Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
05/12/2024, 10:26
Static task
static1
Behavioral task
behavioral1
Sample
458d36f8118c122fcd17e2ea1859282fd29e5f774ab7998787150c4f21ed360e.exe
Resource
win7-20240903-en
General
-
Target
458d36f8118c122fcd17e2ea1859282fd29e5f774ab7998787150c4f21ed360e.exe
-
Size
1.8MB
-
MD5
cd86e4c2fbaf81cb17606d69108fff47
-
SHA1
97117dadf1a95214ceaf1d1d9337dae317c6a358
-
SHA256
458d36f8118c122fcd17e2ea1859282fd29e5f774ab7998787150c4f21ed360e
-
SHA512
42393ee97337b197a176032276b9da8bd3ba26d5e5a36751130271422a9cb0a91d50a22c9f75e4de77083b47d8b6c7f54c5f1ebccd09f97dbba8eb6591554748
-
SSDEEP
49152:1hYf1buEc90mDAkzorHA/GJKEmQVhiln:Mf1qEcvDTSNXmQVh6
Malware Config
Extracted
amadey
4.42
9c9aa5
http://185.215.113.43
-
install_dir
abc3bc1985
-
install_file
skotes.exe
-
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
-
url_paths
/Zu7JuNko/index.php
Extracted
lumma
https://ratiomun.cyou
Extracted
stealc
drum
http://185.215.113.206
-
url_path
/c4becf79229cb002.php
Extracted
lumma
https://ratiomun.cyou/api
Signatures
-
Amadey family
-
Lumma family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 6cfa081146.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection 6cfa081146.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 6cfa081146.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" 6cfa081146.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 6cfa081146.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 6cfa081146.exe -
Process spawned unexpected child process 3 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3316 4636 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3248 4636 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3088 4636 schtasks.exe 91 -
Stealc family
-
Enumerates VirtualBox registry keys 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF abc5253792.exe -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 11 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ BhD8htX.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 4c2ebfca57.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 770c49eec0.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 6cfa081146.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ bbdb2dc777.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 458d36f8118c122fcd17e2ea1859282fd29e5f774ab7998787150c4f21ed360e.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ abc5253792.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ rhnew.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2816 powershell.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 22 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion BhD8htX.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 4c2ebfca57.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 770c49eec0.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 6cfa081146.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion abc5253792.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion bbdb2dc777.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 4c2ebfca57.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 770c49eec0.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 6cfa081146.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion bbdb2dc777.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 458d36f8118c122fcd17e2ea1859282fd29e5f774ab7998787150c4f21ed360e.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion rhnew.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion abc5253792.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion rhnew.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 458d36f8118c122fcd17e2ea1859282fd29e5f774ab7998787150c4f21ed360e.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion BhD8htX.exe -
Checks computer location settings 2 TTPs 5 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation chainportruntimeCrtMonitor.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation 458d36f8118c122fcd17e2ea1859282fd29e5f774ab7998787150c4f21ed360e.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation skotes.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation Go.exe -
Executes dropped EXE 14 IoCs
pid Process 4380 skotes.exe 4084 BhD8htX.exe 1296 Go.exe 4360 abc5253792.exe 3924 chainportruntimeCrtMonitor.exe 3696 rhnew.exe 2856 4c2ebfca57.exe 4860 StartMenuExperienceHost.exe 3044 770c49eec0.exe 1640 a4af905047.exe 3384 6cfa081146.exe 4428 skotes.exe 5552 bbdb2dc777.exe 5476 skotes.exe -
Identifies Wine through registry keys 2 TTPs 11 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Wine skotes.exe Key opened \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Wine 458d36f8118c122fcd17e2ea1859282fd29e5f774ab7998787150c4f21ed360e.exe Key opened \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Wine BhD8htX.exe Key opened \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Wine abc5253792.exe Key opened \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Wine rhnew.exe Key opened \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Wine 770c49eec0.exe Key opened \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Wine 6cfa081146.exe Key opened \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Wine skotes.exe Key opened \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Wine 4c2ebfca57.exe Key opened \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Wine skotes.exe Key opened \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Wine bbdb2dc777.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features 6cfa081146.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" 6cfa081146.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\4c2ebfca57.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1012345001\\4c2ebfca57.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\770c49eec0.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1012346001\\770c49eec0.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\a4af905047.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1012347001\\a4af905047.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\6cfa081146.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1012348001\\6cfa081146.exe" skotes.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/files/0x0008000000023cce-204.dat autoit_exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 11 IoCs
pid Process 2324 458d36f8118c122fcd17e2ea1859282fd29e5f774ab7998787150c4f21ed360e.exe 4380 skotes.exe 4084 BhD8htX.exe 4360 abc5253792.exe 3696 rhnew.exe 2856 4c2ebfca57.exe 3044 770c49eec0.exe 3384 6cfa081146.exe 4428 skotes.exe 5552 bbdb2dc777.exe 5476 skotes.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\skotes.job 458d36f8118c122fcd17e2ea1859282fd29e5f774ab7998787150c4f21ed360e.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 20 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rhnew.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 770c49eec0.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a4af905047.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Go.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4c2ebfca57.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6cfa081146.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language skotes.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BhD8htX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language abc5253792.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage a4af905047.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbdb2dc777.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 458d36f8118c122fcd17e2ea1859282fd29e5f774ab7998787150c4f21ed360e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language a4af905047.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 4316 PING.EXE -
Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe -
Kills process with taskkill 5 IoCs
pid Process 1140 taskkill.exe 2720 taskkill.exe 2660 taskkill.exe 4384 taskkill.exe 1328 taskkill.exe -
Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings Go.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings chainportruntimeCrtMonitor.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings firefox.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 4316 PING.EXE -
Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3316 schtasks.exe 3248 schtasks.exe 3088 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2324 458d36f8118c122fcd17e2ea1859282fd29e5f774ab7998787150c4f21ed360e.exe 2324 458d36f8118c122fcd17e2ea1859282fd29e5f774ab7998787150c4f21ed360e.exe 4380 skotes.exe 4380 skotes.exe 4084 BhD8htX.exe 4084 BhD8htX.exe 4360 abc5253792.exe 4360 abc5253792.exe 4360 abc5253792.exe 4360 abc5253792.exe 4360 abc5253792.exe 4360 abc5253792.exe 4360 abc5253792.exe 4360 abc5253792.exe 4360 abc5253792.exe 4360 abc5253792.exe 3924 chainportruntimeCrtMonitor.exe 3924 chainportruntimeCrtMonitor.exe 3924 chainportruntimeCrtMonitor.exe 3924 chainportruntimeCrtMonitor.exe 3924 chainportruntimeCrtMonitor.exe 3924 chainportruntimeCrtMonitor.exe 3924 chainportruntimeCrtMonitor.exe 3924 chainportruntimeCrtMonitor.exe 3924 chainportruntimeCrtMonitor.exe 3924 chainportruntimeCrtMonitor.exe 3924 chainportruntimeCrtMonitor.exe 3924 chainportruntimeCrtMonitor.exe 3924 chainportruntimeCrtMonitor.exe 3924 chainportruntimeCrtMonitor.exe 3924 chainportruntimeCrtMonitor.exe 3924 chainportruntimeCrtMonitor.exe 3924 chainportruntimeCrtMonitor.exe 3924 chainportruntimeCrtMonitor.exe 3924 chainportruntimeCrtMonitor.exe 3924 chainportruntimeCrtMonitor.exe 3924 chainportruntimeCrtMonitor.exe 3924 chainportruntimeCrtMonitor.exe 3924 chainportruntimeCrtMonitor.exe 3924 chainportruntimeCrtMonitor.exe 3924 chainportruntimeCrtMonitor.exe 3924 chainportruntimeCrtMonitor.exe 3924 chainportruntimeCrtMonitor.exe 3924 chainportruntimeCrtMonitor.exe 3924 chainportruntimeCrtMonitor.exe 3924 chainportruntimeCrtMonitor.exe 3924 chainportruntimeCrtMonitor.exe 3924 chainportruntimeCrtMonitor.exe 3924 chainportruntimeCrtMonitor.exe 3924 chainportruntimeCrtMonitor.exe 3924 chainportruntimeCrtMonitor.exe 3924 chainportruntimeCrtMonitor.exe 3924 chainportruntimeCrtMonitor.exe 3924 chainportruntimeCrtMonitor.exe 3924 chainportruntimeCrtMonitor.exe 3924 chainportruntimeCrtMonitor.exe 3924 chainportruntimeCrtMonitor.exe 3924 chainportruntimeCrtMonitor.exe 3924 chainportruntimeCrtMonitor.exe 3924 chainportruntimeCrtMonitor.exe 3924 chainportruntimeCrtMonitor.exe 3924 chainportruntimeCrtMonitor.exe 3924 chainportruntimeCrtMonitor.exe 3924 chainportruntimeCrtMonitor.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4860 StartMenuExperienceHost.exe -
Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeDebugPrivilege 3924 chainportruntimeCrtMonitor.exe Token: SeDebugPrivilege 2816 powershell.exe Token: SeDebugPrivilege 4860 StartMenuExperienceHost.exe Token: SeDebugPrivilege 2660 taskkill.exe Token: SeDebugPrivilege 4384 taskkill.exe Token: SeDebugPrivilege 1328 taskkill.exe Token: SeDebugPrivilege 1140 taskkill.exe Token: SeDebugPrivilege 2720 taskkill.exe Token: SeDebugPrivilege 3032 firefox.exe Token: SeDebugPrivilege 3032 firefox.exe Token: SeDebugPrivilege 3384 6cfa081146.exe -
Suspicious use of FindShellTrayWindow 33 IoCs
pid Process 2324 458d36f8118c122fcd17e2ea1859282fd29e5f774ab7998787150c4f21ed360e.exe 1640 a4af905047.exe 1640 a4af905047.exe 1640 a4af905047.exe 1640 a4af905047.exe 1640 a4af905047.exe 1640 a4af905047.exe 1640 a4af905047.exe 1640 a4af905047.exe 3032 firefox.exe 3032 firefox.exe 3032 firefox.exe 3032 firefox.exe 3032 firefox.exe 3032 firefox.exe 3032 firefox.exe 3032 firefox.exe 3032 firefox.exe 3032 firefox.exe 3032 firefox.exe 3032 firefox.exe 3032 firefox.exe 3032 firefox.exe 3032 firefox.exe 3032 firefox.exe 3032 firefox.exe 3032 firefox.exe 3032 firefox.exe 3032 firefox.exe 3032 firefox.exe 1640 a4af905047.exe 1640 a4af905047.exe 1640 a4af905047.exe -
Suspicious use of SendNotifyMessage 31 IoCs
pid Process 1640 a4af905047.exe 1640 a4af905047.exe 1640 a4af905047.exe 1640 a4af905047.exe 1640 a4af905047.exe 1640 a4af905047.exe 1640 a4af905047.exe 1640 a4af905047.exe 3032 firefox.exe 3032 firefox.exe 3032 firefox.exe 3032 firefox.exe 3032 firefox.exe 3032 firefox.exe 3032 firefox.exe 3032 firefox.exe 3032 firefox.exe 3032 firefox.exe 3032 firefox.exe 3032 firefox.exe 3032 firefox.exe 3032 firefox.exe 3032 firefox.exe 3032 firefox.exe 3032 firefox.exe 3032 firefox.exe 3032 firefox.exe 3032 firefox.exe 1640 a4af905047.exe 1640 a4af905047.exe 1640 a4af905047.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3032 firefox.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2324 wrote to memory of 4380 2324 458d36f8118c122fcd17e2ea1859282fd29e5f774ab7998787150c4f21ed360e.exe 83 PID 2324 wrote to memory of 4380 2324 458d36f8118c122fcd17e2ea1859282fd29e5f774ab7998787150c4f21ed360e.exe 83 PID 2324 wrote to memory of 4380 2324 458d36f8118c122fcd17e2ea1859282fd29e5f774ab7998787150c4f21ed360e.exe 83 PID 4380 wrote to memory of 4084 4380 skotes.exe 85 PID 4380 wrote to memory of 4084 4380 skotes.exe 85 PID 4380 wrote to memory of 4084 4380 skotes.exe 85 PID 4380 wrote to memory of 1296 4380 skotes.exe 93 PID 4380 wrote to memory of 1296 4380 skotes.exe 93 PID 4380 wrote to memory of 1296 4380 skotes.exe 93 PID 1296 wrote to memory of 392 1296 Go.exe 94 PID 1296 wrote to memory of 392 1296 Go.exe 94 PID 1296 wrote to memory of 392 1296 Go.exe 94 PID 4380 wrote to memory of 4360 4380 skotes.exe 101 PID 4380 wrote to memory of 4360 4380 skotes.exe 101 PID 4380 wrote to memory of 4360 4380 skotes.exe 101 PID 392 wrote to memory of 1692 392 WScript.exe 102 PID 392 wrote to memory of 1692 392 WScript.exe 102 PID 392 wrote to memory of 1692 392 WScript.exe 102 PID 1692 wrote to memory of 3924 1692 cmd.exe 104 PID 1692 wrote to memory of 3924 1692 cmd.exe 104 PID 3924 wrote to memory of 2816 3924 chainportruntimeCrtMonitor.exe 108 PID 3924 wrote to memory of 2816 3924 chainportruntimeCrtMonitor.exe 108 PID 3924 wrote to memory of 2484 3924 chainportruntimeCrtMonitor.exe 110 PID 3924 wrote to memory of 2484 3924 chainportruntimeCrtMonitor.exe 110 PID 2484 wrote to memory of 2192 2484 cmd.exe 112 PID 2484 wrote to memory of 2192 2484 cmd.exe 112 PID 2484 wrote to memory of 4316 2484 cmd.exe 113 PID 2484 wrote to memory of 4316 2484 cmd.exe 113 PID 4380 wrote to memory of 3696 4380 skotes.exe 115 PID 4380 wrote to memory of 3696 4380 skotes.exe 115 PID 4380 wrote to memory of 3696 4380 skotes.exe 115 PID 4380 wrote to memory of 2856 4380 skotes.exe 119 PID 4380 wrote to memory of 2856 4380 skotes.exe 119 PID 4380 wrote to memory of 2856 4380 skotes.exe 119 PID 2484 wrote to memory of 4860 2484 cmd.exe 122 PID 2484 wrote to memory of 4860 2484 cmd.exe 122 PID 4380 wrote to memory of 3044 4380 skotes.exe 123 PID 4380 wrote to memory of 3044 4380 skotes.exe 123 PID 4380 wrote to memory of 3044 4380 skotes.exe 123 PID 4380 wrote to memory of 1640 4380 skotes.exe 124 PID 4380 wrote to memory of 1640 4380 skotes.exe 124 PID 4380 wrote to memory of 1640 4380 skotes.exe 124 PID 1640 wrote to memory of 2660 1640 a4af905047.exe 126 PID 1640 wrote to memory of 2660 1640 a4af905047.exe 126 PID 1640 wrote to memory of 2660 1640 a4af905047.exe 126 PID 1640 wrote to memory of 4384 1640 a4af905047.exe 128 PID 1640 wrote to memory of 4384 1640 a4af905047.exe 128 PID 1640 wrote to memory of 4384 1640 a4af905047.exe 128 PID 1640 wrote to memory of 1328 1640 a4af905047.exe 130 PID 1640 wrote to memory of 1328 1640 a4af905047.exe 130 PID 1640 wrote to memory of 1328 1640 a4af905047.exe 130 PID 1640 wrote to memory of 1140 1640 a4af905047.exe 132 PID 1640 wrote to memory of 1140 1640 a4af905047.exe 132 PID 1640 wrote to memory of 1140 1640 a4af905047.exe 132 PID 1640 wrote to memory of 2720 1640 a4af905047.exe 134 PID 1640 wrote to memory of 2720 1640 a4af905047.exe 134 PID 1640 wrote to memory of 2720 1640 a4af905047.exe 134 PID 1640 wrote to memory of 232 1640 a4af905047.exe 136 PID 1640 wrote to memory of 232 1640 a4af905047.exe 136 PID 232 wrote to memory of 3032 232 firefox.exe 137 PID 232 wrote to memory of 3032 232 firefox.exe 137 PID 232 wrote to memory of 3032 232 firefox.exe 137 PID 232 wrote to memory of 3032 232 firefox.exe 137 PID 232 wrote to memory of 3032 232 firefox.exe 137 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\458d36f8118c122fcd17e2ea1859282fd29e5f774ab7998787150c4f21ed360e.exe"C:\Users\Admin\AppData\Local\Temp\458d36f8118c122fcd17e2ea1859282fd29e5f774ab7998787150c4f21ed360e.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\1012056001\BhD8htX.exe"C:\Users\Admin\AppData\Local\Temp\1012056001\BhD8htX.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4084
-
-
C:\Users\Admin\AppData\Local\Temp\1012333001\Go.exe"C:\Users\Admin\AppData\Local\Temp\1012333001\Go.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1296 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\MsContainer\P69CZ8d7qXWcyOsB66pHSLt72y6yplqEAs.vbe"4⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:392 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\MsContainer\GHGhSTUsO1Bq4f5yX2eWVB.bat" "5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\MsContainer\chainportruntimeCrtMonitor.exe"C:\MsContainer/chainportruntimeCrtMonitor.exe"6⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3924 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\StartMenuExperienceHost.exe'7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:2816
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\i4phPo9p78.bat"7⤵
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Windows\system32\chcp.comchcp 650018⤵PID:2192
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost8⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4316
-
-
C:\Users\Admin\AppData\Local\Temp\StartMenuExperienceHost.exe"C:\Users\Admin\AppData\Local\Temp\StartMenuExperienceHost.exe"8⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:4860
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1012341001\abc5253792.exe"C:\Users\Admin\AppData\Local\Temp\1012341001\abc5253792.exe"3⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4360
-
-
C:\Users\Admin\AppData\Local\Temp\1012344001\rhnew.exe"C:\Users\Admin\AppData\Local\Temp\1012344001\rhnew.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
PID:3696
-
-
C:\Users\Admin\AppData\Local\Temp\1012345001\4c2ebfca57.exe"C:\Users\Admin\AppData\Local\Temp\1012345001\4c2ebfca57.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
PID:2856
-
-
C:\Users\Admin\AppData\Local\Temp\1012346001\770c49eec0.exe"C:\Users\Admin\AppData\Local\Temp\1012346001\770c49eec0.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
PID:3044
-
-
C:\Users\Admin\AppData\Local\Temp\1012347001\a4af905047.exe"C:\Users\Admin\AppData\Local\Temp\1012347001\a4af905047.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM firefox.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2660
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM chrome.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4384
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM msedge.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1328
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM opera.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1140
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM brave.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2720
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking4⤵
- Suspicious use of WriteProcessMemory
PID:232 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking5⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3032 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2016 -parentBuildID 20240401114208 -prefsHandle 1932 -prefMapHandle 1904 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {289614bd-8369-428e-aaac-77b3b9b94fb3} 3032 "\\.\pipe\gecko-crash-server-pipe.3032" gpu6⤵PID:2820
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2452 -parentBuildID 20240401114208 -prefsHandle 2428 -prefMapHandle 2424 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5b491e08-2af1-4c91-94c3-016779b71f7a} 3032 "\\.\pipe\gecko-crash-server-pipe.3032" socket6⤵PID:2444
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1460 -childID 1 -isForBrowser -prefsHandle 1540 -prefMapHandle 3324 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1252 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {048503b7-2f2b-45f5-89b0-7f1c6acd5575} 3032 "\\.\pipe\gecko-crash-server-pipe.3032" tab6⤵PID:1844
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4204 -childID 2 -isForBrowser -prefsHandle 4216 -prefMapHandle 4212 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1252 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e957a85d-50fa-4221-b931-99ed5fb65303} 3032 "\\.\pipe\gecko-crash-server-pipe.3032" tab6⤵PID:1436
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4828 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4780 -prefMapHandle 4808 -prefsLen 29197 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {111a549f-72ad-4373-b9a1-4522eb109f8a} 3032 "\\.\pipe\gecko-crash-server-pipe.3032" utility6⤵
- Checks processor information in registry
PID:3352
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5156 -childID 3 -isForBrowser -prefsHandle 5244 -prefMapHandle 5240 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1252 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f3aa3d3f-988f-4ee5-85c6-d617e092321d} 3032 "\\.\pipe\gecko-crash-server-pipe.3032" tab6⤵PID:5896
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5148 -childID 4 -isForBrowser -prefsHandle 5260 -prefMapHandle 5256 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1252 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5e6dc9ee-aa3b-4468-97c0-74053782ddd5} 3032 "\\.\pipe\gecko-crash-server-pipe.3032" tab6⤵PID:5916
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5724 -childID 5 -isForBrowser -prefsHandle 5224 -prefMapHandle 5228 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1252 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c0673447-fbb7-4050-a3ad-08d8f6c7fddb} 3032 "\\.\pipe\gecko-crash-server-pipe.3032" tab6⤵PID:6032
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1012348001\6cfa081146.exe"C:\Users\Admin\AppData\Local\Temp\1012348001\6cfa081146.exe"3⤵
- Modifies Windows Defender Real-time Protection settings
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Windows security modification
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3384
-
-
C:\Users\Admin\AppData\Local\Temp\1012349001\bbdb2dc777.exe"C:\Users\Admin\AppData\Local\Temp\1012349001\bbdb2dc777.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
PID:5552
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\AppData\Local\Temp\StartMenuExperienceHost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3316
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\StartMenuExperienceHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3088
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\AppData\Local\Temp\StartMenuExperienceHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3248
-
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exeC:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4428
-
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exeC:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5476
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Impair Defenses
2Disable or Modify Tools
2Modify Registry
3Virtualization/Sandbox Evasion
3Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
76B
MD5f64211e9d1ec38ede33666033382d99c
SHA1b602450c1b9d00043f20dcb60537e8706fcad872
SHA2566e4d045d43e97c5fca3ddc26016db1f1c73b334c6fe4cee92b65974c745a9cca
SHA5121e80f74c7a6582ac8187bb22dd70fa38e8d18840d4a45d27098c6eb517228b836218211418b147fc0060cc7029ae12d6abd0d6348b731169b93c9062876c677d
-
Filesize
212B
MD5ccc3de297113f78d2b92b26bf192fce3
SHA1417dcfba717ce68ebd96b71a2edac15f93e91aae
SHA2562e776534dab440e19bda0f46b1bd2a21f2f9c2dee1c225632f87907939516d37
SHA512f4c1aefddfcc7a9eb3fe5f333ad287fc0f4353c475ead34890ffc1609605ce1544bbe0ee4a7192b856af7540a5d1fcdfe9649856c3a04150c6edc709b1bb6459
-
Filesize
1.9MB
MD538514f88aff517ea6be4724d24b28fe2
SHA10d9ce3815f04c401561339b056c7ab2ba907e16c
SHA25692c34270df9842c931ab9e4af87a0cbdd1f3b12e70482d474c3a9d0029f09add
SHA512c7516e29a99fc053d07da626bdce8ab37917267de2911685debd3e0764819b3a387626d98413ec62808789e28e15739e0b533a9c8ab765215506bdf6ad5ef707
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6ir3v68x.default-release\activity-stream.discovery_stream.json
Filesize22KB
MD5ef87b2beac5aedeec7f60571b8ba51f5
SHA103383e48c41d4d261d736ee5b2d963fe9fe01f63
SHA2560edb16447967173abea256fe89b906e9932570f25291480e647372de31ba71f8
SHA512411874579cebee880b9ac74921d10a8f22a7813859db2f6a5cf41801d27e931f1d2330052ca4ea56d96e0945e7b4c3fa34720f3b6c58bd327c14dde0a20a28f9
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6ir3v68x.default-release\cache2\entries\92F4D5A4F9CED6E2E644D803AEE3647A0EA4D984
Filesize13KB
MD56680a9b8c2c27075bc98182055fd83a1
SHA1e9feb6912eee440a44cc6db3f5482ad3dd2b4955
SHA2568ed471f3a711d493871343733302e35ab5fda7b50d13a962f483c82f8062350a
SHA5126a824a174b2bf787e720cedf68502f6edcadcffb5e9e60d191120ebb1b078aa35004089f6031013441e540ed14b54933f6c35ed5eed5bd84e6ca5f64600dbfcb
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6ir3v68x.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
Filesize15KB
MD596c542dec016d9ec1ecc4dddfcbaac66
SHA16199f7648bb744efa58acf7b96fee85d938389e4
SHA2567f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798
SHA512cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658
-
Filesize
612B
MD5e3eb0a1df437f3f97a64aca5952c8ea0
SHA17dd71afcfb14e105e80b0c0d7fce370a28a41f0a
SHA25638ffd4972ae513a0c79a8be4573403edcd709f0f572105362b08ff50cf6de521
SHA51243573b0cbaac6e2e1646e6217d2d10c40ad10b9db1f4492d6740545e793c891b5e39283a082896c0392b88eb319dfa9392421b1c89c094c9ce9f31b53d37ebaf
-
Filesize
1.7MB
MD5ff4cf493ac5f7663d1cfc243e6646eb7
SHA1ff7184eae695580f1e86fac340925c7f01f4de6d
SHA25672a99a945b705fc1c8fa59c3db6810be2aadeaecc34f954f5ab314574002d748
SHA5121eef407d5bfa8b94bb98cb0a64e7c73cb94176507fa924642c6cf21192965ba8856390214379fddf192b88e19377768ead94fb4d393831e47ca230b6b168f14b
-
Filesize
2.2MB
MD5c9059dfb76ad9e011d4e11608ccc98cc
SHA1c7ec739a977cc99a19e39103e2a20d59a6094508
SHA256906e30690506eb761b3f84f7ae1146db9dc796e60d87303173fc99370485c58f
SHA512da494d85e5689c65f2369bcff41479ec9a797322c761e18138c1e2397e0879986dc9bca64d9cdc20999902db90fdec8f94ad36184997d396433ab1a7c2e1b9ce
-
Filesize
4.2MB
MD5928d3b616e73c926bc35d596c432a62b
SHA183f772926daa9beb0f1a60b0a5145685be6f82cd
SHA256cc9929b67e24ad058371096529fda098fc1171df19097b4a05e79e3641b8d71f
SHA5126bb0d25b857fb48ccf81b51c4348ff240083ff8069d8d96bf9b62df9534f6c0891c6954afb30ca5a43ee0d096396a8cd42dcfafff4b0152663ca75bcf3177ade
-
Filesize
1.8MB
MD5f7286fef9317fe91e24cda721ec0be81
SHA10e0197c0f87200f7c1ebb4bba314f7bb875a638c
SHA2564dcf1cc20990dace1f3e7c5a4b94ea7b823f90eb6de639b2b1b6494838f1cc62
SHA512314b3f5cf1a0c15db568d33647b97887b37e987ba253ee9f5ded045446328307ebd04acd832fbdf66ad29be9510bd0c378e2fcb889509dca84df9b9106602c6e
-
Filesize
1.8MB
MD58c230debcaa0241cdf437c61b620b77a
SHA19a16380b7a2f8328b04f060791f7ad52466c374f
SHA256572a83147fc938c1ff176431438955f77fc5dd10cedca752fd7da8bab4506b6d
SHA512de539b4e190bc279969ba97513da91d903fef0eae7d91844f820665e9c1ebd303c5641b39229f5810771d7a590842bd30f41c3627ec694bc2799ce06a1a22132
-
Filesize
4.9MB
MD5834caa1ea7e5fadc7aa0735eed542c0e
SHA11c077c5230136337722a6c127ddbe2ebb49f67b3
SHA256c6502746b552f7a74d91fd5e6574e5059b6e4a6b027f1b3ca68a2d604756c074
SHA5124d8e99d401c0025c38eae93a8b6b41804e83a104a92753eb4a48e9d27c6c901948d7ca0cebaf6771031259039346bb3a2582cce32550bfcba06757edd9b1fe7d
-
Filesize
945KB
MD58517a8167dc00d5cb9b5f0ab6a170552
SHA1d1592531656e09f8aaf724c27e785e1b30498940
SHA256bbec4bc64a4a9ae0c765b71fcdc033b430f50c56b1f5a0e581a3d8117795c11b
SHA512854482678dd01d889b80d794fcc804cc567dc121149beb64b07c4f98a9d476ba99473c0a7f80819156fb41fd73f67bffdf36a6520e19b3912b5d5bc6d293e012
-
Filesize
2.6MB
MD580a4a9bd8cdb150cbc228ad88557260f
SHA1057931385a2bd410d5c5502a2f6461471fa0377f
SHA25610ee97136471d63c17d88a987c7b7282b87c2456f7082310c79fe9c2b6e6ffa1
SHA512ff5117d04af0459b8dc7f6f747026fbc9538954db44489d151a85cdcc238563964593326691dcfa440b6ab379e276074c2c9f231255cd5b844e1bb5cce8a0146
-
Filesize
1.9MB
MD5032aa8264c2ccbdd008693fd9c29a1fb
SHA186a99c6498d68c8af759afd61ed56637a46bb016
SHA256eab9619df6b82520165d2b4455fbdf147077932f8f53b80d6adb9501e822cdbc
SHA512bb5c07246b6bbac5ccfd26fd32e4f8fb1b337590593475ee8a289bb92a502d7f95c7f74dcfdf0c71389290ee4c415fb1328618d081e3c7dbb31a3a5c7aa8a679
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
1.8MB
MD5cd86e4c2fbaf81cb17606d69108fff47
SHA197117dadf1a95214ceaf1d1d9337dae317c6a358
SHA256458d36f8118c122fcd17e2ea1859282fd29e5f774ab7998787150c4f21ed360e
SHA51242393ee97337b197a176032276b9da8bd3ba26d5e5a36751130271422a9cb0a91d50a22c9f75e4de77083b47d8b6c7f54c5f1ebccd09f97dbba8eb6591554748
-
Filesize
189B
MD5c26fa67e386367d49cba684fcb0de333
SHA1e44ae7e34cb6c449195803c0a533bab03ad032f5
SHA2560476b0791eeaf8e93d90c776d017cd2850cd8afb0895b75f9260fc31724367b4
SHA512a51e5e76c29d9807c4a764f155d363d089d23d76dfef1c69d9a47e3441cd6c341e91ef6e59655bbe8e43e650682e0de66f174d229c794467e51f5d53b995094e
-
Filesize
479KB
MD509372174e83dbbf696ee732fd2e875bb
SHA1ba360186ba650a769f9303f48b7200fb5eaccee1
SHA256c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
SHA512b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
-
Filesize
13.8MB
MD50a8747a2ac9ac08ae9508f36c6d75692
SHA1b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA25632d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
SHA51259521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\AlternateServices.bin
Filesize10KB
MD561091254e4e63331896cb1d53d78a535
SHA1b93124623677851991f4b4dbeecf1fddc733085a
SHA256a7bb7ad0377a9274be20c091fed4a108abb3d570642721171a8fda316c1e826f
SHA512068832fb582e0d415c363295c23e9019e40a05a11e078ea746e946fff30151a2db21c4c6ef3389de8c5ed5201d4540fc06b34081a858850ea1103bd747fae5cc
-
Filesize
256KB
MD5fcd6a5b16c97515ba86c1c57d5a8c7ca
SHA1da6e5d1e74ed28b1e3c29e6ffa1b86df63b10352
SHA25661eba0805d1f1b50d92a1e301469e89e646c65efcb61e925e2d10a97864e2d3c
SHA512508b3d6884999f704c5386f3b7c77ca18919b5c3dc0979e239d68cc42f7c57d5e7e3d588a4f95ea055f0e1fa384c0349f4630bc101cb4f62a963ad5647c0b14f
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\db\data.safe.tmp
Filesize15KB
MD54e29cbb7ea0522f5a887226dbcc2ad7c
SHA12ea90386f3dee6df4356d3944820faaa98027c96
SHA2566bf9894598dd0c534189fbd3145c0e1b2fab4aa053b8abb8a56af833afb40bd6
SHA512a8cf57da4d056340fa8d4424e0f39f25b5646bd2c02bac6e1c0ee819a100729e5a3c18c34199011ae5cd3ffe831c833b65f37c8e4db4946635035e92a0ca865d
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\db\data.safe.tmp
Filesize15KB
MD5a7f263e4921825d5dd3b523e9101a896
SHA1b123a68e97d3c82e79dcef07fc6b2ce97f2252a8
SHA256c97e75a0a440b34e2c608fdcaebc92199c3fed19344753779c80cd668eef22b9
SHA512d907b6f60079c2a287cc1c44c731e89e78784d7224a9597ebf6108086dd131b2a1fb2f28a1f27a5ce32ce0aa9966f737bc96a100b05c96c9c96042b64c917c0b
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\db\data.safe.tmp
Filesize5KB
MD5118641b99fb05deace033128c7922530
SHA1f746e525c567460628dbc85cf555356ab052584a
SHA2561db16f6d57f6e971aa5d805d8fff58491d88fd26c4ee3511d0eb6a648407034e
SHA512b5c9e7431a92e815b41f7cbe5fe36ab157bd16ca01be37d9bf1e924d9c834f45ed28fbf845046a8070f4aaa93c549eac935fa9910be11e8550b71252480e5c16
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\pending_pings\0a6eae07-22e6-412e-a98b-958f8e405b2e
Filesize671B
MD5ebe40d717007b64891d8e441c0152940
SHA124d4fb998a0faf6174c42f8192c3194ec6095dbe
SHA2561e62eb59edda9fd4e6d60c37d59aa0bcfc7c7662566a2d8170c52ecc968b5e47
SHA51228cacefa4bd5e9075d0254c72c9d3cbcf3bf94a6edd7c6d99e72228439191cb0001a253c0caef727d43dc206912cfc507c215623be74b8d4b66d83d6cc104f74
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\pending_pings\56e20f20-eeb2-45a7-9335-0f45362c6ae2
Filesize982B
MD56beddfa994d61fb1b788be2cbc8862f5
SHA1a8353da837e0595b9940569bfa881056d85ddd78
SHA256e1427cfbc3073f5970d9ddfab06884c86f6a24f3b37c871b3c7842b16eba1b63
SHA5124535a276cb3e494666f1b0dc314ddbea6dbf8e3742449cd21fb853b4a690ee4baa53cdd1066c9c9599e52d5061710a96fda957c6c2290b0b09a5ba2fb2a2ee1f
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\pending_pings\b24a8c0b-4bd4-47bc-80d3-d2101c3c66b2
Filesize28KB
MD5ac9cef3fb5da11eb157d43d4e4c3251c
SHA14c75cb2de13587c1107d6e3e567367a6c67d720c
SHA2565579786a6476cdc11b1b320ff81fc4796b234518bd168a88fa4e8d461c16da34
SHA51273bc4b3aec092c1faad57660dce5010ad56b2dbf1d3273b5b2ad27a15b12c369fe4b5e8813063f585b65354d5e237e553dbe457d5b25d925777e80606cf024e5
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Filesize1.1MB
MD5842039753bf41fa5e11b3a1383061a87
SHA13e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA256d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
SHA512d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Filesize116B
MD52a461e9eb87fd1955cea740a3444ee7a
SHA1b10755914c713f5a4677494dbe8a686ed458c3c5
SHA2564107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
SHA51234f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Filesize372B
MD5bf957ad58b55f64219ab3f793e374316
SHA1a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA256bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
SHA51279c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Filesize17.8MB
MD5daf7ef3acccab478aaa7d6dc1c60f865
SHA1f8246162b97ce4a945feced27b6ea114366ff2ad
SHA256bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
SHA5125840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
-
Filesize
15KB
MD5e6652c46622f943f2e66f2f82e40c33d
SHA1b92b3b353605e6658b00c06d9f7ba721adc029f9
SHA256d17c9871a168787b70a7ae0dd30c3e256e50190c34f326f7ae9f4eb7aaaed495
SHA5129ad49c81afb8820273803e79920fc71950cd6d8dd4d60c2e3ba6b9e9e3a969ccb74ae69aa4fa32940b061014b56f3b8d6053b5023ae67546e17d03d81cea7d94
-
Filesize
10KB
MD5e91347526bfef1959b597335320fd1ae
SHA10feb09e7fa93dad25b952058529ffeb191609b1b
SHA256e7c14d8442fecf7e665cbe616ba0acdea50a11fb33e902c849e7c674dcd40fea
SHA512b3e9a2543d4af574ee49043f5191fcd4defec8efc01622cbfb3313e0bb7985129be217509ba76446c2432e6a43671d185b070d791358dc4c4030f556b7f9dbc3
-
Filesize
10KB
MD56a62f71f8884d034555e3d558b5e6b8e
SHA156b938ce5e36faa04fbfefa936fc666c29397445
SHA25626f47b911adc68d18b4f33f36376719649ac2e2e27cdec45d698ef9a47341ad4
SHA51250812516ea67f696b0bc6f65e4d29276483ae783e0c36337c675c1592e50ece561b737cd013c42d5b44139d5f5d8f715311a05e61690f569457a9d610cd5450d
-
Filesize
12KB
MD55c44bc5b06702364bef209c4a11ca36d
SHA18c058b8825004073af8b912753a9322ac1a8476a
SHA2562913955941fd85d1f71fe19013ae906224a163b81fa4aa71fba80358bf1782d1
SHA5127d84daacb524d5931eeb3c53568c2a51089315f0acc8545420dce1db5bb5391b3c6100a5379107380e12bc6d8bfdbc0e8671ac0c373454a8117112b3867f2ebf
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Filesize632KB
MD5dd1320123f2e04fcc2495426767cd028
SHA1ce81baf4ba86bcf8a6ab5af28cc0677cc9ccf867
SHA256689c9d44c8e1f28cd6d2ffe1ef54e9edc50877883bd84b3eadca662a3266c5cb
SHA51233bdbf5c43cec1f2eede21e5cd7e2ceccd7f60c2b825e83367073191180f33b220f2c4029519cf0ef2b1e74b55eb0bd2e288f9d0a86d93efd4153644a33bd0f8