Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
07/12/2024, 09:50
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20240903-en
General
-
Target
file.exe
-
Size
4.9MB
-
MD5
443c778fc72c59824a828ece66b8e82a
-
SHA1
91fb9df41bba19b6d6612bbafd6d35dc81dc01d6
-
SHA256
a43029c07921865be726ccc99e368b445715a3e55279c7faaaae5cad38eb4276
-
SHA512
b7d2ea13089446be522b2e69f8a326ff218180aa1a341cd251b13df85ef0f3c68afeb7bb0e2fee57624c9c8a17d7407f75aaf17147186d285d5799b42da00c91
-
SSDEEP
24576:Y4Z2BH81kngyVthXEAEsiBE+/XR2YG+pHhXwiiGS4Q8VmviuhAC2WSGS/mUrAwuy:YhBVqAEl/WiOiI7GLBYzmv3DULP8c5
Malware Config
Extracted
stealc
drum
http://185.215.113.206
-
url_path
/c4becf79229cb002.php
Extracted
amadey
4.42
9c9aa5
http://185.215.113.43
-
install_dir
abc3bc1985
-
install_file
skotes.exe
-
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
-
url_paths
/Zu7JuNko/index.php
Extracted
lumma
https://impend-differ.biz/api
https://print-vexer.biz/api
https://dare-curbys.biz/api
https://covery-mover.biz/api
https://formy-spill.biz/api
https://dwell-exclaim.biz/api
https://zinc-sneark.biz/api
https://se-blurry.biz/api
https://atten-supporse.biz/api
Extracted
lumma
https://dwell-exclaim.biz/api
https://se-blurry.biz/api
https://zinc-sneark.biz/api
https://atten-supporse.biz/api
Signatures
-
Amadey family
-
Lumma family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 47fd3c4639.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 47fd3c4639.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 47fd3c4639.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection 47fd3c4639.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 47fd3c4639.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" 47fd3c4639.exe -
Stealc family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 9 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ file.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 180d45bd84.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ BY5BeYh.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 6882f55319.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 47fd3c4639.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ IIEBGIDAAF.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe -
Downloads MZ/PE file
-
Uses browser remote debugging 2 TTPs 10 IoCs
Can be used control the browser and steal sensitive information such as credentials and session cookies.
pid Process 3844 chrome.exe 4396 chrome.exe 2540 msedge.exe 860 chrome.exe 1636 chrome.exe 5016 chrome.exe 1320 msedge.exe 4324 msedge.exe 2792 msedge.exe 3560 msedge.exe -
Checks BIOS information in registry 2 TTPs 18 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion IIEBGIDAAF.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 180d45bd84.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 6882f55319.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion BY5BeYh.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 180d45bd84.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 6882f55319.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion file.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion IIEBGIDAAF.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion BY5BeYh.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion file.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 47fd3c4639.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 47fd3c4639.exe -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation file.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation IIEBGIDAAF.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation skotes.exe -
Executes dropped EXE 10 IoCs
pid Process 4068 IIEBGIDAAF.exe 724 skotes.exe 4064 BY5BeYh.exe 1516 JoYUT4N.exe 3696 180d45bd84.exe 1820 6882f55319.exe 4412 0abc2ca1f6.exe 3828 skotes.exe 3696 47fd3c4639.exe 5964 skotes.exe -
Identifies Wine through registry keys 2 TTPs 9 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Wine skotes.exe Key opened \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Wine file.exe Key opened \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Wine skotes.exe Key opened \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Wine BY5BeYh.exe Key opened \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Wine 180d45bd84.exe Key opened \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Wine skotes.exe Key opened \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Wine 47fd3c4639.exe Key opened \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Wine IIEBGIDAAF.exe Key opened \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Wine 6882f55319.exe -
Loads dropped DLL 2 IoCs
pid Process 3636 file.exe 3636 file.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features 47fd3c4639.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" 47fd3c4639.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\47fd3c4639.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1012923001\\47fd3c4639.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\180d45bd84.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1012920001\\180d45bd84.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\6882f55319.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1012921001\\6882f55319.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\0abc2ca1f6.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1012922001\\0abc2ca1f6.exe" skotes.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/files/0x000b000000023d28-625.dat autoit_exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs
pid Process 3636 file.exe 4068 IIEBGIDAAF.exe 724 skotes.exe 4064 BY5BeYh.exe 3696 180d45bd84.exe 1820 6882f55319.exe 3828 skotes.exe 3696 47fd3c4639.exe 5964 skotes.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\skotes.job IIEBGIDAAF.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 3 IoCs
pid pid_target Process procid_target 1288 4064 WerFault.exe 136 2540 3696 WerFault.exe 143 3692 3696 WerFault.exe 143 -
System Location Discovery: System Language Discovery 1 TTPs 16 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 47fd3c4639.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BY5BeYh.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage 0abc2ca1f6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IIEBGIDAAF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6882f55319.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language 0abc2ca1f6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0abc2ca1f6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language skotes.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 180d45bd84.exe -
Checks processor information in registry 2 TTPs 13 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 file.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString file.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe -
Enumerates system info in registry 2 TTPs 8 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Kills process with taskkill 5 IoCs
pid Process 3324 taskkill.exe 1428 taskkill.exe 3996 taskkill.exe 4564 taskkill.exe 4652 taskkill.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133780386152348242" chrome.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings firefox.exe -
Suspicious behavior: EnumeratesProcesses 48 IoCs
pid Process 3636 file.exe 3636 file.exe 3636 file.exe 3636 file.exe 3636 file.exe 3636 file.exe 860 chrome.exe 860 chrome.exe 860 chrome.exe 3636 file.exe 3636 file.exe 3636 file.exe 3636 file.exe 2788 msedge.exe 2788 msedge.exe 2788 msedge.exe 2788 msedge.exe 780 msedge.exe 780 msedge.exe 1320 msedge.exe 1320 msedge.exe 3636 file.exe 3636 file.exe 3636 file.exe 3636 file.exe 4068 IIEBGIDAAF.exe 4068 IIEBGIDAAF.exe 724 skotes.exe 724 skotes.exe 4064 BY5BeYh.exe 4064 BY5BeYh.exe 3696 180d45bd84.exe 3696 180d45bd84.exe 1820 6882f55319.exe 1820 6882f55319.exe 4412 0abc2ca1f6.exe 4412 0abc2ca1f6.exe 3828 skotes.exe 3828 skotes.exe 3696 47fd3c4639.exe 3696 47fd3c4639.exe 4412 0abc2ca1f6.exe 4412 0abc2ca1f6.exe 3696 47fd3c4639.exe 3696 47fd3c4639.exe 3696 47fd3c4639.exe 5964 skotes.exe 5964 skotes.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
pid Process 860 chrome.exe 860 chrome.exe 860 chrome.exe 860 chrome.exe 1320 msedge.exe 1320 msedge.exe 1320 msedge.exe 1320 msedge.exe -
Suspicious use of AdjustPrivilegeToken 22 IoCs
description pid Process Token: SeShutdownPrivilege 860 chrome.exe Token: SeCreatePagefilePrivilege 860 chrome.exe Token: SeShutdownPrivilege 860 chrome.exe Token: SeCreatePagefilePrivilege 860 chrome.exe Token: SeShutdownPrivilege 860 chrome.exe Token: SeCreatePagefilePrivilege 860 chrome.exe Token: SeShutdownPrivilege 860 chrome.exe Token: SeCreatePagefilePrivilege 860 chrome.exe Token: SeShutdownPrivilege 860 chrome.exe Token: SeCreatePagefilePrivilege 860 chrome.exe Token: SeShutdownPrivilege 860 chrome.exe Token: SeCreatePagefilePrivilege 860 chrome.exe Token: SeShutdownPrivilege 860 chrome.exe Token: SeCreatePagefilePrivilege 860 chrome.exe Token: SeDebugPrivilege 3996 taskkill.exe Token: SeDebugPrivilege 4564 taskkill.exe Token: SeDebugPrivilege 4652 taskkill.exe Token: SeDebugPrivilege 3324 taskkill.exe Token: SeDebugPrivilege 1428 taskkill.exe Token: SeDebugPrivilege 3184 firefox.exe Token: SeDebugPrivilege 3184 firefox.exe Token: SeDebugPrivilege 3696 47fd3c4639.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 860 chrome.exe 860 chrome.exe 860 chrome.exe 860 chrome.exe 860 chrome.exe 860 chrome.exe 860 chrome.exe 860 chrome.exe 860 chrome.exe 860 chrome.exe 860 chrome.exe 860 chrome.exe 860 chrome.exe 860 chrome.exe 860 chrome.exe 860 chrome.exe 860 chrome.exe 860 chrome.exe 860 chrome.exe 860 chrome.exe 860 chrome.exe 860 chrome.exe 860 chrome.exe 860 chrome.exe 860 chrome.exe 860 chrome.exe 1320 msedge.exe 1320 msedge.exe 1320 msedge.exe 1320 msedge.exe 1320 msedge.exe 1320 msedge.exe 1320 msedge.exe 1320 msedge.exe 1320 msedge.exe 1320 msedge.exe 1320 msedge.exe 1320 msedge.exe 1320 msedge.exe 1320 msedge.exe 1320 msedge.exe 1320 msedge.exe 1320 msedge.exe 1320 msedge.exe 1320 msedge.exe 1320 msedge.exe 1320 msedge.exe 1320 msedge.exe 1320 msedge.exe 1320 msedge.exe 1320 msedge.exe 4068 IIEBGIDAAF.exe 4412 0abc2ca1f6.exe 4412 0abc2ca1f6.exe 4412 0abc2ca1f6.exe 4412 0abc2ca1f6.exe 4412 0abc2ca1f6.exe 4412 0abc2ca1f6.exe 4412 0abc2ca1f6.exe 3184 firefox.exe 3184 firefox.exe 3184 firefox.exe 3184 firefox.exe 3184 firefox.exe -
Suspicious use of SendNotifyMessage 31 IoCs
pid Process 4412 0abc2ca1f6.exe 4412 0abc2ca1f6.exe 4412 0abc2ca1f6.exe 4412 0abc2ca1f6.exe 4412 0abc2ca1f6.exe 4412 0abc2ca1f6.exe 4412 0abc2ca1f6.exe 3184 firefox.exe 3184 firefox.exe 3184 firefox.exe 3184 firefox.exe 3184 firefox.exe 3184 firefox.exe 3184 firefox.exe 3184 firefox.exe 3184 firefox.exe 3184 firefox.exe 3184 firefox.exe 3184 firefox.exe 3184 firefox.exe 3184 firefox.exe 3184 firefox.exe 3184 firefox.exe 3184 firefox.exe 3184 firefox.exe 3184 firefox.exe 3184 firefox.exe 4412 0abc2ca1f6.exe 4412 0abc2ca1f6.exe 4412 0abc2ca1f6.exe 4412 0abc2ca1f6.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3184 firefox.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3636 wrote to memory of 860 3636 file.exe 83 PID 3636 wrote to memory of 860 3636 file.exe 83 PID 860 wrote to memory of 3380 860 chrome.exe 84 PID 860 wrote to memory of 3380 860 chrome.exe 84 PID 860 wrote to memory of 4864 860 chrome.exe 85 PID 860 wrote to memory of 4864 860 chrome.exe 85 PID 860 wrote to memory of 4864 860 chrome.exe 85 PID 860 wrote to memory of 4864 860 chrome.exe 85 PID 860 wrote to memory of 4864 860 chrome.exe 85 PID 860 wrote to memory of 4864 860 chrome.exe 85 PID 860 wrote to memory of 4864 860 chrome.exe 85 PID 860 wrote to memory of 4864 860 chrome.exe 85 PID 860 wrote to memory of 4864 860 chrome.exe 85 PID 860 wrote to memory of 4864 860 chrome.exe 85 PID 860 wrote to memory of 4864 860 chrome.exe 85 PID 860 wrote to memory of 4864 860 chrome.exe 85 PID 860 wrote to memory of 4864 860 chrome.exe 85 PID 860 wrote to memory of 4864 860 chrome.exe 85 PID 860 wrote to memory of 4864 860 chrome.exe 85 PID 860 wrote to memory of 4864 860 chrome.exe 85 PID 860 wrote to memory of 4864 860 chrome.exe 85 PID 860 wrote to memory of 4864 860 chrome.exe 85 PID 860 wrote to memory of 4864 860 chrome.exe 85 PID 860 wrote to memory of 4864 860 chrome.exe 85 PID 860 wrote to memory of 4864 860 chrome.exe 85 PID 860 wrote to memory of 4864 860 chrome.exe 85 PID 860 wrote to memory of 4864 860 chrome.exe 85 PID 860 wrote to memory of 4864 860 chrome.exe 85 PID 860 wrote to memory of 4864 860 chrome.exe 85 PID 860 wrote to memory of 4864 860 chrome.exe 85 PID 860 wrote to memory of 4864 860 chrome.exe 85 PID 860 wrote to memory of 4864 860 chrome.exe 85 PID 860 wrote to memory of 4864 860 chrome.exe 85 PID 860 wrote to memory of 4864 860 chrome.exe 85 PID 860 wrote to memory of 2156 860 chrome.exe 86 PID 860 wrote to memory of 2156 860 chrome.exe 86 PID 860 wrote to memory of 2416 860 chrome.exe 87 PID 860 wrote to memory of 2416 860 chrome.exe 87 PID 860 wrote to memory of 2416 860 chrome.exe 87 PID 860 wrote to memory of 2416 860 chrome.exe 87 PID 860 wrote to memory of 2416 860 chrome.exe 87 PID 860 wrote to memory of 2416 860 chrome.exe 87 PID 860 wrote to memory of 2416 860 chrome.exe 87 PID 860 wrote to memory of 2416 860 chrome.exe 87 PID 860 wrote to memory of 2416 860 chrome.exe 87 PID 860 wrote to memory of 2416 860 chrome.exe 87 PID 860 wrote to memory of 2416 860 chrome.exe 87 PID 860 wrote to memory of 2416 860 chrome.exe 87 PID 860 wrote to memory of 2416 860 chrome.exe 87 PID 860 wrote to memory of 2416 860 chrome.exe 87 PID 860 wrote to memory of 2416 860 chrome.exe 87 PID 860 wrote to memory of 2416 860 chrome.exe 87 PID 860 wrote to memory of 2416 860 chrome.exe 87 PID 860 wrote to memory of 2416 860 chrome.exe 87 PID 860 wrote to memory of 2416 860 chrome.exe 87 PID 860 wrote to memory of 2416 860 chrome.exe 87 PID 860 wrote to memory of 2416 860 chrome.exe 87 PID 860 wrote to memory of 2416 860 chrome.exe 87 PID 860 wrote to memory of 2416 860 chrome.exe 87 PID 860 wrote to memory of 2416 860 chrome.exe 87 PID 860 wrote to memory of 2416 860 chrome.exe 87 PID 860 wrote to memory of 2416 860 chrome.exe 87 PID 860 wrote to memory of 2416 860 chrome.exe 87 PID 860 wrote to memory of 2416 860 chrome.exe 87 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3636 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""2⤵
- Uses browser remote debugging
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:860 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffc507ecc40,0x7ffc507ecc4c,0x7ffc507ecc583⤵PID:3380
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1936,i,10518677502886146018,17024904192811305156,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1924 /prefetch:23⤵PID:4864
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2180,i,10518677502886146018,17024904192811305156,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2192 /prefetch:33⤵PID:2156
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2260,i,10518677502886146018,17024904192811305156,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2452 /prefetch:83⤵PID:2416
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3204,i,10518677502886146018,17024904192811305156,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3224 /prefetch:13⤵
- Uses browser remote debugging
PID:1636
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3228,i,10518677502886146018,17024904192811305156,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3272 /prefetch:13⤵
- Uses browser remote debugging
PID:3844
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4316,i,10518677502886146018,17024904192811305156,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4556 /prefetch:13⤵
- Uses browser remote debugging
PID:5016
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4220,i,10518677502886146018,17024904192811305156,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4312 /prefetch:83⤵PID:3872
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=3628,i,10518677502886146018,17024904192811305156,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4844 /prefetch:83⤵PID:3528
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4916,i,10518677502886146018,17024904192811305156,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4552 /prefetch:83⤵PID:3164
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4932,i,10518677502886146018,17024904192811305156,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5032 /prefetch:83⤵PID:2540
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4844,i,10518677502886146018,17024904192811305156,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5244 /prefetch:83⤵PID:2888
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4764,i,10518677502886146018,17024904192811305156,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4784 /prefetch:83⤵PID:752
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=4788,i,10518677502886146018,17024904192811305156,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4992 /prefetch:23⤵
- Uses browser remote debugging
PID:4396
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"2⤵
- Uses browser remote debugging
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
PID:1320 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc507f46f8,0x7ffc507f4708,0x7ffc507f47183⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:2788
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,16571462838588257403,14825369622295726843,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:23⤵PID:4628
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,16571462838588257403,14825369622295726843,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
PID:780
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,16571462838588257403,14825369622295726843,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2968 /prefetch:83⤵PID:4840
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2120,16571462838588257403,14825369622295726843,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:13⤵
- Uses browser remote debugging
PID:2540
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2120,16571462838588257403,14825369622295726843,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:13⤵
- Uses browser remote debugging
PID:4324
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2120,16571462838588257403,14825369622295726843,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4832 /prefetch:13⤵
- Uses browser remote debugging
PID:2792
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2120,16571462838588257403,14825369622295726843,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4116 /prefetch:13⤵
- Uses browser remote debugging
PID:3560
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\Documents\IIEBGIDAAF.exe"2⤵
- System Location Discovery: System Language Discovery
PID:2372 -
C:\Users\Admin\Documents\IIEBGIDAAF.exe"C:\Users\Admin\Documents\IIEBGIDAAF.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:4068 -
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:724 -
C:\Users\Admin\AppData\Local\Temp\1012713001\BY5BeYh.exe"C:\Users\Admin\AppData\Local\Temp\1012713001\BY5BeYh.exe"5⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4064 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4064 -s 9166⤵
- Program crash
PID:1288
-
-
-
C:\Users\Admin\AppData\Local\Temp\1012911001\JoYUT4N.exe"C:\Users\Admin\AppData\Local\Temp\1012911001\JoYUT4N.exe"5⤵
- Executes dropped EXE
PID:1516
-
-
C:\Users\Admin\AppData\Local\Temp\1012920001\180d45bd84.exe"C:\Users\Admin\AppData\Local\Temp\1012920001\180d45bd84.exe"5⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3696 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3696 -s 14686⤵
- Program crash
PID:2540
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3696 -s 14886⤵
- Program crash
PID:3692
-
-
-
C:\Users\Admin\AppData\Local\Temp\1012921001\6882f55319.exe"C:\Users\Admin\AppData\Local\Temp\1012921001\6882f55319.exe"5⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1820
-
-
C:\Users\Admin\AppData\Local\Temp\1012922001\0abc2ca1f6.exe"C:\Users\Admin\AppData\Local\Temp\1012922001\0abc2ca1f6.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4412 -
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM firefox.exe /T6⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3996
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM chrome.exe /T6⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4564
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM msedge.exe /T6⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4652
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM opera.exe /T6⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3324
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM brave.exe /T6⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1428
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking6⤵PID:4704
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking7⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3184 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2000 -parentBuildID 20240401114208 -prefsHandle 1928 -prefMapHandle 1920 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ca0dbc63-be44-4831-b459-e22f49107147} 3184 "\\.\pipe\gecko-crash-server-pipe.3184" gpu8⤵PID:3040
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2420 -parentBuildID 20240401114208 -prefsHandle 2404 -prefMapHandle 2400 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {41eb8309-ebad-4af9-ba65-c5c4c4631e62} 3184 "\\.\pipe\gecko-crash-server-pipe.3184" socket8⤵PID:4440
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2984 -childID 1 -isForBrowser -prefsHandle 2976 -prefMapHandle 3068 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0de79a85-0f80-4cb4-b3fe-d569b3ac7a39} 3184 "\\.\pipe\gecko-crash-server-pipe.3184" tab8⤵PID:3152
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3088 -childID 2 -isForBrowser -prefsHandle 3420 -prefMapHandle 3436 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bb599cd7-c0f4-4742-9eab-87a85a54b2ea} 3184 "\\.\pipe\gecko-crash-server-pipe.3184" tab8⤵PID:3352
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2564 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4564 -prefMapHandle 4560 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {02d948b1-06ee-4c65-989a-02b4e21973bc} 3184 "\\.\pipe\gecko-crash-server-pipe.3184" utility8⤵
- Checks processor information in registry
PID:5368
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5576 -childID 3 -isForBrowser -prefsHandle 4420 -prefMapHandle 5548 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b72d5f56-08b8-4ab4-b2fb-f57383bdaec2} 3184 "\\.\pipe\gecko-crash-server-pipe.3184" tab8⤵PID:3112
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5796 -childID 4 -isForBrowser -prefsHandle 5716 -prefMapHandle 5720 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b7d0abfc-fbd6-493d-8a92-f5b2e4b0b413} 3184 "\\.\pipe\gecko-crash-server-pipe.3184" tab8⤵PID:2580
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5912 -childID 5 -isForBrowser -prefsHandle 5992 -prefMapHandle 5988 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {80ba4d54-cc8f-42ff-80ca-48f4f96b1c85} 3184 "\\.\pipe\gecko-crash-server-pipe.3184" tab8⤵PID:4052
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1012923001\47fd3c4639.exe"C:\Users\Admin\AppData\Local\Temp\1012923001\47fd3c4639.exe"5⤵
- Modifies Windows Defender Real-time Protection settings
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Windows security modification
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3696
-
-
-
-
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵PID:3116
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:1656
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4064 -ip 40641⤵PID:5108
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3696 -ip 36961⤵PID:552
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3696 -ip 36961⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exeC:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3828
-
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exeC:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5964
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Modify Authentication Process
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Impair Defenses
2Disable or Modify Tools
2Modify Authentication Process
1Modify Registry
3Virtualization/Sandbox Evasion
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Modify Authentication Process
1Steal Web Session Cookie
1Unsecured Credentials
4Credentials In Files
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
593KB
MD5c8fd9be83bc728cc04beffafc2907fe9
SHA195ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
-
Filesize
2.0MB
MD51cc453cdf74f31e4d913ff9c10acdde2
SHA16e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
-
Filesize
649B
MD573f6bd46d8748fc875e2702b1b349093
SHA1354174192e078d106a1591c098d5109e28900883
SHA25696ac373d4b37f044cbda385efba67e935231f57289d5fff946b8946644612c6b
SHA512b7b841d8a62ba365b56335549ebd716e6bc4f13a42a680d983821fc487a0062d0ebdc793703602341d3efc6b5aa1c27ad394a43f0129ad3336ec4677a90f0388
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.84.1_0\_locales\en_CA\messages.json
Filesize851B
MD507ffbe5f24ca348723ff8c6c488abfb8
SHA16dc2851e39b2ee38f88cf5c35a90171dbea5b690
SHA2566895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c
SHA5127ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.84.1_0\dasherSettingSchema.json
Filesize854B
MD54ec1df2da46182103d2ffc3b92d20ca5
SHA1fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA2566c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
SHA512939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
152B
MD561cef8e38cd95bf003f5fdd1dc37dae1
SHA111f2f79ecb349344c143eea9a0fed41891a3467f
SHA256ae671613623b4477fbd5daf1fd2d148ae2a09ddcc3804b2b6d4ffcb60b317e3e
SHA5126fb9b333fe0e8fde19fdd0bd01a1990a4e60a87c0a02bc8297da1206e42f8690d06b030308e58c862e9e77714a585eed7cc1627590d99a10aeb77fc0dd3d864d
-
Filesize
152B
MD50a9dc42e4013fc47438e96d24beb8eff
SHA1806ab26d7eae031a58484188a7eb1adab06457fc
SHA25658d66151799526b3fa372552cd99b385415d9e9a119302b99aadc34dd51dd151
SHA512868d6b421ae2501a519595d0c34ddef25b2a98b082c5203da8349035f1f6764ddf183197f1054e7e86a752c71eccbc0649e515b63c55bc18cf5f0592397e258f
-
Filesize
5KB
MD54b4dea1bbfa943493f8a1663b76a344a
SHA18b490d12900bd05119c8ff513ab339ebaa04c201
SHA256e0db38102677101db0204b471069139ab436fee846f324d4b349bc67b8d829e8
SHA512e700d72e7387ea30f02a8b40502e5b9f6fc023697d3aa4bdcccdd22cceaeecc0f1c2037acc1b2cc0ba4265da9f0babe8d5cbd1f78c5206b26589778d4d8ea615
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b616e4f6-3c37-46e3-9c2a-ea8dc93153bb.tmp
Filesize1B
MD55058f1af8388633f609cadb75a75dc9d
SHA13a52ce780950d4d969792a2559cd519d7ee8c727
SHA256cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
SHA5120b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\activity-stream.discovery_stream.json
Filesize24KB
MD5e8617cbe475a063946010f7ee2ceb989
SHA1ce4b5b6e942f15b6a61c36c82e51bb0baf3e5434
SHA2564d35c4485af7a3f0796890973f882dd5612a8d3a28bd9ad6f7a3500188417ada
SHA51274ca1dcda504c6f189dd094ab6979004773ed108fac3c3ad189312b577edd80b2a3e29d73ed252f1fca46b5d17e8d184a3334419efc7f46e7ee79f4696b69995
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\cache2\entries\92F4D5A4F9CED6E2E644D803AEE3647A0EA4D984
Filesize13KB
MD5fcf771cfd60174085f1e3705e2dde674
SHA1d179421f61df457a8b63f6ff247124b4cd044a2b
SHA25675a4366aea663abc17ca985f48673c3c71fee53a19af4907ddfaf8b8d5321fe4
SHA51269c511b39d804065a27fd5a341dac298d2c2d505d65865b5b92d2efea164d9f97a4f34de15662a99ed1275d3e825ec83e93cc973aa0e7c41d87c1cf3fdc22421
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
Filesize15KB
MD596c542dec016d9ec1ecc4dddfcbaac66
SHA16199f7648bb744efa58acf7b96fee85d938389e4
SHA2567f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798
SHA512cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658
-
Filesize
1.8MB
MD59678100fea9ae7ae60ed363828cfcf1d
SHA1a220ae15cf35dba7a9f4ad52584d481e1a805663
SHA2560b348850f149033d8ab331fedd48e1848e62c8ff7b0ea7909f18b65b44ede386
SHA5123f5e0b5c19047ebf97776f79eb33460447d8c2c3c73f1f79e3568c8a38194722cef78e3cf0fecc41bcbc8b886197447e2318ccb749ac65c07178973dc3d3c8ea
-
Filesize
491KB
MD50141baf82bb318d465d2207be71876ef
SHA1842c96e333bc63b130763369edb5048dc3ca8241
SHA256f90cae22e1c93ab14789f1a8c238312bfdb1885a90058f696f7f446e1c922c48
SHA512560202c3668921b0c8c6e25ba59231feb55d61178e2337f0f70cd2a2cfcd2dceabe2df87bfe46b391fc8694bfd64fb34c645fe9997e43af9026935b67db6a569
-
Filesize
1.8MB
MD5e0933ae8e72f7faa74c26e20098c6279
SHA161edd92c5d8a5416a556b6a822bb7e7cef73068a
SHA2568c60e2eb2504988a8b4d55b0b5d9b430896e04c8b40547efd5e5930b168a7beb
SHA51205ad0f15d4b78581bb7b2f2df4f9c8e38cf83825fdc963d9d8bf633030418bbd01e2330eb411d2c42f78acf3ffe7e9cf6f492cc68316630763fccf811bf8fb3b
-
Filesize
4.9MB
MD5443c778fc72c59824a828ece66b8e82a
SHA191fb9df41bba19b6d6612bbafd6d35dc81dc01d6
SHA256a43029c07921865be726ccc99e368b445715a3e55279c7faaaae5cad38eb4276
SHA512b7d2ea13089446be522b2e69f8a326ff218180aa1a341cd251b13df85ef0f3c68afeb7bb0e2fee57624c9c8a17d7407f75aaf17147186d285d5799b42da00c91
-
Filesize
947KB
MD5af37fe81c11b366a272710684c1c3aad
SHA1db9237e149092c166908deac48bc21fff19e5552
SHA2560faddfc4413703b1d9798592d5902dca7e7bfa737b4df44e92cc3d75b3fa21d8
SHA512b7bcbc21eb7848acac7e193889fd04061937c58660b36cb76340b6a19d92d7f36657709b8bd4593f8c2443796c7b249b807c5212849306f9b44ad0540bcef05d
-
Filesize
2.7MB
MD55fd8503c7d22ef556ff89841f26fe03e
SHA1aa6cea0d0b8be5fba6e1cda19d485c65eaf8f534
SHA2563db166ad30011af27341fe917b0e53fef80ab8051c6a64edd0c76841c6fcfabc
SHA51254c00e445a7e2b97a96350a17a14027dd0910b9db33afaa5ee8a518573b33b5b74bf33038155b69c1b9371cad32d3d98337863a5888b56342d429d72adec8543
-
Filesize
135KB
MD53f6f93c3dccd4a91c4eb25c7f6feb1c1
SHA19b73f46adfa1f4464929b408407e73d4535c6827
SHA25619f05352cb4c6e231c1c000b6c8b7e9edcc1e8082caf46fff16b239d32aa7c9e
SHA512d488fa67e3a29d0147e9eaf2eabc74d9a255f8470cf79a4aea60e3b3b5e48a3fcbc4fc3e9ce58dff8d7d0caa8ae749295f221e1fe1ba5d20deb2d97544a12ba4
-
Filesize
711B
MD5558659936250e03cc14b60ebf648aa09
SHA132f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA2562445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
SHA5121632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
-
Filesize
479KB
MD509372174e83dbbf696ee732fd2e875bb
SHA1ba360186ba650a769f9303f48b7200fb5eaccee1
SHA256c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
SHA512b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
-
Filesize
13.8MB
MD50a8747a2ac9ac08ae9508f36c6d75692
SHA1b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA25632d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
SHA51259521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\AlternateServices.bin
Filesize6KB
MD58efcfcba11097d6a41150444a9bf8940
SHA17daf4a4b38746141c6f4322607d6143933a31a98
SHA256a1277023e6194eb1e07b7530521c6a446dd51d8f63cd79ad8b27985ee230a387
SHA512d56589be1a455162aced6d19a4997eb8d8503cf26632dd4ba8bd63929c0a768435a8ea991901e9d7a88535d9ae028b760b0f97a881114fed68cfce3b3909faf2
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\AlternateServices.bin
Filesize10KB
MD575cec86d2e66e888c22d57693f4dd5e1
SHA14e081bc15c963d8b10eac364c4c34e2454d0a790
SHA2561f72c76c43d1cdbf8752e87d8949c0a6d8bfa83c5d203281610b950141eae220
SHA512e211a23d59bcc290fe737ae67f9b1bbc765ffcb4eb0749eb57a7a36b64bbf9248ad544f809f77ec2f78c08bdc92b335ed76524df8e075c2a800eeedb43ef04d5
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\db\data.safe.tmp
Filesize15KB
MD5598b8153bdf684646b384e8264156032
SHA15b1c7bf72cbf25f624bd07e43ca39f233a0f1f36
SHA2566e29ea368b40469a8ab2c6df7e01857a5a421ae39c920111199e2d409cb8de06
SHA512e68a2935884d99520d12312d849870d5ca25b07385ea4a2db0ffe6ee14400d1efa1c0eb8cf63ea6fa92c10c008d5445cf4b82e8fcb37f79238f2c2ebe3060a01
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\db\data.safe.tmp
Filesize5KB
MD59bab37ea7eb6f09fa44b12ae2d13f54d
SHA100ac79904029870265352f4d65052d0939feaa6d
SHA256dade846200eaa3b892c817c3009d7f146955318ab0cdcf6b0101651d44e3fd1b
SHA5120d8e50124f308caebb1627ea93146751b82f3d2f5393684e8f50bfeeabadd8c19e2f8e419bea381484a7d146bf56b55d92c693e3fcbbc65fbd480576b904dba9
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\db\data.safe.tmp
Filesize15KB
MD5a21ede8c6e8e776afa8cb0b39e24cce1
SHA1a63c694a804e7a2d71706ae1347bfbcc9b287962
SHA256e2be852b5049581caec594d588553a0e7d16248825dbe0704880611a3be3d6d1
SHA5121cbb92b0c86877171d46ee4bbaae7692bbf8498efc0319f24c834109bb8109b2fdd48f23237d320e54480ae749245a3909959abbe01076f143812e3bf9e563ca
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\pending_pings\23b906e4-01cd-4f63-b789-a58659123911
Filesize25KB
MD5424dc5b5c9fdae71c8a54489d1652e4e
SHA15c764d81df9ffd4031d9ea8ac33a3541695f2428
SHA256dc2de3a66b8624eefccdcdac44839f9c1c75000ce3e260dc9c9322ab3a2f4cec
SHA512f70aecbddf6f4aa290258dbf5fdce08b0c92dff16f902d528fe59af7d710ee9f47ce3004639aab7f247c6bbd567f0c196d151b31f657731cdd95d5b40bb42ada
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\pending_pings\ad2f1b6b-3861-48be-bf1a-26ef4d7dbf41
Filesize671B
MD5d965b0c344f09de3d40bab7ea55cdb1f
SHA1c6d91b2f80293e2912874c3d7c25546abdc7bf77
SHA256bdfff59d69895e1ac33482622eb9e20c2de32af64a0d278ec5d45dc4db19db16
SHA512cdcf2464f9e6f21c61121d3f332114ec356ef9f7ccc48abf767173008c58cd345c9c40b1bee544272a9388e4629295e953c474196f8b872c4321209f253e7199
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\pending_pings\f74ddc2f-89ff-4087-8d1f-3e0cbdfa1e0f
Filesize982B
MD5b20caf36a11cefbbbc5c336c4016b2b7
SHA150ee3b60ab05a56e204a600f3eb1817b82fbb53e
SHA25630fc84fb9400d7126d9c4d778c7dd125c5c3360d925fd74fd3ea2a8fc3833a88
SHA5122cf5041f40e53c70eb3f10776d76ece886d0c3c63f94b3e430019caf821b55459a5c5013529f34423ba0bddab858f16b45e7a349efa49423a6e489c48b3eb4d1
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Filesize1.1MB
MD5842039753bf41fa5e11b3a1383061a87
SHA13e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA256d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
SHA512d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Filesize116B
MD52a461e9eb87fd1955cea740a3444ee7a
SHA1b10755914c713f5a4677494dbe8a686ed458c3c5
SHA2564107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
SHA51234f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Filesize372B
MD5bf957ad58b55f64219ab3f793e374316
SHA1a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA256bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
SHA51279c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Filesize17.8MB
MD5daf7ef3acccab478aaa7d6dc1c60f865
SHA1f8246162b97ce4a945feced27b6ea114366ff2ad
SHA256bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
SHA5125840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
-
Filesize
15KB
MD583c84238b49bde1f94ad94a3f48774d5
SHA10414411eb5b904b7cb572a2bc1ea1e508d3bb610
SHA256e9748a0ba6a2eb7586d4475132bafa7e7d0df36e121c005c052d1c595f5b2516
SHA512b4dcddc1fc526fcf5e1a4aafc10462d232ada148a2b7a12a9f56eb549a9dbf67468163451f0e91b8fb6f842d4b1e980838df50b064d4b21abf090352c032cb6e
-
Filesize
10KB
MD5a4b6c8e652b5d09735907c7ca2d88f74
SHA1065531fe1233d78cd9d62b0fca578b5b3ae5e3e9
SHA25683c71405c685e84e55bd3e5de1b4220c4f9925dd5d51affe9de9c3f0371a637d
SHA51289917d0a4ccf07df514fce34101782433c79dd9995ce3683b4442d42f48c0d9f5cff8043ec1fe422038706e5027529b01387189cf9a91f97d63157fda5f6d8a3
-
Filesize
10KB
MD505036fa20c8f1e35b60c6f1e26cd28e4
SHA115a68179757f5855857d4d16700109670503b0be
SHA256154b2377eb600d293f1bf65d79cad8ef173449749a43682d8746cd1870bfdbd1
SHA51250e2cd796162c84a26c33a098f7dfcdf395c03665f56dd27beee2446ab9bccec24cd27c136f08f05c957ae5734b16b53a4b0b90f6c649738b3884734fbc9e1ce
-
Filesize
11KB
MD51144804b8eeadd2ebeeb3069194f8881
SHA1d64a17f5a32ef9e851df29ecfe69da6e50729917
SHA256075982762293e0985cc6b92444c8601db83df61e3b0449d4d1cb9d63ec5b8502
SHA5127abb7fe2ec000e332116019ae298bef205867a19a6aea42c62152427911e463a65619aecd391c90ecccd153fe84018cd08ec700b1c33aa81ef41e567ee57aea4
-
Filesize
3.1MB
MD5c0d113d521f4055ce2d25ba430f7789d
SHA17a9e6c9ca301b9bbc363b615a6f8c9ea3f199758
SHA2560cdee686d940e327d736172dbe61168063bfaf253cca8ad0b37ec2097bc20fcd
SHA512c9567a7b02758846c8aa4e201a01cc807233fdbbfc63ebe2d350388682935ca98313531aff4c026c31b2ffbb6302e220cd6e68bdd42e1e42475400aa6608a084