Analysis
-
max time kernel
145s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10-12-2024 03:42
Static task
static1
General
-
Target
e7aa9c79350c8dab8bd903b453f3dfd899956698fb717c91ac3cab9dec75f361.exe
-
Size
3.1MB
-
MD5
31b1538dfcc40163da1a24b8a48e6c90
-
SHA1
4377e5c025672f6dca9ed52bd08ca164b89bdca2
-
SHA256
e7aa9c79350c8dab8bd903b453f3dfd899956698fb717c91ac3cab9dec75f361
-
SHA512
3eb7b3d132ccf5c52e64eac37a00b07c3ec2a3c111cdfb2d229963b31f688f204252021be233b0d967ee4bbb3b79b62182bf1ec02247753a826218910733960e
-
SSDEEP
49152:axjioF/x5ioHP05Hp5GEUjdMbmUG4XRO3QP7ShSSDIj/:E2A/a0PqTGEQdMFBXYgP7YS5j/
Malware Config
Extracted
amadey
4.42
9c9aa5
http://185.215.113.43
-
install_dir
abc3bc1985
-
install_file
skotes.exe
-
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
-
url_paths
/Zu7JuNko/index.php
Extracted
stealc
stok
http://185.215.113.206
-
url_path
/c4becf79229cb002.php
Extracted
lumma
https://impend-differ.biz/api
https://print-vexer.biz/api
https://dare-curbys.biz/api
https://covery-mover.biz/api
https://formy-spill.biz/api
https://dwell-exclaim.biz/api
https://zinc-sneark.biz/api
https://se-blurry.biz/api
https://atten-supporse.biz/api
Extracted
lumma
https://atten-supporse.biz/api
https://se-blurry.biz/api
https://zinc-sneark.biz/api
Signatures
-
Amadey family
-
Gcleaner family
-
Lumma family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" dc8b1c7c41.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" dc8b1c7c41.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" dc8b1c7c41.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" dc8b1c7c41.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection dc8b1c7c41.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" dc8b1c7c41.exe -
Stealc family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 9 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 5eec2ccf42.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ f1c2e38e1c.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ ba9243fa42.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ dc8b1c7c41.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ e7aa9c79350c8dab8bd903b453f3dfd899956698fb717c91ac3cab9dec75f361.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 18 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion e7aa9c79350c8dab8bd903b453f3dfd899956698fb717c91ac3cab9dec75f361.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 5eec2ccf42.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion dc8b1c7c41.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion e7aa9c79350c8dab8bd903b453f3dfd899956698fb717c91ac3cab9dec75f361.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion ba9243fa42.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 5eec2ccf42.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion ba9243fa42.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion dc8b1c7c41.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion f1c2e38e1c.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion f1c2e38e1c.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation skotes.exe Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation e7aa9c79350c8dab8bd903b453f3dfd899956698fb717c91ac3cab9dec75f361.exe -
Executes dropped EXE 9 IoCs
pid Process 3960 skotes.exe 2220 5eec2ccf42.exe 4840 skotes.exe 1756 f1c2e38e1c.exe 3740 ba9243fa42.exe 1108 572d4717d3.exe 4680 dc8b1c7c41.exe 6112 skotes.exe 3444 skotes.exe -
Identifies Wine through registry keys 2 TTPs 9 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Wine ba9243fa42.exe Key opened \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Wine skotes.exe Key opened \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Wine skotes.exe Key opened \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Wine 5eec2ccf42.exe Key opened \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Wine skotes.exe Key opened \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Wine f1c2e38e1c.exe Key opened \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Wine e7aa9c79350c8dab8bd903b453f3dfd899956698fb717c91ac3cab9dec75f361.exe Key opened \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Wine dc8b1c7c41.exe Key opened \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Wine skotes.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features dc8b1c7c41.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" dc8b1c7c41.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\f1c2e38e1c.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1013601001\\f1c2e38e1c.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ba9243fa42.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1013602001\\ba9243fa42.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\572d4717d3.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1013603001\\572d4717d3.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dc8b1c7c41.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1013604001\\dc8b1c7c41.exe" skotes.exe -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/files/0x0007000000023cc2-100.dat autoit_exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs
pid Process 4048 e7aa9c79350c8dab8bd903b453f3dfd899956698fb717c91ac3cab9dec75f361.exe 3960 skotes.exe 2220 5eec2ccf42.exe 4840 skotes.exe 1756 f1c2e38e1c.exe 3740 ba9243fa42.exe 4680 dc8b1c7c41.exe 6112 skotes.exe 3444 skotes.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\skotes.job e7aa9c79350c8dab8bd903b453f3dfd899956698fb717c91ac3cab9dec75f361.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 3 IoCs
pid pid_target Process procid_target 3004 1756 WerFault.exe 94 3508 1756 WerFault.exe 94 5756 2220 WerFault.exe 87 -
System Location Discovery: System Language Discovery 1 TTPs 14 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language skotes.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ba9243fa42.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 572d4717d3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dc8b1c7c41.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e7aa9c79350c8dab8bd903b453f3dfd899956698fb717c91ac3cab9dec75f361.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language 572d4717d3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5eec2ccf42.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f1c2e38e1c.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage 572d4717d3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe -
Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe -
Kills process with taskkill 5 IoCs
pid Process 716 taskkill.exe 740 taskkill.exe 1524 taskkill.exe 376 taskkill.exe 4140 taskkill.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings firefox.exe -
Suspicious behavior: EnumeratesProcesses 25 IoCs
pid Process 4048 e7aa9c79350c8dab8bd903b453f3dfd899956698fb717c91ac3cab9dec75f361.exe 4048 e7aa9c79350c8dab8bd903b453f3dfd899956698fb717c91ac3cab9dec75f361.exe 3960 skotes.exe 3960 skotes.exe 2220 5eec2ccf42.exe 2220 5eec2ccf42.exe 4840 skotes.exe 4840 skotes.exe 1756 f1c2e38e1c.exe 1756 f1c2e38e1c.exe 3740 ba9243fa42.exe 3740 ba9243fa42.exe 1108 572d4717d3.exe 1108 572d4717d3.exe 4680 dc8b1c7c41.exe 4680 dc8b1c7c41.exe 1108 572d4717d3.exe 1108 572d4717d3.exe 4680 dc8b1c7c41.exe 4680 dc8b1c7c41.exe 4680 dc8b1c7c41.exe 6112 skotes.exe 6112 skotes.exe 3444 skotes.exe 3444 skotes.exe -
Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeDebugPrivilege 740 taskkill.exe Token: SeDebugPrivilege 1524 taskkill.exe Token: SeDebugPrivilege 376 taskkill.exe Token: SeDebugPrivilege 4140 taskkill.exe Token: SeDebugPrivilege 716 taskkill.exe Token: SeDebugPrivilege 4100 firefox.exe Token: SeDebugPrivilege 4100 firefox.exe Token: SeDebugPrivilege 4680 dc8b1c7c41.exe Token: SeDebugPrivilege 4100 firefox.exe Token: SeDebugPrivilege 4100 firefox.exe Token: SeDebugPrivilege 4100 firefox.exe -
Suspicious use of FindShellTrayWindow 33 IoCs
pid Process 4048 e7aa9c79350c8dab8bd903b453f3dfd899956698fb717c91ac3cab9dec75f361.exe 1108 572d4717d3.exe 1108 572d4717d3.exe 1108 572d4717d3.exe 1108 572d4717d3.exe 1108 572d4717d3.exe 1108 572d4717d3.exe 1108 572d4717d3.exe 1108 572d4717d3.exe 4100 firefox.exe 4100 firefox.exe 4100 firefox.exe 4100 firefox.exe 4100 firefox.exe 4100 firefox.exe 4100 firefox.exe 4100 firefox.exe 4100 firefox.exe 4100 firefox.exe 4100 firefox.exe 4100 firefox.exe 4100 firefox.exe 4100 firefox.exe 4100 firefox.exe 4100 firefox.exe 4100 firefox.exe 4100 firefox.exe 4100 firefox.exe 4100 firefox.exe 4100 firefox.exe 1108 572d4717d3.exe 1108 572d4717d3.exe 1108 572d4717d3.exe -
Suspicious use of SendNotifyMessage 31 IoCs
pid Process 1108 572d4717d3.exe 1108 572d4717d3.exe 1108 572d4717d3.exe 1108 572d4717d3.exe 1108 572d4717d3.exe 1108 572d4717d3.exe 1108 572d4717d3.exe 1108 572d4717d3.exe 4100 firefox.exe 4100 firefox.exe 4100 firefox.exe 4100 firefox.exe 4100 firefox.exe 4100 firefox.exe 4100 firefox.exe 4100 firefox.exe 4100 firefox.exe 4100 firefox.exe 4100 firefox.exe 4100 firefox.exe 4100 firefox.exe 4100 firefox.exe 4100 firefox.exe 4100 firefox.exe 4100 firefox.exe 4100 firefox.exe 4100 firefox.exe 4100 firefox.exe 1108 572d4717d3.exe 1108 572d4717d3.exe 1108 572d4717d3.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4100 firefox.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4048 wrote to memory of 3960 4048 e7aa9c79350c8dab8bd903b453f3dfd899956698fb717c91ac3cab9dec75f361.exe 83 PID 4048 wrote to memory of 3960 4048 e7aa9c79350c8dab8bd903b453f3dfd899956698fb717c91ac3cab9dec75f361.exe 83 PID 4048 wrote to memory of 3960 4048 e7aa9c79350c8dab8bd903b453f3dfd899956698fb717c91ac3cab9dec75f361.exe 83 PID 3960 wrote to memory of 2220 3960 skotes.exe 87 PID 3960 wrote to memory of 2220 3960 skotes.exe 87 PID 3960 wrote to memory of 2220 3960 skotes.exe 87 PID 3960 wrote to memory of 1756 3960 skotes.exe 94 PID 3960 wrote to memory of 1756 3960 skotes.exe 94 PID 3960 wrote to memory of 1756 3960 skotes.exe 94 PID 3960 wrote to memory of 3740 3960 skotes.exe 106 PID 3960 wrote to memory of 3740 3960 skotes.exe 106 PID 3960 wrote to memory of 3740 3960 skotes.exe 106 PID 3960 wrote to memory of 1108 3960 skotes.exe 107 PID 3960 wrote to memory of 1108 3960 skotes.exe 107 PID 3960 wrote to memory of 1108 3960 skotes.exe 107 PID 1108 wrote to memory of 740 1108 572d4717d3.exe 109 PID 1108 wrote to memory of 740 1108 572d4717d3.exe 109 PID 1108 wrote to memory of 740 1108 572d4717d3.exe 109 PID 1108 wrote to memory of 1524 1108 572d4717d3.exe 112 PID 1108 wrote to memory of 1524 1108 572d4717d3.exe 112 PID 1108 wrote to memory of 1524 1108 572d4717d3.exe 112 PID 1108 wrote to memory of 376 1108 572d4717d3.exe 114 PID 1108 wrote to memory of 376 1108 572d4717d3.exe 114 PID 1108 wrote to memory of 376 1108 572d4717d3.exe 114 PID 1108 wrote to memory of 4140 1108 572d4717d3.exe 116 PID 1108 wrote to memory of 4140 1108 572d4717d3.exe 116 PID 1108 wrote to memory of 4140 1108 572d4717d3.exe 116 PID 1108 wrote to memory of 716 1108 572d4717d3.exe 118 PID 1108 wrote to memory of 716 1108 572d4717d3.exe 118 PID 1108 wrote to memory of 716 1108 572d4717d3.exe 118 PID 1108 wrote to memory of 5088 1108 572d4717d3.exe 120 PID 1108 wrote to memory of 5088 1108 572d4717d3.exe 120 PID 5088 wrote to memory of 4100 5088 firefox.exe 121 PID 5088 wrote to memory of 4100 5088 firefox.exe 121 PID 5088 wrote to memory of 4100 5088 firefox.exe 121 PID 5088 wrote to memory of 4100 5088 firefox.exe 121 PID 5088 wrote to memory of 4100 5088 firefox.exe 121 PID 5088 wrote to memory of 4100 5088 firefox.exe 121 PID 5088 wrote to memory of 4100 5088 firefox.exe 121 PID 5088 wrote to memory of 4100 5088 firefox.exe 121 PID 5088 wrote to memory of 4100 5088 firefox.exe 121 PID 5088 wrote to memory of 4100 5088 firefox.exe 121 PID 5088 wrote to memory of 4100 5088 firefox.exe 121 PID 4100 wrote to memory of 1196 4100 firefox.exe 122 PID 4100 wrote to memory of 1196 4100 firefox.exe 122 PID 4100 wrote to memory of 1196 4100 firefox.exe 122 PID 4100 wrote to memory of 1196 4100 firefox.exe 122 PID 4100 wrote to memory of 1196 4100 firefox.exe 122 PID 4100 wrote to memory of 1196 4100 firefox.exe 122 PID 4100 wrote to memory of 1196 4100 firefox.exe 122 PID 4100 wrote to memory of 1196 4100 firefox.exe 122 PID 4100 wrote to memory of 1196 4100 firefox.exe 122 PID 4100 wrote to memory of 1196 4100 firefox.exe 122 PID 4100 wrote to memory of 1196 4100 firefox.exe 122 PID 4100 wrote to memory of 1196 4100 firefox.exe 122 PID 4100 wrote to memory of 1196 4100 firefox.exe 122 PID 4100 wrote to memory of 1196 4100 firefox.exe 122 PID 4100 wrote to memory of 1196 4100 firefox.exe 122 PID 4100 wrote to memory of 1196 4100 firefox.exe 122 PID 4100 wrote to memory of 1196 4100 firefox.exe 122 PID 4100 wrote to memory of 1196 4100 firefox.exe 122 PID 4100 wrote to memory of 1196 4100 firefox.exe 122 PID 4100 wrote to memory of 1196 4100 firefox.exe 122 PID 4100 wrote to memory of 1196 4100 firefox.exe 122 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\e7aa9c79350c8dab8bd903b453f3dfd899956698fb717c91ac3cab9dec75f361.exe"C:\Users\Admin\AppData\Local\Temp\e7aa9c79350c8dab8bd903b453f3dfd899956698fb717c91ac3cab9dec75f361.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4048 -
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\1013600001\5eec2ccf42.exe"C:\Users\Admin\AppData\Local\Temp\1013600001\5eec2ccf42.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2220 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2220 -s 6364⤵
- Program crash
PID:5756
-
-
-
C:\Users\Admin\AppData\Local\Temp\1013601001\f1c2e38e1c.exe"C:\Users\Admin\AppData\Local\Temp\1013601001\f1c2e38e1c.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1756 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1756 -s 15124⤵
- Program crash
PID:3004
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1756 -s 14924⤵
- Program crash
PID:3508
-
-
-
C:\Users\Admin\AppData\Local\Temp\1013602001\ba9243fa42.exe"C:\Users\Admin\AppData\Local\Temp\1013602001\ba9243fa42.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3740
-
-
C:\Users\Admin\AppData\Local\Temp\1013603001\572d4717d3.exe"C:\Users\Admin\AppData\Local\Temp\1013603001\572d4717d3.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM firefox.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:740
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM chrome.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1524
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM msedge.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:376
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM opera.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4140
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM brave.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:716
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking4⤵
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking5⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2028 -parentBuildID 20240401114208 -prefsHandle 1956 -prefMapHandle 1948 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1ba8647e-b365-461f-82f8-c75cf8d3420b} 4100 "\\.\pipe\gecko-crash-server-pipe.4100" gpu6⤵PID:1196
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2448 -parentBuildID 20240401114208 -prefsHandle 2440 -prefMapHandle 2428 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8a33573f-9161-4231-a092-b4f6e4f8113a} 4100 "\\.\pipe\gecko-crash-server-pipe.4100" socket6⤵PID:3164
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3108 -childID 1 -isForBrowser -prefsHandle 3120 -prefMapHandle 3116 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d7c01202-ed31-4929-a4d6-1f47e12518fd} 4100 "\\.\pipe\gecko-crash-server-pipe.4100" tab6⤵PID:3212
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3996 -childID 2 -isForBrowser -prefsHandle 3980 -prefMapHandle 3976 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {83e4c479-fd5a-416f-acc6-f922fecdac4a} 4100 "\\.\pipe\gecko-crash-server-pipe.4100" tab6⤵PID:740
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4964 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4956 -prefMapHandle 4844 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5f497595-399b-40f1-a716-73a4268196fc} 4100 "\\.\pipe\gecko-crash-server-pipe.4100" utility6⤵
- Checks processor information in registry
PID:5472
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5340 -childID 3 -isForBrowser -prefsHandle 5476 -prefMapHandle 5348 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1ba93bf5-c6e8-4312-9db1-6f4dddac912f} 4100 "\\.\pipe\gecko-crash-server-pipe.4100" tab6⤵PID:2724
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5724 -childID 4 -isForBrowser -prefsHandle 5804 -prefMapHandle 5800 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {772095e3-d84b-432c-8beb-0147708f7767} 4100 "\\.\pipe\gecko-crash-server-pipe.4100" tab6⤵PID:3872
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5792 -childID 5 -isForBrowser -prefsHandle 5908 -prefMapHandle 5476 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {897475e1-6951-4586-898e-3bea7ceb91b0} 4100 "\\.\pipe\gecko-crash-server-pipe.4100" tab6⤵PID:3144
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1013604001\dc8b1c7c41.exe"C:\Users\Admin\AppData\Local\Temp\1013604001\dc8b1c7c41.exe"3⤵
- Modifies Windows Defender Real-time Protection settings
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Windows security modification
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4680
-
-
-
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exeC:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4840
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1756 -ip 17561⤵PID:4460
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1756 -ip 17561⤵PID:3448
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 2220 -ip 22201⤵PID:5740
-
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exeC:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:6112
-
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exeC:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3444
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Impair Defenses
2Disable or Modify Tools
2Modify Registry
3Virtualization/Sandbox Evasion
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1B
MD5cfcd208495d565ef66e7dff9f98764da
SHA1b6589fc6ab0dc82cf12099d1c2d40ab994e8410c
SHA2565feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
SHA51231bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\42vejdix.default-release\activity-stream.discovery_stream.json
Filesize27KB
MD554a3d8a2e1a216c86e66a0a5ca73dac4
SHA14a1a0466110faf6dd09f4ca4d3f58fda63b1e6b3
SHA2562c87becc5263b77d69c2716cf91ec14824a3280962e4b9945d8e167b0c991aa1
SHA512c15615b0b4d3312dae8c1fdb140ff3e02cd8ea6f9ee646fbc26976358d81a2a726ae8cf0b25aecec4e7097562de3f757c2a947e7c483a6132ffb2dd432936a26
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\42vejdix.default-release\cache2\entries\92F4D5A4F9CED6E2E644D803AEE3647A0EA4D984
Filesize13KB
MD5970c66d5b078b41f7b5422af7f55f9d8
SHA1a9e5d76306c4bf05e9285aefb801c14056f55eb2
SHA2564a9d6d23ab5ad51dc358e9829d4b61ae7449979e7da44a50d456b5fe1126dbfd
SHA51215e6d70da7620125f649491d289ec0c69456fa1601d8447b7c02f446ec375374982e2f96f1c35b0d7001e8fcf893919c2b1f916b035ab09b0bf5a6d2d51fcd4d
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\42vejdix.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
Filesize15KB
MD596c542dec016d9ec1ecc4dddfcbaac66
SHA16199f7648bb744efa58acf7b96fee85d938389e4
SHA2567f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798
SHA512cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658
-
Filesize
1.9MB
MD5054b1e771a301c1e792397a683ed0a90
SHA1eb209469e0b66a485b135012cf43538ceb9dc96c
SHA2566b2391a7841833a3524f5034b7287e55f4c8fbec8678ecf7a6040ada9c07fde1
SHA51223317dcaf76cc1a9dc6c3dc5e551c88905163625617abc7aa389255dd17ee9ca330303521fabfb91c3a33bf1c2a650f2935a7a047eadf1814ea60e2ec387275e
-
Filesize
1.7MB
MD573f9c0001107eb1b3aab6549c6574f7f
SHA192f5d81090d2cb7ff8be9764e7b69dca16ba44da
SHA256d1f439cd24726a4ed6001304ea33e413856a7242292f750088e66696bb5aecaa
SHA5124026d6b9ecb2aafbb293533ee6221c2b3dc4d1bcfcd5cbec28275e1848b586139ba790cbb7446f9f33e256a9d67282f09586774018236592fe6c103cf9dc7e9c
-
Filesize
1.7MB
MD5e814098146a7d5bb6910f684d24ddda7
SHA13ac620ff3ae684e4d614ffb27821d8301f973a84
SHA2568bd7b0662ecb72eb60b3ae68a0534acb4a787263a37a619a48bc7a2186c4415d
SHA5127d3dced81670b6e318e77057bbad45d5d7d4015f08ba0548e0f52766bf6ec2d874990a2c5003f5c2d48a39801d6c5c5fe26b85cc120b2ab77a7c8f4166588c99
-
Filesize
945KB
MD5cd6fbd133b166f011ee0459dab795a09
SHA18aeaa235e3210f51f69d2e582157a90dfdc4cbff
SHA256372b4cee4013a85a973aa26f426edcc974b88c34df77b867622ca294bda3a638
SHA5122b62c881a7306fe5c718e081a7be0c1a7ecc3c1d3d7fddac41c93919b95e08232e32bb736c148cc41d2280ead149810d31729ca505a4dab6118cc34466dfbfcb
-
Filesize
2.7MB
MD510bb282a6a510155af521185a136c32d
SHA1b0cddbafc0067a12a2e956719e31379dba526175
SHA256fb4563df189c1a024633917a3ddb4ba58495fe4929cd1a71a955abfdadc5ce3c
SHA512e35b9ae296a83db15165687c9a3c1e3bae30ec56d94787e11dd5e8bc3d2a15fe6bdc0cee4b65a56d77efc2db7b7383e1579dbf6088c141d89433ece5aaad8cbc
-
Filesize
3.1MB
MD531b1538dfcc40163da1a24b8a48e6c90
SHA14377e5c025672f6dca9ed52bd08ca164b89bdca2
SHA256e7aa9c79350c8dab8bd903b453f3dfd899956698fb717c91ac3cab9dec75f361
SHA5123eb7b3d132ccf5c52e64eac37a00b07c3ec2a3c111cdfb2d229963b31f688f204252021be233b0d967ee4bbb3b79b62182bf1ec02247753a826218910733960e
-
Filesize
479KB
MD509372174e83dbbf696ee732fd2e875bb
SHA1ba360186ba650a769f9303f48b7200fb5eaccee1
SHA256c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
SHA512b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
-
Filesize
13.8MB
MD50a8747a2ac9ac08ae9508f36c6d75692
SHA1b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA25632d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
SHA51259521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\AlternateServices.bin
Filesize6KB
MD5399053c623cd0c6992ac5b1b94e27edf
SHA17fa62ff115d34404ac836b2c561aa0edcac1bd69
SHA256020553979c5cd040106a2a00abec5d6eb23c525659ca53ddd41ebc02ce2ee802
SHA5124cd1ae6b9592a9fbd1b79bb9a230a5336a52bbfa79aa294096c7dba16ab4fe20c8e466eb10ec5555ccb7836710a7d9a23a6d6d1f26153d5b6d5a803465a867aa
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\AlternateServices.bin
Filesize18KB
MD53b56935cac406869819abbfafd2d849f
SHA175b318f2363363916b91ad505e3560508742344d
SHA2567a5328dcb50e49e26df163c17838af7e05b442db8745afc4440a000ac225a583
SHA51271450adfea88de4c6ff4d1e20243560a2e52038c2c98c466956486b412408a6cc115876db219e789dd7c49b8bbfc4cc6b6e8993274e272ed0822abb85dd27ef0
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\AlternateServices.bin
Filesize8KB
MD59975438bf969e079dabf4bc5593b599e
SHA12b42f07d9fb4e21d8b81a94aa4d686ff3faf7fac
SHA25610864f72fd9b0ad4a8e5105a6a122e8d274230bf54baad23cc9a0c85321f9790
SHA5126456e36c8d57742c73344b2fc62b8f066feb521290dd63e34289823d4c53120f88286fcf7d64757a6ef89ff91e0ae4b538551de0603d21711e35fc5362bbbed3
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\db\data.safe.tmp
Filesize21KB
MD59af918b43583c1f43f44f3d2df86a67e
SHA15abcb4ee4ef59d892ae04b20d55566397e56854a
SHA2564a4badecd7fcb0fb2625d92f2807a773897a865fe175ba2c6109e1e3d62bd834
SHA51249d29e7adc221a864195b672a968d638f7cc86aafc41335906f9e590665e8fbd87c70d4a42717bd33290d38371587d2d8f151097939b00ce2f1b02ee1a78afc0
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\db\data.safe.tmp
Filesize22KB
MD52a1ed4aedd75473e2989de0cdf781fcd
SHA13a070096d5226220f76493ab3446b23ce3e92f6a
SHA256663e311a22f71345ed46871dd85ffbaf543033f36f5ccb070e29e1e62c815911
SHA512e1e6d252110514e31c1aa9868b0ab4b4f923fd00248683861f2482b2534b39164c843d2bf65e06eddfc2616d5b3b2533178885d56e5b4eaac3a6769a82851bc6
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\db\data.safe.tmp
Filesize24KB
MD5d5b03436894bb6923df198898c2d4695
SHA10d2fb66ef62f5e8dae65593dc3e412c30a9f21b7
SHA2563a26aeb980bb54f06ccab5ef6d639419823bacbc098dcc92b07c5b1a7d740ec4
SHA51299a3673b747d04ddd59fe41b9ba30ab9d621d3a06c5428494f796b7f31ecf480ec4526cab052f10919732426c9f87f1df4e22a2b1a9200156c292726f05b5dd3
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\db\data.safe.tmp
Filesize24KB
MD58974cf278ffb28e03f84d72e5a768f1a
SHA17b30dc3ae05bac296d9a2728348f8a14c2049a68
SHA256a25186d9c23e686713d365f293cbdfd0fe2a967aa2a947626732efd1b8753418
SHA512e90141df11ffe1b3a0bc577643231d1c2cf98f2a2dce9bcccfba831b5c07c1b2b0d0a9a2fb0137797fc3657aca2cae7aaff6abaffb730e709a070ae362b46293
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\db\data.safe.tmp
Filesize21KB
MD550cdb18ae6023e30a2b3e9c5b78a17fa
SHA1f8443b62f3234cf2c9d26c0673ab19caa2fe9278
SHA256c90f7c3c189e5f38449ba4771513c18833896322e993f41674256ab2aad27f22
SHA5129b419e4ea7b9b59416c0f0dfaec5e196d0dc730bc80e9edb26e7e5b52db08f80c3413378454b9d0a5d1fdfd4d89cd10a7d9692229b07a7611ae056e250aa94b5
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\db\data.safe.tmp
Filesize22KB
MD5988527de422c0be6884f9ec613eaa318
SHA1acb6e0e177426fd71671dc44b56dc1771b35a093
SHA2569edbc64e7e0cd1853aa44f6dd73bf14a7d71705a5f04e48cd2d93889fb14b2a0
SHA5128339177bd3a5bdb562aef2c05c8c018410c0769fe4bab9562782b4cfb235e96e2d6f22a862ebc19de033066079009a87f13647b37ac3f6b1eeeb72546bb96092
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\db\data.safe.tmp
Filesize24KB
MD5d8d16b0a4d7a26daf0f817fbb26f6254
SHA1245b5b1f86e79006022a661df0de9187b9e934f9
SHA2569e7bcde768493af7a00b1ebbb31fbbf953e8a39a36daa31be9b70a47c9200d0b
SHA5121c8cfd81e8af5825c88d7bb853dfeec156ad78b23583be50423b299f718682ed6367f18cab64e11e060fa2e10cf2a8d4992a601d5464f4da0496ac3d860f7b0c
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\pending_pings\1229f453-3cfe-4c16-b8b1-c97856cf39ae
Filesize659B
MD595f17bfc0ec9e042e7bd0860a6bd522f
SHA1bd32690f8726fa8b8824705702a91dd9f2e24fe7
SHA2561e22de26c3de31966af63f16c3655678800b6ba3aaad200cb0fcba2ea77732d2
SHA51219918a3c6273409b3c4d4f28d5520c7a349061fd11d0e70db34c788daf7e5d198fa8fcbc77a6840e94da5fc576af170acde3eca2001577d5b63b7f9bdf2c0931
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\pending_pings\904e7609-a2d6-463c-95e6-3267141f934b
Filesize982B
MD50c102f9d2f78897c27a9b1d021f88625
SHA10d3e0c95f17f1d6e084be6c669e8e21f5497ab82
SHA25637265d42ff612a282e36c1b73af1c73784dfcdeaf4c99a4d6333066f8eeafe89
SHA512b717f210d34e6a7334208981952940994ab6cbd1d19ad4d29f93ab79f3e10e99ad2cdcc65428ed9a1c887f77c574c35471d8e1985fb1f56135780b9df6f975f7
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Filesize1.1MB
MD5842039753bf41fa5e11b3a1383061a87
SHA13e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA256d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
SHA512d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Filesize116B
MD52a461e9eb87fd1955cea740a3444ee7a
SHA1b10755914c713f5a4677494dbe8a686ed458c3c5
SHA2564107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
SHA51234f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Filesize372B
MD5bf957ad58b55f64219ab3f793e374316
SHA1a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA256bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
SHA51279c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Filesize17.8MB
MD5daf7ef3acccab478aaa7d6dc1c60f865
SHA1f8246162b97ce4a945feced27b6ea114366ff2ad
SHA256bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
SHA5125840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
-
Filesize
12KB
MD58ab9614209603cec8237179d10fbc0cb
SHA128a7601309024288edf5acc8ade22c9fd2947467
SHA256b8001dfe0a034ba29d9850e8b1835e47adf3bb1dbdce1d8d55a2b37e7a08ee67
SHA5121e8f69cb3bbc7d7347da2cfcea2f1ccfb906d890e5e1033e4df25ee773fe56b815c842bb174a736f48727f80f5853d3eea6f511a411e2f3a0cb57545adacc689
-
Filesize
15KB
MD5383b98c0d0fe78d005ac1a74e014a141
SHA1484eb489d73d62388dbf8e7cba72de04cd563556
SHA25638362f5b511baacd2d1937a64bbcb0da5cc80b7802fc9b441db21de4dfbab755
SHA512b87007e1417313426bd7b5e3bfa4813c88baa38e170cc059854e3c04bc699a60b22ea0151d16a88063640377e5d5101a3813887145787e49cffeab6048e43a2a
-
Filesize
10KB
MD5964e5b61def45195d5b530425f0782c9
SHA17225615117adaa38eb26a1ad48d9f661fca9ac72
SHA2564ca9f179a9d446c0afdffe898ffe8fb52a739a3fcf356a36c15b46cd2a3e381d
SHA5126ff357a4c2b7ac77adc7698adb728a0139e1880c75441fee98b9577630f401ee77a2e6c9a81e1e36dbc8d312563e0e6d0f9dd4011c042a5bde9079c5a187160d
-
Filesize
10KB
MD5f10521ca39d2aabefa1387d42b901726
SHA13c446e762594be69b895452eed1a2cc29dd2d66a
SHA256057c4401e716d2e74e36c1a3ba13ce255330676365a14638dd3ac8000d441ebc
SHA512f581ae73dfde2de07b8ed9e49162850a8da752e14f7494ed0af4ae983b25c5ae67d4565e1239e310f781538578e4a8b2c1afd1535acf2a8b812ff3d7efe8f70b