Analysis
-
max time kernel
105s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
12-12-2024 22:49
Static task
static1
General
-
Target
file.exe
-
Size
3.1MB
-
MD5
3197aa29fd7d023f4483200e06a95d7a
-
SHA1
62cd61a0004ef666d0d6427c42c8a6ec7b30617c
-
SHA256
ac7eab26629e889c428293f303b428424ffccae5658636cca54512753fa2792a
-
SHA512
7379939f14ce763a9726638f6b694e0a84dbc80a2128db6e58224e2db432ad242cfc04e2576ffd462e1c75836141310cfd0ac751245061170d041b211e528637
-
SSDEEP
49152:of5+2z7fYXSXFA0R8kTiglrFF852feG2ezYVW5es:o5fYXSXm0RbTiglv852XZzeW5e
Malware Config
Extracted
amadey
4.42
9c9aa5
http://185.215.113.43
-
install_dir
abc3bc1985
-
install_file
skotes.exe
-
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
-
url_paths
/Zu7JuNko/index.php
Extracted
stealc
stok
http://185.215.113.206
-
url_path
/c4becf79229cb002.php
Extracted
lumma
https://drive-connect.cyou/api
https://covery-mover.biz/api
Signatures
-
Amadey family
-
Gcleaner family
-
Lumma family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 24adda8406.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" 24adda8406.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 24adda8406.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 24adda8406.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 24adda8406.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection 24adda8406.exe -
Stealc family
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 4468 created 3420 4468 CuKxXX0.exe 56 -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ be07f52020.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 24adda8406.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ file.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ c53422928e.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 12 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion file.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion file.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion c53422928e.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion c53422928e.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion be07f52020.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 24adda8406.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion be07f52020.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 24adda8406.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe -
Checks computer location settings 2 TTPs 5 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation file.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation skotes.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation CuKxXX0.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation 02fd456b06.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation 0c7ebd51f8.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindosCPUsystem.vbs CuKxXX0.exe -
Executes dropped EXE 21 IoCs
pid Process 5104 skotes.exe 4468 CuKxXX0.exe 4260 c53422928e.exe 2368 02fd456b06.exe 4388 7z.exe 4368 7z.exe 4144 7z.exe 4572 7z.exe 4968 aebbf5afb2.exe 2340 7z.exe 1992 7z.exe 624 7z.exe 5108 7z.exe 880 in.exe 3084 aebbf5afb2.exe 4024 04a802c413.exe 760 be07f52020.exe 2428 24adda8406.exe 6424 0c7ebd51f8.exe 6764 skotes.exe 7012 Intel_PTT_EK_Recertification.exe -
Identifies Wine through registry keys 2 TTPs 6 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Wine skotes.exe Key opened \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Wine c53422928e.exe Key opened \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Wine be07f52020.exe Key opened \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Wine 24adda8406.exe Key opened \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Wine skotes.exe Key opened \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Wine file.exe -
Loads dropped DLL 8 IoCs
pid Process 4388 7z.exe 4368 7z.exe 4144 7z.exe 4572 7z.exe 2340 7z.exe 1992 7z.exe 624 7z.exe 5108 7z.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features 24adda8406.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" 24adda8406.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\04a802c413.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1014553001\\04a802c413.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\be07f52020.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1014554001\\be07f52020.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\24adda8406.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1014555001\\24adda8406.exe" skotes.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/files/0x0009000000023cfe-1383.dat autoit_exe -
pid Process 5216 powershell.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
pid Process 2496 file.exe 5104 skotes.exe 4260 c53422928e.exe 760 be07f52020.exe 2428 24adda8406.exe 6764 skotes.exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 4968 set thread context of 3084 4968 aebbf5afb2.exe 126 PID 4468 set thread context of 5528 4468 CuKxXX0.exe 159 PID 7012 set thread context of 7032 7012 Intel_PTT_EK_Recertification.exe 190 PID 5528 set thread context of 6276 5528 MSBuild.exe 201 -
resource yara_rule behavioral2/memory/880-1363-0x00007FF71CD30000-0x00007FF71D1C0000-memory.dmp upx behavioral2/memory/880-1361-0x00007FF71CD30000-0x00007FF71D1C0000-memory.dmp upx behavioral2/files/0x0007000000023d0d-1359.dat upx behavioral2/memory/7012-1956-0x00007FF728E40000-0x00007FF7292D0000-memory.dmp upx behavioral2/memory/7012-1970-0x00007FF728E40000-0x00007FF7292D0000-memory.dmp upx behavioral2/memory/7164-4961-0x00007FF654230000-0x00007FF6546C0000-memory.dmp upx behavioral2/memory/7164-4999-0x00007FF654230000-0x00007FF6546C0000-memory.dmp upx -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\skotes.job file.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
pid pid_target Process procid_target 6700 6424 WerFault.exe 184 6936 4260 WerFault.exe 97 -
System Location Discovery: System Language Discovery 1 TTPs 19 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language aebbf5afb2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 02fd456b06.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language be07f52020.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 04a802c413.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language 04a802c413.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage 04a802c413.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c53422928e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language skotes.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language aebbf5afb2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 24adda8406.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0c7ebd51f8.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language file.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 6 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 6708 PING.EXE 2348 powershell.exe 2392 PING.EXE 7084 powershell.exe 5660 PING.EXE 7104 powershell.exe -
Checks processor information in registry 2 TTPs 10 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 0c7ebd51f8.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 0c7ebd51f8.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 6500 timeout.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 4756 ipconfig.exe 5908 ipconfig.exe -
Kills process with taskkill 5 IoCs
pid Process 3812 taskkill.exe 392 taskkill.exe 1536 taskkill.exe 3536 taskkill.exe 3528 taskkill.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings firefox.exe -
Runs ping.exe 1 TTPs 3 IoCs
pid Process 2392 PING.EXE 5660 PING.EXE 6708 PING.EXE -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2252 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2496 file.exe 2496 file.exe 5104 skotes.exe 5104 skotes.exe 4260 c53422928e.exe 4260 c53422928e.exe 4468 CuKxXX0.exe 4468 CuKxXX0.exe 4468 CuKxXX0.exe 2348 powershell.exe 2348 powershell.exe 2348 powershell.exe 4760 powershell.exe 4760 powershell.exe 4760 powershell.exe 4024 04a802c413.exe 4024 04a802c413.exe 760 be07f52020.exe 760 be07f52020.exe 4468 CuKxXX0.exe 4468 CuKxXX0.exe 5216 powershell.exe 5216 powershell.exe 4468 CuKxXX0.exe 5216 powershell.exe 4024 04a802c413.exe 4024 04a802c413.exe 3276 msedge.exe 3276 msedge.exe 3216 msedge.exe 3216 msedge.exe 2428 24adda8406.exe 2428 24adda8406.exe 4548 identity_helper.exe 4548 identity_helper.exe 2428 24adda8406.exe 2428 24adda8406.exe 2428 24adda8406.exe 6764 skotes.exe 6764 skotes.exe 7012 Intel_PTT_EK_Recertification.exe 6424 0c7ebd51f8.exe 6424 0c7ebd51f8.exe 7084 powershell.exe 7084 powershell.exe 7084 powershell.exe 5528 MSBuild.exe 6276 explorer.exe 6276 explorer.exe 6276 explorer.exe 6276 explorer.exe 6276 explorer.exe 6276 explorer.exe 6276 explorer.exe 6276 explorer.exe 6276 explorer.exe 6276 explorer.exe 6276 explorer.exe 6276 explorer.exe 6276 explorer.exe 6276 explorer.exe 6276 explorer.exe 6276 explorer.exe 6276 explorer.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 3216 msedge.exe 3216 msedge.exe 3216 msedge.exe 3216 msedge.exe 3216 msedge.exe 3216 msedge.exe 3216 msedge.exe -
Suspicious use of AdjustPrivilegeToken 49 IoCs
description pid Process Token: SeDebugPrivilege 4468 CuKxXX0.exe Token: SeRestorePrivilege 4388 7z.exe Token: 35 4388 7z.exe Token: SeSecurityPrivilege 4388 7z.exe Token: SeSecurityPrivilege 4388 7z.exe Token: SeRestorePrivilege 4368 7z.exe Token: 35 4368 7z.exe Token: SeSecurityPrivilege 4368 7z.exe Token: SeSecurityPrivilege 4368 7z.exe Token: SeRestorePrivilege 4144 7z.exe Token: 35 4144 7z.exe Token: SeSecurityPrivilege 4144 7z.exe Token: SeSecurityPrivilege 4144 7z.exe Token: SeRestorePrivilege 4572 7z.exe Token: 35 4572 7z.exe Token: SeSecurityPrivilege 4572 7z.exe Token: SeSecurityPrivilege 4572 7z.exe Token: SeRestorePrivilege 2340 7z.exe Token: 35 2340 7z.exe Token: SeSecurityPrivilege 2340 7z.exe Token: SeSecurityPrivilege 2340 7z.exe Token: SeRestorePrivilege 1992 7z.exe Token: 35 1992 7z.exe Token: SeSecurityPrivilege 1992 7z.exe Token: SeSecurityPrivilege 1992 7z.exe Token: SeRestorePrivilege 624 7z.exe Token: 35 624 7z.exe Token: SeSecurityPrivilege 624 7z.exe Token: SeSecurityPrivilege 624 7z.exe Token: SeRestorePrivilege 5108 7z.exe Token: 35 5108 7z.exe Token: SeSecurityPrivilege 5108 7z.exe Token: SeSecurityPrivilege 5108 7z.exe Token: SeDebugPrivilege 2348 powershell.exe Token: SeDebugPrivilege 3812 taskkill.exe Token: SeDebugPrivilege 4760 powershell.exe Token: SeDebugPrivilege 392 taskkill.exe Token: SeDebugPrivilege 1536 taskkill.exe Token: SeDebugPrivilege 3536 taskkill.exe Token: SeDebugPrivilege 3528 taskkill.exe Token: SeDebugPrivilege 3304 firefox.exe Token: SeDebugPrivilege 3304 firefox.exe Token: SeDebugPrivilege 4468 CuKxXX0.exe Token: SeDebugPrivilege 5216 powershell.exe Token: SeDebugPrivilege 2428 24adda8406.exe Token: SeLockMemoryPrivilege 7032 explorer.exe Token: SeDebugPrivilege 7084 powershell.exe Token: SeLockMemoryPrivilege 6276 explorer.exe Token: SeLockMemoryPrivilege 6276 explorer.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2496 file.exe 4024 04a802c413.exe 4024 04a802c413.exe 4024 04a802c413.exe 4024 04a802c413.exe 4024 04a802c413.exe 4024 04a802c413.exe 4024 04a802c413.exe 3304 firefox.exe 3304 firefox.exe 3304 firefox.exe 3304 firefox.exe 3304 firefox.exe 3304 firefox.exe 3304 firefox.exe 3304 firefox.exe 3304 firefox.exe 3304 firefox.exe 3304 firefox.exe 3304 firefox.exe 3304 firefox.exe 3304 firefox.exe 3304 firefox.exe 3304 firefox.exe 3304 firefox.exe 3304 firefox.exe 3304 firefox.exe 3304 firefox.exe 3304 firefox.exe 4024 04a802c413.exe 4024 04a802c413.exe 4024 04a802c413.exe 3216 msedge.exe 3216 msedge.exe 3216 msedge.exe 3216 msedge.exe 3216 msedge.exe 3216 msedge.exe 3216 msedge.exe 3216 msedge.exe 3216 msedge.exe 3216 msedge.exe 3216 msedge.exe 3216 msedge.exe 3216 msedge.exe 3216 msedge.exe 3216 msedge.exe 3216 msedge.exe 3216 msedge.exe 3216 msedge.exe 3216 msedge.exe 3216 msedge.exe 3216 msedge.exe 3216 msedge.exe 3216 msedge.exe 3216 msedge.exe 3216 msedge.exe 6276 explorer.exe 6276 explorer.exe 6276 explorer.exe 6276 explorer.exe 6276 explorer.exe 6276 explorer.exe 6276 explorer.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4024 04a802c413.exe 4024 04a802c413.exe 4024 04a802c413.exe 4024 04a802c413.exe 4024 04a802c413.exe 4024 04a802c413.exe 4024 04a802c413.exe 3304 firefox.exe 3304 firefox.exe 3304 firefox.exe 3304 firefox.exe 3304 firefox.exe 3304 firefox.exe 3304 firefox.exe 3304 firefox.exe 3304 firefox.exe 3304 firefox.exe 3304 firefox.exe 3304 firefox.exe 3304 firefox.exe 3304 firefox.exe 3304 firefox.exe 3304 firefox.exe 3304 firefox.exe 3304 firefox.exe 3304 firefox.exe 3304 firefox.exe 4024 04a802c413.exe 4024 04a802c413.exe 4024 04a802c413.exe 3216 msedge.exe 3216 msedge.exe 3216 msedge.exe 3216 msedge.exe 3216 msedge.exe 3216 msedge.exe 3216 msedge.exe 3216 msedge.exe 3216 msedge.exe 3216 msedge.exe 3216 msedge.exe 3216 msedge.exe 3216 msedge.exe 3216 msedge.exe 3216 msedge.exe 3216 msedge.exe 3216 msedge.exe 3216 msedge.exe 3216 msedge.exe 3216 msedge.exe 3216 msedge.exe 3216 msedge.exe 3216 msedge.exe 3216 msedge.exe 6276 explorer.exe 6276 explorer.exe 6276 explorer.exe 6276 explorer.exe 6276 explorer.exe 6276 explorer.exe 6276 explorer.exe 6276 explorer.exe 6276 explorer.exe 6276 explorer.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3304 firefox.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2496 wrote to memory of 5104 2496 file.exe 83 PID 2496 wrote to memory of 5104 2496 file.exe 83 PID 2496 wrote to memory of 5104 2496 file.exe 83 PID 5104 wrote to memory of 4468 5104 skotes.exe 93 PID 5104 wrote to memory of 4468 5104 skotes.exe 93 PID 5104 wrote to memory of 4260 5104 skotes.exe 97 PID 5104 wrote to memory of 4260 5104 skotes.exe 97 PID 5104 wrote to memory of 4260 5104 skotes.exe 97 PID 5104 wrote to memory of 2368 5104 skotes.exe 99 PID 5104 wrote to memory of 2368 5104 skotes.exe 99 PID 5104 wrote to memory of 2368 5104 skotes.exe 99 PID 4468 wrote to memory of 4516 4468 CuKxXX0.exe 100 PID 4468 wrote to memory of 4516 4468 CuKxXX0.exe 100 PID 4516 wrote to memory of 4756 4516 cmd.exe 103 PID 4516 wrote to memory of 4756 4516 cmd.exe 103 PID 2368 wrote to memory of 4216 2368 02fd456b06.exe 104 PID 2368 wrote to memory of 4216 2368 02fd456b06.exe 104 PID 4216 wrote to memory of 2392 4216 cmd.exe 106 PID 4216 wrote to memory of 2392 4216 cmd.exe 106 PID 4216 wrote to memory of 4388 4216 cmd.exe 107 PID 4216 wrote to memory of 4388 4216 cmd.exe 107 PID 4216 wrote to memory of 4368 4216 cmd.exe 108 PID 4216 wrote to memory of 4368 4216 cmd.exe 108 PID 4216 wrote to memory of 4144 4216 cmd.exe 109 PID 4216 wrote to memory of 4144 4216 cmd.exe 109 PID 4216 wrote to memory of 4572 4216 cmd.exe 110 PID 4216 wrote to memory of 4572 4216 cmd.exe 110 PID 5104 wrote to memory of 4968 5104 skotes.exe 111 PID 5104 wrote to memory of 4968 5104 skotes.exe 111 PID 5104 wrote to memory of 4968 5104 skotes.exe 111 PID 4216 wrote to memory of 2340 4216 cmd.exe 113 PID 4216 wrote to memory of 2340 4216 cmd.exe 113 PID 4216 wrote to memory of 1992 4216 cmd.exe 114 PID 4216 wrote to memory of 1992 4216 cmd.exe 114 PID 4216 wrote to memory of 624 4216 cmd.exe 115 PID 4216 wrote to memory of 624 4216 cmd.exe 115 PID 4216 wrote to memory of 5108 4216 cmd.exe 116 PID 4216 wrote to memory of 5108 4216 cmd.exe 116 PID 4216 wrote to memory of 1888 4216 cmd.exe 117 PID 4216 wrote to memory of 1888 4216 cmd.exe 117 PID 4216 wrote to memory of 880 4216 cmd.exe 118 PID 4216 wrote to memory of 880 4216 cmd.exe 118 PID 880 wrote to memory of 1260 880 in.exe 119 PID 880 wrote to memory of 1260 880 in.exe 119 PID 880 wrote to memory of 2480 880 in.exe 120 PID 880 wrote to memory of 2480 880 in.exe 120 PID 880 wrote to memory of 2252 880 in.exe 121 PID 880 wrote to memory of 2252 880 in.exe 121 PID 880 wrote to memory of 2348 880 in.exe 122 PID 880 wrote to memory of 2348 880 in.exe 122 PID 4968 wrote to memory of 3084 4968 aebbf5afb2.exe 126 PID 4968 wrote to memory of 3084 4968 aebbf5afb2.exe 126 PID 4968 wrote to memory of 3084 4968 aebbf5afb2.exe 126 PID 4968 wrote to memory of 3084 4968 aebbf5afb2.exe 126 PID 4968 wrote to memory of 3084 4968 aebbf5afb2.exe 126 PID 4968 wrote to memory of 3084 4968 aebbf5afb2.exe 126 PID 4968 wrote to memory of 3084 4968 aebbf5afb2.exe 126 PID 4968 wrote to memory of 3084 4968 aebbf5afb2.exe 126 PID 4968 wrote to memory of 3084 4968 aebbf5afb2.exe 126 PID 4968 wrote to memory of 3084 4968 aebbf5afb2.exe 126 PID 2348 wrote to memory of 2392 2348 powershell.exe 130 PID 2348 wrote to memory of 2392 2348 powershell.exe 130 PID 5104 wrote to memory of 4024 5104 skotes.exe 131 PID 5104 wrote to memory of 4024 5104 skotes.exe 131 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Views/modifies file attributes 1 TTPs 3 IoCs
pid Process 1888 attrib.exe 2480 attrib.exe 1260 attrib.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3420
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\1014535001\CuKxXX0.exe"C:\Users\Admin\AppData\Local\Temp\1014535001\CuKxXX0.exe"4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ipconfig /release5⤵
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Windows\system32\ipconfig.exeipconfig /release6⤵
- Gathers network information
PID:4756
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAMQAwADEANAA1ADMANQAwADAAMQBcAEMAdQBLAHgAWABYADAALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAMQAwADEANAA1ADMANQAwADAAMQBcAEMAdQBLAHgAWABYADAALgBlAHgAZQA7AEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwAUgBvAGEAbQBpAG4AZwBcAFcAaQBuAGQAbwBzAEMAUABVAHMAeQBzAHQAZQBtAC4AZQB4AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwAUgBvAGEAbQBpAG4AZwBcAFcAaQBuAGQAbwBzAEMAUABVAHMAeQBzAHQAZQBtAC4AZQB4AGUA5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4760
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Process "https://google.com"5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5216 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.com/6⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3216 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa62df46f8,0x7ffa62df4708,0x7ffa62df47187⤵PID:6072
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,6291718101011536567,10121569303013392887,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:27⤵PID:388
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,6291718101011536567,10121569303013392887,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2516 /prefetch:37⤵
- Suspicious behavior: EnumeratesProcesses
PID:3276
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,6291718101011536567,10121569303013392887,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:87⤵PID:5640
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,6291718101011536567,10121569303013392887,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:17⤵PID:5408
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,6291718101011536567,10121569303013392887,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:17⤵PID:5400
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,6291718101011536567,10121569303013392887,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4888 /prefetch:17⤵PID:5412
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,6291718101011536567,10121569303013392887,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5184 /prefetch:87⤵PID:1768
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,6291718101011536567,10121569303013392887,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5184 /prefetch:87⤵
- Suspicious behavior: EnumeratesProcesses
PID:4548
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,6291718101011536567,10121569303013392887,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:17⤵PID:6184
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,6291718101011536567,10121569303013392887,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:17⤵PID:6192
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,6291718101011536567,10121569303013392887,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4104 /prefetch:17⤵PID:6540
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,6291718101011536567,10121569303013392887,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:17⤵PID:6548
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ipconfig /renew5⤵PID:5788
-
C:\Windows\system32\ipconfig.exeipconfig /renew6⤵
- Gathers network information
PID:5908
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1014550001\c53422928e.exe"C:\Users\Admin\AppData\Local\Temp\1014550001\c53422928e.exe"4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4260 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4260 -s 6445⤵
- Program crash
PID:6936
-
-
-
C:\Users\Admin\AppData\Local\Temp\1014551001\02fd456b06.exe"C:\Users\Admin\AppData\Local\Temp\1014551001\02fd456b06.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"5⤵
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Windows\system32\mode.commode 65,106⤵PID:2392
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e file.zip -p24291711423417250691697322505 -oextracted6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:4388
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_7.zip -oextracted6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:4368
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_6.zip -oextracted6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:4144
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_5.zip -oextracted6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:4572
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_4.zip -oextracted6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2340
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_3.zip -oextracted6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1992
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_2.zip -oextracted6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:624
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_1.zip -oextracted6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:5108
-
-
C:\Windows\system32\attrib.exeattrib +H "in.exe"6⤵
- Views/modifies file attributes
PID:1888
-
-
C:\Users\Admin\AppData\Local\Temp\main\in.exe"in.exe"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:880 -
C:\Windows\SYSTEM32\attrib.exeattrib +H +S C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe7⤵
- Views/modifies file attributes
PID:1260
-
-
C:\Windows\SYSTEM32\attrib.exeattrib +H C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe7⤵
- Views/modifies file attributes
PID:2480
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE7⤵
- Scheduled Task/Job: Scheduled Task
PID:2252
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell ping 127.0.0.1; del in.exe7⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Windows\system32\PING.EXE"C:\Windows\system32\PING.EXE" 127.0.0.18⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2392
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1014552001\aebbf5afb2.exe"C:\Users\Admin\AppData\Local\Temp\1014552001\aebbf5afb2.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\1014552001\aebbf5afb2.exe"C:\Users\Admin\AppData\Local\Temp\1014552001\aebbf5afb2.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3084
-
-
-
C:\Users\Admin\AppData\Local\Temp\1014553001\04a802c413.exe"C:\Users\Admin\AppData\Local\Temp\1014553001\04a802c413.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4024 -
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM firefox.exe /T5⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3812
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM chrome.exe /T5⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:392
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM msedge.exe /T5⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1536
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM opera.exe /T5⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3536
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM brave.exe /T5⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3528
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking5⤵PID:2228
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking6⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3304 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2036 -parentBuildID 20240401114208 -prefsHandle 1952 -prefMapHandle 1944 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d2e5e64b-57f9-49ce-b914-327a5e8f3659} 3304 "\\.\pipe\gecko-crash-server-pipe.3304" gpu7⤵PID:704
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2468 -parentBuildID 20240401114208 -prefsHandle 2436 -prefMapHandle 2432 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2605e851-cdb6-47e7-b6a4-4c1622ea872d} 3304 "\\.\pipe\gecko-crash-server-pipe.3304" socket7⤵PID:4200
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3156 -childID 1 -isForBrowser -prefsHandle 3084 -prefMapHandle 3220 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1220 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {69dbc7e0-60dc-43be-b6b4-9cad15f7ac57} 3304 "\\.\pipe\gecko-crash-server-pipe.3304" tab7⤵PID:1896
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4092 -childID 2 -isForBrowser -prefsHandle 4084 -prefMapHandle 3208 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1220 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5780057c-6986-480d-9b30-01978b3cd0f3} 3304 "\\.\pipe\gecko-crash-server-pipe.3304" tab7⤵PID:4068
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4768 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4700 -prefMapHandle 4660 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {05a643b9-de76-409d-9c10-adb060ab6dd3} 3304 "\\.\pipe\gecko-crash-server-pipe.3304" utility7⤵
- Checks processor information in registry
PID:5628
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5252 -childID 3 -isForBrowser -prefsHandle 5268 -prefMapHandle 5264 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1220 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0a1e6436-f93f-49e6-9963-93afd0dcee12} 3304 "\\.\pipe\gecko-crash-server-pipe.3304" tab7⤵PID:3816
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5432 -childID 4 -isForBrowser -prefsHandle 5444 -prefMapHandle 5388 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1220 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a951ec86-32ef-4297-b2f6-632e02520bd4} 3304 "\\.\pipe\gecko-crash-server-pipe.3304" tab7⤵PID:1728
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5592 -childID 5 -isForBrowser -prefsHandle 5600 -prefMapHandle 5604 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1220 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {eb3133e0-8a15-4cd3-89cc-25bbfdf0fe0f} 3304 "\\.\pipe\gecko-crash-server-pipe.3304" tab7⤵PID:5016
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1014554001\be07f52020.exe"C:\Users\Admin\AppData\Local\Temp\1014554001\be07f52020.exe"4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:760
-
-
C:\Users\Admin\AppData\Local\Temp\1014555001\24adda8406.exe"C:\Users\Admin\AppData\Local\Temp\1014555001\24adda8406.exe"4⤵
- Modifies Windows Defender Real-time Protection settings
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Windows security modification
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2428
-
-
C:\Users\Admin\AppData\Local\Temp\1014556001\0c7ebd51f8.exe"C:\Users\Admin\AppData\Local\Temp\1014556001\0c7ebd51f8.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:6424 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\Admin\AppData\Local\Temp\1014556001\0c7ebd51f8.exe" & rd /s /q "C:\ProgramData\TR9Z5XBSR1N7" & exit5⤵
- System Location Discovery: System Language Discovery
PID:1724 -
C:\Windows\SysWOW64\timeout.exetimeout /t 106⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:6500
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6424 -s 20525⤵
- Program crash
PID:6700
-
-
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:5528 -
C:\Windows\explorer.exeexplorer.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:6276
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5356
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5816
-
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exeC:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:6764
-
C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exeC:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:7012 -
C:\Windows\explorer.exeexplorer.exe2⤵
- Suspicious use of AdjustPrivilegeToken
PID:7032
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe2⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:7084 -
C:\Windows\system32\PING.EXE"C:\Windows\system32\PING.EXE" 127.1.10.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:5660
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 6424 -ip 64241⤵PID:6468
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4260 -ip 42601⤵PID:6776
-
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exeC:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe1⤵PID:6764
-
C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exeC:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe1⤵PID:7164
-
C:\Windows\explorer.exeexplorer.exe2⤵PID:1424
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe2⤵
- System Network Configuration Discovery: Internet Connection Discovery
PID:7104 -
C:\Windows\system32\PING.EXE"C:\Windows\system32\PING.EXE" 127.1.10.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:6708
-
-
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
2PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Impair Defenses
2Disable or Modify Tools
2Modify Registry
3Virtualization/Sandbox Evasion
2Discovery
Browser Information Discovery
1Query Registry
8Remote System Discovery
1System Information Discovery
6System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1Virtualization/Sandbox Evasion
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
152B
MD5c2d9eeb3fdd75834f0ac3f9767de8d6f
SHA14d16a7e82190f8490a00008bd53d85fb92e379b0
SHA2561e5efb5f1d78a4cc269cb116307e9d767fc5ad8a18e6cf95c81c61d7b1da5c66
SHA512d92f995f9e096ecc0a7b8b4aca336aeef0e7b919fe7fe008169f0b87da84d018971ba5728141557d42a0fc562a25191bd85e0d7354c401b09e8b62cdc44b6dcd
-
Filesize
152B
MD5e55832d7cd7e868a2c087c4c73678018
SHA1ed7a2f6d6437e907218ffba9128802eaf414a0eb
SHA256a4d7777b980ec53de3a70aca8fb25b77e9b53187e7d2f0fa1a729ee9a35da574
SHA512897fdebf1a9269a1bf1e3a791f6ee9ab7c24c9d75eeff65ac9599764e1c8585784e1837ba5321d90af0b004af121b2206081a6fb1b1ad571a0051ee33d3f5c5f
-
Filesize
215KB
MD52be38925751dc3580e84c3af3a87f98d
SHA18a390d24e6588bef5da1d3db713784c11ca58921
SHA2561412046f2516b688d644ff26b6c7ef2275b6c8f132eb809bd32e118208a4ec1b
SHA5121341ffc84f16c1247eb0e9baacd26a70c6b9ee904bc2861e55b092263613c0f09072efd174b3e649a347ef3192ae92d7807cc4f5782f8fd07389703d75c4c4e2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize120B
MD555f11e578596d7bc6de2ec24a449f92d
SHA1235fd895f9b0a9b869143bb8b2f226b3a7aab4be
SHA25615293a42d234ec99192feac16657547b13e64f59bdcf104383be4fd53a0466ec
SHA512d69f11819346d591bba3cdabab66e9f5d0692e2e3b25157eb64d2e7fb944d8f8ce984f6f39a8a7f6d2cf5af38019da37149c0354dd11ccaac12703a91982e54e
-
Filesize
1003B
MD5b194ccb91602ab90656c629f1c03290c
SHA1d8489c36157ed0c6dc03ae7e4736918ef21beb94
SHA2564867e0f065644e0348193bfac551be707fca8bcc77992ecd4881ad12c21a550a
SHA512be83672b1b5a4adac7695b7c4a9168a8f1d3c2f92db378ccc3bc17306a9a6524b3b36d074b699881b110229e060c5897021e8845b6f945728e4cc5a233173e9b
-
Filesize
5KB
MD5bf2333110d58a741647a9d5e27990ffb
SHA16cfe871f20d2f9c44c350450f6f3228b0834905e
SHA2569046aa530d2f70f8b78b6a784d3dfc1448abea5cc15b80aab4b044ba92778e82
SHA5124369812fa37dfe3b52ef165d7093d40c95bb9c85ef6293b9323d2b2fa30e2064963f32a8ac34d8b8d3fda1ee990d73977a1264fbf8af42f19d07ff841b1acdb3
-
Filesize
6KB
MD58d57e2d7e8342138da10f0aee39a6143
SHA1d32980e3946528b17a6abb5311aee500027586a4
SHA2564b0b76804513dc913115b22eb3d12d07145121f4b07a34885586a3823653c339
SHA512337af19ed47cc7b148062e55df299097683a9ed2d255045f0f2288987a4f46c78efd18429819051c47ef7d98d8744d760fa4dabc4998b34736ce4ba067f04356
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD5186a7636348b481c3665befe87c3b58f
SHA1ba6c7b1010d034bf46ad1b5bc02245761b07fcaa
SHA256b690fd0fd5c538d0072b3f7c52a64454547ef63c7ecec5e476acb582d5b14b7a
SHA512324ff7520dbf5bfb63f1f391be7ef85c62c24ebde9317bb6fc75f4c640a3cfd5b4d584249fea5d3fbe800430ad4eb1f3252bfee033641b6859519684b72afb15
-
Filesize
1B
MD5cfcd208495d565ef66e7dff9f98764da
SHA1b6589fc6ab0dc82cf12099d1c2d40ab994e8410c
SHA2565feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
SHA51231bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99
-
Filesize
1KB
MD5276798eeb29a49dc6e199768bc9c2e71
SHA15fdc8ccb897ac2df7476fbb07517aca5b7a6205b
SHA256cd0a1056e8f1b6cb5cb328532239d802f4e2aa8f8fcdc0fcb487684bd68e0dcc
SHA5120d34fce64bbefc57d64fa6e03ca886952263d5f24df9c1c4cce6a1e8f5a47a9a21e9820f8d38caa7f7b43a52336ce00b738ea18419aaa7c788b72e04ce19e4f2
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6ir3v68x.default-release\cache2\entries\92F4D5A4F9CED6E2E644D803AEE3647A0EA4D984
Filesize13KB
MD59880dc6b05504220859d191a7d4cecf8
SHA18beb89aecfa1863db6dede954647b997ea094b59
SHA25612e16797d1c33b24a86fda1aec888c9a0b303bbb87c9aa94474bcb462368abd8
SHA5121dcbfb3e5e25840ed52f6c7d1b376cb2332afe5f663abadfc2a843884e25624c256310c568b4bd36bf987d1607fb6fef05d1915036b64073ef8f6182a1463803
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6ir3v68x.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
Filesize15KB
MD596c542dec016d9ec1ecc4dddfcbaac66
SHA16199f7648bb744efa58acf7b96fee85d938389e4
SHA2567f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798
SHA512cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658
-
Filesize
5.6MB
MD5c72b7c1a451219825e066832e38f92f8
SHA170227f19e7092c41d6699efa2a709fa489bb7847
SHA2564e7a2984e68806ab0d4489587aaa2a731171fc968aa7d40532020bf9c26539b3
SHA512cbe4a782cb8500fd7d1c3ba641b58964722d978176d3f8d782693d16b7638a24dc472954200dd085484d132c840f3c420cc7393326cef96fd5ae6342403228bb
-
Filesize
1.9MB
MD5dd44780d69d56d86bd3be9d6ca0f69a9
SHA1c9afab3e117153f469723102214a907685a509d6
SHA2565cf283b12d73892ee010289b4d554e5b1c7d1aede0a8e6cd0a33415513526b5b
SHA5122941a447f343d039f356cd63a009b33f5eb042553143c009a23a4e68e76c59101052fc9a8092f56b81bf61b3c068b3c685c558933a672ec03c0e94fb4b873eff
-
Filesize
4.2MB
MD53a425626cbd40345f5b8dddd6b2b9efa
SHA17b50e108e293e54c15dce816552356f424eea97a
SHA256ba9212d2d5cd6df5eb7933fb37c1b72a648974c1730bf5c32439987558f8e8b1
SHA512a7538c6b7e17c35f053721308b8d6dc53a90e79930ff4ed5cffecaa97f4d0fbc5f9e8b59f1383d8f0699c8d4f1331f226af71d40325022d10b885606a72fe668
-
Filesize
710KB
MD528e568616a7b792cac1726deb77d9039
SHA139890a418fb391b823ed5084533e2e24dff021e1
SHA2569597798f7789adc29fbe97707b1bd8ca913c4d5861b0ad4fdd6b913af7c7a8e2
SHA51285048799e6d2756f1d6af77f34e6a1f454c48f2f43042927845931b7ecff2e5de45f864627a3d4aa061252401225bbb6c2caa8532320ccbe401e97c9c79ac8e5
-
Filesize
949KB
MD5e1eb6e279e48e48e1c0021e3dbe01e9b
SHA156fce13b8967a0cd68e48b425f38a50f4a957e18
SHA2561935497fd015edb463f3a1a229be949c565a7346521719595a6e46c8552145dd
SHA512ca71848d6a95c9ba45b7cf73f11a2b301bf4b24cfa2549ee38ec53307e7c99fa7cdc3884103a7ad281a36b9ebc8567d8fa84ed56f9caeeacefd1a3120d9124be
-
Filesize
1.8MB
MD5bb02eb5eef47a773ae26d60ae263d9fa
SHA1283211e861760787a349aefc7b393f41bd00dda6
SHA256eb9e0ab7722a28e6c8e797d66593cb11b544ec242c245f9d8d924b255ed539ba
SHA5125868e829d7bbb1e3f208631c9b31c93faabc9cb9e197b814364c91459a4d6fd2b84de19552bd36950878c5b54224c1e2cb35c181d9b4115a848386836e140818
-
Filesize
2.7MB
MD5c657bf839fb979c5ce29cec72eebf10b
SHA187e7d374570f137582ffcc4d62d71e44380839df
SHA2569239680c12bab0e396798fd89cbbab0b8ebbd8b65cf03c73ff246236390d85fe
SHA51270098c26906d60437d77fae7bbb6e48f0435e094323d050b23188766bb248d6b77079a44770105b198ddaf439f584f86105c01f32e5f4ad555060870f517295e
-
Filesize
384KB
MD5dfd5f78a711fa92337010ecc028470b4
SHA11a389091178f2be8ce486cd860de16263f8e902e
SHA256da96f2eb74e60de791961ef3800c36a5e12202fe97ae5d2fcfc1fe404bc13c0d
SHA512a3673074919039a2dc854b0f91d1e1a69724056594e33559741f53594e0f6e61e3d99ec664d541b17f09ffdebc2de1b042eec19ca8477fac86359c703f8c9656
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
3.1MB
MD53197aa29fd7d023f4483200e06a95d7a
SHA162cd61a0004ef666d0d6427c42c8a6ec7b30617c
SHA256ac7eab26629e889c428293f303b428424ffccae5658636cca54512753fa2792a
SHA5127379939f14ce763a9726638f6b694e0a84dbc80a2128db6e58224e2db432ad242cfc04e2576ffd462e1c75836141310cfd0ac751245061170d041b211e528637
-
Filesize
1.6MB
MD572491c7b87a7c2dd350b727444f13bb4
SHA11e9338d56db7ded386878eab7bb44b8934ab1bc7
SHA25634ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891
SHA512583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511
-
Filesize
458KB
MD5619f7135621b50fd1900ff24aade1524
SHA16c7ea8bbd435163ae3945cbef30ef6b9872a4591
SHA256344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2
SHA5122c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628
-
Filesize
2.2MB
MD5579a63bebccbacab8f14132f9fc31b89
SHA1fca8a51077d352741a9c1ff8a493064ef5052f27
SHA2560ac3504d5fa0460cae3c0fd9c4b628e1a65547a60563e6d1f006d17d5a6354b0
SHA5124a58ca0f392187a483b9ef652b6e8b2e60d01daa5d331549df9f359d2c0a181e975cf9df79552e3474b9d77f8e37a1cf23725f32d4cdbe4885e257a7625f7b1f
-
Filesize
1.7MB
MD55659eba6a774f9d5322f249ad989114a
SHA14bfb12aa98a1dc2206baa0ac611877b815810e4c
SHA256e04346fee15c3f98387a3641e0bba2e555a5a9b0200e4b9256b1b77094069ae4
SHA512f93abf2787b1e06ce999a0cbc67dc787b791a58f9ce20af5587b2060d663f26be9f648d116d9ca279af39299ea5d38e3c86271297e47c1438102ca28fce8edc4
-
Filesize
1.7MB
MD55404286ec7853897b3ba00adf824d6c1
SHA139e543e08b34311b82f6e909e1e67e2f4afec551
SHA256ec94a6666a3103ba6be60b92e843075a2d7fe7d30fa41099c3f3b1e2a5eba266
SHA512c4b78298c42148d393feea6c3941c48def7c92ef0e6baac99144b083937d0a80d3c15bd9a0bf40daa60919968b120d62999fa61af320e507f7e99fbfe9b9ef30
-
Filesize
1.7MB
MD55eb39ba3698c99891a6b6eb036cfb653
SHA1d2f1cdd59669f006a2f1aa9214aeed48bc88c06e
SHA256e77f5e03ae140dda27d73e1ffe43f7911e006a108cf51cbd0e05d73aa92da7c2
SHA5126c4ca20e88d49256ed9cabec0d1f2b00dfcf3d1603b5c95d158d4438c9f1e58495f8dfa200dbe7f49b5b0dd57886517eb3b98c4190484548720dad4b3db6069e
-
Filesize
1.7MB
MD57187cc2643affab4ca29d92251c96dee
SHA1ab0a4de90a14551834e12bb2c8c6b9ee517acaf4
SHA256c7e92a1af295307fb92ad534e05fba879a7cf6716f93aefca0ebfcb8cee7a830
SHA51227985d317a5c844871ffb2527d04aa50ef7442b2f00d69d5ab6bbb85cd7be1d7057ffd3151d0896f05603677c2f7361ed021eac921e012d74da049ef6949e3a3
-
Filesize
1.7MB
MD5b7d1e04629bec112923446fda5391731
SHA1814055286f963ddaa5bf3019821cb8a565b56cb8
SHA2564da77d4ee30ad0cd56cd620f4e9dc4016244ace015c5b4b43f8f37dd8e3a8789
SHA51279fc3606b0fe6a1e31a2ecacc96623caf236bf2be692dadab6ea8ffa4af4231d782094a63b76631068364ac9b6a872b02f1e080636eba40ed019c2949a8e28db
-
Filesize
1.7MB
MD50dc4014facf82aa027904c1be1d403c1
SHA15e6d6c020bfc2e6f24f3d237946b0103fe9b1831
SHA256a29ddd29958c64e0af1a848409e97401307277bb6f11777b1cfb0404a6226de7
SHA512cbeead189918657cc81e844ed9673ee8f743aed29ad9948e90afdfbecacc9c764fbdbfb92e8c8ceb5ae47cee52e833e386a304db0572c7130d1a54fd9c2cc028
-
Filesize
3.3MB
MD5cea368fc334a9aec1ecff4b15612e5b0
SHA1493d23f72731bb570d904014ffdacbba2334ce26
SHA25607e38cad68b0cdbea62f55f9bc6ee80545c2e1a39983baa222e8af788f028541
SHA512bed35a1cc56f32e0109ea5a02578489682a990b5cefa58d7cf778815254af9849e731031e824adba07c86c8425df58a1967ac84ce004c62e316a2e51a75c8748
-
Filesize
3.3MB
MD5045b0a3d5be6f10ddf19ae6d92dfdd70
SHA10387715b6681d7097d372cd0005b664f76c933c7
SHA25694b392e94fa47d1b9b7ae6a29527727268cc2e3484e818c23608f8835bc1104d
SHA51258255a755531791b888ffd9b663cc678c63d5caa932260e9546b1b10a8d54208334725c14529116b067bcf5a5e02da85e015a3bed80092b7698a43dab0168c7b
-
Filesize
1.7MB
MD583d75087c9bf6e4f07c36e550731ccde
SHA1d5ff596961cce5f03f842cfd8f27dde6f124e3ae
SHA25646db3164bebffc61c201fe1e086bffe129ddfed575e6d839ddb4f9622963fb3f
SHA512044e1f5507e92715ce9df8bb802e83157237a2f96f39bac3b6a444175f1160c4d82f41a0bcecf5feaf1c919272ed7929baef929a8c3f07deecebc44b0435164a
-
Filesize
440B
MD53626532127e3066df98e34c3d56a1869
SHA15fa7102f02615afde4efd4ed091744e842c63f78
SHA2562a0e18ef585db0802269b8c1ddccb95ce4c0bac747e207ee6131dee989788bca
SHA512dcce66d6e24d5a4a352874144871cd73c327e04c1b50764399457d8d70a9515f5bc0a650232763bf34d4830bab70ee4539646e7625cfe5336a870e311043b2bd
-
Filesize
479KB
MD509372174e83dbbf696ee732fd2e875bb
SHA1ba360186ba650a769f9303f48b7200fb5eaccee1
SHA256c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
SHA512b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
-
Filesize
13.8MB
MD50a8747a2ac9ac08ae9508f36c6d75692
SHA1b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA25632d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
SHA51259521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\AlternateServices.bin
Filesize8KB
MD575773d79fdd50f2ca8dcb4b1414499f0
SHA164b85214bcbfb3d11d8fe4d791a3fca6d853e29f
SHA256577974fd93f6083a283fc03df945534324de7fbd9278253ccec6a9a301ece66e
SHA512ebe5dcf34b6955c193f420d4db600172e81f41af27505e88535665e605d865237157a5bfba974c5561b7456a048ea6308457115144d5828b810aa16fd43f4108
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\AlternateServices.bin
Filesize18KB
MD570f06d5bd902bf96b67419f3aca6f03a
SHA1cb80909e9ab84d4afc419f9b8039da5127538755
SHA256c7690fb96947edfdd257dba2cae63bb71f8d00c40b191e2c8fbfe5a799bba3b6
SHA512008dd69ace826adc46bb7df45810b66e6b4feeeb19bad58322e818ced5a0b0d454ab1aeb8e7ea93888cb6529971d09a7d0dfa442dba59f43223ab9321cd1c754
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\db\data.safe.tmp
Filesize5KB
MD556163a410e40477ce24c305303d9984e
SHA1eb0e94f38de191732dc6cce84df5d4cb71aa6442
SHA25627b26f70096efbb1be2bbcf1d8b35f06db3b2961f16a7ed0192f514d30ec3c65
SHA512c74bfe9940d474a5d48425ec7a6441e65941d169893ddc96e4083692fe751d6f2dea54e6988ada29fcb558cc7c0cf4b6fb1cadc893e6eb1709d06997d5e23afa
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\db\data.safe.tmp
Filesize15KB
MD5dc7711ee17240f99227099192d655d82
SHA1dfe2d8633a7ca0756975da16a356e2ec3d930db2
SHA25622239da36230cd976630f42bc1b8797d79d4ec27353f50435d0a0b4262168ca6
SHA51227c39248d3fc4f24348b4ea6e31be13ef0fcb7247b1b6f3a1aba11793b5fe2f0619624a6d8ec405d11ec381e1398fcc7b45692f009f16bf23e81bb3b3848854c
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\db\data.safe.tmp
Filesize15KB
MD564dfbf2d1485a21bc34775791157ecf3
SHA1671a41810f6f564498ee3fc0be8de38c0b82c64f
SHA2569c709fec777a8a156067b5d28d7fb2f0174dba699ee56e37c04a96593af921ec
SHA512d8579759227c8ef4ed4504aadd60fc9e7a9809ffaca53e6957929f8a8490d8af5351293d7515a3950e344ee8cf262bfa84490efa048626aa7c536c52c4bae83a
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\pending_pings\19d7941b-1dfd-49ed-a8a4-307df4788be7
Filesize671B
MD5d1003c95f34633d9c3ffe6d49b0fcdeb
SHA151a1760a4caf21518b407cd1d096e8860ebd59f8
SHA2568f2608372d9b884039d8c06584d9176b61fc8016a17e191911e50a73b8b162a8
SHA51295954112a0a364d01f04b0d97bb4986ad38f3f51c8ee41873c80ec267a5eaa18d65f79466b4e3717cc0f06474212d37ed8a1224ab0be88e3d5593843b020bd1a
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\pending_pings\783a9fab-17c1-44ae-8050-2a32a58f88ef
Filesize982B
MD5361417b811e7276f9234e6a864a8bfd4
SHA107bdb2f1e28925835471914b19cb34f422767f60
SHA25612f88e8364aebcd0d9a7d45082ba924ba17b771e678c4016115368dd8fb26e08
SHA512d618cc91a64f183baf8b75cbdab6166ea4e2dcecd476520f2d3f74eb71d17219891f4e28d36f67e8303f515f25733432fc166b47e8bc45b777b05ed82dea07b4
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\pending_pings\9712e756-7519-4a8d-b80e-991b6b2b6cfb
Filesize27KB
MD5a5d614246361e043376276bdd221c808
SHA10b40575bcfb7281ad207f7c3928605d56d3061b7
SHA256789f36e97fc425baad8743b11c44fb8eb61094d9f4e4bf6bbd47a8c6fa0619f0
SHA512bbf318967f64297720c99886b5aafab35fd3761ddd1aeed6abec8070d465406637d89a58d3a5e66d34875918f91320e73d57672dd56d1f2ef108e7b27f6c402f
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Filesize1.1MB
MD5842039753bf41fa5e11b3a1383061a87
SHA13e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA256d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
SHA512d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Filesize116B
MD52a461e9eb87fd1955cea740a3444ee7a
SHA1b10755914c713f5a4677494dbe8a686ed458c3c5
SHA2564107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
SHA51234f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Filesize372B
MD5bf957ad58b55f64219ab3f793e374316
SHA1a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA256bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
SHA51279c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Filesize17.8MB
MD5daf7ef3acccab478aaa7d6dc1c60f865
SHA1f8246162b97ce4a945feced27b6ea114366ff2ad
SHA256bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
SHA5125840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
-
Filesize
10KB
MD51aaef83a3a359623578ccc7256ae19c0
SHA15a708af272a91ba305c884a016a094972ce5ebe3
SHA256d13a9e77f3a949ab372f9eae183da3e3c482d3dc10070144c082365957231bc6
SHA5128554915ae19af4cbf09e5101c4dba75b70c508ace4cab303e7ea969042dab8122846292bf2dc507952b85eb756ebf9bae179ba17a56040171333f93eca2d8120
-
Filesize
15KB
MD5ecbc921e636ed8df6d172d1fbf7e4155
SHA1d478fafc32bfe7f7901c8b758bd5a2329e81c320
SHA256db9ee70a2dac9bf623561b412af62ec86bb449b1184b7f89fb22e19c72677e12
SHA5127fdbb8ee27a37ac62c85ff0481a0e808c41afca41018f6e325450bbd84cf9b4d0c5e67db81aec920b65427e6289f7d0ac2efa13d75f9bcb6b8fb3d2d54854a0a
-
Filesize
12KB
MD5c93351b48a297f548a19713aa66daeff
SHA15ab6f7191c863e3071e9e4e7db16baeb90338603
SHA2562acc15e5ce9be0315f14b14480336a3e319bfd2ef214bcefed37e3ec8549a912
SHA512a25667f36d104c6df1f4eb9c36683b14f3e12ab49216f493ea629d255d785b87c8aba5696a7dfec3c95cafeff4d3437ab793f23e431952ffac7bf60c14a2c001
-
Filesize
10KB
MD55775d7f74f154ec3f61b06fb5654e176
SHA1b903841d0b52729daec052eaaaad305dc261a437
SHA2564f1f516dc2bb1793231a4c6aef4217ddf4b640758ac3d3700a4e02eec2b2c3be
SHA512abe6a9945057142a0e1cf1832eb8e3c8a8c2d9eebf63989288ac2f98029f31c43bacfff31e9aff9135a0575107e2571b3f9d4c657e4ce720e7187f06153f86bd
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Filesize1.2MB
MD519d491c2e30a54cf293d0ddcb5371da6
SHA1ce9d5ca8d4fc3ad8fb8a5fcc8b3fc04672fe28f9
SHA256c0374b909aad4c600890bca5760d52e64f9e6a573e4fdd2a5300e9bd068948e7
SHA5129e5120c06a9b679ae2e2cdd6d2c2cce6fa1bd0847501bb1dd781a1e9a671a7396767c2bcb37cd58c793bd1d6e9c129264e5208ee1ec22f215275630e84d68816
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Filesize9.5MB
MD5c087787b091b3969cfdec5746d1b4bba
SHA1fb76d2ff32035935ab4c0d5082bfa9e111ac268b
SHA256b5edf7e03df12c75371f82016d2ddc850a38b0f1dc124f2073aba1f0226d100e
SHA5121107903ebd44e81ea5b17476b5687b54c713b369ae8ccf77cf64a478c57e390e5391a473acfee09a48cb3568534c5702c059d4a7d23dfcb5cccd8910d86097cb
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-wal
Filesize32KB
MD5d3a9247aa0cfdd00117cf31c7eeee547
SHA179f85dbcda0e7c8ec13cdeb171c77113a79d4d8b
SHA256659ee8e637b4ea396d7d84668d7a0797b1932afd01f4adf5594c3b8679a4efe1
SHA512a542ef374ef33bbc8c6abbef253e8fda88de21304fe443fba24263a10f23ea7d286838493f0bdbd8114c73cd7e533d93acf4274f537d83647e9abbaee2b5f2aa