Analysis
-
max time kernel
142s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10-12-2024 03:23
Static task
static1
Behavioral task
behavioral1
Sample
b0b56a92786831c7512288ff06c7691b61290eb97959dbe7fcab9daeda0cf442.exe
Resource
win7-20240708-en
General
-
Target
b0b56a92786831c7512288ff06c7691b61290eb97959dbe7fcab9daeda0cf442.exe
-
Size
3.1MB
-
MD5
9616371054857f390d2a2cefeb6fb9ea
-
SHA1
e1b0ffc6f19b81ecd8552483986570a0acafe576
-
SHA256
b0b56a92786831c7512288ff06c7691b61290eb97959dbe7fcab9daeda0cf442
-
SHA512
1cefd75f8f84a5bdc2af9225f034a4cc9067287f674a64495f534f910d39ca45738a4736d650c5cb99824bce4ca9b3ff0371bc7f66651e525aa79e13103139a5
-
SSDEEP
24576:A+FiXZMeKDrxsQKUxPbp8CzZb9Ynxo+LItEHUpYxD8eXg3A87hzdnMOrVe6+9KD7:aZGx91yJTXO3pX+GoCXb
Malware Config
Extracted
amadey
4.42
9c9aa5
http://185.215.113.43
-
install_dir
abc3bc1985
-
install_file
skotes.exe
-
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
-
url_paths
/Zu7JuNko/index.php
Extracted
lumma
https://impend-differ.biz/api
https://print-vexer.biz/api
https://dare-curbys.biz/api
https://covery-mover.biz/api
https://formy-spill.biz/api
https://dwell-exclaim.biz/api
https://zinc-sneark.biz/api
https://se-blurry.biz/api
https://atten-supporse.biz/api
Extracted
stealc
stok
http://185.215.113.206
-
url_path
/c4becf79229cb002.php
Extracted
lumma
https://atten-supporse.biz/api
https://se-blurry.biz/api
https://zinc-sneark.biz/api
Signatures
-
Amadey family
-
Gcleaner family
-
Lumma family
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection 35bd31e606.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 35bd31e606.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" 35bd31e606.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 35bd31e606.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 35bd31e606.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 35bd31e606.exe -
Stealc family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 8 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ f4f4f2e715.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ b0b56a92786831c7512288ff06c7691b61290eb97959dbe7fcab9daeda0cf442.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 4aef4e06f8.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ ccf1b06858.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 35bd31e606.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 16 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion b0b56a92786831c7512288ff06c7691b61290eb97959dbe7fcab9daeda0cf442.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion ccf1b06858.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 35bd31e606.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion f4f4f2e715.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion ccf1b06858.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 35bd31e606.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion b0b56a92786831c7512288ff06c7691b61290eb97959dbe7fcab9daeda0cf442.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 4aef4e06f8.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 4aef4e06f8.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion f4f4f2e715.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation b0b56a92786831c7512288ff06c7691b61290eb97959dbe7fcab9daeda0cf442.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation skotes.exe -
Executes dropped EXE 8 IoCs
pid Process 320 skotes.exe 3812 4aef4e06f8.exe 2992 ccf1b06858.exe 2712 1e9bb0a28b.exe 4100 35bd31e606.exe 2012 f4f4f2e715.exe 1376 skotes.exe 5876 skotes.exe -
Identifies Wine through registry keys 2 TTPs 8 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Wine 35bd31e606.exe Key opened \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Wine f4f4f2e715.exe Key opened \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Wine skotes.exe Key opened \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Wine skotes.exe Key opened \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Wine b0b56a92786831c7512288ff06c7691b61290eb97959dbe7fcab9daeda0cf442.exe Key opened \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Wine skotes.exe Key opened \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Wine 4aef4e06f8.exe Key opened \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Wine ccf1b06858.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" 35bd31e606.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features 35bd31e606.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\4aef4e06f8.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1013596001\\4aef4e06f8.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ccf1b06858.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1013597001\\ccf1b06858.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\1e9bb0a28b.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1013598001\\1e9bb0a28b.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\35bd31e606.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1013599001\\35bd31e606.exe" skotes.exe -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/files/0x000a000000023c0b-71.dat autoit_exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs
pid Process 1724 b0b56a92786831c7512288ff06c7691b61290eb97959dbe7fcab9daeda0cf442.exe 320 skotes.exe 3812 4aef4e06f8.exe 2992 ccf1b06858.exe 4100 35bd31e606.exe 2012 f4f4f2e715.exe 1376 skotes.exe 5876 skotes.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\skotes.job b0b56a92786831c7512288ff06c7691b61290eb97959dbe7fcab9daeda0cf442.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
pid pid_target Process procid_target 3912 3812 WerFault.exe 84 5748 2012 WerFault.exe 117 -
System Location Discovery: System Language Discovery 1 TTPs 14 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b0b56a92786831c7512288ff06c7691b61290eb97959dbe7fcab9daeda0cf442.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language skotes.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4aef4e06f8.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ccf1b06858.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage 1e9bb0a28b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f4f4f2e715.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1e9bb0a28b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language 1e9bb0a28b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 35bd31e606.exe -
Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe -
Kills process with taskkill 5 IoCs
pid Process 380 taskkill.exe 4720 taskkill.exe 2544 taskkill.exe 4448 taskkill.exe 3116 taskkill.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings firefox.exe -
Suspicious behavior: EnumeratesProcesses 23 IoCs
pid Process 1724 b0b56a92786831c7512288ff06c7691b61290eb97959dbe7fcab9daeda0cf442.exe 1724 b0b56a92786831c7512288ff06c7691b61290eb97959dbe7fcab9daeda0cf442.exe 320 skotes.exe 320 skotes.exe 3812 4aef4e06f8.exe 3812 4aef4e06f8.exe 2992 ccf1b06858.exe 2992 ccf1b06858.exe 2712 1e9bb0a28b.exe 2712 1e9bb0a28b.exe 4100 35bd31e606.exe 4100 35bd31e606.exe 2712 1e9bb0a28b.exe 2712 1e9bb0a28b.exe 4100 35bd31e606.exe 4100 35bd31e606.exe 4100 35bd31e606.exe 2012 f4f4f2e715.exe 2012 f4f4f2e715.exe 1376 skotes.exe 1376 skotes.exe 5876 skotes.exe 5876 skotes.exe -
Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeDebugPrivilege 380 taskkill.exe Token: SeDebugPrivilege 4720 taskkill.exe Token: SeDebugPrivilege 2544 taskkill.exe Token: SeDebugPrivilege 4448 taskkill.exe Token: SeDebugPrivilege 3116 taskkill.exe Token: SeDebugPrivilege 4484 firefox.exe Token: SeDebugPrivilege 4484 firefox.exe Token: SeDebugPrivilege 4100 35bd31e606.exe Token: SeDebugPrivilege 4484 firefox.exe Token: SeDebugPrivilege 4484 firefox.exe Token: SeDebugPrivilege 4484 firefox.exe -
Suspicious use of FindShellTrayWindow 33 IoCs
pid Process 1724 b0b56a92786831c7512288ff06c7691b61290eb97959dbe7fcab9daeda0cf442.exe 2712 1e9bb0a28b.exe 2712 1e9bb0a28b.exe 2712 1e9bb0a28b.exe 2712 1e9bb0a28b.exe 2712 1e9bb0a28b.exe 2712 1e9bb0a28b.exe 2712 1e9bb0a28b.exe 4484 firefox.exe 4484 firefox.exe 4484 firefox.exe 4484 firefox.exe 4484 firefox.exe 4484 firefox.exe 4484 firefox.exe 4484 firefox.exe 4484 firefox.exe 4484 firefox.exe 4484 firefox.exe 4484 firefox.exe 4484 firefox.exe 4484 firefox.exe 4484 firefox.exe 4484 firefox.exe 4484 firefox.exe 4484 firefox.exe 4484 firefox.exe 4484 firefox.exe 4484 firefox.exe 2712 1e9bb0a28b.exe 2712 1e9bb0a28b.exe 2712 1e9bb0a28b.exe 2712 1e9bb0a28b.exe -
Suspicious use of SendNotifyMessage 31 IoCs
pid Process 2712 1e9bb0a28b.exe 2712 1e9bb0a28b.exe 2712 1e9bb0a28b.exe 2712 1e9bb0a28b.exe 2712 1e9bb0a28b.exe 2712 1e9bb0a28b.exe 2712 1e9bb0a28b.exe 4484 firefox.exe 4484 firefox.exe 4484 firefox.exe 4484 firefox.exe 4484 firefox.exe 4484 firefox.exe 4484 firefox.exe 4484 firefox.exe 4484 firefox.exe 4484 firefox.exe 4484 firefox.exe 4484 firefox.exe 4484 firefox.exe 4484 firefox.exe 4484 firefox.exe 4484 firefox.exe 4484 firefox.exe 4484 firefox.exe 4484 firefox.exe 4484 firefox.exe 2712 1e9bb0a28b.exe 2712 1e9bb0a28b.exe 2712 1e9bb0a28b.exe 2712 1e9bb0a28b.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4484 firefox.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1724 wrote to memory of 320 1724 b0b56a92786831c7512288ff06c7691b61290eb97959dbe7fcab9daeda0cf442.exe 83 PID 1724 wrote to memory of 320 1724 b0b56a92786831c7512288ff06c7691b61290eb97959dbe7fcab9daeda0cf442.exe 83 PID 1724 wrote to memory of 320 1724 b0b56a92786831c7512288ff06c7691b61290eb97959dbe7fcab9daeda0cf442.exe 83 PID 320 wrote to memory of 3812 320 skotes.exe 84 PID 320 wrote to memory of 3812 320 skotes.exe 84 PID 320 wrote to memory of 3812 320 skotes.exe 84 PID 320 wrote to memory of 2992 320 skotes.exe 92 PID 320 wrote to memory of 2992 320 skotes.exe 92 PID 320 wrote to memory of 2992 320 skotes.exe 92 PID 320 wrote to memory of 2712 320 skotes.exe 93 PID 320 wrote to memory of 2712 320 skotes.exe 93 PID 320 wrote to memory of 2712 320 skotes.exe 93 PID 2712 wrote to memory of 380 2712 1e9bb0a28b.exe 95 PID 2712 wrote to memory of 380 2712 1e9bb0a28b.exe 95 PID 2712 wrote to memory of 380 2712 1e9bb0a28b.exe 95 PID 2712 wrote to memory of 4720 2712 1e9bb0a28b.exe 97 PID 2712 wrote to memory of 4720 2712 1e9bb0a28b.exe 97 PID 2712 wrote to memory of 4720 2712 1e9bb0a28b.exe 97 PID 2712 wrote to memory of 2544 2712 1e9bb0a28b.exe 99 PID 2712 wrote to memory of 2544 2712 1e9bb0a28b.exe 99 PID 2712 wrote to memory of 2544 2712 1e9bb0a28b.exe 99 PID 2712 wrote to memory of 4448 2712 1e9bb0a28b.exe 101 PID 2712 wrote to memory of 4448 2712 1e9bb0a28b.exe 101 PID 2712 wrote to memory of 4448 2712 1e9bb0a28b.exe 101 PID 2712 wrote to memory of 3116 2712 1e9bb0a28b.exe 103 PID 2712 wrote to memory of 3116 2712 1e9bb0a28b.exe 103 PID 2712 wrote to memory of 3116 2712 1e9bb0a28b.exe 103 PID 2712 wrote to memory of 4852 2712 1e9bb0a28b.exe 105 PID 2712 wrote to memory of 4852 2712 1e9bb0a28b.exe 105 PID 4852 wrote to memory of 4484 4852 firefox.exe 106 PID 4852 wrote to memory of 4484 4852 firefox.exe 106 PID 4852 wrote to memory of 4484 4852 firefox.exe 106 PID 4852 wrote to memory of 4484 4852 firefox.exe 106 PID 4852 wrote to memory of 4484 4852 firefox.exe 106 PID 4852 wrote to memory of 4484 4852 firefox.exe 106 PID 4852 wrote to memory of 4484 4852 firefox.exe 106 PID 4852 wrote to memory of 4484 4852 firefox.exe 106 PID 4852 wrote to memory of 4484 4852 firefox.exe 106 PID 4852 wrote to memory of 4484 4852 firefox.exe 106 PID 4852 wrote to memory of 4484 4852 firefox.exe 106 PID 4484 wrote to memory of 548 4484 firefox.exe 107 PID 4484 wrote to memory of 548 4484 firefox.exe 107 PID 4484 wrote to memory of 548 4484 firefox.exe 107 PID 4484 wrote to memory of 548 4484 firefox.exe 107 PID 4484 wrote to memory of 548 4484 firefox.exe 107 PID 4484 wrote to memory of 548 4484 firefox.exe 107 PID 4484 wrote to memory of 548 4484 firefox.exe 107 PID 4484 wrote to memory of 548 4484 firefox.exe 107 PID 4484 wrote to memory of 548 4484 firefox.exe 107 PID 4484 wrote to memory of 548 4484 firefox.exe 107 PID 4484 wrote to memory of 548 4484 firefox.exe 107 PID 4484 wrote to memory of 548 4484 firefox.exe 107 PID 4484 wrote to memory of 548 4484 firefox.exe 107 PID 4484 wrote to memory of 548 4484 firefox.exe 107 PID 4484 wrote to memory of 548 4484 firefox.exe 107 PID 4484 wrote to memory of 548 4484 firefox.exe 107 PID 4484 wrote to memory of 548 4484 firefox.exe 107 PID 4484 wrote to memory of 548 4484 firefox.exe 107 PID 4484 wrote to memory of 548 4484 firefox.exe 107 PID 4484 wrote to memory of 548 4484 firefox.exe 107 PID 4484 wrote to memory of 548 4484 firefox.exe 107 PID 4484 wrote to memory of 548 4484 firefox.exe 107 PID 4484 wrote to memory of 548 4484 firefox.exe 107 PID 4484 wrote to memory of 548 4484 firefox.exe 107 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\b0b56a92786831c7512288ff06c7691b61290eb97959dbe7fcab9daeda0cf442.exe"C:\Users\Admin\AppData\Local\Temp\b0b56a92786831c7512288ff06c7691b61290eb97959dbe7fcab9daeda0cf442.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:320 -
C:\Users\Admin\AppData\Local\Temp\1013596001\4aef4e06f8.exe"C:\Users\Admin\AppData\Local\Temp\1013596001\4aef4e06f8.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3812 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3812 -s 13804⤵
- Program crash
PID:3912
-
-
-
C:\Users\Admin\AppData\Local\Temp\1013597001\ccf1b06858.exe"C:\Users\Admin\AppData\Local\Temp\1013597001\ccf1b06858.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2992
-
-
C:\Users\Admin\AppData\Local\Temp\1013598001\1e9bb0a28b.exe"C:\Users\Admin\AppData\Local\Temp\1013598001\1e9bb0a28b.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM firefox.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:380
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM chrome.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4720
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM msedge.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2544
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM opera.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4448
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM brave.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3116
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking4⤵
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking5⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2016 -parentBuildID 20240401114208 -prefsHandle 1940 -prefMapHandle 1932 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2fa9157f-b2fa-48fc-860e-83f3837efd91} 4484 "\\.\pipe\gecko-crash-server-pipe.4484" gpu6⤵PID:548
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2468 -parentBuildID 20240401114208 -prefsHandle 2460 -prefMapHandle 2456 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1280a34d-62e3-4e9b-b4cb-fe113be78858} 4484 "\\.\pipe\gecko-crash-server-pipe.4484" socket6⤵PID:2016
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1396 -childID 1 -isForBrowser -prefsHandle 3128 -prefMapHandle 3236 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1132 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {534c63be-7752-4531-9847-62502129248a} 4484 "\\.\pipe\gecko-crash-server-pipe.4484" tab6⤵PID:4760
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4140 -childID 2 -isForBrowser -prefsHandle 4132 -prefMapHandle 4128 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1132 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {986b69c5-c9db-4830-9a54-3524f540bfd1} 4484 "\\.\pipe\gecko-crash-server-pipe.4484" tab6⤵PID:3280
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4740 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4780 -prefMapHandle 4776 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {446ae0a6-aea6-4d77-8795-ece2063a6648} 4484 "\\.\pipe\gecko-crash-server-pipe.4484" utility6⤵
- Checks processor information in registry
PID:3608
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5172 -childID 3 -isForBrowser -prefsHandle 5152 -prefMapHandle 5160 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1132 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {89d68402-3ef7-4004-a070-33d27774e607} 4484 "\\.\pipe\gecko-crash-server-pipe.4484" tab6⤵PID:2556
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5392 -childID 4 -isForBrowser -prefsHandle 5312 -prefMapHandle 5316 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1132 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {70dd875b-e227-4878-b09b-2d685ced4f57} 4484 "\\.\pipe\gecko-crash-server-pipe.4484" tab6⤵PID:2064
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5584 -childID 5 -isForBrowser -prefsHandle 5504 -prefMapHandle 5508 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1132 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0095bf13-37bb-4a25-9ef5-1cb15a7f68ef} 4484 "\\.\pipe\gecko-crash-server-pipe.4484" tab6⤵PID:1080
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1013599001\35bd31e606.exe"C:\Users\Admin\AppData\Local\Temp\1013599001\35bd31e606.exe"3⤵
- Modifies Windows Defender Real-time Protection settings
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Windows security modification
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4100
-
-
C:\Users\Admin\AppData\Local\Temp\1013600001\f4f4f2e715.exe"C:\Users\Admin\AppData\Local\Temp\1013600001\f4f4f2e715.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2012 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2012 -s 6444⤵
- Program crash
PID:5748
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3812 -ip 38121⤵PID:4236
-
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exeC:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1376
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 2012 -ip 20121⤵PID:5712
-
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exeC:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5876
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Impair Defenses
2Disable or Modify Tools
2Modify Registry
3Virtualization/Sandbox Evasion
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1B
MD5cfcd208495d565ef66e7dff9f98764da
SHA1b6589fc6ab0dc82cf12099d1c2d40ab994e8410c
SHA2565feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
SHA51231bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\activity-stream.discovery_stream.json
Filesize27KB
MD555f7d51e604714d606e3e36b76d0800c
SHA1bf75e9f4b7d25f9ac2e74ec8196ff0eebe44d449
SHA256abdd04d09d3f796ea5b8fd3d94f5c64867f0ff87dc641a258c35dd1d534625fe
SHA512b6b8d556b7c769aa538839d27a3bdbc51fd6c4b09517f0103c1bde61cb0a1f1baa553d9c7a7919681df65710dede8d6633b0d7a227d4af27e02a86d9df731c47
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\cache2\entries\92F4D5A4F9CED6E2E644D803AEE3647A0EA4D984
Filesize13KB
MD5912378afb4b4e8ab6d10a4047f5deef0
SHA1e5f6d4c201b80efa088e64344d05609d8d87e6a5
SHA256eea169630b8b55efd360ba52eb22e2e0f16faf52c5130cda6613f84aa8a1d6b6
SHA512178fb0c0ede021ea0e27e5ef64ecd7fa1da6a56b74f097077ff7515537e4f3b245aea21814aff0d3c2cdcd7b84084a96af186f2415697ce46f064ab6fc6911e8
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
Filesize15KB
MD596c542dec016d9ec1ecc4dddfcbaac66
SHA16199f7648bb744efa58acf7b96fee85d938389e4
SHA2567f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798
SHA512cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658
-
Filesize
1.8MB
MD5430241ea54c659cd093cbf48a09f8324
SHA1b9c512490e4f96ad0851fae682719a51bd3088a6
SHA25688cf30a71ad167f40a9bf9b1cc7b8b68429c712bfda9afa3d495345394c3a76b
SHA5123dfde3ebab2d5f34d1d8a50b014dcb1ce15e3eb3eddfd7e3df5c4bc9ba533b510fd5e04f074d5bb68cf0608c91c1e8b223a4819c88a67f612c4eb0701055d739
-
Filesize
1.7MB
MD59083cdf00ff3295432676d6ee4c6c9f4
SHA12f83025aaf303478fb07cf9fd9630ca3874e6163
SHA25622a7b5fc61cf54485bd374a221386b1c2675f7eb4b1428677ff86b3add14238e
SHA512b1a3bd15d30dc60e6aa3bd027e39be463a7f026815f66b84a44bc93cb1b89e42211b5352b5cc44e2e46c7fa9f43f6d888c9678fa6cbe7679e2d8f1be35d8d942
-
Filesize
949KB
MD5b5811acb833a790513d5baab884cf1f7
SHA1a0b5690a5cbc8dfec6a0f6355ca3c4cc4890efc7
SHA25665378c55edffc59d371243cc8bb2f44def33e5f317993032189eb31b4ecf02bf
SHA5129668f726715d489acb1c57440ffa6c4bab4acb352c6f3f67115e2ec6b1e0b4d00ba4e41b062d596a872eea20e9f4702b2579c1a91c11e388fb9207b5f7c7db21
-
Filesize
2.7MB
MD554ac54d599adabb8aa9403177cdb635c
SHA1031afc5a647a7bd0379f277b819a35137a00fc79
SHA2567bd295999c86a6d00f670bee17c926ebddf85a7de84a93d9f944363bc3de96ee
SHA5120d92aa49fb0cbe67969604d8d1c09cc32d39c093d7f19a1d21cf0bd4a17cf6c8a80f28575c07995c573410e810625bdddd39e2e851aaea8b255c42dd3222d311
-
Filesize
1.9MB
MD5054b1e771a301c1e792397a683ed0a90
SHA1eb209469e0b66a485b135012cf43538ceb9dc96c
SHA2566b2391a7841833a3524f5034b7287e55f4c8fbec8678ecf7a6040ada9c07fde1
SHA51223317dcaf76cc1a9dc6c3dc5e551c88905163625617abc7aa389255dd17ee9ca330303521fabfb91c3a33bf1c2a650f2935a7a047eadf1814ea60e2ec387275e
-
Filesize
3.1MB
MD59616371054857f390d2a2cefeb6fb9ea
SHA1e1b0ffc6f19b81ecd8552483986570a0acafe576
SHA256b0b56a92786831c7512288ff06c7691b61290eb97959dbe7fcab9daeda0cf442
SHA5121cefd75f8f84a5bdc2af9225f034a4cc9067287f674a64495f534f910d39ca45738a4736d650c5cb99824bce4ca9b3ff0371bc7f66651e525aa79e13103139a5
-
Filesize
479KB
MD509372174e83dbbf696ee732fd2e875bb
SHA1ba360186ba650a769f9303f48b7200fb5eaccee1
SHA256c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
SHA512b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
-
Filesize
13.8MB
MD50a8747a2ac9ac08ae9508f36c6d75692
SHA1b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA25632d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
SHA51259521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\AlternateServices.bin
Filesize6KB
MD59535103e4f8de0e528670ba60dc20053
SHA1f76caf28d899e8cbc90d29e1f02e723ee1bcbf39
SHA2568bf4763648e7de7b4a57f6f1e69ae45e6e50766ed699623b83f51b6a47663db9
SHA512b18326dcc5a80973b4137de4680b28799a06019934144717fddd826d4d9f32b004c69d0b9208ffe1c838188b0998d2208818a5ab4b958df361c4437fc1a36188
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\AlternateServices.bin
Filesize8KB
MD5028abd58ef4abd5a1c9f33d6ea87e1a0
SHA1157172854e4eb16055196e68937c47a3f02acf94
SHA2564c960b02b5d06a20b8008db1a013c87e6fb87f20967e7427164632501b06287e
SHA5120c04e1ca1859bdba8bea45a3c34af4f2c8364d43819ee70404469dac322ab2aafc0243de403c4f42b78025c307bb416656022e9dbbb6305c5f0fc9fe8082f84c
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\AlternateServices.bin
Filesize18KB
MD53372822eaeb9417625380741221e5e3d
SHA177af7397b5dab9870a7e63230ebc6523130e6136
SHA256c7601cee1299e5285bd109934095d70bf31ea4b52ef3524c782339fda251b9b9
SHA51212ecc4d5317c5c2e7fa15ebd0397dbfed2b56cd0195797689256b3ba30fbba3923236c0e8f0dcefa769296dd4506d78e1091c56bdb2333b73589d147d463fbca
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\db\data.safe.tmp
Filesize22KB
MD59465de705c3c27ee3d105b17bdffefb5
SHA10e5270439872ca9f9213787293135ddff4c5a90d
SHA256cb31ff90f07549ce0cb7bd693890afd916c5cd8ff29e2c8adeef6d123c84e0a2
SHA51266f9e34208844f6e6046e843efd0fe5186c0f03c2016da04b6b76cb863e8da1a30eb9f50f9e5605827717685fe2405628d22a6b73dbbb3d5915459117a22f0c7
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\db\data.safe.tmp
Filesize23KB
MD5527e99af0e3f6ec0a6f5291e7c5db81b
SHA180e5496aa8c8d43d0093e7f65a86c01ac6198098
SHA2562ac067d408f61a506be3d27883ef6469ed71623ded8e33725538cb9ce4539964
SHA51246ec259be33c1db1877bd18e77c39e859e78b6407606312b210e5d4b3dcd559b1524b8d7cc68515326a7885786dad769139e961ff8ded22e61ec26f07b3248d8
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\db\data.safe.tmp
Filesize25KB
MD51f8a37868f8d80806879e015306bf7e1
SHA133d35aa3d03dd0bb0b50bd519ec3fec535b54385
SHA2561c5f12a2ea01fd085c5c1d49358ed8627e7a144b21fb79c1efd66e080ce76d35
SHA5120460f340975c8129722085f69da83adf4c62ce2cf51e28ad9c110767da5f9b3d9078fd33951c7c26646987108bf63c16b30bdbe0e88aa9b031349cfe2bae5c49
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\db\data.safe.tmp
Filesize25KB
MD508fa58bceaa1d934f048eba3468b449f
SHA1c8eb995bd2b515b599748d97a3e56c3ca9d86457
SHA2567427612c83aed5186cc011b9cdb2f999c84aac6c2799f9facb6c81690ce573ba
SHA512b2f01b909aed7b0556dfd985ec81f2efa265cac6d35487317d77c66d8a4c4bdc54ac56ef3a7724cbfe16eccdd224c907be6b2c4ecfd03d621e584ea4fd443f4c
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\db\data.safe.tmp
Filesize23KB
MD5c6b557eb38bdd9a5f83da18c8bbd2a5d
SHA1bb2cff6d8426224eaa7d76046676cfff57f8e83b
SHA256b26f83c0265114d93d28de4e9053893d750aff29ae5330aa28041af36208bc36
SHA512dc90a116cc93dc093002f3dc73c87509a66f2992a01b9057a3105565d1e6c80b2ad69c0a8b38983119bfa78af6b73add64f040ae921998ebe186131bd4e59af2
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\pending_pings\5a5b2fc6-f9c7-4ee5-a63f-17e2309864ea
Filesize659B
MD59414809d71c47c162401856e4d1224ab
SHA1003d678318ba0bc07dd015cb3267bf6b460faaee
SHA2563b5477b22b838e34476f69d931e9a71d734d53758649cb1096e718a4e58d217d
SHA512000a9bb7abbcfa4c4683363dff08549f9f2e0de53b3a2719ce133b45ff1461a2a5bd54ca74c875ceed68d066a0e282c82ea934e2094761cef08bb4f4ff4e155b
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\pending_pings\602794e8-4d02-4f13-806b-6e2ff3961e7c
Filesize982B
MD5d1f636cbc967ab02c7753372b7f11d6d
SHA12840a15d1680ecc8e7ca1edd71399fbf3fa0c017
SHA256a223daa38ff73ddf1a057853e3515908b43e3792ef5d788411826671cc80e33e
SHA512b2847c469e6293096376e3f5b3cd0a5ea861e920766324f9cce182da58fa2172681ebb2b3eda661c1e7b85c6bf0cfd6b00941e2d2b40a331b4af2376c9e5f1bb
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Filesize1.1MB
MD5842039753bf41fa5e11b3a1383061a87
SHA13e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA256d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
SHA512d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Filesize116B
MD52a461e9eb87fd1955cea740a3444ee7a
SHA1b10755914c713f5a4677494dbe8a686ed458c3c5
SHA2564107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
SHA51234f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Filesize372B
MD5bf957ad58b55f64219ab3f793e374316
SHA1a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA256bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
SHA51279c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Filesize17.8MB
MD5daf7ef3acccab478aaa7d6dc1c60f865
SHA1f8246162b97ce4a945feced27b6ea114366ff2ad
SHA256bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
SHA5125840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
-
Filesize
12KB
MD51aeb13e83ad3554099049f5322a60552
SHA1bcbcda687b2fa31b5f12fe293e30755b98f4c9c5
SHA256a4e11bcb4d30799adb8ed5a532d1b95359f4bfbc93868b9ec7de4d01734bdcd9
SHA512cc8854a103dc5defd2a075e363f6fff5cd48d7c5de4dc0723d65c91b92af2039f1cf5af23d9dd5e92998d029e77e3c69730aa081385c29ec0191ca30629c7af6
-
Filesize
10KB
MD5aa71d10695be988c7aee263b4fa4c149
SHA1229c2b2d37563c1f0b9ded2931c565fbc2382e31
SHA25669f185f803b16d0aeeb521f4b6f95b235d41d3cab9dcaaa2c39bbaa3a831bd9c
SHA512543a134a1866b9aa8db34a6861620b7da5bfac734703b08b9af095faae1cc58aa9dc1f892ca3cea018cacceba34030092f5c418fdb308a6cdeb870b8a5665877
-
Filesize
15KB
MD5c945d12c02c74d9894db5b6833a8f4f1
SHA1d58174874e7153829a07f44c4ee468140740433f
SHA256ba07369a8c69620bdeb1e4351ec9194ad242d7b06ca42605ad0bf58a455567b7
SHA512fdc942f788dcee1c7282294e66a920c5921591af7b8338489fb7f91c52339c231a88957d4c3e66b099e90c56f21268aa0197184c9b1771b4bc727d45b98a4a74
-
Filesize
10KB
MD5929685579eef45ff6441c54e0921984e
SHA162a204a81bd48e80dc268ea50b147eca8c908dd6
SHA2569b0334f0794d1b33ca5ed80a38f1dc0c3d0a454e596161a17e678d271f0dc7ab
SHA512764ecc7e1904117a98f6071e23950bf8300f0bdfb31bc0dca23af73654d67570777e5d11f52a10e0d545937e5e97b10a9d8208c0e002dd538e3212facdbbe657