Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
13-12-2024 23:52
Static task
static1
General
-
Target
file.exe
-
Size
3.0MB
-
MD5
691c2dd42261c667ef6ca6844f8a56ca
-
SHA1
252755b9c7ed1ab5ce27826cfd6eca4956bd6ded
-
SHA256
71da7d1635f8d6162009ae77943109bf19b0ff32de0e12b4e6079901fd750b8e
-
SHA512
4a291dd8cd92399c726b2b835a6f11d6d5a913b12197a44a82de152845f0f2c8caeedccdd18ac729cbd1a3bd23f1ed5afd8f18d257ab02021811db027bc30899
-
SSDEEP
49152:GR4Oba4SOEscdZL5iZQAy2B6A4zh+kfNWOpx:c4OWCEvZli2Ay2B6A4tN5v
Malware Config
Extracted
amadey
4.42
9c9aa5
http://185.215.113.43
-
install_dir
abc3bc1985
-
install_file
skotes.exe
-
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
-
url_paths
/Zu7JuNko/index.php
Extracted
lumma
https://impend-differ.biz/api
https://print-vexer.biz/api
https://dare-curbys.biz/api
https://covery-mover.biz/api
https://formy-spill.biz/api
https://dwell-exclaim.biz/api
https://zinc-sneark.biz/api
https://se-blurry.biz/api
https://drive-connect.cyou/api
Extracted
stealc
stok
http://185.215.113.206
-
url_path
/c4becf79229cb002.php
Extracted
lumma
https://drive-connect.cyou/api
Signatures
-
Amadey family
-
Gcleaner family
-
Lumma family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" ccd09dd76a.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection ccd09dd76a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" ccd09dd76a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" ccd09dd76a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" ccd09dd76a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" ccd09dd76a.exe -
Stealc family
-
Xmrig family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 8 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ ccd09dd76a.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ JKEGDHCFCA.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ file.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 312bbf8dcf.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 1cf56063ed.exe -
XMRig Miner payload 10 IoCs
resource yara_rule behavioral2/memory/6084-1295-0x0000000140000000-0x0000000140770000-memory.dmp xmrig behavioral2/memory/6084-1297-0x0000000140000000-0x0000000140770000-memory.dmp xmrig behavioral2/memory/6084-1305-0x0000000140000000-0x0000000140770000-memory.dmp xmrig behavioral2/memory/6084-1306-0x0000000140000000-0x0000000140770000-memory.dmp xmrig behavioral2/memory/6084-1308-0x0000000140000000-0x0000000140770000-memory.dmp xmrig behavioral2/memory/6084-1316-0x0000000140000000-0x0000000140770000-memory.dmp xmrig behavioral2/memory/6084-1317-0x0000000140000000-0x0000000140770000-memory.dmp xmrig behavioral2/memory/6084-1327-0x0000000140000000-0x0000000140770000-memory.dmp xmrig behavioral2/memory/6084-1329-0x0000000140000000-0x0000000140770000-memory.dmp xmrig behavioral2/memory/6084-1347-0x0000000140000000-0x0000000140770000-memory.dmp xmrig -
Downloads MZ/PE file
-
Uses browser remote debugging 2 TTPs 9 IoCs
Can be used control the browser and steal sensitive information such as credentials and session cookies.
pid Process 5392 msedge.exe 5512 chrome.exe 3064 chrome.exe 5140 chrome.exe 5304 chrome.exe 5916 msedge.exe 5700 msedge.exe 6068 msedge.exe 5300 msedge.exe -
Checks BIOS information in registry 2 TTPs 16 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion file.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion file.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 312bbf8dcf.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion ccd09dd76a.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion JKEGDHCFCA.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion JKEGDHCFCA.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 312bbf8dcf.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 1cf56063ed.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 1cf56063ed.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion ccd09dd76a.exe -
Checks computer location settings 2 TTPs 5 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation 1cf56063ed.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation file.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation skotes.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation 1167afa62d.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation 92957fe4b9.exe -
Executes dropped EXE 24 IoCs
pid Process 2188 skotes.exe 536 1167afa62d.exe 1624 7z.exe 2488 7z.exe 4344 7z.exe 3588 7z.exe 3088 7z.exe 448 7z.exe 3668 7z.exe 3620 7z.exe 932 in.exe 4240 00dd496f44.exe 3592 00dd496f44.exe 1900 92957fe4b9.exe 4084 312bbf8dcf.exe 1484 87c51327e6.exe 4236 1cf56063ed.exe 5264 ccd09dd76a.exe 4304 6aa6770d5d.exe 1964 JKEGDHCFCA.exe 6040 skotes.exe 1480 Intel_PTT_EK_Recertification.exe 5084 skotes.exe 3592 Intel_PTT_EK_Recertification.exe -
Identifies Wine through registry keys 2 TTPs 8 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Software\Wine 312bbf8dcf.exe Key opened \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Software\Wine 1cf56063ed.exe Key opened \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Software\Wine ccd09dd76a.exe Key opened \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Software\Wine JKEGDHCFCA.exe Key opened \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Software\Wine skotes.exe Key opened \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Software\Wine skotes.exe Key opened \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Software\Wine file.exe Key opened \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Software\Wine skotes.exe -
Loads dropped DLL 10 IoCs
pid Process 1624 7z.exe 2488 7z.exe 4344 7z.exe 3588 7z.exe 3088 7z.exe 448 7z.exe 3668 7z.exe 3620 7z.exe 4236 1cf56063ed.exe 4236 1cf56063ed.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features ccd09dd76a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" ccd09dd76a.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\87c51327e6.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1014984001\\87c51327e6.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\1cf56063ed.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1014985001\\1cf56063ed.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ccd09dd76a.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1014986001\\ccd09dd76a.exe" skotes.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/files/0x0008000000023c6f-194.dat autoit_exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs
pid Process 2608 file.exe 2188 skotes.exe 4084 312bbf8dcf.exe 4236 1cf56063ed.exe 5264 ccd09dd76a.exe 1964 JKEGDHCFCA.exe 6040 skotes.exe 5084 skotes.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 4240 set thread context of 3592 4240 00dd496f44.exe 108 PID 1480 set thread context of 6084 1480 Intel_PTT_EK_Recertification.exe 178 PID 3592 set thread context of 3728 3592 Intel_PTT_EK_Recertification.exe 184 -
resource yara_rule behavioral2/files/0x0008000000023c4e-110.dat upx behavioral2/memory/932-114-0x00007FF605FB0000-0x00007FF606440000-memory.dmp upx behavioral2/memory/1480-1285-0x00007FF7D8CB0000-0x00007FF7D9140000-memory.dmp upx behavioral2/memory/1480-1337-0x00007FF7D8CB0000-0x00007FF7D9140000-memory.dmp upx behavioral2/memory/3592-3384-0x00007FF7D8CB0000-0x00007FF7D9140000-memory.dmp upx -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\skotes.job file.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 212 1900 WerFault.exe 113 -
System Location Discovery: System Language Discovery 1 TTPs 22 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language skotes.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 312bbf8dcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87c51327e6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 00dd496f44.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage 87c51327e6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JKEGDHCFCA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1cf56063ed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1167afa62d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 00dd496f44.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 92957fe4b9.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language 87c51327e6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ccd09dd76a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6aa6770d5d.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 6 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 5984 PING.EXE 1040 PING.EXE 4252 powershell.exe 5296 powershell.exe 1972 PING.EXE 6096 powershell.exe -
Checks processor information in registry 2 TTPs 15 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 1cf56063ed.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 1cf56063ed.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 92957fe4b9.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 92957fe4b9.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 1640 timeout.exe -
Enumerates system info in registry 2 TTPs 8 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Kills process with taskkill 5 IoCs
pid Process 532 taskkill.exe 2012 taskkill.exe 4436 taskkill.exe 4452 taskkill.exe 4960 taskkill.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133786075594298167" chrome.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings firefox.exe -
Runs ping.exe 1 TTPs 3 IoCs
pid Process 1040 PING.EXE 1972 PING.EXE 5984 PING.EXE -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1792 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 58 IoCs
pid Process 2608 file.exe 2608 file.exe 2188 skotes.exe 2188 skotes.exe 4252 powershell.exe 4252 powershell.exe 1900 92957fe4b9.exe 1900 92957fe4b9.exe 4084 312bbf8dcf.exe 4084 312bbf8dcf.exe 1484 87c51327e6.exe 1484 87c51327e6.exe 4236 1cf56063ed.exe 4236 1cf56063ed.exe 4236 1cf56063ed.exe 4236 1cf56063ed.exe 1484 87c51327e6.exe 1484 87c51327e6.exe 4236 1cf56063ed.exe 4236 1cf56063ed.exe 5512 chrome.exe 5512 chrome.exe 5512 chrome.exe 5264 ccd09dd76a.exe 5264 ccd09dd76a.exe 5264 ccd09dd76a.exe 5264 ccd09dd76a.exe 5264 ccd09dd76a.exe 4236 1cf56063ed.exe 4236 1cf56063ed.exe 4236 1cf56063ed.exe 4236 1cf56063ed.exe 5608 msedge.exe 5608 msedge.exe 6056 msedge.exe 6056 msedge.exe 6056 msedge.exe 6056 msedge.exe 5916 msedge.exe 5916 msedge.exe 4236 1cf56063ed.exe 4236 1cf56063ed.exe 4236 1cf56063ed.exe 4236 1cf56063ed.exe 1964 JKEGDHCFCA.exe 1964 JKEGDHCFCA.exe 6040 skotes.exe 6040 skotes.exe 1480 Intel_PTT_EK_Recertification.exe 5296 powershell.exe 5296 powershell.exe 5296 powershell.exe 3592 Intel_PTT_EK_Recertification.exe 5084 skotes.exe 5084 skotes.exe 6096 powershell.exe 6096 powershell.exe 6096 powershell.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 5512 chrome.exe 5512 chrome.exe 5512 chrome.exe 5916 msedge.exe 5916 msedge.exe 5916 msedge.exe 5916 msedge.exe -
Suspicious use of AdjustPrivilegeToken 62 IoCs
description pid Process Token: SeRestorePrivilege 1624 7z.exe Token: 35 1624 7z.exe Token: SeSecurityPrivilege 1624 7z.exe Token: SeSecurityPrivilege 1624 7z.exe Token: SeRestorePrivilege 2488 7z.exe Token: 35 2488 7z.exe Token: SeSecurityPrivilege 2488 7z.exe Token: SeSecurityPrivilege 2488 7z.exe Token: SeRestorePrivilege 4344 7z.exe Token: 35 4344 7z.exe Token: SeSecurityPrivilege 4344 7z.exe Token: SeSecurityPrivilege 4344 7z.exe Token: SeRestorePrivilege 3588 7z.exe Token: 35 3588 7z.exe Token: SeSecurityPrivilege 3588 7z.exe Token: SeSecurityPrivilege 3588 7z.exe Token: SeRestorePrivilege 3088 7z.exe Token: 35 3088 7z.exe Token: SeSecurityPrivilege 3088 7z.exe Token: SeSecurityPrivilege 3088 7z.exe Token: SeRestorePrivilege 448 7z.exe Token: 35 448 7z.exe Token: SeSecurityPrivilege 448 7z.exe Token: SeSecurityPrivilege 448 7z.exe Token: SeRestorePrivilege 3668 7z.exe Token: 35 3668 7z.exe Token: SeSecurityPrivilege 3668 7z.exe Token: SeSecurityPrivilege 3668 7z.exe Token: SeRestorePrivilege 3620 7z.exe Token: 35 3620 7z.exe Token: SeSecurityPrivilege 3620 7z.exe Token: SeSecurityPrivilege 3620 7z.exe Token: SeDebugPrivilege 4252 powershell.exe Token: SeDebugPrivilege 532 taskkill.exe Token: SeDebugPrivilege 2012 taskkill.exe Token: SeDebugPrivilege 4436 taskkill.exe Token: SeDebugPrivilege 4452 taskkill.exe Token: SeDebugPrivilege 4960 taskkill.exe Token: SeDebugPrivilege 1800 firefox.exe Token: SeDebugPrivilege 1800 firefox.exe Token: SeShutdownPrivilege 5512 chrome.exe Token: SeCreatePagefilePrivilege 5512 chrome.exe Token: SeShutdownPrivilege 5512 chrome.exe Token: SeCreatePagefilePrivilege 5512 chrome.exe Token: SeShutdownPrivilege 5512 chrome.exe Token: SeCreatePagefilePrivilege 5512 chrome.exe Token: SeDebugPrivilege 5264 ccd09dd76a.exe Token: SeShutdownPrivilege 5512 chrome.exe Token: SeCreatePagefilePrivilege 5512 chrome.exe Token: SeShutdownPrivilege 5512 chrome.exe Token: SeCreatePagefilePrivilege 5512 chrome.exe Token: SeShutdownPrivilege 5512 chrome.exe Token: SeCreatePagefilePrivilege 5512 chrome.exe Token: SeShutdownPrivilege 5512 chrome.exe Token: SeCreatePagefilePrivilege 5512 chrome.exe Token: SeLockMemoryPrivilege 6084 explorer.exe Token: SeDebugPrivilege 5296 powershell.exe Token: SeDebugPrivilege 6096 powershell.exe Token: SeLockMemoryPrivilege 3728 explorer.exe Token: SeDebugPrivilege 1800 firefox.exe Token: SeDebugPrivilege 1800 firefox.exe Token: SeDebugPrivilege 1800 firefox.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2608 file.exe 1484 87c51327e6.exe 1484 87c51327e6.exe 1484 87c51327e6.exe 1484 87c51327e6.exe 1484 87c51327e6.exe 1484 87c51327e6.exe 1484 87c51327e6.exe 1800 firefox.exe 1800 firefox.exe 1800 firefox.exe 1800 firefox.exe 1800 firefox.exe 1800 firefox.exe 1800 firefox.exe 1800 firefox.exe 1800 firefox.exe 1800 firefox.exe 1800 firefox.exe 1800 firefox.exe 1800 firefox.exe 1800 firefox.exe 1800 firefox.exe 1800 firefox.exe 1800 firefox.exe 1800 firefox.exe 1800 firefox.exe 1800 firefox.exe 1800 firefox.exe 1484 87c51327e6.exe 1484 87c51327e6.exe 1484 87c51327e6.exe 1484 87c51327e6.exe 5512 chrome.exe 5512 chrome.exe 5512 chrome.exe 5512 chrome.exe 5512 chrome.exe 5512 chrome.exe 5512 chrome.exe 5512 chrome.exe 5512 chrome.exe 5512 chrome.exe 5512 chrome.exe 5512 chrome.exe 5512 chrome.exe 5512 chrome.exe 5512 chrome.exe 5512 chrome.exe 5512 chrome.exe 5512 chrome.exe 5512 chrome.exe 5512 chrome.exe 5512 chrome.exe 5512 chrome.exe 5512 chrome.exe 5512 chrome.exe 5512 chrome.exe 5512 chrome.exe 5916 msedge.exe 5916 msedge.exe 5916 msedge.exe 5916 msedge.exe 5916 msedge.exe -
Suspicious use of SendNotifyMessage 31 IoCs
pid Process 1484 87c51327e6.exe 1484 87c51327e6.exe 1484 87c51327e6.exe 1484 87c51327e6.exe 1484 87c51327e6.exe 1484 87c51327e6.exe 1484 87c51327e6.exe 1800 firefox.exe 1800 firefox.exe 1800 firefox.exe 1800 firefox.exe 1800 firefox.exe 1800 firefox.exe 1800 firefox.exe 1800 firefox.exe 1800 firefox.exe 1800 firefox.exe 1800 firefox.exe 1800 firefox.exe 1800 firefox.exe 1800 firefox.exe 1800 firefox.exe 1800 firefox.exe 1800 firefox.exe 1800 firefox.exe 1800 firefox.exe 1800 firefox.exe 1484 87c51327e6.exe 1484 87c51327e6.exe 1484 87c51327e6.exe 1484 87c51327e6.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1800 firefox.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2608 wrote to memory of 2188 2608 file.exe 82 PID 2608 wrote to memory of 2188 2608 file.exe 82 PID 2608 wrote to memory of 2188 2608 file.exe 82 PID 2188 wrote to memory of 536 2188 skotes.exe 83 PID 2188 wrote to memory of 536 2188 skotes.exe 83 PID 2188 wrote to memory of 536 2188 skotes.exe 83 PID 536 wrote to memory of 548 536 1167afa62d.exe 84 PID 536 wrote to memory of 548 536 1167afa62d.exe 84 PID 548 wrote to memory of 4920 548 cmd.exe 86 PID 548 wrote to memory of 4920 548 cmd.exe 86 PID 548 wrote to memory of 1624 548 cmd.exe 87 PID 548 wrote to memory of 1624 548 cmd.exe 87 PID 548 wrote to memory of 2488 548 cmd.exe 88 PID 548 wrote to memory of 2488 548 cmd.exe 88 PID 548 wrote to memory of 4344 548 cmd.exe 89 PID 548 wrote to memory of 4344 548 cmd.exe 89 PID 548 wrote to memory of 3588 548 cmd.exe 90 PID 548 wrote to memory of 3588 548 cmd.exe 90 PID 548 wrote to memory of 3088 548 cmd.exe 91 PID 548 wrote to memory of 3088 548 cmd.exe 91 PID 548 wrote to memory of 448 548 cmd.exe 92 PID 548 wrote to memory of 448 548 cmd.exe 92 PID 548 wrote to memory of 3668 548 cmd.exe 93 PID 548 wrote to memory of 3668 548 cmd.exe 93 PID 548 wrote to memory of 3620 548 cmd.exe 94 PID 548 wrote to memory of 3620 548 cmd.exe 94 PID 548 wrote to memory of 4036 548 cmd.exe 95 PID 548 wrote to memory of 4036 548 cmd.exe 95 PID 548 wrote to memory of 932 548 cmd.exe 96 PID 548 wrote to memory of 932 548 cmd.exe 96 PID 932 wrote to memory of 3572 932 in.exe 97 PID 932 wrote to memory of 3572 932 in.exe 97 PID 932 wrote to memory of 1660 932 in.exe 98 PID 932 wrote to memory of 1660 932 in.exe 98 PID 932 wrote to memory of 1792 932 in.exe 99 PID 932 wrote to memory of 1792 932 in.exe 99 PID 932 wrote to memory of 4252 932 in.exe 100 PID 932 wrote to memory of 4252 932 in.exe 100 PID 4252 wrote to memory of 1040 4252 powershell.exe 105 PID 4252 wrote to memory of 1040 4252 powershell.exe 105 PID 2188 wrote to memory of 4240 2188 skotes.exe 106 PID 2188 wrote to memory of 4240 2188 skotes.exe 106 PID 2188 wrote to memory of 4240 2188 skotes.exe 106 PID 4240 wrote to memory of 3592 4240 00dd496f44.exe 108 PID 4240 wrote to memory of 3592 4240 00dd496f44.exe 108 PID 4240 wrote to memory of 3592 4240 00dd496f44.exe 108 PID 4240 wrote to memory of 3592 4240 00dd496f44.exe 108 PID 4240 wrote to memory of 3592 4240 00dd496f44.exe 108 PID 4240 wrote to memory of 3592 4240 00dd496f44.exe 108 PID 4240 wrote to memory of 3592 4240 00dd496f44.exe 108 PID 4240 wrote to memory of 3592 4240 00dd496f44.exe 108 PID 4240 wrote to memory of 3592 4240 00dd496f44.exe 108 PID 4240 wrote to memory of 3592 4240 00dd496f44.exe 108 PID 2188 wrote to memory of 1900 2188 skotes.exe 113 PID 2188 wrote to memory of 1900 2188 skotes.exe 113 PID 2188 wrote to memory of 1900 2188 skotes.exe 113 PID 2188 wrote to memory of 4084 2188 skotes.exe 115 PID 2188 wrote to memory of 4084 2188 skotes.exe 115 PID 2188 wrote to memory of 4084 2188 skotes.exe 115 PID 1900 wrote to memory of 2216 1900 92957fe4b9.exe 118 PID 1900 wrote to memory of 2216 1900 92957fe4b9.exe 118 PID 1900 wrote to memory of 2216 1900 92957fe4b9.exe 118 PID 2216 wrote to memory of 1640 2216 cmd.exe 122 PID 2216 wrote to memory of 1640 2216 cmd.exe 122 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Views/modifies file attributes 1 TTPs 3 IoCs
pid Process 1660 attrib.exe 3572 attrib.exe 4036 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\1014980001\1167afa62d.exe"C:\Users\Admin\AppData\Local\Temp\1014980001\1167afa62d.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:536 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"4⤵
- Suspicious use of WriteProcessMemory
PID:548 -
C:\Windows\system32\mode.commode 65,105⤵PID:4920
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e file.zip -p24291711423417250691697322505 -oextracted5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1624
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_7.zip -oextracted5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2488
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_6.zip -oextracted5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:4344
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_5.zip -oextracted5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:3588
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_4.zip -oextracted5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:3088
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_3.zip -oextracted5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:448
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_2.zip -oextracted5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:3668
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_1.zip -oextracted5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:3620
-
-
C:\Windows\system32\attrib.exeattrib +H "in.exe"5⤵
- Views/modifies file attributes
PID:4036
-
-
C:\Users\Admin\AppData\Local\Temp\main\in.exe"in.exe"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:932 -
C:\Windows\SYSTEM32\attrib.exeattrib +H +S C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe6⤵
- Views/modifies file attributes
PID:3572
-
-
C:\Windows\SYSTEM32\attrib.exeattrib +H C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe6⤵
- Views/modifies file attributes
PID:1660
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE6⤵
- Scheduled Task/Job: Scheduled Task
PID:1792
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell ping 127.0.0.1; del in.exe6⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Windows\system32\PING.EXE"C:\Windows\system32\PING.EXE" 127.0.0.17⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:1040
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1014981001\00dd496f44.exe"C:\Users\Admin\AppData\Local\Temp\1014981001\00dd496f44.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4240 -
C:\Users\Admin\AppData\Local\Temp\1014981001\00dd496f44.exe"C:\Users\Admin\AppData\Local\Temp\1014981001\00dd496f44.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3592
-
-
-
C:\Users\Admin\AppData\Local\Temp\1014982001\92957fe4b9.exe"C:\Users\Admin\AppData\Local\Temp\1014982001\92957fe4b9.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\Admin\AppData\Local\Temp\1014982001\92957fe4b9.exe" & rd /s /q "C:\ProgramData\ZUKFK6PZ58YM" & exit4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Windows\SysWOW64\timeout.exetimeout /t 105⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:1640
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1900 -s 19964⤵
- Program crash
PID:212
-
-
-
C:\Users\Admin\AppData\Local\Temp\1014983001\312bbf8dcf.exe"C:\Users\Admin\AppData\Local\Temp\1014983001\312bbf8dcf.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4084
-
-
C:\Users\Admin\AppData\Local\Temp\1014984001\87c51327e6.exe"C:\Users\Admin\AppData\Local\Temp\1014984001\87c51327e6.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1484 -
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM firefox.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:532
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM chrome.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2012
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM msedge.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4436
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM opera.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4452
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM brave.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4960
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking4⤵PID:404
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking5⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1800 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1984 -parentBuildID 20240401114208 -prefsHandle 1900 -prefMapHandle 1892 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {63698c7b-7ab4-4d8d-bc4f-dfe7a273a018} 1800 "\\.\pipe\gecko-crash-server-pipe.1800" gpu6⤵PID:3776
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2468 -parentBuildID 20240401114208 -prefsHandle 2460 -prefMapHandle 2448 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0b434711-07ac-403d-a0d2-4b47b945aa7a} 1800 "\\.\pipe\gecko-crash-server-pipe.1800" socket6⤵PID:228
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1740 -childID 1 -isForBrowser -prefsHandle 3088 -prefMapHandle 1800 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fe793a68-caa8-47f7-b9ca-73357b49dda8} 1800 "\\.\pipe\gecko-crash-server-pipe.1800" tab6⤵PID:932
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3908 -childID 2 -isForBrowser -prefsHandle 3900 -prefMapHandle 3896 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9479c6f3-a568-4af6-a2bb-5a38035e1589} 1800 "\\.\pipe\gecko-crash-server-pipe.1800" tab6⤵PID:4192
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4708 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4716 -prefMapHandle 4692 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {28f9d0d4-6c98-4118-a00a-4fb46e152aea} 1800 "\\.\pipe\gecko-crash-server-pipe.1800" utility6⤵
- Checks processor information in registry
PID:5536
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5504 -childID 3 -isForBrowser -prefsHandle 5496 -prefMapHandle 5484 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {703c37d0-402a-41b9-9d84-5a7bf893f2b0} 1800 "\\.\pipe\gecko-crash-server-pipe.1800" tab6⤵PID:5616
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5636 -childID 4 -isForBrowser -prefsHandle 5644 -prefMapHandle 5648 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {31d0a98d-ccc1-4c3b-9ca9-d8fc374d702a} 1800 "\\.\pipe\gecko-crash-server-pipe.1800" tab6⤵PID:4400
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5828 -childID 5 -isForBrowser -prefsHandle 5836 -prefMapHandle 5840 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b0dbaeb9-c0dc-4f6b-9d95-62d5a25d1cea} 1800 "\\.\pipe\gecko-crash-server-pipe.1800" tab6⤵PID:2816
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1014985001\1cf56063ed.exe"C:\Users\Admin\AppData\Local\Temp\1014985001\1cf56063ed.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:4236 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""4⤵
- Uses browser remote debugging
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5512 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffbf04bcc40,0x7ffbf04bcc4c,0x7ffbf04bcc585⤵PID:5532
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1984,i,8010470417221146577,17525441413856438739,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1980 /prefetch:25⤵PID:5860
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1852,i,8010470417221146577,17525441413856438739,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2020 /prefetch:35⤵PID:5868
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2260,i,8010470417221146577,17525441413856438739,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2460 /prefetch:85⤵PID:6040
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3164,i,8010470417221146577,17525441413856438739,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3176 /prefetch:15⤵
- Uses browser remote debugging
PID:5140
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3184,i,8010470417221146577,17525441413856438739,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3216 /prefetch:15⤵
- Uses browser remote debugging
PID:3064
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4460,i,8010470417221146577,17525441413856438739,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4464 /prefetch:15⤵
- Uses browser remote debugging
PID:5304
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4772,i,8010470417221146577,17525441413856438739,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4796 /prefetch:85⤵PID:1196
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4812,i,8010470417221146577,17525441413856438739,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4824 /prefetch:85⤵PID:1640
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"4⤵
- Uses browser remote debugging
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
PID:5916 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc02b446f8,0x7ffc02b44708,0x7ffc02b447185⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:6056
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,4178183144183255088,8105152329409965000,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:25⤵PID:5600
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,4178183144183255088,8105152329409965000,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:35⤵
- Suspicious behavior: EnumeratesProcesses
PID:5608
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,4178183144183255088,8105152329409965000,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2784 /prefetch:85⤵PID:5388
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2124,4178183144183255088,8105152329409965000,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3156 /prefetch:15⤵
- Uses browser remote debugging
PID:6068
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2124,4178183144183255088,8105152329409965000,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3164 /prefetch:15⤵
- Uses browser remote debugging
PID:5700
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2124,4178183144183255088,8105152329409965000,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4444 /prefetch:15⤵
- Uses browser remote debugging
PID:5300
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2124,4178183144183255088,8105152329409965000,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4588 /prefetch:15⤵
- Uses browser remote debugging
PID:5392
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\Documents\JKEGDHCFCA.exe"4⤵
- System Location Discovery: System Language Discovery
PID:5368 -
C:\Users\Admin\Documents\JKEGDHCFCA.exe"C:\Users\Admin\Documents\JKEGDHCFCA.exe"5⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1964
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1014986001\ccd09dd76a.exe"C:\Users\Admin\AppData\Local\Temp\1014986001\ccd09dd76a.exe"3⤵
- Modifies Windows Defender Real-time Protection settings
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Windows security modification
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5264
-
-
C:\Users\Admin\AppData\Local\Temp\1014987001\6aa6770d5d.exe"C:\Users\Admin\AppData\Local\Temp\1014987001\6aa6770d5d.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4304
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1900 -ip 19001⤵PID:4280
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵PID:3888
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:6108
-
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exeC:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:6040
-
C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exeC:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:1480 -
C:\Windows\explorer.exeexplorer.exe2⤵
- Suspicious use of AdjustPrivilegeToken
PID:6084
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe2⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5296 -
C:\Windows\system32\PING.EXE"C:\Windows\system32\PING.EXE" 127.1.10.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:1972
-
-
-
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exeC:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5084
-
C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exeC:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:3592 -
C:\Windows\explorer.exeexplorer.exe2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3728
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe2⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6096 -
C:\Windows\system32\PING.EXE"C:\Windows\system32\PING.EXE" 127.1.10.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:5984
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Modify Authentication Process
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Impair Defenses
2Disable or Modify Tools
2Modify Authentication Process
1Modify Registry
3Virtualization/Sandbox Evasion
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Modify Authentication Process
1Steal Web Session Cookie
1Unsecured Credentials
4Credentials In Files
4Discovery
Browser Information Discovery
1Query Registry
8Remote System Discovery
1System Information Discovery
5System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1Virtualization/Sandbox Evasion
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
593KB
MD5c8fd9be83bc728cc04beffafc2907fe9
SHA195ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
-
Filesize
2.0MB
MD51cc453cdf74f31e4d913ff9c10acdde2
SHA16e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
-
Filesize
649B
MD50f739d5ed52060116c18405fbdff0375
SHA19a6c388a2fa00052cfa779b7a22517120d8c64e0
SHA256829d92e2275cf78114fb4f4f68e642b8286607d5c18859cbb4445ff6e4fe197d
SHA512afeb85d137bbbd932c452f55f0c8287754e2cd127e5caeb18697993d83b9b83591cd82313a14e3605eb98342422ce0f5bc19a9573dd135b37dddd5bd5920e236
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
152B
MD5a0486d6f8406d852dd805b66ff467692
SHA177ba1f63142e86b21c951b808f4bc5d8ed89b571
SHA256c0745fd195f3a51b27e4d35a626378a62935dccebefb94db404166befd68b2be
SHA512065a62032eb799fade5fe75f390e7ab3c9442d74cb8b520d846662d144433f39b9186b3ef3db3480cd1d1d655d8f0630855ed5d6e85cf157a40c38a19375ed8a
-
Filesize
152B
MD5dc058ebc0f8181946a312f0be99ed79c
SHA10c6f376ed8f2d4c275336048c7c9ef9edf18bff0
SHA256378701e87dcff90aa092702bc299859d6ae8f7e313f773bf594f81df6f40bf6a
SHA51236e0de64a554762b28045baebf9f71930c59d608f8d05c5faf8906d62eaf83f6d856ef1d1b38110e512fbb1a85d3e2310be11a7f679c6b5b3c62313cc7af52aa
-
Filesize
5KB
MD5ffca1caafd0ab4495e45382795da8e5d
SHA17ced3d5a5786aeacf3eebd5aeffe847679082337
SHA2561dfc331339deba4b3d69103437af11574474a91d85c2c2074525b3f1082fa9b3
SHA512631e3bc7c1e69fa302c3d7599a613816f982d9fc956b0dc983e34ece67802e5da98248f1e58b2a2e9313fc2905e0701fa2e63037b3021e88047e05b0641635d4
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\7fmsgkth.default-release\activity-stream.discovery_stream.json
Filesize19KB
MD5d981bd4c089174d6daf50f0e5986c43a
SHA16c697f8094d0c2fe89e49507ed51c4b816549c46
SHA256778d035dd7a1a2785af41ae183b1a92fc3bd7220a1ad18458c8b58d417839c87
SHA512115106c5e3ef0327e2a402a027d10583aa13179cef9d6895cd4d6f55bab8e322ce0113b2b9cf63f501f541c00ba61bd43235ef8aec124d4ef43f1105195068c4
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\7fmsgkth.default-release\cache2\entries\92F4D5A4F9CED6E2E644D803AEE3647A0EA4D984
Filesize13KB
MD5c9a1be4f19dd21233055b6fafb6f98f4
SHA1e5501b0285a7bf5ba1f647dd47756a6adae8a507
SHA2563ae9fa329a70206e7a323fb3a0a8324038fa74535b3b6399faa1633d60b188a7
SHA5122c240ef8132848f5f4a697abf535362b569f7c7236dcbff9723a8760ed7d2e181a75115c557e079f9dd00015d4626e0a22d312847f1520b00429be631c22cadf
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\7fmsgkth.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
Filesize15KB
MD596c542dec016d9ec1ecc4dddfcbaac66
SHA16199f7648bb744efa58acf7b96fee85d938389e4
SHA2567f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798
SHA512cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658
-
Filesize
4.2MB
MD53a425626cbd40345f5b8dddd6b2b9efa
SHA17b50e108e293e54c15dce816552356f424eea97a
SHA256ba9212d2d5cd6df5eb7933fb37c1b72a648974c1730bf5c32439987558f8e8b1
SHA512a7538c6b7e17c35f053721308b8d6dc53a90e79930ff4ed5cffecaa97f4d0fbc5f9e8b59f1383d8f0699c8d4f1331f226af71d40325022d10b885606a72fe668
-
Filesize
710KB
MD528e568616a7b792cac1726deb77d9039
SHA139890a418fb391b823ed5084533e2e24dff021e1
SHA2569597798f7789adc29fbe97707b1bd8ca913c4d5861b0ad4fdd6b913af7c7a8e2
SHA51285048799e6d2756f1d6af77f34e6a1f454c48f2f43042927845931b7ecff2e5de45f864627a3d4aa061252401225bbb6c2caa8532320ccbe401e97c9c79ac8e5
-
Filesize
384KB
MD5dfd5f78a711fa92337010ecc028470b4
SHA11a389091178f2be8ce486cd860de16263f8e902e
SHA256da96f2eb74e60de791961ef3800c36a5e12202fe97ae5d2fcfc1fe404bc13c0d
SHA512a3673074919039a2dc854b0f91d1e1a69724056594e33559741f53594e0f6e61e3d99ec664d541b17f09ffdebc2de1b042eec19ca8477fac86359c703f8c9656
-
Filesize
1.9MB
MD5d06c235aff40e13989582be7ff528a14
SHA151ee74eb591a925fbdf35e6b66c109d9b7e8609e
SHA25669615a4a7d21f3a65247576820e03cd986b8180382d8944f0035009da62eeee6
SHA512bbb4e0290491fcd7b7c456be530e7e9124e4263044fcb8a61db919bd33de3455c4c60c9fb35f8df14e91e09a295c3ecffc0c26d73931735361faedb225c9f867
-
Filesize
946KB
MD5d8728863c82f9ebc986f3d7833cc01fe
SHA1b0a83ef38e9cff7ee8b283968f424fe11f177720
SHA256e23d4c11adf5509ebb231c0f9c0f8b8aade3bc664da7af7022adb09a5001ed28
SHA51242c1d6660fd33fab48417f1664e1412324845aeb7bdc45b0e51b30da25242f6beaa90148e6ad80f427b8438f6afb670ba136929b70bd968b23a833af7a987326
-
Filesize
1.7MB
MD5011b8ef391bffb8402c5a40431fe52a4
SHA1529698247ad752e253e8a3f92fcd0e466613f166
SHA25605f4645f9300276165704abbcba9c7ea06e840c323fbb5d69bdd261106caf029
SHA512dc337a4ab409da7c03762e2cf4d34f2feb6fd1ac058506b9a029b865bd77cdb0d9bb37562f11b24824f2dddf53f38f0d60a8b790c85b3bebd173019fcbf177fd
-
Filesize
2.8MB
MD55e1a91d2d015d67004518b0e100377ac
SHA1f3477a9d94facee6442dd93a3f16789a9bfccfd5
SHA256b203eeb89870ba428cd79ee4165c724187afcd3624ac8f2e416e94860fc1ac84
SHA512f25af880e4485ee2730ac563333d7e8a35d15e3f1b7dffc8174c6ca43e82aefc149c956070abaabb3695cd2aef3d59528ebf239701863d81e6c629ceac360fc5
-
Filesize
2.5MB
MD52a78ce9f3872f5e591d643459cabe476
SHA19ac947dfc71a868bc9c2eb2bd78dfb433067682e
SHA25621a2ac44acd7a640735870eebfd04b8dc57bc66877cb5be3b929299e86a43dae
SHA51203e2cd8161a1394ee535a2ea7d197791ab715d69a02ffab98121ec5ac8150d2b17a9a32a59307042c4bbeffad7425b55efa047651de6ed39277dba80711454f9
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
3.0MB
MD5691c2dd42261c667ef6ca6844f8a56ca
SHA1252755b9c7ed1ab5ce27826cfd6eca4956bd6ded
SHA25671da7d1635f8d6162009ae77943109bf19b0ff32de0e12b4e6079901fd750b8e
SHA5124a291dd8cd92399c726b2b835a6f11d6d5a913b12197a44a82de152845f0f2c8caeedccdd18ac729cbd1a3bd23f1ed5afd8f18d257ab02021811db027bc30899
-
Filesize
1.6MB
MD572491c7b87a7c2dd350b727444f13bb4
SHA11e9338d56db7ded386878eab7bb44b8934ab1bc7
SHA25634ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891
SHA512583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511
-
Filesize
458KB
MD5619f7135621b50fd1900ff24aade1524
SHA16c7ea8bbd435163ae3945cbef30ef6b9872a4591
SHA256344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2
SHA5122c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628
-
Filesize
2.2MB
MD5579a63bebccbacab8f14132f9fc31b89
SHA1fca8a51077d352741a9c1ff8a493064ef5052f27
SHA2560ac3504d5fa0460cae3c0fd9c4b628e1a65547a60563e6d1f006d17d5a6354b0
SHA5124a58ca0f392187a483b9ef652b6e8b2e60d01daa5d331549df9f359d2c0a181e975cf9df79552e3474b9d77f8e37a1cf23725f32d4cdbe4885e257a7625f7b1f
-
Filesize
1.7MB
MD55659eba6a774f9d5322f249ad989114a
SHA14bfb12aa98a1dc2206baa0ac611877b815810e4c
SHA256e04346fee15c3f98387a3641e0bba2e555a5a9b0200e4b9256b1b77094069ae4
SHA512f93abf2787b1e06ce999a0cbc67dc787b791a58f9ce20af5587b2060d663f26be9f648d116d9ca279af39299ea5d38e3c86271297e47c1438102ca28fce8edc4
-
Filesize
1.7MB
MD55404286ec7853897b3ba00adf824d6c1
SHA139e543e08b34311b82f6e909e1e67e2f4afec551
SHA256ec94a6666a3103ba6be60b92e843075a2d7fe7d30fa41099c3f3b1e2a5eba266
SHA512c4b78298c42148d393feea6c3941c48def7c92ef0e6baac99144b083937d0a80d3c15bd9a0bf40daa60919968b120d62999fa61af320e507f7e99fbfe9b9ef30
-
Filesize
1.7MB
MD55eb39ba3698c99891a6b6eb036cfb653
SHA1d2f1cdd59669f006a2f1aa9214aeed48bc88c06e
SHA256e77f5e03ae140dda27d73e1ffe43f7911e006a108cf51cbd0e05d73aa92da7c2
SHA5126c4ca20e88d49256ed9cabec0d1f2b00dfcf3d1603b5c95d158d4438c9f1e58495f8dfa200dbe7f49b5b0dd57886517eb3b98c4190484548720dad4b3db6069e
-
Filesize
1.7MB
MD57187cc2643affab4ca29d92251c96dee
SHA1ab0a4de90a14551834e12bb2c8c6b9ee517acaf4
SHA256c7e92a1af295307fb92ad534e05fba879a7cf6716f93aefca0ebfcb8cee7a830
SHA51227985d317a5c844871ffb2527d04aa50ef7442b2f00d69d5ab6bbb85cd7be1d7057ffd3151d0896f05603677c2f7361ed021eac921e012d74da049ef6949e3a3
-
Filesize
1.7MB
MD5b7d1e04629bec112923446fda5391731
SHA1814055286f963ddaa5bf3019821cb8a565b56cb8
SHA2564da77d4ee30ad0cd56cd620f4e9dc4016244ace015c5b4b43f8f37dd8e3a8789
SHA51279fc3606b0fe6a1e31a2ecacc96623caf236bf2be692dadab6ea8ffa4af4231d782094a63b76631068364ac9b6a872b02f1e080636eba40ed019c2949a8e28db
-
Filesize
1.7MB
MD50dc4014facf82aa027904c1be1d403c1
SHA15e6d6c020bfc2e6f24f3d237946b0103fe9b1831
SHA256a29ddd29958c64e0af1a848409e97401307277bb6f11777b1cfb0404a6226de7
SHA512cbeead189918657cc81e844ed9673ee8f743aed29ad9948e90afdfbecacc9c764fbdbfb92e8c8ceb5ae47cee52e833e386a304db0572c7130d1a54fd9c2cc028
-
Filesize
3.3MB
MD5cea368fc334a9aec1ecff4b15612e5b0
SHA1493d23f72731bb570d904014ffdacbba2334ce26
SHA25607e38cad68b0cdbea62f55f9bc6ee80545c2e1a39983baa222e8af788f028541
SHA512bed35a1cc56f32e0109ea5a02578489682a990b5cefa58d7cf778815254af9849e731031e824adba07c86c8425df58a1967ac84ce004c62e316a2e51a75c8748
-
Filesize
3.3MB
MD5045b0a3d5be6f10ddf19ae6d92dfdd70
SHA10387715b6681d7097d372cd0005b664f76c933c7
SHA25694b392e94fa47d1b9b7ae6a29527727268cc2e3484e818c23608f8835bc1104d
SHA51258255a755531791b888ffd9b663cc678c63d5caa932260e9546b1b10a8d54208334725c14529116b067bcf5a5e02da85e015a3bed80092b7698a43dab0168c7b
-
Filesize
1.7MB
MD583d75087c9bf6e4f07c36e550731ccde
SHA1d5ff596961cce5f03f842cfd8f27dde6f124e3ae
SHA25646db3164bebffc61c201fe1e086bffe129ddfed575e6d839ddb4f9622963fb3f
SHA512044e1f5507e92715ce9df8bb802e83157237a2f96f39bac3b6a444175f1160c4d82f41a0bcecf5feaf1c919272ed7929baef929a8c3f07deecebc44b0435164a
-
Filesize
440B
MD53626532127e3066df98e34c3d56a1869
SHA15fa7102f02615afde4efd4ed091744e842c63f78
SHA2562a0e18ef585db0802269b8c1ddccb95ce4c0bac747e207ee6131dee989788bca
SHA512dcce66d6e24d5a4a352874144871cd73c327e04c1b50764399457d8d70a9515f5bc0a650232763bf34d4830bab70ee4539646e7625cfe5336a870e311043b2bd
-
Filesize
479KB
MD509372174e83dbbf696ee732fd2e875bb
SHA1ba360186ba650a769f9303f48b7200fb5eaccee1
SHA256c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
SHA512b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
-
Filesize
13.8MB
MD50a8747a2ac9ac08ae9508f36c6d75692
SHA1b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA25632d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
SHA51259521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\AlternateServices.bin
Filesize6KB
MD52f2c4d09c334d06a4e09707ce4ef25d1
SHA12f9fd1811df478a9ca9463bf109957447f4c532b
SHA2569d7f4c05cfab92db3e83f5d5bff52779bf2ced4f82b52c693d9dc6b30098d16b
SHA512248fb1860f96daaf6f823971ef1d9d686b348e040a68208b2f38949691a61acf51d56e903fe4f7d00626d6131eae567b7f9e2655c84d0c48a5f573dc894092f6
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\AlternateServices.bin
Filesize18KB
MD5752e493c53c46aff5f8b6b8b64db330e
SHA1e6de51903b989ef1357d5ef27b01a74c99dd87b1
SHA256fd09f360442253b198ec788d14d853c6f1d6b96e451e9c7c364a63772f947bb3
SHA512aa0d6238b94336e551155ff73421d1d6a405da490872c4863422a9c0343d6ac301e3cdf978ca55da65f3b189b3034438f1039f796dfa4ceff6aba5edc94bad09
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\AlternateServices.bin
Filesize10KB
MD5193b0f7ce2b03da2f2c435cadfbd22b7
SHA168b8ecb40d09381b58b98f31a357cea2d5f8e763
SHA25609bba0601289a614f3fcda6a58f89618944a1e466a5c4856c43dba2132ba932c
SHA5129d2d1e70f8c16255c1973e83b43c8c434d6c4be7ce31000b554282b3fda5abd764b2b1b8f7ef46beda777e8c80f92b413af0b956536e2cf2cf3425fb51916dc0
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\datareporting\glean\db\data.safe.tmp
Filesize15KB
MD58e5f270123f068e60e3e65a60fb25eed
SHA19fdbf0faf0b883c914ea9a1083f7d48d0d0608cf
SHA256d116fa709db3b410db283b7fe1bc2721d5550694c5be13e0b3dad68d56f2fb30
SHA51288571bf2d797572d23621f62e02631e1c5ef770e97bd2e126c1c4c317e1ec97b91a152955b97d04f5945263810106446eb188bbeef86d8e36b4f2d620bc97f32
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\datareporting\glean\db\data.safe.tmp
Filesize6KB
MD578116bc5288b7510d57b115e48a1ac0f
SHA10fb59c7ff8c18e9b815fa84e29c9e7a8a2456f72
SHA2562a2b8a25b8818d164f95d78e26f4b90d37bc47e2c4dca4a9ab960654582f26c7
SHA512845aaa9f4d28ab32820fac836b590fa85a65cb69ae4116a5aa262d3988094b3e35ed40b8773bd0509572262d26259ffa56cf8121dae36d31e9a3fa8621629bfd
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\datareporting\glean\db\data.safe.tmp
Filesize5KB
MD5a89a265b592d6106a842d38f5226bbe5
SHA1595c145e439c909a1b791d699698733423b63c66
SHA2565c558f5e9057b4f12da7bb067ea1d032f13f2b1dc4ce9531a4b7a9a23198fb76
SHA5121f45af8b7466284201f66794a7292083c30bd380c4743f4ccc593ca1d47cb1464c06c3db7d015b91ec2e9426696877352cb4c2ad07f875ef8d100491962cbad9
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\datareporting\glean\db\data.safe.tmp
Filesize15KB
MD574c244b983d0d80f7c64ab842af59423
SHA12b95153e369404c5d698846d417535d5a2be683b
SHA2563e193fb0177659f64826e8e229ae4438fe210240cd594699b1e503d1cd186d45
SHA5124bc3900ac762cfb07ad650055cd863d611b25249e6656887ffa22527f557171037214c7db19301bf18352c178913ff186d0987ea04d1941decf8abc412db2e83
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\datareporting\glean\pending_pings\a7be20af-7407-4f76-9288-0e01b7203a79
Filesize671B
MD5106a346d06a62915be7af64f191427ab
SHA1339444d84cb11516305b81185d9dbe3ea3afd84c
SHA256af9fdd12c9afba5044c86544a4d939b209931776c15f71f7715e9e933bde70e1
SHA512d364b7703ab5af057b39940598958afd682a2fbe6e72b71dcb4e0391fcaeb67fff1c69eb0e982cb46c5b5daba6de61ea890ef54564878fe1bfdd46d585bbbca4
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\datareporting\glean\pending_pings\c9ff44db-cdfc-463e-be7e-5cdb07733632
Filesize982B
MD5a4e5292ba6587bdd6f0aa041a239ae27
SHA100f59285e64363437b1b60c461d6f99bf201a5b1
SHA2560f68e8e6e8cc0b0d8ffde275ace9ab2044af479d67029e5427329bf7e16ff485
SHA51241c8fb1e03b3e05234eb580d466f4ccc72dabe94416078005b0abd643c72ba164207f6b899c4b4fa309e7b672e6315ede1ec2ea73294ba99927e6e7066cbf465
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\datareporting\glean\pending_pings\fac6cbf4-1666-465a-adfe-ecc89989746a
Filesize25KB
MD566978629a51774dc5500be5676faf952
SHA1cd3c17c2392213a0cd77be55b977d0652281c894
SHA2567811d3697bbf231b2942d6409e21adae1e65b126581f19b5de14133a3a338999
SHA512c2fb655edb115331f13b91131c505c49264a97d94ce0e9a6b460a526b2d51bd78a9bfca956179660ccd5a24405c5137dbd8dc8428137eda16ea0a876319fc9b1
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Filesize1.1MB
MD5842039753bf41fa5e11b3a1383061a87
SHA13e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA256d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
SHA512d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Filesize116B
MD52a461e9eb87fd1955cea740a3444ee7a
SHA1b10755914c713f5a4677494dbe8a686ed458c3c5
SHA2564107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
SHA51234f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Filesize372B
MD5bf957ad58b55f64219ab3f793e374316
SHA1a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA256bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
SHA51279c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Filesize17.8MB
MD5daf7ef3acccab478aaa7d6dc1c60f865
SHA1f8246162b97ce4a945feced27b6ea114366ff2ad
SHA256bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
SHA5125840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
-
Filesize
10KB
MD577b607afaa88f8079ed1c1f988b7332f
SHA1374e8bdc3d2ae660f6ad89287a040c9025e78337
SHA2565ff69680e5defe1f3e7162510de9bc31f03dbda1d0ee751b36d27528278c54bd
SHA51284a71bd5fe453b33504d5d814882aaaefa31d4ced08bff3ac4634c6131eacce28fbc519f2c014dcfffada69d35f18819e9f857e023c0b0d9970fb05bf9ef5b5d
-
Filesize
11KB
MD599874804dc511a9532856e70fe509a48
SHA117f5aaadaa75f57637cb035c621b7c9e8c23792a
SHA256ace14ba781c69afb541da12b12a57d07bd047e68c201d67ee74b7a5afb1d1228
SHA5121f78c2e9a0b4e9567faa2d8eb49dcac12a213391e768c68f8b21118ec2687021ba6e52c44e0b6aefaa898e9ef5a6ddb5a4b46548cbabd97663b9e5d32c1e47cc
-
Filesize
11KB
MD5d2dad07bc4b045e4a07d2ec7c95efba8
SHA13c0abb3024b932c09264b54485130e8212f7b8db
SHA2568c6a76dc6061d36b07a577affafb59af201a1afbb5c44c6053e428be31490cd3
SHA51278e0a7a9c106a80dc26d327191718035d1f0dd740c38a9b80aee80242e1bf0da5f32163dbab4d2f0fa744523dfb79bbaaa2f8ebd426d9f626bef3c0a9d71b9df