Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
05/12/2024, 02:08
Static task
static1
Behavioral task
behavioral1
Sample
16ecebf3a511ecf41aedcb046c749990fd7d25581a3387bb6204989b78928d12.exe
Resource
win7-20240903-en
General
-
Target
16ecebf3a511ecf41aedcb046c749990fd7d25581a3387bb6204989b78928d12.exe
-
Size
1.8MB
-
MD5
7b92d16653d665a34de4c92d58e583df
-
SHA1
3023e4305423e69cabf82b2e0ba20d87cf67cd85
-
SHA256
16ecebf3a511ecf41aedcb046c749990fd7d25581a3387bb6204989b78928d12
-
SHA512
6efb2fa816fe7bb92e91233756781ffed7d72594d4ae927e0ea3fcb61744e9bd7dfe626c6e64445d0797815748765032b44d9ab1a3c6f22e46dd86cda5098a03
-
SSDEEP
24576:GiZI3q/ZYhTUvu4XYCK7mqtpvp8GPlAdD/9zmt26WeQcEcPH8GLMOMGEP0dH:G0IqwUVXN+8GPap9iOrGLJM/Pm
Malware Config
Extracted
amadey
4.42
9c9aa5
http://185.215.113.43
-
install_dir
abc3bc1985
-
install_file
skotes.exe
-
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
-
url_paths
/Zu7JuNko/index.php
Extracted
lumma
https://ratiomun.cyou
Extracted
stealc
drum
http://185.215.113.206
-
url_path
/c4becf79229cb002.php
Extracted
lumma
https://ratiomun.cyou/api
Signatures
-
Amadey family
-
Lumma family
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection 53a0351a32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 53a0351a32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" 53a0351a32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 53a0351a32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 53a0351a32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 53a0351a32.exe -
Stealc family
-
Enumerates VirtualBox registry keys 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF 4bfe0b645e.exe -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 9 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 16ecebf3a511ecf41aedcb046c749990fd7d25581a3387bb6204989b78928d12.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ BhD8htX.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 565efac2fa.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 53a0351a32.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 4bfe0b645e.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ rhnew.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 7a3d156003.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 9251ef622a.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 18 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion BhD8htX.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion BhD8htX.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 4bfe0b645e.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 4bfe0b645e.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion rhnew.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 16ecebf3a511ecf41aedcb046c749990fd7d25581a3387bb6204989b78928d12.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 7a3d156003.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 7a3d156003.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 53a0351a32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 53a0351a32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 16ecebf3a511ecf41aedcb046c749990fd7d25581a3387bb6204989b78928d12.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 565efac2fa.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 9251ef622a.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 9251ef622a.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 565efac2fa.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion rhnew.exe -
Executes dropped EXE 9 IoCs
pid Process 2408 skotes.exe 2960 BhD8htX.exe 1780 7a3d156003.exe 1624 565efac2fa.exe 1564 9251ef622a.exe 2808 06c279527c.exe 2088 53a0351a32.exe 3552 4bfe0b645e.exe 3772 rhnew.exe -
Identifies Wine through registry keys 2 TTPs 9 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Wine 9251ef622a.exe Key opened \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Wine 4bfe0b645e.exe Key opened \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Wine rhnew.exe Key opened \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Wine 16ecebf3a511ecf41aedcb046c749990fd7d25581a3387bb6204989b78928d12.exe Key opened \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Wine skotes.exe Key opened \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Wine 565efac2fa.exe Key opened \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Wine BhD8htX.exe Key opened \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Wine 7a3d156003.exe Key opened \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Wine 53a0351a32.exe -
Loads dropped DLL 14 IoCs
pid Process 2892 16ecebf3a511ecf41aedcb046c749990fd7d25581a3387bb6204989b78928d12.exe 2892 16ecebf3a511ecf41aedcb046c749990fd7d25581a3387bb6204989b78928d12.exe 2408 skotes.exe 2408 skotes.exe 2408 skotes.exe 2408 skotes.exe 2408 skotes.exe 2408 skotes.exe 2408 skotes.exe 2408 skotes.exe 2408 skotes.exe 2408 skotes.exe 2408 skotes.exe 1780 7a3d156003.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features 53a0351a32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" 53a0351a32.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\565efac2fa.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1012209001\\565efac2fa.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\9251ef622a.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1012210001\\9251ef622a.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\06c279527c.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1012211001\\06c279527c.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\53a0351a32.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1012212001\\53a0351a32.exe" skotes.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/files/0x0006000000017472-169.dat autoit_exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs
pid Process 2892 16ecebf3a511ecf41aedcb046c749990fd7d25581a3387bb6204989b78928d12.exe 2408 skotes.exe 2960 BhD8htX.exe 1780 7a3d156003.exe 1624 565efac2fa.exe 1564 9251ef622a.exe 2088 53a0351a32.exe 3552 4bfe0b645e.exe 3772 rhnew.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\skotes.job 16ecebf3a511ecf41aedcb046c749990fd7d25581a3387bb6204989b78928d12.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 900 2960 WerFault.exe 32 -
System Location Discovery: System Language Discovery 1 TTPs 17 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 06c279527c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7a3d156003.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language 06c279527c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language skotes.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 565efac2fa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9251ef622a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 53a0351a32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 16ecebf3a511ecf41aedcb046c749990fd7d25581a3387bb6204989b78928d12.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage 06c279527c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4bfe0b645e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rhnew.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BhD8htX.exe -
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe -
Kills process with taskkill 5 IoCs
pid Process 2952 taskkill.exe 1452 taskkill.exe 2300 taskkill.exe 1396 taskkill.exe 2780 taskkill.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_Classes\Local Settings firefox.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 BhD8htX.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a BhD8htX.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a BhD8htX.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 565efac2fa.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a 565efac2fa.exe -
Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 2892 16ecebf3a511ecf41aedcb046c749990fd7d25581a3387bb6204989b78928d12.exe 2408 skotes.exe 2960 BhD8htX.exe 1780 7a3d156003.exe 1624 565efac2fa.exe 1564 9251ef622a.exe 2808 06c279527c.exe 2088 53a0351a32.exe 2808 06c279527c.exe 2088 53a0351a32.exe 2088 53a0351a32.exe 3552 4bfe0b645e.exe 3552 4bfe0b645e.exe 3552 4bfe0b645e.exe 3552 4bfe0b645e.exe 3552 4bfe0b645e.exe 3552 4bfe0b645e.exe 3552 4bfe0b645e.exe 3552 4bfe0b645e.exe 3552 4bfe0b645e.exe 3552 4bfe0b645e.exe 3552 4bfe0b645e.exe 3772 rhnew.exe 3772 rhnew.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeDebugPrivilege 2952 taskkill.exe Token: SeDebugPrivilege 1452 taskkill.exe Token: SeDebugPrivilege 2300 taskkill.exe Token: SeDebugPrivilege 1396 taskkill.exe Token: SeDebugPrivilege 2780 taskkill.exe Token: SeDebugPrivilege 2568 firefox.exe Token: SeDebugPrivilege 2568 firefox.exe Token: SeDebugPrivilege 2088 53a0351a32.exe -
Suspicious use of FindShellTrayWindow 16 IoCs
pid Process 2892 16ecebf3a511ecf41aedcb046c749990fd7d25581a3387bb6204989b78928d12.exe 2808 06c279527c.exe 2808 06c279527c.exe 2808 06c279527c.exe 2808 06c279527c.exe 2808 06c279527c.exe 2808 06c279527c.exe 2808 06c279527c.exe 2568 firefox.exe 2568 firefox.exe 2568 firefox.exe 2568 firefox.exe 2808 06c279527c.exe 2808 06c279527c.exe 2808 06c279527c.exe 2808 06c279527c.exe -
Suspicious use of SendNotifyMessage 14 IoCs
pid Process 2808 06c279527c.exe 2808 06c279527c.exe 2808 06c279527c.exe 2808 06c279527c.exe 2808 06c279527c.exe 2808 06c279527c.exe 2808 06c279527c.exe 2568 firefox.exe 2568 firefox.exe 2568 firefox.exe 2808 06c279527c.exe 2808 06c279527c.exe 2808 06c279527c.exe 2808 06c279527c.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2892 wrote to memory of 2408 2892 16ecebf3a511ecf41aedcb046c749990fd7d25581a3387bb6204989b78928d12.exe 28 PID 2892 wrote to memory of 2408 2892 16ecebf3a511ecf41aedcb046c749990fd7d25581a3387bb6204989b78928d12.exe 28 PID 2892 wrote to memory of 2408 2892 16ecebf3a511ecf41aedcb046c749990fd7d25581a3387bb6204989b78928d12.exe 28 PID 2892 wrote to memory of 2408 2892 16ecebf3a511ecf41aedcb046c749990fd7d25581a3387bb6204989b78928d12.exe 28 PID 2408 wrote to memory of 2960 2408 skotes.exe 32 PID 2408 wrote to memory of 2960 2408 skotes.exe 32 PID 2408 wrote to memory of 2960 2408 skotes.exe 32 PID 2408 wrote to memory of 2960 2408 skotes.exe 32 PID 2408 wrote to memory of 1780 2408 skotes.exe 33 PID 2408 wrote to memory of 1780 2408 skotes.exe 33 PID 2408 wrote to memory of 1780 2408 skotes.exe 33 PID 2408 wrote to memory of 1780 2408 skotes.exe 33 PID 2408 wrote to memory of 1624 2408 skotes.exe 36 PID 2408 wrote to memory of 1624 2408 skotes.exe 36 PID 2408 wrote to memory of 1624 2408 skotes.exe 36 PID 2408 wrote to memory of 1624 2408 skotes.exe 36 PID 2408 wrote to memory of 1564 2408 skotes.exe 37 PID 2408 wrote to memory of 1564 2408 skotes.exe 37 PID 2408 wrote to memory of 1564 2408 skotes.exe 37 PID 2408 wrote to memory of 1564 2408 skotes.exe 37 PID 2408 wrote to memory of 2808 2408 skotes.exe 39 PID 2408 wrote to memory of 2808 2408 skotes.exe 39 PID 2408 wrote to memory of 2808 2408 skotes.exe 39 PID 2408 wrote to memory of 2808 2408 skotes.exe 39 PID 2808 wrote to memory of 2952 2808 06c279527c.exe 40 PID 2808 wrote to memory of 2952 2808 06c279527c.exe 40 PID 2808 wrote to memory of 2952 2808 06c279527c.exe 40 PID 2808 wrote to memory of 2952 2808 06c279527c.exe 40 PID 2808 wrote to memory of 1452 2808 06c279527c.exe 42 PID 2808 wrote to memory of 1452 2808 06c279527c.exe 42 PID 2808 wrote to memory of 1452 2808 06c279527c.exe 42 PID 2808 wrote to memory of 1452 2808 06c279527c.exe 42 PID 2808 wrote to memory of 2300 2808 06c279527c.exe 44 PID 2808 wrote to memory of 2300 2808 06c279527c.exe 44 PID 2808 wrote to memory of 2300 2808 06c279527c.exe 44 PID 2808 wrote to memory of 2300 2808 06c279527c.exe 44 PID 2808 wrote to memory of 1396 2808 06c279527c.exe 46 PID 2808 wrote to memory of 1396 2808 06c279527c.exe 46 PID 2808 wrote to memory of 1396 2808 06c279527c.exe 46 PID 2808 wrote to memory of 1396 2808 06c279527c.exe 46 PID 2808 wrote to memory of 2780 2808 06c279527c.exe 48 PID 2808 wrote to memory of 2780 2808 06c279527c.exe 48 PID 2808 wrote to memory of 2780 2808 06c279527c.exe 48 PID 2808 wrote to memory of 2780 2808 06c279527c.exe 48 PID 2808 wrote to memory of 2784 2808 06c279527c.exe 50 PID 2808 wrote to memory of 2784 2808 06c279527c.exe 50 PID 2808 wrote to memory of 2784 2808 06c279527c.exe 50 PID 2808 wrote to memory of 2784 2808 06c279527c.exe 50 PID 2784 wrote to memory of 2568 2784 firefox.exe 51 PID 2784 wrote to memory of 2568 2784 firefox.exe 51 PID 2784 wrote to memory of 2568 2784 firefox.exe 51 PID 2784 wrote to memory of 2568 2784 firefox.exe 51 PID 2784 wrote to memory of 2568 2784 firefox.exe 51 PID 2784 wrote to memory of 2568 2784 firefox.exe 51 PID 2784 wrote to memory of 2568 2784 firefox.exe 51 PID 2784 wrote to memory of 2568 2784 firefox.exe 51 PID 2784 wrote to memory of 2568 2784 firefox.exe 51 PID 2784 wrote to memory of 2568 2784 firefox.exe 51 PID 2784 wrote to memory of 2568 2784 firefox.exe 51 PID 2784 wrote to memory of 2568 2784 firefox.exe 51 PID 2568 wrote to memory of 1916 2568 firefox.exe 52 PID 2568 wrote to memory of 1916 2568 firefox.exe 52 PID 2568 wrote to memory of 1916 2568 firefox.exe 52 PID 2568 wrote to memory of 1536 2568 firefox.exe 53 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\16ecebf3a511ecf41aedcb046c749990fd7d25581a3387bb6204989b78928d12.exe"C:\Users\Admin\AppData\Local\Temp\16ecebf3a511ecf41aedcb046c749990fd7d25581a3387bb6204989b78928d12.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\1012056001\BhD8htX.exe"C:\Users\Admin\AppData\Local\Temp\1012056001\BhD8htX.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
PID:2960 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2960 -s 13324⤵
- Program crash
PID:900
-
-
-
C:\Users\Admin\AppData\Local\Temp\1012208001\7a3d156003.exe"C:\Users\Admin\AppData\Local\Temp\1012208001\7a3d156003.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1780
-
-
C:\Users\Admin\AppData\Local\Temp\1012209001\565efac2fa.exe"C:\Users\Admin\AppData\Local\Temp\1012209001\565efac2fa.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
PID:1624
-
-
C:\Users\Admin\AppData\Local\Temp\1012210001\9251ef622a.exe"C:\Users\Admin\AppData\Local\Temp\1012210001\9251ef622a.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1564
-
-
C:\Users\Admin\AppData\Local\Temp\1012211001\06c279527c.exe"C:\Users\Admin\AppData\Local\Temp\1012211001\06c279527c.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM firefox.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2952
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM chrome.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1452
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM msedge.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2300
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM opera.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1396
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM brave.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2780
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking4⤵
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking5⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2568.0.1426064203\1481529635" -parentBuildID 20221007134813 -prefsHandle 1252 -prefMapHandle 1244 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {73645b1d-b90c-4cde-a03a-41205f906c9a} 2568 "\\.\pipe\gecko-crash-server-pipe.2568" 1368 14d03b58 gpu6⤵PID:1916
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2568.1.824081260\133019257" -parentBuildID 20221007134813 -prefsHandle 1520 -prefMapHandle 1516 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f24e081a-ef4d-484c-93a3-8087761df0a3} 2568 "\\.\pipe\gecko-crash-server-pipe.2568" 1532 43fa258 socket6⤵PID:1536
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2568.2.1584116418\1733051821" -childID 1 -isForBrowser -prefsHandle 2092 -prefMapHandle 2088 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 824 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {77cfdba3-ad33-4f01-b2de-7e385a4761de} 2568 "\\.\pipe\gecko-crash-server-pipe.2568" 2104 1aba2958 tab6⤵PID:2188
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2568.3.1934312804\1464531787" -childID 2 -isForBrowser -prefsHandle 2640 -prefMapHandle 2636 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 824 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4bfa4ba2-6476-4451-978f-b1e54f95c8d3} 2568 "\\.\pipe\gecko-crash-server-pipe.2568" 2656 e5d258 tab6⤵PID:2800
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2568.4.2042713237\856247168" -childID 3 -isForBrowser -prefsHandle 3944 -prefMapHandle 3940 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 824 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c94e7672-3e9d-4fd4-8b4d-edd9477289a9} 2568 "\\.\pipe\gecko-crash-server-pipe.2568" 3956 2092b158 tab6⤵PID:2760
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2568.5.1408148532\873108101" -childID 4 -isForBrowser -prefsHandle 4064 -prefMapHandle 4068 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 824 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {19f51c3d-6193-4c23-b77d-ebc41e145047} 2568 "\\.\pipe\gecko-crash-server-pipe.2568" 4052 2092b458 tab6⤵PID:2600
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2568.6.904559918\1055196687" -childID 5 -isForBrowser -prefsHandle 4236 -prefMapHandle 4240 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 824 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c4bf11e5-5d8b-4317-b070-47b5ff466bc8} 2568 "\\.\pipe\gecko-crash-server-pipe.2568" 4224 20a4a558 tab6⤵PID:2276
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1012212001\53a0351a32.exe"C:\Users\Admin\AppData\Local\Temp\1012212001\53a0351a32.exe"3⤵
- Modifies Windows Defender Real-time Protection settings
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Windows security modification
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2088
-
-
C:\Users\Admin\AppData\Local\Temp\1012213001\4bfe0b645e.exe"C:\Users\Admin\AppData\Local\Temp\1012213001\4bfe0b645e.exe"3⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3552
-
-
C:\Users\Admin\AppData\Local\Temp\1012214001\rhnew.exe"C:\Users\Admin\AppData\Local\Temp\1012214001\rhnew.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3772
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Impair Defenses
2Disable or Modify Tools
2Modify Registry
4Subvert Trust Controls
1Install Root Certificate
1Virtualization/Sandbox Evasion
3Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\01LB6K3J\download[1].htm
Filesize1B
MD5cfcd208495d565ef66e7dff9f98764da
SHA1b6589fc6ab0dc82cf12099d1c2d40ab994e8410c
SHA2565feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
SHA51231bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5nwvfgbl.default-release\activity-stream.discovery_stream.json.tmp
Filesize32KB
MD57d358841ccf1696019c040ffdf700390
SHA11775fe17d3b64400e410cd6b318a8b62f77c967a
SHA2562421531343742fa86cd3dba365d313f5275802d4db213077d424bd0d4923a028
SHA51278cdff7ddc9a2c44ee5151281c201c77eec2f021d8863b320ccff3c7e74e904dd18fe32c69fdefdecb9fef639f098ea9b6b4bb99bfb966156a503d37f73271c5
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5nwvfgbl.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
Filesize15KB
MD596c542dec016d9ec1ecc4dddfcbaac66
SHA16199f7648bb744efa58acf7b96fee85d938389e4
SHA2567f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798
SHA512cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658
-
Filesize
612B
MD5e3eb0a1df437f3f97a64aca5952c8ea0
SHA17dd71afcfb14e105e80b0c0d7fce370a28a41f0a
SHA25638ffd4972ae513a0c79a8be4573403edcd709f0f572105362b08ff50cf6de521
SHA51243573b0cbaac6e2e1646e6217d2d10c40ad10b9db1f4492d6740545e793c891b5e39283a082896c0392b88eb319dfa9392421b1c89c094c9ce9f31b53d37ebaf
-
Filesize
1.7MB
MD5ff4cf493ac5f7663d1cfc243e6646eb7
SHA1ff7184eae695580f1e86fac340925c7f01f4de6d
SHA25672a99a945b705fc1c8fa59c3db6810be2aadeaecc34f954f5ab314574002d748
SHA5121eef407d5bfa8b94bb98cb0a64e7c73cb94176507fa924642c6cf21192965ba8856390214379fddf192b88e19377768ead94fb4d393831e47ca230b6b168f14b
-
Filesize
1.8MB
MD506b66556e8a2389c099c0da6e0db3dd2
SHA153f96909c6ae94499b790eba12ec355a275388df
SHA256ccd13fcd2302d16a0fd2d9cc2653869ce0551d464145bf264f75163f03f874bc
SHA5128623c835b552b000749405788eba8cc221f505d5285ff5fe8c5d79d81ae5d9a18985427e1f98c4baf2defd38ece14af11683524de636612d69d9b913a6869ce5
-
Filesize
1.8MB
MD5b12e16778fc59591c0be9a05f177bdae
SHA13809bacf7fa357579a7d0f81d036d7fc5e482dd6
SHA256675290c045ad958ec71e15c3134b41c1e4aa8be8475b4ad46b8d4a323936d750
SHA512362f2f7121cd21ecc4fc590dca11a70cc8ba7633d36d1b38fffc6a1cb9d4ad06ea9aa1c7984853bd49e9116d53e6db39aedd741f14335e587e8dce87cfa236bf
-
Filesize
1.7MB
MD5da71401999308f3006e292a28a953516
SHA19a8470f97760506d8fe83c0e0398f9b37c857b2f
SHA256e1bdbadb3c03238af26c510775bb0aa63f7221dd43eb6f02a16332e091718779
SHA5124fd76deffcca140a1d1138386b1f2b87853686660b4ff4c17e80505ecec1f6742c552636a17bdfc3a3aef24d359c376dfef13c14dd0005bc94d1f521e3aa7df4
-
Filesize
948KB
MD5a1c0ae9c47dfa39f9f4ecb25a8ed6df3
SHA162a0861c8a57f4afcd49d4db7ad3a46897b10e1e
SHA256200baf4c343c7bee6e39a39097fda685d33ba525ee1d7045ccafb97b3a22d1a7
SHA5129f13e3774584e6af8cfc7788befc49715bbda6050b1df8675eb8e9b648f38a3a463760f691a6ff639542e5e70d8406f8060d86636e85d596cd883fbc2f614879
-
Filesize
2.6MB
MD56497aafc301bd0c3313acb178dd5b328
SHA15d13e25e93ed6b09b8d9ee87449915b7b5352ec3
SHA256fe5929f96b7aa3c446141156ec7456d560a7a8b576d55bc7fbbd6b4c1201cf8a
SHA51239080221d3740f629691c11174debd1cbeaa4fbafc1bd912b9ecdea9079cf3e8a24e9fecb34c7533e89c3258bc37079f635b665714dc92d2a7e28ad3cda74745
-
Filesize
4.2MB
MD588bf63a8e16a403ede877c51371debe2
SHA104dfbf773b963149cfbe1787bae7a3c8a5bd1f34
SHA2566da015a4d07aaa513f90f351e52f6789345826bf255e5ea616b2bfded6ed4477
SHA512886629e4f4d041cba51659885ad27451f4103cf1c556de21439b52b362b6f03a046b1c245a6b2259d6726fbf9db9f0ea1fee72dde86303fe7aec8a597dd6da9f
-
Filesize
1.8MB
MD5f7286fef9317fe91e24cda721ec0be81
SHA10e0197c0f87200f7c1ebb4bba314f7bb875a638c
SHA2564dcf1cc20990dace1f3e7c5a4b94ea7b823f90eb6de639b2b1b6494838f1cc62
SHA512314b3f5cf1a0c15db568d33647b97887b37e987ba253ee9f5ded045446328307ebd04acd832fbdf66ad29be9510bd0c378e2fcb889509dca84df9b9106602c6e
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
1.8MB
MD57b92d16653d665a34de4c92d58e583df
SHA13023e4305423e69cabf82b2e0ba20d87cf67cd85
SHA25616ecebf3a511ecf41aedcb046c749990fd7d25581a3387bb6204989b78928d12
SHA5126efb2fa816fe7bb92e91233756781ffed7d72594d4ae927e0ea3fcb61744e9bd7dfe626c6e64445d0797815748765032b44d9ab1a3c6f22e46dd86cda5098a03
-
Filesize
442KB
MD585430baed3398695717b0263807cf97c
SHA1fffbee923cea216f50fce5d54219a188a5100f41
SHA256a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
SHA51206511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1
-
Filesize
8.0MB
MD5a01c5ecd6108350ae23d2cddf0e77c17
SHA1c6ac28a2cd979f1f9a75d56271821d5ff665e2b6
SHA256345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42
SHA512b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5nwvfgbl.default-release\datareporting\glean\db\data.safe.bin
Filesize9KB
MD5ffc108691430c9ee14682d007f64eb02
SHA16eb7a61b16c0ca3fb8d556bba85dee5bde71a323
SHA2567ec4bb415f99e54c299639750bdd85c59746ef17ba740bbfb192bdc9ff669ecb
SHA51297b1db17535e8d57689bafa4be62229f010f239df4e2e49834ac100cd6b16303632ce4cc223e6ec6107a862fc968a69927c1aa21f21a43d0a61247fdae380071
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5nwvfgbl.default-release\datareporting\glean\pending_pings\52720a7d-7ccb-44b5-a97e-600603c58409
Filesize733B
MD51af202ef09edc07e3c4a750b05f4a651
SHA12a897d4ae7abec63eedc36e9ecdf3196062c7d8d
SHA256f3939f9c278f6cf964ec345cae37be72ddc7d667a62683421ce31575d4a21b52
SHA5128b2d2902765f03e0e4f13e9ab50b7eb77cc844fa7b018268289d2f387eb2ed999b6fca96e347cee2f9fcfae0f29fa7a7e585ed4c24f3fbacb0942a1d74d79961
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5nwvfgbl.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
Filesize997KB
MD5fe3355639648c417e8307c6d051e3e37
SHA1f54602d4b4778da21bc97c7238fc66aa68c8ee34
SHA2561ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
SHA5128f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5nwvfgbl.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
Filesize116B
MD53d33cdc0b3d281e67dd52e14435dd04f
SHA14db88689282fd4f9e9e6ab95fcbb23df6e6485db
SHA256f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
SHA512a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5nwvfgbl.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
Filesize479B
MD549ddb419d96dceb9069018535fb2e2fc
SHA162aa6fea895a8b68d468a015f6e6ab400d7a7ca6
SHA2562af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
SHA51248386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5nwvfgbl.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
Filesize372B
MD58be33af717bb1b67fbd61c3f4b807e9e
SHA17cf17656d174d951957ff36810e874a134dd49e0
SHA256e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
SHA5126125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5nwvfgbl.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
Filesize11.8MB
MD533bf7b0439480effb9fb212efce87b13
SHA1cee50f2745edc6dc291887b6075ca64d716f495a
SHA2568ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e
SHA512d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5nwvfgbl.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
Filesize1KB
MD5688bed3676d2104e7f17ae1cd2c59404
SHA1952b2cdf783ac72fcb98338723e9afd38d47ad8e
SHA25633899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
SHA5127a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5nwvfgbl.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
Filesize1KB
MD5937326fead5fd401f6cca9118bd9ade9
SHA14526a57d4ae14ed29b37632c72aef3c408189d91
SHA25668a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
SHA512b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2
-
Filesize
6KB
MD5991d3b4cf3b6997b34cc1c285a43f9b8
SHA14a2367488587dc1f13a57038d896da0c52a0b5b0
SHA2560b22775b3a6a84647489b5cedfac51a83e5e1843f15ff93ac180dd800af36feb
SHA51207b8328d6ee5505628769e560b5df40e95bae54337c8804b1bf2f3373fe8671684ceedf04d0c0eeb648f4bc43f0f12d282858490e3b96e3b99bfd37cc5330654
-
Filesize
7KB
MD5d6cc6f4963dfee22c09e61cdf0af8c93
SHA127de951bacf3ec8b84af0bde8d54bef5c9197b08
SHA2563775e7f9a3df394e6357db113d60ff8fce3aeb5d3dd055e4d9d7a62905715967
SHA5123fddb164279f22e6c5958610976ada014b58c453c68d3d3ce194f1a1ba90dff06d9a787c152a1b46bc9f4cdc870657f9b013422676a9fd27348c52cb84bb034e
-
Filesize
7KB
MD53409401f46fdc1b0b2ea142e5f826417
SHA1411058e074807e67877f5a7dd269ec103208c2ca
SHA2562c0daf176c915a13143f624ab4910f42955c9e15b16a2b86df59145d94ab32ab
SHA512fe740d77622df0f78b71f55d5b9bb9a854852c25c092329c6ebd5382f3d3a357c856f4a6a08e8bfc7c02379573c4bb286e48d33934b4894c883258703bfa391a
-
Filesize
6KB
MD57efc8d3161871e1b3308a2aa6cf6dd7c
SHA13447168c80017c8605bacd0e849de9e2dbe8824a
SHA25659aff506682e6351f7d5727de4fe913cb91c311a8b883646e25d54fd61e15b00
SHA512b09e8c6215a5d6388151f0716888b07427d202c5962257509b7c9d75e4a1b4f39ee1ac1962bed1805e13e7f394214445dcb96a2dba5be86b6a26d98192d01429
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5nwvfgbl.default-release\sessionstore-backups\recovery.jsonlz4
Filesize4KB
MD59ce622b5950aee6374d493efa910eb85
SHA118f11e216a5d9ca2e99088859f28ea5b2bd8f616
SHA256b2979a5926759eb818c1c1b93c9e59b6534e2ac07b980a9b58b95da394930ee3
SHA51284905590ad2a9e6b81c02b09411178df48e94ed4f521b4114bad0f24279e24ce514766e6139da4fbd54cf1a92ab2f151b9dac934766bd15688613cf40da6d25d
-
Filesize
1.4MB
MD5a8cf5621811f7fac55cfe8cb3fa6b9f6
SHA1121356839e8138a03141f5f5856936a85bd2a474
SHA256614a0362ab87cee48d0935b5bb957d539be1d94c6fdeb3fe42fac4fbe182c10c
SHA5124479d951435f222ca7306774002f030972c9f1715d6aaf512fca9420dd79cb6d08240f80129f213851773290254be34f0ff63c7b1f4d554a7db5f84b69e84bdd