752c
-
Filesize
1.8MB
MD5e0b3a256f8cd635f3a1497999014e98e
SHA1f3ed2b5b54f6bb4a25784d61e66821dd4a19b83a
SHA256c6df4575c43ca119907e903726e88ce21dc41a36ea6b0dda25806b862050fdf5
SHA51249a1bdb0fdfec426cc0ccdb0f2fc4ce7009beff590402568dbd6691a26b239999df05bfe97220a9a1e87fcf44501235b26ab54be69f1c4951794ad247cf9befa
-
Filesize
1.7MB
MD57fd8a3ed2355ac7d27edebd3d03b9c3d
SHA15ad5b704bb66f76c64d0c493094380f2844fef0e
SHA256560e746a7908dddf140088039058c2150e08f726e4304869506061e4bce3885e
SHA512f15bfd422666f858efb415405b0687ff8b9b40bf09375f99b7499e34684c511dffce88e885220ca6c8d982c0073098549b3b28f8c32084befc22af364f7d3653
-
Filesize
901KB
MD5fe2a0ebaeea647b4dc4f5c618b8dd0f3
SHA1baebc0cf9bde7bd8c12dacada897061e5c429e77
SHA256af3143bdb99bd44d6f3cd024a9756dc2e11f88e7822c85995e1ebfe1f9a8d88c
SHA512fa3758e86ee68f633c9d64beceec8d976a0b2c6b8ddef9a727513bb08ccabb5d6be3b9130b0ebf060aab4976d379c2e46aded43b6b3ef7e736498e4af423547a
-
Filesize
2.7MB
MD5ea7b10fa11829c0ef4a26b92a175e297
SHA1b1fa74961129d2c77ceff663e528345c0123cc3b
SHA2561bae6047517dcc64ed7dc0e7b76b32cc1d7a00e5e0fa6a260b286c4f993817e4
SHA5127deceab061a45128aa7f79b6bb577a8b16ed9d5f2a5da49d2e53315e752e61d5da315deb0b26625c5fa3ea1862d1b88d67bfe03696b4a32c8fa769079053b807
-
Filesize
1.8MB
MD59b8db0a71bea0503b72502f6b7e9cc55
SHA12ea420bde7b1d202670292af13649b840e02eed8
SHA256fabcaffe12bb450540c927b2579527ccee45730225ecd1ef7bc8b2d64ec1aecc
SHA512d2a509269644c94b10e3bd4990810523747b113ec0d56a0d22b61402cf9870b4a6bde3f03943548e7ef228e77af07a735c5f556e367f62908a3b545d96d6754c
-
Filesize
479KB
MD509372174e83dbbf696ee732fd2e875bb
SHA1ba360186ba650a769f9303f48b7200fb5eaccee1
SHA256c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
SHA512b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
-
Filesize
13.8MB
MD50a8747a2ac9ac08ae9508f36c6d75692
SHA1b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA25632d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
SHA51259521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\AlternateServices.bin
Filesize6KB
MD526d36ac05b6bb3850f6b39e4528f0255
SHA14a36e23b9bbced86a7b2162c4380e1d2ed8084fd
SHA256b0276108010be2744ec6014662d93f72efb3d2d5198df70e8f61bc3a2bc2c2d1
SHA51236781fb76579b4a66affb1ca952852afe09d8c77be42705415c24eda0a431a3967e5a14383b188fa0e61a3113a85ba490c730225939ce55b420f4b93d04fc2be
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\AlternateServices.bin
Filesize8KB
MD5218716eb2569e3ce07dda00e0e8a5fce
SHA17bc11d7b00de6ef0607e8e1684f37044224f0fb2
SHA25644b133549e0724d7580b732153aa4ec57507270129536a967419030ef1dcd5ba
SHA512eb2b302bbfdcb2f867a71f7df22bb9e2e67fed25d94c4f676c2ab02d61317c17d3449a812ddad4fee23e2fd759de92d59f1631bca0eb1fd975dfd8a9630a2e50
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\AlternateServices.bin
Filesize12KB
MD505eea7f46e81b58df38d1da5afd0035e
SHA1a96f988f7db3b2200fb0f5740785549a1f058015
SHA2560af210821ec7c759572170742b411e3531104b594ad5c60f66b5d7a3c664eda5
SHA512c1d7f0e82caf50b848c1eb7ef077dcbf1175b55d3e902571e1d35745d737c504212aa158c59f86547cba668dac6b1e387b6f4404f3cf20225e143b93e37a02ce
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\datareporting\glean\db\data.safe.tmp
Filesize5KB
MD5362c71fb714c50a883cf3b12b80ad3f0
SHA142f2e92bcda63610de035d8082dd897bb50fe375
SHA25660da775306412a040c463cc9ffe9e0cf4946ef7a0042be9a3632627de4fa0fea
SHA5124a15e69e48b3fe812afd79f80cc264931112144946f14e2385dde111ac83dbdc7cd47f287a3104feb9c4ea7ba6f995f6d645f229ae90e1559f4627668dbf5694
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\datareporting\glean\db\data.safe.tmp
Filesize15KB
MD51c573e2adeb3f2c844511068d3c720ad
SHA100b1d79e63c9288e32faed1d658e569049723660
SHA256b2a9e0c0cc3eafe35b13ba8adfcad055c9da8494c3d6bd863808861f940b3751
SHA5129e42e50460a09a7ecbad8225305651890374089963d4c99f097f0bde86bb85495a8bd07f4ca2fbb96a8ab6171d412af38225053e5e3c0e31574949cf8568d217
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\datareporting\glean\db\data.safe.tmp
Filesize15KB
MD5dede397577397b2003feb194e062ae5f
SHA19091bbdcbcc8bb0e0eff885c7ababc5dcea50b43
SHA256010993eed7d50adeec9f7d59b4316550356db9462c5662f7dd3ca44e19b9948a
SHA51295817f9035fc1442273021a9fc00a996cf67920cb6ed8e71ad583d5c1a09f049357b9bc6bf7c87d18cb25a4b6261a71fab27bd3903f602f3a8a79ce1b1c130dd
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\datareporting\glean\pending_pings\039a56d6-79b3-42d2-9465-1d60ad3f142d
Filesize982B
MD5da127f53be02031369942d8930f62e07
SHA1ba7fc87e65df7ff3944d27b211a0acd87c02d109
SHA2560e8a3ac76b8d63b79df93add5eb54cc33f52717e746b853823a6374a9a41b3a6
SHA512193f1f9b5165bc76b831352e1a77e1992076d3961eb345843c8c4174af74829aaca229504f43575e1897fa8c5b7762467389128b0af2dea0210cff2a595f18b1
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\datareporting\glean\pending_pings\4f726115-9ca0-449c-a9b5-a1938cfa86df
Filesize27KB
MD50b5dc352c9ecab68ca4f1c6e44105a0d
SHA1f5cd3eb7d72ff5ae4d9acd49862703f9d3a109f8
SHA256056c2f49f043dc047b2175b8a424383777919c401bb747b57dd0f87607649851
SHA512f73307e36ec6c4330ca44f02344f805a9c1ff6f9f882d8019ec860de9d6eebe424d875ebbcf3d947d557af2f92095eff2ff1633da245a11c8937ef8237cf1b6f
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\datareporting\glean\pending_pings\b7d1a5cc-e9d3-4222-9118-e2399c22c46b
Filesize671B
MD5b4a6b8c7ee5cfb1370f18a132e295241
SHA130182836e8593f3c1bafef7255abfb16639933d8
SHA2565613f0726f01c5b5569cc2f9830d1bd151f216e4bd802fa533e46e144f3c1793
SHA5120c263f77d1c7eaa85f0c18087ace6744235c85a451cd7ba8b4cfc70048dae537e595789b4d4bb9cce8dbd7e16dee7d6912bc16cd5da8c898f45606eb9a9b7ae3
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Filesize1.1MB
MD5842039753bf41fa5e11b3a1383061a87
SHA13e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA256d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
SHA512d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Filesize116B
MD52a461e9eb87fd1955cea740a3444ee7a
SHA1b10755914c713f5a4677494dbe8a686ed458c3c5
SHA2564107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
SHA51234f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Filesize372B
MD5bf957ad58b55f64219ab3f793e374316
SHA1a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA256bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
SHA51279c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Filesize17.8MB
MD5daf7ef3acccab478aaa7d6dc1c60f865
SHA1f8246162b97ce4a945feced27b6ea114366ff2ad
SHA256bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
SHA5125840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
-
Filesize
11KB
MD53e024d208d180f8dc28f5a651e911482
SHA1e1725482294ec6d9f24107d0c37077baff8d8ead
SHA2562704361b51230592b099e818b11fadb7d5fbe8c4e00db2793022023b31a4ef54
SHA5123f18d760386fe0bcade9250ea73700fcb46d5c4938e5b0bb3f3ea807d00f1ee8de6105b7a3e8073283560acd3553dc37b5fe7a2349be93e57daa13936a1ebe6d
-
Filesize
11KB
MD5999d592c0d7451008a648edbf6498077
SHA154cd97cd603cc68a886c3b6214e06f00869dc468
SHA2566600651246fd240862ef33ea0b7a20f50c47b180084f24585595edde4b114ed7
SHA512874562bb4abdbce044cacc7f3519471bf8ecff05c4f01ae0e2af341fa3cb8a4b3629c136446c162ae3d74e6ab3d2e91bb8fd767dd2314641f51e7560eea5f041