Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
01/12/2024, 01:08
Static task
static1
Behavioral task
behavioral1
Sample
373ffb138b7376264a307837ef5bd51bd02380376f9fdd27350cf1b65a28bcbb.exe
Resource
win7-20241023-en
General
-
Target
373ffb138b7376264a307837ef5bd51bd02380376f9fdd27350cf1b65a28bcbb.exe
-
Size
1.8MB
-
MD5
3ca635061fa9685d799784f665850565
-
SHA1
549bb2808560d826b7be8ea502b46e3cdc101ce3
-
SHA256
373ffb138b7376264a307837ef5bd51bd02380376f9fdd27350cf1b65a28bcbb
-
SHA512
7812edb799fc4ac60c856c61ecd793fb5499ffe433c9bf60e251d4e3e9d5bb4df8d8f2873bb643036ccbb5bc611cc339ad8e8789feec3b3c5834bb72ed887792
-
SSDEEP
24576:9w/gXXZLf9FpuSVA83ZIaoOD8BR98BpLOKKxsGaC3x5MY0s9r3k7in9tFvGH:9kKpVu8pIO+D8rLOKHRQ5MYR3mV
Malware Config
Extracted
amadey
4.42
9c9aa5
http://185.215.113.43
-
install_dir
abc3bc1985
-
install_file
skotes.exe
-
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
-
url_paths
/Zu7JuNko/index.php
Extracted
stealc
drum
http://185.215.113.206
-
url_path
/c4becf79229cb002.php
Extracted
lumma
Signatures
-
Amadey family
-
Lumma family
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection 2bb7ba6b04.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 2bb7ba6b04.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" 2bb7ba6b04.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 2bb7ba6b04.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 2bb7ba6b04.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 2bb7ba6b04.exe -
Stealc family
-
Enumerates VirtualBox registry keys 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF 8b454a45af.exe -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 2704fd3c33.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 8a9e2c7282.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 2bb7ba6b04.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 373ffb138b7376264a307837ef5bd51bd02380376f9fdd27350cf1b65a28bcbb.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 8b454a45af.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 3f3f5ea8aa.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 14 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 8a9e2c7282.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 2bb7ba6b04.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 8b454a45af.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 8b454a45af.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 373ffb138b7376264a307837ef5bd51bd02380376f9fdd27350cf1b65a28bcbb.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 8a9e2c7282.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 3f3f5ea8aa.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 2704fd3c33.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 2bb7ba6b04.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 373ffb138b7376264a307837ef5bd51bd02380376f9fdd27350cf1b65a28bcbb.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 2704fd3c33.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 3f3f5ea8aa.exe -
Executes dropped EXE 7 IoCs
pid Process 2696 skotes.exe 1972 8b454a45af.exe 2832 3f3f5ea8aa.exe 2784 2704fd3c33.exe 748 8a9e2c7282.exe 2676 f85c115af8.exe 2568 2bb7ba6b04.exe -
Identifies Wine through registry keys 2 TTPs 7 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Wine skotes.exe Key opened \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Wine 8b454a45af.exe Key opened \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Wine 3f3f5ea8aa.exe Key opened \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Wine 2704fd3c33.exe Key opened \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Wine 8a9e2c7282.exe Key opened \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Wine 2bb7ba6b04.exe Key opened \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Wine 373ffb138b7376264a307837ef5bd51bd02380376f9fdd27350cf1b65a28bcbb.exe -
Loads dropped DLL 10 IoCs
pid Process 1988 373ffb138b7376264a307837ef5bd51bd02380376f9fdd27350cf1b65a28bcbb.exe 1988 373ffb138b7376264a307837ef5bd51bd02380376f9fdd27350cf1b65a28bcbb.exe 2696 skotes.exe 2696 skotes.exe 2696 skotes.exe 2696 skotes.exe 2696 skotes.exe 2696 skotes.exe 2696 skotes.exe 2696 skotes.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features 2bb7ba6b04.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" 2bb7ba6b04.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\f85c115af8.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1010836001\\f85c115af8.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\2bb7ba6b04.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1010837001\\2bb7ba6b04.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\2704fd3c33.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1010834001\\2704fd3c33.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\8a9e2c7282.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1010835001\\8a9e2c7282.exe" skotes.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/files/0x000500000001878e-146.dat autoit_exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
pid Process 1988 373ffb138b7376264a307837ef5bd51bd02380376f9fdd27350cf1b65a28bcbb.exe 2696 skotes.exe 1972 8b454a45af.exe 2832 3f3f5ea8aa.exe 2784 2704fd3c33.exe 748 8a9e2c7282.exe 2568 2bb7ba6b04.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\skotes.job 373ffb138b7376264a307837ef5bd51bd02380376f9fdd27350cf1b65a28bcbb.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 12 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 373ffb138b7376264a307837ef5bd51bd02380376f9fdd27350cf1b65a28bcbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language skotes.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8b454a45af.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2704fd3c33.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f85c115af8.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8a9e2c7282.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2bb7ba6b04.exe -
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe -
Kills process with taskkill 5 IoCs
pid Process 1832 taskkill.exe 2636 taskkill.exe 1196 taskkill.exe 1388 taskkill.exe 1932 taskkill.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_Classes\Local Settings firefox.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 2704fd3c33.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a 2704fd3c33.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a 2704fd3c33.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 1988 373ffb138b7376264a307837ef5bd51bd02380376f9fdd27350cf1b65a28bcbb.exe 2696 skotes.exe 1972 8b454a45af.exe 1972 8b454a45af.exe 1972 8b454a45af.exe 1972 8b454a45af.exe 1972 8b454a45af.exe 1972 8b454a45af.exe 2832 3f3f5ea8aa.exe 2784 2704fd3c33.exe 748 8a9e2c7282.exe 2676 f85c115af8.exe 2568 2bb7ba6b04.exe 2676 f85c115af8.exe 2568 2bb7ba6b04.exe 2568 2bb7ba6b04.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeDebugPrivilege 1832 taskkill.exe Token: SeDebugPrivilege 2636 taskkill.exe Token: SeDebugPrivilege 1196 taskkill.exe Token: SeDebugPrivilege 1388 taskkill.exe Token: SeDebugPrivilege 1932 taskkill.exe Token: SeDebugPrivilege 1912 firefox.exe Token: SeDebugPrivilege 1912 firefox.exe Token: SeDebugPrivilege 2568 2bb7ba6b04.exe -
Suspicious use of FindShellTrayWindow 15 IoCs
pid Process 1988 373ffb138b7376264a307837ef5bd51bd02380376f9fdd27350cf1b65a28bcbb.exe 2676 f85c115af8.exe 2676 f85c115af8.exe 2676 f85c115af8.exe 2676 f85c115af8.exe 2676 f85c115af8.exe 1912 firefox.exe 1912 firefox.exe 1912 firefox.exe 1912 firefox.exe 2676 f85c115af8.exe 2676 f85c115af8.exe 2676 f85c115af8.exe 2676 f85c115af8.exe 2676 f85c115af8.exe -
Suspicious use of SendNotifyMessage 13 IoCs
pid Process 2676 f85c115af8.exe 2676 f85c115af8.exe 2676 f85c115af8.exe 2676 f85c115af8.exe 2676 f85c115af8.exe 1912 firefox.exe 1912 firefox.exe 1912 firefox.exe 2676 f85c115af8.exe 2676 f85c115af8.exe 2676 f85c115af8.exe 2676 f85c115af8.exe 2676 f85c115af8.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1988 wrote to memory of 2696 1988 373ffb138b7376264a307837ef5bd51bd02380376f9fdd27350cf1b65a28bcbb.exe 30 PID 1988 wrote to memory of 2696 1988 373ffb138b7376264a307837ef5bd51bd02380376f9fdd27350cf1b65a28bcbb.exe 30 PID 1988 wrote to memory of 2696 1988 373ffb138b7376264a307837ef5bd51bd02380376f9fdd27350cf1b65a28bcbb.exe 30 PID 1988 wrote to memory of 2696 1988 373ffb138b7376264a307837ef5bd51bd02380376f9fdd27350cf1b65a28bcbb.exe 30 PID 2696 wrote to memory of 1972 2696 skotes.exe 33 PID 2696 wrote to memory of 1972 2696 skotes.exe 33 PID 2696 wrote to memory of 1972 2696 skotes.exe 33 PID 2696 wrote to memory of 1972 2696 skotes.exe 33 PID 2696 wrote to memory of 2832 2696 skotes.exe 34 PID 2696 wrote to memory of 2832 2696 skotes.exe 34 PID 2696 wrote to memory of 2832 2696 skotes.exe 34 PID 2696 wrote to memory of 2832 2696 skotes.exe 34 PID 2696 wrote to memory of 2784 2696 skotes.exe 35 PID 2696 wrote to memory of 2784 2696 skotes.exe 35 PID 2696 wrote to memory of 2784 2696 skotes.exe 35 PID 2696 wrote to memory of 2784 2696 skotes.exe 35 PID 2696 wrote to memory of 748 2696 skotes.exe 36 PID 2696 wrote to memory of 748 2696 skotes.exe 36 PID 2696 wrote to memory of 748 2696 skotes.exe 36 PID 2696 wrote to memory of 748 2696 skotes.exe 36 PID 2696 wrote to memory of 2676 2696 skotes.exe 37 PID 2696 wrote to memory of 2676 2696 skotes.exe 37 PID 2696 wrote to memory of 2676 2696 skotes.exe 37 PID 2696 wrote to memory of 2676 2696 skotes.exe 37 PID 2676 wrote to memory of 1832 2676 f85c115af8.exe 38 PID 2676 wrote to memory of 1832 2676 f85c115af8.exe 38 PID 2676 wrote to memory of 1832 2676 f85c115af8.exe 38 PID 2676 wrote to memory of 1832 2676 f85c115af8.exe 38 PID 2676 wrote to memory of 2636 2676 f85c115af8.exe 41 PID 2676 wrote to memory of 2636 2676 f85c115af8.exe 41 PID 2676 wrote to memory of 2636 2676 f85c115af8.exe 41 PID 2676 wrote to memory of 2636 2676 f85c115af8.exe 41 PID 2676 wrote to memory of 1196 2676 f85c115af8.exe 43 PID 2676 wrote to memory of 1196 2676 f85c115af8.exe 43 PID 2676 wrote to memory of 1196 2676 f85c115af8.exe 43 PID 2676 wrote to memory of 1196 2676 f85c115af8.exe 43 PID 2676 wrote to memory of 1388 2676 f85c115af8.exe 45 PID 2676 wrote to memory of 1388 2676 f85c115af8.exe 45 PID 2676 wrote to memory of 1388 2676 f85c115af8.exe 45 PID 2676 wrote to memory of 1388 2676 f85c115af8.exe 45 PID 2676 wrote to memory of 1932 2676 f85c115af8.exe 47 PID 2676 wrote to memory of 1932 2676 f85c115af8.exe 47 PID 2676 wrote to memory of 1932 2676 f85c115af8.exe 47 PID 2676 wrote to memory of 1932 2676 f85c115af8.exe 47 PID 2676 wrote to memory of 1712 2676 f85c115af8.exe 49 PID 2676 wrote to memory of 1712 2676 f85c115af8.exe 49 PID 2676 wrote to memory of 1712 2676 f85c115af8.exe 49 PID 2676 wrote to memory of 1712 2676 f85c115af8.exe 49 PID 1712 wrote to memory of 1912 1712 firefox.exe 50 PID 1712 wrote to memory of 1912 1712 firefox.exe 50 PID 1712 wrote to memory of 1912 1712 firefox.exe 50 PID 1712 wrote to memory of 1912 1712 firefox.exe 50 PID 1712 wrote to memory of 1912 1712 firefox.exe 50 PID 1712 wrote to memory of 1912 1712 firefox.exe 50 PID 1712 wrote to memory of 1912 1712 firefox.exe 50 PID 1712 wrote to memory of 1912 1712 firefox.exe 50 PID 1712 wrote to memory of 1912 1712 firefox.exe 50 PID 1712 wrote to memory of 1912 1712 firefox.exe 50 PID 1712 wrote to memory of 1912 1712 firefox.exe 50 PID 1712 wrote to memory of 1912 1712 firefox.exe 50 PID 1912 wrote to memory of 2852 1912 firefox.exe 51 PID 1912 wrote to memory of 2852 1912 firefox.exe 51 PID 1912 wrote to memory of 2852 1912 firefox.exe 51 PID 1912 wrote to memory of 756 1912 firefox.exe 52 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\373ffb138b7376264a307837ef5bd51bd02380376f9fdd27350cf1b65a28bcbb.exe"C:\Users\Admin\AppData\Local\Temp\373ffb138b7376264a307837ef5bd51bd02380376f9fdd27350cf1b65a28bcbb.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\1010832001\8b454a45af.exe"C:\Users\Admin\AppData\Local\Temp\1010832001\8b454a45af.exe"3⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1972
-
-
C:\Users\Admin\AppData\Local\Temp\1010833001\3f3f5ea8aa.exe"C:\Users\Admin\AppData\Local\Temp\1010833001\3f3f5ea8aa.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2832
-
-
C:\Users\Admin\AppData\Local\Temp\1010834001\2704fd3c33.exe"C:\Users\Admin\AppData\Local\Temp\1010834001\2704fd3c33.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
PID:2784
-
-
C:\Users\Admin\AppData\Local\Temp\1010835001\8a9e2c7282.exe"C:\Users\Admin\AppData\Local\Temp\1010835001\8a9e2c7282.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:748
-
-
C:\Users\Admin\AppData\Local\Temp\1010836001\f85c115af8.exe"C:\Users\Admin\AppData\Local\Temp\1010836001\f85c115af8.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM firefox.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1832
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM chrome.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2636
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM msedge.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1196
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM opera.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1388
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM brave.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1932
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking4⤵
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking5⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1912.0.1780278759\1875541443" -parentBuildID 20221007134813 -prefsHandle 1232 -prefMapHandle 1224 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {09d48e23-6895-4712-8b0f-5fe40cf2f9c0} 1912 "\\.\pipe\gecko-crash-server-pipe.1912" 1296 128e5058 gpu6⤵PID:2852
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1912.1.1224423619\1596953378" -parentBuildID 20221007134813 -prefsHandle 1500 -prefMapHandle 1496 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {cabdf1a6-9240-4bf8-8cce-c4115df14a48} 1912 "\\.\pipe\gecko-crash-server-pipe.1912" 1512 e71b58 socket6⤵PID:756
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1912.2.90872897\778685358" -childID 1 -isForBrowser -prefsHandle 2096 -prefMapHandle 2092 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 832 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {19beef15-602b-4bf6-8cfa-75b66657856c} 1912 "\\.\pipe\gecko-crash-server-pipe.1912" 2108 1a7f3558 tab6⤵PID:2076
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1912.3.393596178\1003355182" -childID 2 -isForBrowser -prefsHandle 2596 -prefMapHandle 2592 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 832 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {dec152fe-55ed-41bd-b7fd-e0ac37a737ae} 1912 "\\.\pipe\gecko-crash-server-pipe.1912" 2712 e64b58 tab6⤵PID:1412
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1912.4.943670386\960781120" -childID 3 -isForBrowser -prefsHandle 3412 -prefMapHandle 3692 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 832 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {99caae62-1289-46fe-ae6b-0145c000be89} 1912 "\\.\pipe\gecko-crash-server-pipe.1912" 3724 20437c58 tab6⤵PID:324
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1912.5.1501857847\542134683" -childID 4 -isForBrowser -prefsHandle 3836 -prefMapHandle 3840 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 832 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {188d9456-500c-43ed-b15f-a597210d37be} 1912 "\\.\pipe\gecko-crash-server-pipe.1912" 3824 1bb4cc58 tab6⤵PID:1516
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1912.6.1744238979\820912223" -childID 5 -isForBrowser -prefsHandle 4040 -prefMapHandle 4044 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 832 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2a3ae0d3-ff0a-409d-8da1-a7a01372baf9} 1912 "\\.\pipe\gecko-crash-server-pipe.1912" 4028 212b2558 tab6⤵PID:880
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1010837001\2bb7ba6b04.exe"C:\Users\Admin\AppData\Local\Temp\1010837001\2bb7ba6b04.exe"3⤵
- Modifies Windows Defender Real-time Protection settings
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Windows security modification
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2568
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Impair Defenses
2Disable or Modify Tools
2Modify Registry
4Subvert Trust Controls
1Install Root Certificate
1Virtualization/Sandbox Evasion
3Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\z3l10m6w.default-release\activity-stream.discovery_stream.json.tmp
Filesize26KB
MD5b458301fe67c4c4ad33e10032fd963d2
SHA1764ccb75da7eaf5bd08e230f882fa0e91105c2a8
SHA256c1bd68efa7b3e2a0add214da7e7cd4a00b699b9083429cd87cab6802d8f207c2
SHA5125aca8640730fe1dc0d24a5e708cf44228f54d88c5c447eaf211c6304bc8fa1c4f80a6ad24dcb85b8502827e928c41c5b44f1b6dabb16b61ed44a3e55bf0dcc26
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\z3l10m6w.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
Filesize13KB
MD5f99b4984bd93547ff4ab09d35b9ed6d5
SHA173bf4d313cb094bb6ead04460da9547106794007
SHA256402571262fd1f6dca336f822ceb0ec2a368a25dfe2f4bfa13b45c983e88b6069
SHA512cd0ed84a24d3faae94290aca1b5ef65eef4cfba8a983da9f88ee3268fc611484a72bd44ca0947c0ca8de174619debae4604e15e4b2c364e636424ba1d37e1759
-
Filesize
4.2MB
MD5c94feb7d4fe260f53cc227b9833c6b7e
SHA18d1f50a705256b9b8b688ed385799ed297ca0138
SHA2569926ea0046fd1472946e4db23cd38e22ceecb5dd384ed91fc105a6c4d266ca1d
SHA512fe606f2006ba996ca9afda8b42c89e297106541ced3b2cef15689c6e2a361b69cd2275fa21ba333031befc5321f7c463e935da0ee7a18b07d12ec4f24d191ce6
-
Filesize
4.3MB
MD5a3b6fc75e9332e814f8068fc74937028
SHA1aacf898df6cdc6b7da5d97b7a5728108a1551a18
SHA256a28d11a71ff174f3f011ec4b94d0c67c6c07a367f165347ad02d7004dae27a26
SHA5123d5db5aab7952acb8bcdf670a4eaa14b606b6518219ba15ab6bc5f2c9b5feb2d0acf3c5146751965d33f5cb93bd87048f2e5f4e3928aa3358143cc682ac0bc84
-
Filesize
1.8MB
MD51d118d21b56a59293e64999be49fb8d1
SHA1508580f5568eb0640792416745849846680ba6bd
SHA25669400f595fba73b10cbe83c95fffce2cc33d4f5134d9a96c7c9b9e16c898f15a
SHA5121a158c3469cf0f0f375f311960750885bd21557bce25bf53115e2514e7c945dd9e540ffcb760f99a1bcddc1ec0511448441301f24f302714a8489284f7f6ba87
-
Filesize
1.7MB
MD55851c6aa37bcc0a5b5b899cbc5f2518e
SHA11553c526dbf937284eb69d8005276daafd768f11
SHA256eda726274201ab47f594adb46b80559f8a6d057d9feca660143642e3a475fcf5
SHA51226a1ac576d0cfba9de3e769594d54d1b88299664614946e0de5f26bc6a00b68da1414497b31bc586463250f6b9bad69f3c552f45e1fcb2b48013195004986da1
-
Filesize
900KB
MD536945cc772da75aae26bd98962b20cf5
SHA1644291aadfc10b8f25d403d53cb9d3cab93e7088
SHA25674aebd1ac1cd8dad4f39dd7a8a041b874eb567d2996eaab01aa7e1770f844a06
SHA512eaaa83aba45c84019b25b663834b422024d11c217211795cd7c487214821d26afb1014c878de2ee60d061319e4015bd232ad4d065bcf8604943ea73e28b388c2
-
Filesize
2.7MB
MD5944eb68b3615a8ec06e3dee7f5aacfc8
SHA1d0b1a5caa37cb68232ae4f44febc69fcdcefc962
SHA2562214f8f849171ce12a6761de39767107281f59f8b2ceb9b1e745b3f94f3db5ea
SHA512139cf47d341f35030825c1f4d71d20afc94ec9cd2760507bce4b5fa95bfab0ac4bddcc71839e89f02f7bc4b0722b504c8124729e80770843038d216188ae44d3
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
442KB
MD585430baed3398695717b0263807cf97c
SHA1fffbee923cea216f50fce5d54219a188a5100f41
SHA256a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
SHA51206511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1
-
Filesize
8.0MB
MD5a01c5ecd6108350ae23d2cddf0e77c17
SHA1c6ac28a2cd979f1f9a75d56271821d5ff665e2b6
SHA256345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42
SHA512b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3l10m6w.default-release\datareporting\glean\db\data.safe.bin
Filesize9KB
MD566bb5fc6b672ad6329a6c0003f9e1e98
SHA17e8a54d524a57b355fadd4b7c5eaecab76b51302
SHA256943d51a88ef831251d3bf7a91f1ea2e4125299b1e58f8c3a15f69e22540c9ea0
SHA5121ed52f26eae88f49fc91c78d4e512f90af579b9e046c3b06fe61ec0108de015a22355bbc6e64c3a036957c61bb7b9d1076fd2f1472b4aa3daba0420bf146b3a9
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3l10m6w.default-release\datareporting\glean\pending_pings\e2b04aa4-93b2-4c7a-b5bf-7892f5a67bd5
Filesize733B
MD563270712cef600468a463a8ade5cc477
SHA1459534aff47e9d5e27ca18c559505b41b1ff2d84
SHA256306f2ebc7601411e65a42155a3381313c841e0d36a7590efaa2850e32fb6846a
SHA512655f7096fcc038c1a366aaac0ffd5a2ed4da9e83ba1a1b6b51832863e3975c44b9570a920c1ff2b55fb0b347e4cff40748a675435a661b37005d79e923bfc637
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3l10m6w.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
Filesize997KB
MD5fe3355639648c417e8307c6d051e3e37
SHA1f54602d4b4778da21bc97c7238fc66aa68c8ee34
SHA2561ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
SHA5128f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3l10m6w.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
Filesize116B
MD53d33cdc0b3d281e67dd52e14435dd04f
SHA14db88689282fd4f9e9e6ab95fcbb23df6e6485db
SHA256f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
SHA512a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3l10m6w.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
Filesize479B
MD549ddb419d96dceb9069018535fb2e2fc
SHA162aa6fea895a8b68d468a015f6e6ab400d7a7ca6
SHA2562af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
SHA51248386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3l10m6w.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
Filesize372B
MD58be33af717bb1b67fbd61c3f4b807e9e
SHA17cf17656d174d951957ff36810e874a134dd49e0
SHA256e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
SHA5126125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3l10m6w.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
Filesize11.8MB
MD533bf7b0439480effb9fb212efce87b13
SHA1cee50f2745edc6dc291887b6075ca64d716f495a
SHA2568ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e
SHA512d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3l10m6w.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
Filesize1KB
MD5688bed3676d2104e7f17ae1cd2c59404
SHA1952b2cdf783ac72fcb98338723e9afd38d47ad8e
SHA25633899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
SHA5127a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3l10m6w.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
Filesize1KB
MD5937326fead5fd401f6cca9118bd9ade9
SHA14526a57d4ae14ed29b37632c72aef3c408189d91
SHA25668a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
SHA512b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2
-
Filesize
6KB
MD540a0c2995a5181fd7ab3b1fd7e99d374
SHA18375c98d37f0aa8850cdb075bd96c9e105edd20e
SHA2561a11684a28d13ee52ce3148246693f5cd2f6621c41fb2e0a54a293f848750496
SHA512b079d75024bdf26e008d60b833405d5baebbe378b57b6364fbd8ac0a1dd98c8bfea4d29ca7b0455eb2bb0ecce59fd3c67ca7a8f37b7af093ead9bbc03daf5769
-
Filesize
7KB
MD509ab4a6ba52cb1adbdd236808dacafbd
SHA1a7852d5d8cbcb16b28fc8ddf07ea5e44efafc8fb
SHA2561162cce3ac21aa40ad79f97e4e0cc405fb16a8821d2c94f005776ab4d925f0e2
SHA5123844532279d24821faf89b8999398809500a13ac8cfa8f51b44b01825dfbbcbc6b21938b96c99609fc0e79c3063a480b0c278d3afeadd1df7b88c2f07247cabb
-
Filesize
7KB
MD5f3b481bb3d34caeda496b1407150d6e4
SHA1159516210c18611dad3a4b23a82a8ce27a092181
SHA256a3ea27150a0db6c4efdb96f91d3cd7a9b2977d8541ce214ce2c93c2efbbc2076
SHA51257fdaf336aa453bdc13cafefae31c75f346b4c8a0b153880027172ce469deac10cef53ec112713c826644ff567125b48d6ea5c2ed8b8e91024284e486b9657f5
-
Filesize
6KB
MD53ee11d9d8702542283b443acf52f6322
SHA19332c7e3d4f0d8f28f6d64f58c3e853a6ec17115
SHA256133ed00219ed2ed8f5eadeebbad0e34cefdb547975d2eed139240c262905efd9
SHA512750957637f2be7b20efd154bcdc5e577f342321d28d960abb365ef2dd44f5b7179578fe67288b35a3a91913d8080ebdfdfe9a7ca7789aa3d693a2a0c57ab08b8
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3l10m6w.default-release\sessionstore-backups\recovery.jsonlz4
Filesize4KB
MD5c25324135a33d39d3b635b7d00637ba8
SHA1e4de51ecb1d111e54e2b12e5938988ac6c441c24
SHA2565bd45d89bd08826a9fbb8b2358e0b104ad6514b9c99615afc6c4c18c96e51812
SHA5124185ec6b72f4c5994b103ab13be7f42534824e3121c30aebd4c8fd76181570fe30c9a1c59516a140c8678c12c354b049f3fdb450226756b6c0fb6f69b0f3f326
-
Filesize
1.8MB
MD53ca635061fa9685d799784f665850565
SHA1549bb2808560d826b7be8ea502b46e3cdc101ce3
SHA256373ffb138b7376264a307837ef5bd51bd02380376f9fdd27350cf1b65a28bcbb
SHA5127812edb799fc4ac60c856c61ecd793fb5499ffe433c9bf60e251d4e3e9d5bb4df8d8f2873bb643036ccbb5bc611cc339ad8e8789feec3b3c5834bb72ed887792