Analysis
-
max time kernel
141s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
13-12-2024 12:51
Static task
static1
General
-
Target
file.exe
-
Size
3.1MB
-
MD5
197f7a10814e446ee3d649f2509b1608
-
SHA1
a459ec5320318e01318105d8e87e707ea480a4c7
-
SHA256
b4ab50c0c3a89046764d4b805c9c4cf5cbe6ae07aa2eddb5e445c11479a912ce
-
SHA512
b595f5b8de7ecf96cb18f9f1de10bbb4988bb9b6412e1837b49469b78f7f15bbae661b8092b1d46fa6d2bdfeaa5f0e8e0f493c70dbe7d94c66cba325d83e6c85
-
SSDEEP
49152:yZ1m9In5PVRjbnKSoNK1yoJFk/yUXeo7HH4MBQC+kQFw:yZ0In9V1nKR4yiFkqUX0C+9w
Malware Config
Extracted
amadey
4.42
9c9aa5
http://185.215.113.43
-
install_dir
abc3bc1985
-
install_file
skotes.exe
-
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
-
url_paths
/Zu7JuNko/index.php
Extracted
stealc
stok
http://185.215.113.206
-
url_path
/c4becf79229cb002.php
Extracted
lumma
https://drive-connect.cyou/api
Signatures
-
Amadey family
-
Gcleaner family
-
Lumma family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 968376c4b3.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection 968376c4b3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 968376c4b3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" 968376c4b3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 968376c4b3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 968376c4b3.exe -
Stealc family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 8 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ file.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ f4b5923886.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 968376c4b3.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 2547cd7fe9.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ ECBKKKFHCF.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
pid Process 1552 powershell.exe 6060 powershell.exe -
Downloads MZ/PE file
-
Uses browser remote debugging 2 TTPs 15 IoCs
Can be used control the browser and steal sensitive information such as credentials and session cookies.
pid Process 5300 chrome.exe 5288 chrome.exe 5228 chrome.exe 6828 msedge.exe 7116 msedge.exe 6564 msedge.exe 744 msedge.exe 7108 chrome.exe 5596 chrome.exe 5144 chrome.exe 5284 chrome.exe 5560 chrome.exe 6812 msedge.exe 4868 msedge.exe 5416 msedge.exe -
Checks BIOS information in registry 2 TTPs 16 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion ECBKKKFHCF.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion ECBKKKFHCF.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion file.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion f4b5923886.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 968376c4b3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion f4b5923886.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 968376c4b3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion file.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 2547cd7fe9.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 2547cd7fe9.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe -
Checks computer location settings 2 TTPs 5 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation file.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation skotes.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation 9687ed5e81.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation 65b7a94d68.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation f4b5923886.exe -
Executes dropped EXE 26 IoCs
pid Process 1416 skotes.exe 1228 LoaderHRC.exe 1880 LoaderHRC.exe 1584 9687ed5e81.exe 5008 2068849fdc.exe 6860 4fda3ab85a.exe 3988 f4b5923886.exe 1952 968376c4b3.exe 6888 2547cd7fe9.exe 7116 65b7a94d68.exe 5576 7z.exe 4192 7z.exe 1968 7z.exe 4724 7z.exe 5236 7z.exe 5584 7z.exe 5196 7z.exe 7120 7z.exe 6164 in.exe 7080 67e21b6585.exe 6076 67e21b6585.exe 4192 skotes.exe 5936 Intel_PTT_EK_Recertification.exe 1868 ECBKKKFHCF.exe 4264 skotes.exe 4048 Intel_PTT_EK_Recertification.exe -
Identifies Wine through registry keys 2 TTPs 8 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Wine skotes.exe Key opened \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Wine file.exe Key opened \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Wine skotes.exe Key opened \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Wine f4b5923886.exe Key opened \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Wine 968376c4b3.exe Key opened \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Wine 2547cd7fe9.exe Key opened \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Wine skotes.exe Key opened \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Wine ECBKKKFHCF.exe -
Loads dropped DLL 55 IoCs
pid Process 1880 LoaderHRC.exe 1880 LoaderHRC.exe 1880 LoaderHRC.exe 1880 LoaderHRC.exe 1880 LoaderHRC.exe 1880 LoaderHRC.exe 1880 LoaderHRC.exe 1880 LoaderHRC.exe 1880 LoaderHRC.exe 1880 LoaderHRC.exe 1880 LoaderHRC.exe 1880 LoaderHRC.exe 1880 LoaderHRC.exe 1880 LoaderHRC.exe 1880 LoaderHRC.exe 1880 LoaderHRC.exe 1880 LoaderHRC.exe 1880 LoaderHRC.exe 1880 LoaderHRC.exe 1880 LoaderHRC.exe 1880 LoaderHRC.exe 1880 LoaderHRC.exe 1880 LoaderHRC.exe 1880 LoaderHRC.exe 1880 LoaderHRC.exe 1880 LoaderHRC.exe 1880 LoaderHRC.exe 1880 LoaderHRC.exe 1880 LoaderHRC.exe 1880 LoaderHRC.exe 1880 LoaderHRC.exe 1880 LoaderHRC.exe 1880 LoaderHRC.exe 1880 LoaderHRC.exe 1880 LoaderHRC.exe 1880 LoaderHRC.exe 1880 LoaderHRC.exe 1880 LoaderHRC.exe 1880 LoaderHRC.exe 1880 LoaderHRC.exe 1880 LoaderHRC.exe 1880 LoaderHRC.exe 1880 LoaderHRC.exe 1880 LoaderHRC.exe 1880 LoaderHRC.exe 5576 7z.exe 4192 7z.exe 1968 7z.exe 4724 7z.exe 5236 7z.exe 5584 7z.exe 5196 7z.exe 7120 7z.exe 3988 f4b5923886.exe 3988 f4b5923886.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features 968376c4b3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" 968376c4b3.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\f4b5923886.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1014793001\\f4b5923886.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\968376c4b3.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1014794001\\968376c4b3.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Powershell = "\"powershell.exe\" -WindowStyle Hidden -ExecutionPolicy Bypass -File \"C:\\Users\\Admin\\AppData\\Local\\Temp\\FVDdjSmqeZICURB.ps1\"" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\4fda3ab85a.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1014792001\\4fda3ab85a.exe" skotes.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 8 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 278 api.ipify.org 290 api.ipify.org 87 api.ipify.org 88 api.ipify.org 202 api.ipify.org 228 api.ipify.org 233 api.ipify.org 261 api.ipify.org -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/files/0x0007000000023c8c-1604.dat autoit_exe -
Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 2236 tasklist.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs
pid Process 3736 file.exe 1416 skotes.exe 1880 LoaderHRC.exe 3988 f4b5923886.exe 1952 968376c4b3.exe 6888 2547cd7fe9.exe 4192 skotes.exe 1868 ECBKKKFHCF.exe 4264 skotes.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 7080 set thread context of 6076 7080 67e21b6585.exe 298 PID 5936 set thread context of 6168 5936 Intel_PTT_EK_Recertification.exe 283 PID 4048 set thread context of 4356 4048 Intel_PTT_EK_Recertification.exe 323 -
resource yara_rule behavioral2/memory/6164-2204-0x00007FF6560F0000-0x00007FF656580000-memory.dmp upx behavioral2/memory/6164-2207-0x00007FF6560F0000-0x00007FF656580000-memory.dmp upx behavioral2/memory/5936-2284-0x00007FF752C80000-0x00007FF753110000-memory.dmp upx behavioral2/memory/5936-2316-0x00007FF752C80000-0x00007FF753110000-memory.dmp upx behavioral2/memory/4048-4884-0x00007FF752C80000-0x00007FF753110000-memory.dmp upx -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\skotes.job file.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
pid pid_target Process procid_target 2104 1584 WerFault.exe 95 4348 6888 WerFault.exe 207 -
System Location Discovery: System Language Discovery 1 TTPs 22 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage 4fda3ab85a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 65b7a94d68.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ECBKKKFHCF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4fda3ab85a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 968376c4b3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9687ed5e81.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language 4fda3ab85a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f4b5923886.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2547cd7fe9.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 67e21b6585.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language skotes.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 67e21b6585.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2068849fdc.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 6 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 2792 powershell.exe 5204 PING.EXE 5760 powershell.exe 4652 PING.EXE 5696 powershell.exe 3756 PING.EXE -
Checks processor information in registry 2 TTPs 15 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 9687ed5e81.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 9687ed5e81.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 f4b5923886.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString f4b5923886.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz msedge.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 2024 timeout.exe -
Enumerates system info in registry 2 TTPs 11 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Gathers network information 2 TTPs 17 IoCs
Uses commandline utility to view network configuration.
pid Process 5320 ipconfig.exe 1652 ipconfig.exe 2088 ipconfig.exe 3696 ipconfig.exe 5680 ipconfig.exe 6536 ipconfig.exe 6000 ipconfig.exe 6096 ipconfig.exe 6436 ipconfig.exe 5252 ipconfig.exe 5764 ipconfig.exe 6276 ipconfig.exe 4604 ipconfig.exe 5312 ipconfig.exe 6560 ipconfig.exe 6584 ipconfig.exe 5884 ipconfig.exe -
Gathers system information 1 TTPs 7 IoCs
Runs systeminfo.exe.
pid Process 4980 systeminfo.exe 6976 systeminfo.exe 5992 systeminfo.exe 6596 systeminfo.exe 6828 systeminfo.exe 64 systeminfo.exe 6480 systeminfo.exe -
Kills process with taskkill 7 IoCs
pid Process 4224 taskkill.exe 5056 taskkill.exe 4820 taskkill.exe 3900 taskkill.exe 6928 taskkill.exe 5592 taskkill.exe 1632 taskkill.exe -
Modifies data under HKEY_USERS 3 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133785678878014803" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings firefox.exe -
Runs ping.exe 1 TTPs 3 IoCs
pid Process 3756 PING.EXE 5204 PING.EXE 4652 PING.EXE -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2532 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3736 file.exe 3736 file.exe 1416 skotes.exe 1416 skotes.exe 1880 LoaderHRC.exe 1880 LoaderHRC.exe 1880 LoaderHRC.exe 1880 LoaderHRC.exe 5840 msedge.exe 5840 msedge.exe 7108 chrome.exe 7108 chrome.exe 1584 9687ed5e81.exe 1584 9687ed5e81.exe 1880 LoaderHRC.exe 1880 LoaderHRC.exe 1880 LoaderHRC.exe 1880 LoaderHRC.exe 1880 LoaderHRC.exe 1880 LoaderHRC.exe 1880 LoaderHRC.exe 1880 LoaderHRC.exe 1880 LoaderHRC.exe 1880 LoaderHRC.exe 1880 LoaderHRC.exe 1880 LoaderHRC.exe 1880 LoaderHRC.exe 1880 LoaderHRC.exe 1880 LoaderHRC.exe 1880 LoaderHRC.exe 1880 LoaderHRC.exe 1880 LoaderHRC.exe 1880 LoaderHRC.exe 1880 LoaderHRC.exe 1880 LoaderHRC.exe 1880 LoaderHRC.exe 1880 LoaderHRC.exe 1880 LoaderHRC.exe 1880 LoaderHRC.exe 1880 LoaderHRC.exe 1880 LoaderHRC.exe 1880 LoaderHRC.exe 1880 LoaderHRC.exe 1880 LoaderHRC.exe 1880 LoaderHRC.exe 1880 LoaderHRC.exe 1880 LoaderHRC.exe 1880 LoaderHRC.exe 1880 LoaderHRC.exe 1880 LoaderHRC.exe 1880 LoaderHRC.exe 1880 LoaderHRC.exe 1880 LoaderHRC.exe 1880 LoaderHRC.exe 1880 LoaderHRC.exe 1880 LoaderHRC.exe 1880 LoaderHRC.exe 1880 LoaderHRC.exe 1880 LoaderHRC.exe 1880 LoaderHRC.exe 1880 LoaderHRC.exe 1880 LoaderHRC.exe 1880 LoaderHRC.exe 1880 LoaderHRC.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
pid Process 7108 chrome.exe 7108 chrome.exe 7108 chrome.exe 5596 chrome.exe 5596 chrome.exe 5596 chrome.exe 6564 msedge.exe 6564 msedge.exe 6564 msedge.exe 6564 msedge.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1880 LoaderHRC.exe Token: SeShutdownPrivilege 7108 chrome.exe Token: SeCreatePagefilePrivilege 7108 chrome.exe Token: SeShutdownPrivilege 7108 chrome.exe Token: SeCreatePagefilePrivilege 7108 chrome.exe Token: SeShutdownPrivilege 7108 chrome.exe Token: SeCreatePagefilePrivilege 7108 chrome.exe Token: SeShutdownPrivilege 7108 chrome.exe Token: SeCreatePagefilePrivilege 7108 chrome.exe Token: SeShutdownPrivilege 7108 chrome.exe Token: SeCreatePagefilePrivilege 7108 chrome.exe Token: SeShutdownPrivilege 7108 chrome.exe Token: SeCreatePagefilePrivilege 7108 chrome.exe Token: SeDebugPrivilege 3900 taskkill.exe Token: SeDebugPrivilege 4820 taskkill.exe Token: SeDebugPrivilege 6060 powershell.exe Token: SeDebugPrivilege 1552 powershell.exe Token: SeDebugPrivilege 6928 taskkill.exe Token: SeDebugPrivilege 5592 taskkill.exe Token: SeDebugPrivilege 2236 tasklist.exe Token: SeDebugPrivilege 1632 taskkill.exe Token: SeDebugPrivilege 4224 taskkill.exe Token: SeDebugPrivilege 5056 taskkill.exe Token: SeDebugPrivilege 1864 firefox.exe Token: SeDebugPrivilege 1864 firefox.exe Token: SeShutdownPrivilege 5596 chrome.exe Token: SeCreatePagefilePrivilege 5596 chrome.exe Token: SeShutdownPrivilege 5596 chrome.exe Token: SeCreatePagefilePrivilege 5596 chrome.exe Token: SeShutdownPrivilege 5596 chrome.exe Token: SeCreatePagefilePrivilege 5596 chrome.exe Token: SeDebugPrivilege 1952 968376c4b3.exe Token: SeShutdownPrivilege 5596 chrome.exe Token: SeCreatePagefilePrivilege 5596 chrome.exe Token: SeShutdownPrivilege 5596 chrome.exe Token: SeCreatePagefilePrivilege 5596 chrome.exe Token: SeShutdownPrivilege 5596 chrome.exe Token: SeCreatePagefilePrivilege 5596 chrome.exe Token: SeShutdownPrivilege 5596 chrome.exe Token: SeCreatePagefilePrivilege 5596 chrome.exe Token: SeRestorePrivilege 5576 7z.exe Token: 35 5576 7z.exe Token: SeSecurityPrivilege 5576 7z.exe Token: SeSecurityPrivilege 5576 7z.exe Token: SeRestorePrivilege 4192 7z.exe Token: 35 4192 7z.exe Token: SeSecurityPrivilege 4192 7z.exe Token: SeSecurityPrivilege 4192 7z.exe Token: SeRestorePrivilege 1968 7z.exe Token: 35 1968 7z.exe Token: SeSecurityPrivilege 1968 7z.exe Token: SeSecurityPrivilege 1968 7z.exe Token: SeRestorePrivilege 4724 7z.exe Token: 35 4724 7z.exe Token: SeSecurityPrivilege 4724 7z.exe Token: SeSecurityPrivilege 4724 7z.exe Token: SeRestorePrivilege 5236 7z.exe Token: 35 5236 7z.exe Token: SeSecurityPrivilege 5236 7z.exe Token: SeSecurityPrivilege 5236 7z.exe Token: SeRestorePrivilege 5584 7z.exe Token: 35 5584 7z.exe Token: SeSecurityPrivilege 5584 7z.exe Token: SeSecurityPrivilege 5584 7z.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3736 file.exe 7108 chrome.exe 6860 4fda3ab85a.exe 6860 4fda3ab85a.exe 6860 4fda3ab85a.exe 6860 4fda3ab85a.exe 6860 4fda3ab85a.exe 6860 4fda3ab85a.exe 6860 4fda3ab85a.exe 6860 4fda3ab85a.exe 1864 firefox.exe 1864 firefox.exe 1864 firefox.exe 1864 firefox.exe 1864 firefox.exe 1864 firefox.exe 1864 firefox.exe 1864 firefox.exe 1864 firefox.exe 1864 firefox.exe 1864 firefox.exe 1864 firefox.exe 1864 firefox.exe 1864 firefox.exe 1864 firefox.exe 1864 firefox.exe 1864 firefox.exe 1864 firefox.exe 1864 firefox.exe 1864 firefox.exe 1864 firefox.exe 6860 4fda3ab85a.exe 6860 4fda3ab85a.exe 6860 4fda3ab85a.exe 6860 4fda3ab85a.exe 5596 chrome.exe 5596 chrome.exe 5596 chrome.exe 5596 chrome.exe 5596 chrome.exe 5596 chrome.exe 5596 chrome.exe 5596 chrome.exe 5596 chrome.exe 5596 chrome.exe 5596 chrome.exe 5596 chrome.exe 5596 chrome.exe 5596 chrome.exe 5596 chrome.exe 5596 chrome.exe 5596 chrome.exe 5596 chrome.exe 5596 chrome.exe 5596 chrome.exe 5596 chrome.exe 5596 chrome.exe 5596 chrome.exe 5596 chrome.exe 5596 chrome.exe 5596 chrome.exe 6564 msedge.exe 6564 msedge.exe 6564 msedge.exe -
Suspicious use of SendNotifyMessage 32 IoCs
pid Process 6860 4fda3ab85a.exe 6860 4fda3ab85a.exe 6860 4fda3ab85a.exe 6860 4fda3ab85a.exe 6860 4fda3ab85a.exe 6860 4fda3ab85a.exe 6860 4fda3ab85a.exe 6860 4fda3ab85a.exe 1864 firefox.exe 1864 firefox.exe 1864 firefox.exe 1864 firefox.exe 1864 firefox.exe 1864 firefox.exe 1864 firefox.exe 1864 firefox.exe 1864 firefox.exe 1864 firefox.exe 1864 firefox.exe 1864 firefox.exe 1864 firefox.exe 1864 firefox.exe 1864 firefox.exe 1864 firefox.exe 1864 firefox.exe 1864 firefox.exe 1864 firefox.exe 1864 firefox.exe 6860 4fda3ab85a.exe 6860 4fda3ab85a.exe 6860 4fda3ab85a.exe 6860 4fda3ab85a.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1864 firefox.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3736 wrote to memory of 1416 3736 file.exe 83 PID 3736 wrote to memory of 1416 3736 file.exe 83 PID 3736 wrote to memory of 1416 3736 file.exe 83 PID 1416 wrote to memory of 1228 1416 skotes.exe 86 PID 1416 wrote to memory of 1228 1416 skotes.exe 86 PID 1228 wrote to memory of 1880 1228 LoaderHRC.exe 89 PID 1228 wrote to memory of 1880 1228 LoaderHRC.exe 89 PID 1880 wrote to memory of 3560 1880 LoaderHRC.exe 90 PID 1880 wrote to memory of 3560 1880 LoaderHRC.exe 90 PID 1416 wrote to memory of 1584 1416 skotes.exe 95 PID 1416 wrote to memory of 1584 1416 skotes.exe 95 PID 1416 wrote to memory of 1584 1416 skotes.exe 95 PID 1880 wrote to memory of 7108 1880 LoaderHRC.exe 97 PID 1880 wrote to memory of 7108 1880 LoaderHRC.exe 97 PID 1880 wrote to memory of 7116 1880 LoaderHRC.exe 98 PID 1880 wrote to memory of 7116 1880 LoaderHRC.exe 98 PID 7108 wrote to memory of 7136 7108 chrome.exe 99 PID 7108 wrote to memory of 7136 7108 chrome.exe 99 PID 7116 wrote to memory of 7144 7116 msedge.exe 100 PID 7116 wrote to memory of 7144 7116 msedge.exe 100 PID 7116 wrote to memory of 5856 7116 msedge.exe 101 PID 7116 wrote to memory of 5856 7116 msedge.exe 101 PID 7116 wrote to memory of 5856 7116 msedge.exe 101 PID 7116 wrote to memory of 5856 7116 msedge.exe 101 PID 7116 wrote to memory of 5856 7116 msedge.exe 101 PID 7116 wrote to memory of 5856 7116 msedge.exe 101 PID 7116 wrote to memory of 5856 7116 msedge.exe 101 PID 7116 wrote to memory of 5856 7116 msedge.exe 101 PID 7116 wrote to memory of 5856 7116 msedge.exe 101 PID 7116 wrote to memory of 5856 7116 msedge.exe 101 PID 7116 wrote to memory of 5856 7116 msedge.exe 101 PID 7116 wrote to memory of 5856 7116 msedge.exe 101 PID 7116 wrote to memory of 5856 7116 msedge.exe 101 PID 7116 wrote to memory of 5856 7116 msedge.exe 101 PID 7116 wrote to memory of 5856 7116 msedge.exe 101 PID 7116 wrote to memory of 5856 7116 msedge.exe 101 PID 7116 wrote to memory of 5856 7116 msedge.exe 101 PID 7116 wrote to memory of 5856 7116 msedge.exe 101 PID 7116 wrote to memory of 5856 7116 msedge.exe 101 PID 7116 wrote to memory of 5856 7116 msedge.exe 101 PID 7116 wrote to memory of 5856 7116 msedge.exe 101 PID 7116 wrote to memory of 5856 7116 msedge.exe 101 PID 7116 wrote to memory of 5856 7116 msedge.exe 101 PID 7116 wrote to memory of 5856 7116 msedge.exe 101 PID 7116 wrote to memory of 5856 7116 msedge.exe 101 PID 7116 wrote to memory of 5856 7116 msedge.exe 101 PID 7116 wrote to memory of 5856 7116 msedge.exe 101 PID 7116 wrote to memory of 5856 7116 msedge.exe 101 PID 7116 wrote to memory of 5856 7116 msedge.exe 101 PID 7116 wrote to memory of 5856 7116 msedge.exe 101 PID 7116 wrote to memory of 5856 7116 msedge.exe 101 PID 7116 wrote to memory of 5856 7116 msedge.exe 101 PID 7116 wrote to memory of 5856 7116 msedge.exe 101 PID 7116 wrote to memory of 5856 7116 msedge.exe 101 PID 7116 wrote to memory of 5856 7116 msedge.exe 101 PID 7116 wrote to memory of 5856 7116 msedge.exe 101 PID 7116 wrote to memory of 5856 7116 msedge.exe 101 PID 7116 wrote to memory of 5856 7116 msedge.exe 101 PID 7116 wrote to memory of 5856 7116 msedge.exe 101 PID 7116 wrote to memory of 5856 7116 msedge.exe 101 PID 7116 wrote to memory of 5840 7116 msedge.exe 102 PID 7116 wrote to memory of 5840 7116 msedge.exe 102 PID 7108 wrote to memory of 5688 7108 chrome.exe 104 PID 7108 wrote to memory of 5688 7108 chrome.exe 104 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Views/modifies file attributes 1 TTPs 3 IoCs
pid Process 548 attrib.exe 4940 attrib.exe 6168 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3736 -
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\1014759001\LoaderHRC.exe"C:\Users\Admin\AppData\Local\Temp\1014759001\LoaderHRC.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\1014759001\LoaderHRC.exe"C:\Users\Admin\AppData\Local\Temp\1014759001\LoaderHRC.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"5⤵PID:3560
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --restore-last-session --remote-debugging-port=8533 --remote-allow-origins=* --headless=new "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data"5⤵
- Uses browser remote debugging
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:7108 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff988ebcc40,0x7ff988ebcc4c,0x7ff988ebcc586⤵PID:7136
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1932,i,17635915978955069238,150364929099989810,262144 --disable-features=PaintHolding --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1928 /prefetch:26⤵PID:5688
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-appcompat-clear --field-trial-handle=2064,i,17635915978955069238,150364929099989810,262144 --disable-features=PaintHolding --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2120 /prefetch:36⤵PID:5652
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-appcompat-clear --field-trial-handle=2260,i,17635915978955069238,150364929099989810,262144 --disable-features=PaintHolding --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2592 /prefetch:86⤵PID:5584
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-appcompat-clear --remote-debugging-port=8533 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3732,i,17635915978955069238,150364929099989810,262144 --disable-features=PaintHolding --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3752 /prefetch:16⤵
- Uses browser remote debugging
PID:5300
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-appcompat-clear --remote-debugging-port=8533 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3760,i,17635915978955069238,150364929099989810,262144 --disable-features=PaintHolding --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4028 /prefetch:16⤵
- Uses browser remote debugging
PID:5288
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-appcompat-clear --remote-debugging-port=8533 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4412,i,17635915978955069238,150364929099989810,262144 --disable-features=PaintHolding --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4432 /prefetch:16⤵
- Uses browser remote debugging
PID:5144
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-appcompat-clear --field-trial-handle=4608,i,17635915978955069238,150364929099989810,262144 --disable-features=PaintHolding --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4736 /prefetch:86⤵PID:1732
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-appcompat-clear --field-trial-handle=4764,i,17635915978955069238,150364929099989810,262144 --disable-features=PaintHolding --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4772 /prefetch:86⤵PID:1744
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --restore-last-session --remote-debugging-port=8933 --remote-allow-origins=* --headless=new "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data"5⤵
- Uses browser remote debugging
- Suspicious use of WriteProcessMemory
PID:7116 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff988d746f8,0x7ff988d74708,0x7ff988d747186⤵PID:7144
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1480,3648203889141984060,7210335553288107250,131072 --disable-features=PaintHolding --headless=new --headless --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=swiftshader-webgl --override-use-software-gl-for-tests --mojo-platform-channel-handle=1488 /prefetch:26⤵PID:5856
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1480,3648203889141984060,7210335553288107250,131072 --disable-features=PaintHolding --lang=en-US --service-sandbox-type=none --use-gl=swiftshader-webgl --headless --mojo-platform-channel-handle=1848 /prefetch:36⤵
- Suspicious behavior: EnumeratesProcesses
PID:5840
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=8933 --allow-pre-commit-input --field-trial-handle=1480,3648203889141984060,7210335553288107250,131072 --disable-features=PaintHolding --lang=en-US --headless --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2016 /prefetch:16⤵
- Uses browser remote debugging
PID:5416
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /IM chrome.exe"5⤵PID:4648
-
C:\Windows\system32\taskkill.exetaskkill /F /IM chrome.exe6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3900
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /IM msedge.exe"5⤵PID:1776
-
C:\Windows\system32\taskkill.exetaskkill /F /IM msedge.exe6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4820
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command " Add-MpPreference -ExclusionExtension '.ps1', '.tmp', '.py' Add-MpPreference -ExclusionPath \"$env:TEMP\", \"$env:APPDATA\" "5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:6060
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"5⤵PID:224
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Powershell\Get-Clipboard.ps15⤵
- Command and Scripting Interpreter: PowerShell
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:1552 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\yuzzdruu\yuzzdruu.cmdline"6⤵PID:6480
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD419.tmp" "c:\Users\Admin\AppData\Local\Temp\yuzzdruu\CSC514861D33D4455387C0A13C33B88DBB.TMP"7⤵PID:6524
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ipconfig"5⤵PID:1076
-
C:\Windows\system32\ipconfig.exeipconfig6⤵
- Gathers network information
PID:6276
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ipconfig /all"5⤵PID:6328
-
C:\Windows\system32\ipconfig.exeipconfig /all6⤵
- Gathers network information
PID:6436
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "systeminfo"5⤵PID:6548
-
C:\Windows\system32\systeminfo.exesysteminfo6⤵
- Gathers system information
PID:6596
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist"5⤵PID:5176
-
C:\Windows\system32\tasklist.exetasklist6⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2236
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ipconfig /all"5⤵PID:6004
-
C:\Windows\system32\ipconfig.exeipconfig /all6⤵
- Gathers network information
PID:5680
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ipconfig"5⤵PID:1948
-
C:\Windows\system32\ipconfig.exeipconfig6⤵
- Gathers network information
PID:4604
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ipconfig"5⤵PID:6668
-
C:\Windows\system32\ipconfig.exeipconfig6⤵
- Gathers network information
PID:6536
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ipconfig /all"5⤵PID:1404
-
C:\Windows\system32\ipconfig.exeipconfig /all6⤵
- Gathers network information
PID:6560
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "systeminfo"5⤵PID:6648
-
C:\Windows\system32\systeminfo.exesysteminfo6⤵
- Gathers system information
PID:6828
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ipconfig"5⤵PID:1716
-
C:\Windows\system32\ipconfig.exeipconfig6⤵
- Gathers network information
PID:5252
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ipconfig /all"5⤵PID:5256
-
C:\Windows\system32\ipconfig.exeipconfig /all6⤵
- Gathers network information
PID:6000
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "systeminfo"5⤵PID:6040
-
C:\Windows\system32\systeminfo.exesysteminfo6⤵
- Gathers system information
PID:64
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ipconfig"5⤵PID:7076
-
C:\Windows\system32\ipconfig.exeipconfig6⤵
- Gathers network information
PID:6096
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ipconfig /all"5⤵PID:5812
-
C:\Windows\system32\ipconfig.exeipconfig /all6⤵
- Gathers network information
PID:5320
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "systeminfo"5⤵PID:5336
-
C:\Windows\system32\systeminfo.exesysteminfo6⤵
- Gathers system information
PID:6480
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ipconfig"5⤵PID:4204
-
C:\Windows\system32\ipconfig.exeipconfig6⤵
- Gathers network information
PID:5312
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ipconfig /all"5⤵PID:5536
-
C:\Windows\system32\ipconfig.exeipconfig /all6⤵
- Gathers network information
PID:1652
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "systeminfo"5⤵PID:5224
-
C:\Windows\system32\systeminfo.exesysteminfo6⤵
- Gathers system information
PID:4980
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ipconfig"5⤵PID:4560
-
C:\Windows\system32\ipconfig.exeipconfig6⤵
- Gathers network information
PID:2088
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ipconfig /all"5⤵PID:5212
-
C:\Windows\system32\ipconfig.exeipconfig /all6⤵
- Gathers network information
PID:6584
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "systeminfo"5⤵PID:5012
-
C:\Windows\system32\systeminfo.exesysteminfo6⤵
- Gathers system information
PID:6976
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ipconfig"5⤵PID:7020
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵PID:6076
-
-
C:\Windows\system32\ipconfig.exeipconfig6⤵
- Gathers network information
PID:3696
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ipconfig"5⤵PID:5164
-
C:\Windows\system32\ipconfig.exeipconfig6⤵
- Gathers network information
PID:5884
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ipconfig /all"5⤵PID:5416
-
C:\Windows\system32\ipconfig.exeipconfig /all6⤵
- Gathers network information
PID:5764
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "systeminfo"5⤵PID:5336
-
C:\Windows\system32\systeminfo.exesysteminfo6⤵
- Gathers system information
PID:5992
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Missing runtime 140.DLL please download runtime 140 to continue.', 0, 'Missing DLL files', 0+16);close()""5⤵PID:2068
-
C:\Windows\system32\mshta.exemshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Missing runtime 140.DLL please download runtime 140 to continue.', 0, 'Missing DLL files', 0+16);close()"6⤵PID:5896
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1014790001\9687ed5e81.exe"C:\Users\Admin\AppData\Local\Temp\1014790001\9687ed5e81.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:1584 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\Admin\AppData\Local\Temp\1014790001\9687ed5e81.exe" & rd /s /q "C:\ProgramData\2DBI5PPH4EUA" & exit4⤵
- System Location Discovery: System Language Discovery
PID:4344 -
C:\Windows\SysWOW64\timeout.exetimeout /t 105⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2024
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1584 -s 20524⤵
- Program crash
PID:2104
-
-
-
C:\Users\Admin\AppData\Local\Temp\1014791001\2068849fdc.exe"C:\Users\Admin\AppData\Local\Temp\1014791001\2068849fdc.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5008
-
-
C:\Users\Admin\AppData\Local\Temp\1014792001\4fda3ab85a.exe"C:\Users\Admin\AppData\Local\Temp\1014792001\4fda3ab85a.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:6860 -
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM firefox.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:6928
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM chrome.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5592
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM msedge.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1632
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM opera.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4224
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM brave.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5056
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking4⤵PID:5020
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking5⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1864 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1972 -parentBuildID 20240401114208 -prefsHandle 1760 -prefMapHandle 1752 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2d9e5d3f-45fd-4030-b8d9-f3b256dfb63d} 1864 "\\.\pipe\gecko-crash-server-pipe.1864" gpu6⤵PID:3472
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2416 -parentBuildID 20240401114208 -prefsHandle 2408 -prefMapHandle 2396 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {617b8e6d-a07d-4694-a889-143f29c8598a} 1864 "\\.\pipe\gecko-crash-server-pipe.1864" socket6⤵PID:3932
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3216 -childID 1 -isForBrowser -prefsHandle 3228 -prefMapHandle 3224 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d7b77295-637a-4129-9de8-4bce6a549960} 1864 "\\.\pipe\gecko-crash-server-pipe.1864" tab6⤵PID:1964
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3676 -childID 2 -isForBrowser -prefsHandle 3668 -prefMapHandle 3664 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9c5e9ef9-1012-40d1-a802-cc8703bb99c0} 1864 "\\.\pipe\gecko-crash-server-pipe.1864" tab6⤵PID:5608
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4904 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 3656 -prefMapHandle 2568 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e8baa37f-8f04-4471-9e02-8e4b4e73d531} 1864 "\\.\pipe\gecko-crash-server-pipe.1864" utility6⤵
- Checks processor information in registry
PID:6284
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5180 -childID 3 -isForBrowser -prefsHandle 5192 -prefMapHandle 5188 -prefsLen 26944 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {45ed3c1c-41ff-449c-8fce-fc9c8c76a064} 1864 "\\.\pipe\gecko-crash-server-pipe.1864" tab6⤵PID:4800
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5372 -childID 4 -isForBrowser -prefsHandle 5292 -prefMapHandle 5300 -prefsLen 26944 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {df6d813b-8a2a-43f3-a394-b26c2aaa377e} 1864 "\\.\pipe\gecko-crash-server-pipe.1864" tab6⤵PID:6468
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5556 -childID 5 -isForBrowser -prefsHandle 5472 -prefMapHandle 5476 -prefsLen 26944 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {274fc2ab-2b44-4b40-896d-9bb6a91b85e0} 1864 "\\.\pipe\gecko-crash-server-pipe.1864" tab6⤵PID:3212
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1014793001\f4b5923886.exe"C:\Users\Admin\AppData\Local\Temp\1014793001\f4b5923886.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Checks processor information in registry
PID:3988 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""4⤵
- Uses browser remote debugging
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5596 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff97cffcc40,0x7ff97cffcc4c,0x7ff97cffcc585⤵PID:7080
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2264,i,10438278087733372888,15074611708057176108,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2216 /prefetch:25⤵PID:5932
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1780,i,10438278087733372888,15074611708057176108,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2560 /prefetch:35⤵PID:5916
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=1964,i,10438278087733372888,15074611708057176108,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2672 /prefetch:85⤵PID:4868
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3164,i,10438278087733372888,15074611708057176108,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3236 /prefetch:15⤵
- Uses browser remote debugging
PID:5228
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3172,i,10438278087733372888,15074611708057176108,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3264 /prefetch:15⤵
- Uses browser remote debugging
PID:5284
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4476,i,10438278087733372888,15074611708057176108,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4404 /prefetch:15⤵
- Uses browser remote debugging
PID:5560
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4752,i,10438278087733372888,15074611708057176108,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4748 /prefetch:85⤵PID:5056
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4924,i,10438278087733372888,15074611708057176108,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4968 /prefetch:85⤵PID:5880
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"4⤵
- Uses browser remote debugging
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
PID:6564 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff98a2446f8,0x7ff98a244708,0x7ff98a2447185⤵
- Checks processor information in registry
- Enumerates system info in registry
PID:6356
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,14921398765597602942,14037278993182772307,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:25⤵PID:4416
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,14921398765597602942,14037278993182772307,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:35⤵PID:4388
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,14921398765597602942,14037278993182772307,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:85⤵PID:5420
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2136,14921398765597602942,14037278993182772307,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:15⤵
- Uses browser remote debugging
PID:6812
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2136,14921398765597602942,14037278993182772307,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:15⤵
- Uses browser remote debugging
PID:6828
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2136,14921398765597602942,14037278993182772307,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4860 /prefetch:15⤵
- Uses browser remote debugging
PID:4868
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2136,14921398765597602942,14037278993182772307,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4924 /prefetch:15⤵
- Uses browser remote debugging
PID:744
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\Documents\ECBKKKFHCF.exe"4⤵
- System Location Discovery: System Language Discovery
PID:4776 -
C:\Users\Admin\Documents\ECBKKKFHCF.exe"C:\Users\Admin\Documents\ECBKKKFHCF.exe"5⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
PID:1868
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1014794001\968376c4b3.exe"C:\Users\Admin\AppData\Local\Temp\1014794001\968376c4b3.exe"3⤵
- Modifies Windows Defender Real-time Protection settings
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Windows security modification
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1952
-
-
C:\Users\Admin\AppData\Local\Temp\1014795001\2547cd7fe9.exe"C:\Users\Admin\AppData\Local\Temp\1014795001\2547cd7fe9.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
PID:6888 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6888 -s 14564⤵
- Program crash
PID:4348
-
-
-
C:\Users\Admin\AppData\Local\Temp\1014796001\65b7a94d68.exe"C:\Users\Admin\AppData\Local\Temp\1014796001\65b7a94d68.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:7116 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"4⤵PID:6516
-
C:\Windows\system32\mode.commode 65,105⤵PID:6444
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e file.zip -p24291711423417250691697322505 -oextracted5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:5576
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_7.zip -oextracted5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:4192
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_6.zip -oextracted5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1968
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_5.zip -oextracted5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:4724
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_4.zip -oextracted5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:5236
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_3.zip -oextracted5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:5584
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_2.zip -oextracted5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5196
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_1.zip -oextracted5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:7120
-
-
C:\Windows\system32\attrib.exeattrib +H "in.exe"5⤵
- Views/modifies file attributes
PID:548
-
-
C:\Users\Admin\AppData\Local\Temp\main\in.exe"in.exe"5⤵
- Executes dropped EXE
PID:6164 -
C:\Windows\SYSTEM32\attrib.exeattrib +H +S C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe6⤵
- Views/modifies file attributes
PID:6168
-
-
C:\Windows\SYSTEM32\attrib.exeattrib +H C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe6⤵
- Views/modifies file attributes
PID:4940
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE6⤵
- Scheduled Task/Job: Scheduled Task
PID:2532
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell ping 127.0.0.1; del in.exe6⤵
- System Network Configuration Discovery: Internet Connection Discovery
PID:2792 -
C:\Windows\system32\PING.EXE"C:\Windows\system32\PING.EXE" 127.0.0.17⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:5204
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1014797001\67e21b6585.exe"C:\Users\Admin\AppData\Local\Temp\1014797001\67e21b6585.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:7080 -
C:\Users\Admin\AppData\Local\Temp\1014797001\67e21b6585.exe"C:\Users\Admin\AppData\Local\Temp\1014797001\67e21b6585.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6076
-
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5696
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵PID:5260
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:3380
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1584 -ip 15841⤵PID:1600
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exeC:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4192
-
C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exeC:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5936 -
C:\Windows\explorer.exeexplorer.exe2⤵PID:6168
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe2⤵
- System Network Configuration Discovery: Internet Connection Discovery
PID:5760 -
C:\Windows\system32\PING.EXE"C:\Windows\system32\PING.EXE" 127.1.10.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4652
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 6888 -ip 68881⤵PID:1360
-
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exeC:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4264
-
C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exeC:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4048 -
C:\Windows\explorer.exeexplorer.exe2⤵PID:4356
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe2⤵
- System Network Configuration Discovery: Internet Connection Discovery
PID:5696 -
C:\Windows\system32\PING.EXE"C:\Windows\system32\PING.EXE" 127.1.10.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:3756
-
-
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
2PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Modify Authentication Process
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Impair Defenses
2Disable or Modify Tools
2Modify Authentication Process
1Modify Registry
3Virtualization/Sandbox Evasion
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Modify Authentication Process
1Steal Web Session Cookie
1Unsecured Credentials
4Credentials In Files
4Discovery
Browser Information Discovery
1Process Discovery
1Query Registry
8Remote System Discovery
1System Information Discovery
7System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1Virtualization/Sandbox Evasion
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
114KB
MD5f1b0d67d9700b657fffb1e53c14444ae
SHA1ae8a3a681da72d78263510a2e6a2ad5a66cb0164
SHA2567a26e63a529f6c2ceb6063b72e61caae2a643152c7b1b75b3396a700aac95bc1
SHA512a2b3ab1807a517b1b499df7d8cbd7b695918113f4124b60ab54b6fa1b2fee6d0813c73202ceec42c7b9fc2c124e0555ecff62acb948cf0ddc19b51607f527b50
-
Filesize
116KB
MD5f70aa3fa04f0536280f872ad17973c3d
SHA150a7b889329a92de1b272d0ecf5fce87395d3123
SHA2568d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8
SHA51230675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84
-
Filesize
40KB
MD5a182561a527f929489bf4b8f74f65cd7
SHA18cd6866594759711ea1836e86a5b7ca64ee8911f
SHA25642aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914
SHA5129bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558
-
Filesize
48KB
MD5349e6eb110e34a08924d92f6b334801d
SHA1bdfb289daff51890cc71697b6322aa4b35ec9169
SHA256c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a
SHA5122a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574
-
Filesize
593KB
MD5c8fd9be83bc728cc04beffafc2907fe9
SHA195ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
-
Filesize
40B
MD5186ccc6761714f7e88de1fff069b95fb
SHA1c7dec1fff5e2f359cccf94875265f96757865b34
SHA256abb5c7113a03fa5d3a4d6d25007f875d5189c85054252a03a3c9d2cc64a5f59e
SHA5125f346abd0068d56df1bc7236a8f8ae6e0397cd35c7e8a6554f90724bc4936ed6a1f127aef797391d34ab458ba9ff3337bade05334155aae7473e6c463b0499c9
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
152B
MD534d2c4f40f47672ecdf6f66fea242f4a
SHA14bcad62542aeb44cae38a907d8b5a8604115ada2
SHA256b214e3affb02a2ea4469a8bbdfa8a179e7cc57cababd83b4bafae9cdbe23fa33
SHA51250fba54ec95d694211a005d0e3e6cf5b5677efa16989cbf854207a1a67e3a139f32b757c6f2ce824a48f621440b93fde60ad1dc790fcec4b76edddd0d92a75d6
-
Filesize
152B
MD58749e21d9d0a17dac32d5aa2027f7a75
SHA1a5d555f8b035c7938a4a864e89218c0402ab7cde
SHA256915193bd331ee9ea7c750398a37fbb552b8c5a1d90edec6293688296bda6f304
SHA512c645a41180ed01e854f197868283f9b40620dbbc813a1c122f6870db574ebc1c4917da4d320bdfd1cc67f23303a2c6d74e4f36dd9d3ffcfa92d3dfca3b7ca31a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\53fcb921-e6b9-403a-ae02-6c82fe026939.tmp
Filesize1B
MD55058f1af8388633f609cadb75a75dc9d
SHA13a52ce780950d4d969792a2559cd519d7ee8c727
SHA256cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
SHA5120b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
-
Filesize
5KB
MD55610f9e7dd479997e7ecc1000ee6f8c7
SHA182eb7b1c43b330fd6ff5ba5fe427cfb121437c57
SHA25615e67db58d4a9a2010276119cdd3a0ebf02e68991349645253bf6cc4fc4ac512
SHA5127c9f5766ac43b46184322569f973a2f80c3d6aecc99621d28703fb22acf1699c3174239442a9baf0a590af3ff8a46d21a8a5ea663a29f8d3ac00c3904b9e8d9d
-
Filesize
1B
MD5cfcd208495d565ef66e7dff9f98764da
SHA1b6589fc6ab0dc82cf12099d1c2d40ab994e8410c
SHA2565feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
SHA51231bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4ws2kncw.default-release\activity-stream.discovery_stream.json
Filesize21KB
MD559c3d6d17bc7f5e5d7e52b96cc18df11
SHA1cbbda41a78fe02fad1092646f5a8f0375ca39d42
SHA2563b0250142a39ced0d6e6bec7b76f0dc0c6c87ba56337f54d8597744b22ddfdcf
SHA5127cfe53337d26803242a7130aa251ab7cc64a054aa9e7afd069b9fea685a7ea5fe3799cb243cfb33dde25c56311617550e8e95c444e0a801ffb1da7bd5c717295
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4ws2kncw.default-release\cache2\entries\92F4D5A4F9CED6E2E644D803AEE3647A0EA4D984
Filesize13KB
MD509a5883147303875197353f4446158c1
SHA11e4d7eadf4947fd235aaa5243670a485f32eadbc
SHA256b36c87f140db3335c459413c18196e76511490c24d3f4e6108994611d246f28e
SHA512a145522ea2f9f2e53e7efc0998984c2ddb1e1cf2c8d6849fb806dc64bf9b39a527bd6a3fa429d893307ab0f97ec96e42d06da4c26b20c7bdbc09853e5f2b0fa5
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4ws2kncw.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
Filesize15KB
MD596c542dec016d9ec1ecc4dddfcbaac66
SHA16199f7648bb744efa58acf7b96fee85d938389e4
SHA2567f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798
SHA512cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658
-
Filesize
384KB
MD5dfd5f78a711fa92337010ecc028470b4
SHA11a389091178f2be8ce486cd860de16263f8e902e
SHA256da96f2eb74e60de791961ef3800c36a5e12202fe97ae5d2fcfc1fe404bc13c0d
SHA512a3673074919039a2dc854b0f91d1e1a69724056594e33559741f53594e0f6e61e3d99ec664d541b17f09ffdebc2de1b042eec19ca8477fac86359c703f8c9656
-
Filesize
2.5MB
MD52a78ce9f3872f5e591d643459cabe476
SHA19ac947dfc71a868bc9c2eb2bd78dfb433067682e
SHA25621a2ac44acd7a640735870eebfd04b8dc57bc66877cb5be3b929299e86a43dae
SHA51203e2cd8161a1394ee535a2ea7d197791ab715d69a02ffab98121ec5ac8150d2b17a9a32a59307042c4bbeffad7425b55efa047651de6ed39277dba80711454f9
-
Filesize
942KB
MD5d314453dba24064a56b135aeb166cdda
SHA17bd741b3eac3cf5c17e50957f6ae79202921f5c8
SHA256ff33ed675de449450940132fa1033c7174bc3df9d1d4a226905f3c8709634c04
SHA512db05274cfeef8149fb9b937c2a90019201bd0d76c507cd2559d4d8ac9a907c4af8217ac371a9c71096052ae9af07741cf77c43ff181157304eef4d67aabe217f
-
Filesize
1.7MB
MD5bd77afda9f7533654b270dc7196689cf
SHA16486841c00452279ef7dbe6716925ea0f58e6ec1
SHA2561e327ff9e5867b053c7da23e53375fb7e79e150f98f9e8e4a5a2ea47a7bb25a2
SHA51250beaf2650ba6a389d886105844e6027099ad5beab32ff726064458c6eda312d4149a39e1400050cd7b64b589953e5e48486302a1743b4a45709b290c0fce8f2
-
Filesize
2.7MB
MD5b0b3fc8a43169dd5d7e252ef410e48b5
SHA1ecb35c0f2c89e093006c341001d31fd53e9c9986
SHA2563324a620600aac9b552c5af9022a1fa755adf355da9ca79eda97e40b7e44f10b
SHA512ec6b8b13539a404f20dd5b0210cee45240cfa68146332485b45253c66ca900c431da848e2a9d5a43bb65969f71663d75fe87d8c8d8c6116ff9e747b339563eea
-
Filesize
1.9MB
MD5c371507551999618fa1dceb764333bc0
SHA1e71870305ad13fef36b85e5a3cd8e038525f994c
SHA2560fb1f2f159e36668c4480491ae8b05fe3f8fd28beeb933d46cf10ba3343256b6
SHA512758e15b5edc9db3d060f52a6f0b8caf07a03523905ad15d4a944b9c2c025545c4b498b22c2ad92a9781235e7a450c2608e40fffd98f1f764334d02cf3b2f243e
-
Filesize
4.2MB
MD53a425626cbd40345f5b8dddd6b2b9efa
SHA17b50e108e293e54c15dce816552356f424eea97a
SHA256ba9212d2d5cd6df5eb7933fb37c1b72a648974c1730bf5c32439987558f8e8b1
SHA512a7538c6b7e17c35f053721308b8d6dc53a90e79930ff4ed5cffecaa97f4d0fbc5f9e8b59f1383d8f0699c8d4f1331f226af71d40325022d10b885606a72fe668
-
Filesize
710KB
MD528e568616a7b792cac1726deb77d9039
SHA139890a418fb391b823ed5084533e2e24dff021e1
SHA2569597798f7789adc29fbe97707b1bd8ca913c4d5861b0ad4fdd6b913af7c7a8e2
SHA51285048799e6d2756f1d6af77f34e6a1f454c48f2f43042927845931b7ecff2e5de45f864627a3d4aa061252401225bbb6c2caa8532320ccbe401e97c9c79ac8e5
-
Filesize
494B
MD50a6b580e41f745b5721cea97dc01c995
SHA1eb35462fbc0cc68c4420339e2c6d9475230917dc
SHA256dae1d545d52ba57ca7a93724421feb69524844df3bd7ded4ee40ba26d7eee7f0
SHA5120807804c5a731adc759023a6a4088ad03fbafa5620337e018188fe9e3ca7b43a0b50ed59bcc1f4b9f6b690ca478ba06b7b01a34ee9602d62a0e76117d666f4c8
-
Filesize
12KB
MD573dd025bfa3cfb38e5daad0ed9914679
SHA165d141331e8629293146d3398a2f76c52301d682
SHA256c89f3c0b89cfee35583d6c470d378da0af455ebd9549be341b4179d342353641
SHA51220569f672f3f2e6439afd714f179a590328a1f9c40c6bc0dc6fcad7581bc620a877282baf7ec7f16aaa79724ba2165f71d79aa5919c8d23214bbd39611c23aed
-
Filesize
13KB
MD5e87aac7f2a9bf57d6796e5302626ee2f
SHA14b633501e76e96c8859436445f38240f877fc6c6
SHA25697bf9e392d6ad9e1ec94237407887ea3d1dec2d23978891a8174c03af606fd34
SHA512108663f0700d9e30e259a62c1ae35b23f5f2abd0eff00523aae171d1db803da99488c7395afd3ad54a242f0cb2c66a60e6904d3e3f75bb1193621fd65df4ad5c
-
Filesize
14KB
MD5f3f30d72d6d7f4ba94b3c1a9364f1831
SHA146705c3a35c84bf15cf434e2607bddd18991e138
SHA2567820395c44eab26de0312dfc5d08a9a27398f0caa80d8f9a88dee804880996ff
SHA51201c5ea300a7458efe1b209c56a826df0bf3d6ff4dd512f169d6aee9d540600510c3249866bfb991975ca5e41c77107123e480eda4d55eccb88ed22399ee57912
-
Filesize
10KB
MD593da52e6ce73e0c1fc14f7b24dcf4b45
SHA10961cfb91bbcee3462954996c422e1a9302a690b
SHA256ddd427c76f29edd559425b31eee54eb5b1bdd567219ba5023254efde6591faa0
SHA51249202a13d260473d3281bf7ca375ac1766189b6936c4aa03f524081cc573ee98d236aa9c736ba674ade876b7e29ae9891af50f1a72c49850bb21186f84a3c3ab
-
Filesize
12KB
MD50628dc6d83f4a9dddb0552bd0cc9b54c
SHA1c73f990b84a126a05f1d32d509b6361dca80bc93
SHA256f136b963b5ceb60b0f58127a925d68f04c1c8a946970e10c4abc3c45a1942bc7
SHA51278d005a2fec5d1c67fc2b64936161026f9a0b1756862baf51eaf14edee7739f915d059814c8d6f66797f84a28071c46b567f3392daf4ff7fcdfa94220c965c1a
-
Filesize
13KB
MD54d8230d64493ce217853b4d3b6768674
SHA1c845366e7c02a2402ba00b9b6735e1fad3f2f1ef
SHA25606885dc99a7621ba3be3b28cb4bcf972549e23acf62a710f6d6c580aaba1f25a
SHA512c32d5987a0b1ded7211545cb7d3d7482657ca7d74a9083d37a33f65bbe2e7e075cb52efaeea00f1840ab8f0baf7df1466a4f4e880abf9650a709814bcee2f945
-
Filesize
10KB
MD53369f9bb8b0ee93e5ad5b201956dc60f
SHA1a5b75cbd6ce905a179e49888e798cd6ae9e9194d
SHA2565940e97e687a854e446dc859284a90c64cf6d87912c37172b8823a8c3a7b73df
SHA512c4e71d683be64a8e6ab533fa4c1c3040b96d0be812ea74c99d2d2b5d52470c24b45d55366a7acb9d8cda759a618cbaf0d0a7ecfef4c0954df89fdb768d9893e2
-
Filesize
96KB
MD5f12681a472b9dd04a812e16096514974
SHA16fd102eb3e0b0e6eef08118d71f28702d1a9067c
SHA256d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8
SHA5127d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2
-
Filesize
81KB
MD5a4b636201605067b676cc43784ae5570
SHA1e9f49d0fc75f25743d04ce23c496eb5f89e72a9a
SHA256f178e29921c04fb68cc08b1e5d1181e5df8ce1de38a968778e27990f4a69973c
SHA51202096bc36c7a9ecfa1712fe738b5ef8b78c6964e0e363136166657c153727b870a6a44c1e1ec9b81289d1aa0af9c85f1a37b95b667103edc2d3916280b6a9488
-
Filesize
174KB
MD52baaa98b744915339ae6c016b17c3763
SHA1483c11673b73698f20ca2ff0748628c789b4dc68
SHA2564f1ce205c2be986c9d38b951b6bcb6045eb363e06dacc069a41941f80be9068c
SHA5122ae8df6e764c0813a4c9f7ac5a08e045b44daac551e8ff5f8aa83286be96aa0714d373b8d58e6d3aa4b821786a919505b74f118013d9fcd1ebc5a9e4876c2b5f
-
Filesize
119KB
MD587596db63925dbfe4d5f0f36394d7ab0
SHA1ad1dd48bbc078fe0a2354c28cb33f92a7e64907e
SHA25692d7954d9099762d81c1ae2836c11b6ba58c1883fde8eeefe387cc93f2f6afb4
SHA512e6d63e6fe1c3bd79f1e39cb09b6f56589f0ee80fd4f4638002fe026752bfa65457982adbef13150fa2f36e68771262d9378971023e07a75d710026ed37e83d7b
-
Filesize
60KB
MD549ce7a28e1c0eb65a9a583a6ba44fa3b
SHA1dcfbee380e7d6c88128a807f381a831b6a752f10
SHA2561be5cfd06a782b2ae8e4629d9d035cbc487074e8f63b9773c85e317be29c0430
SHA512cf1f96d6d61ecb2997bb541e9eda7082ef4a445d3dd411ce6fd71b0dfe672f4dfaddf36ae0fb7d5f6d1345fbd90c19961a8f35328332cdaa232f322c0bf9a1f9
-
Filesize
154KB
MD5b5fbc034ad7c70a2ad1eb34d08b36cf8
SHA14efe3f21be36095673d949cceac928e11522b29c
SHA25680a6ebe46f43ffa93bbdbfc83e67d6f44a44055de1439b06e4dd2983cb243df6
SHA512e7185da748502b645030c96d3345d75814ba5fd95a997c2d1c923d981c44d5b90db64faf77ddbbdc805769af1bec37daf0ecee0930a248b67a1c2d92b59c250c
-
Filesize
1.1MB
MD5e4761848102a6902b8e38f3116a91a41
SHA1c262973e26bd9d8549d4a9abf4b7ae0ca4db75f0
SHA2569d03619721c887413315bd674dae694fbd70ef575eb0138f461a34e2dd98a5fd
SHA512a148640aa6f4b4ef3ae37922d8a11f4def9ecfd595438b9a36b1be0810bfb36abf0e01bee0aa79712af0d70cddce928c0df5057c0418c4ed0d733c6193761e82
-
Filesize
29KB
MD523f4becf6a1df36aee468bb0949ac2bc
SHA1a0e027d79a281981f97343f2d0e7322b9fe9b441
SHA25609c5faf270fd63bde6c45cc53b05160262c7ca47d4c37825ed3e15d479daee66
SHA5123ee5b3b7583be1408c0e1e1c885512445a7e47a69ff874508e8f0a00a66a40a0e828ce33e6f30ddc3ac518d69e4bb96c8b36011fb4ededf9a9630ef98a14893b
-
Filesize
75KB
MD5e137df498c120d6ac64ea1281bcab600
SHA1b515e09868e9023d43991a05c113b2b662183cfe
SHA2568046bf64e463d5aa38d13525891156131cf997c2e6cdf47527bc352f00f5c90a
SHA512cc2772d282b81873aa7c5cba5939d232cceb6be0908b211edb18c25a17cbdb5072f102c0d6b7bc9b6b2f1f787b56ab1bc9be731bb9e98885c17e26a09c2beb90
-
Filesize
155KB
MD535f66ad429cd636bcad858238c596828
SHA1ad4534a266f77a9cdce7b97818531ce20364cb65
SHA25658b772b53bfe898513c0eb264ae4fa47ed3d8f256bc8f70202356d20f9ecb6dc
SHA5121cca8e6c3a21a8b05cc7518bd62c4e3f57937910f2a310e00f13f60f6a94728ef2004a2f4a3d133755139c3a45b252e6db76987b6b78bc8269a21ad5890356ad
-
Filesize
812KB
MD5f9da77f8af9a76c34908fb074986266f
SHA18551d1b4e20ca211932b78696155deda6dc438b7
SHA25672afdafd935526cc357122420b737b27ad497c1b2b3eb9a85df35f84faa33047
SHA512335b7f6cf1c7f0a8f786d6b7c1d413174055df33c2a5e981016d7abce5cf2086b39baf908f7bae2e8c2f3a46321fa888c57bfdb1da277eec2c685a6abf827114
-
Filesize
1KB
MD54ce7501f6608f6ce4011d627979e1ae4
SHA178363672264d9cd3f72d5c1d3665e1657b1a5071
SHA25637fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
SHA512a4cdf92725e1d740758da4dd28df5d1131f70cef46946b173fe6956cc0341f019d7c4fecc3c9605f354e1308858721dada825b4c19f59c5ad1ce01ab84c46b24
-
Filesize
3.3MB
MD5ab01c808bed8164133e5279595437d3d
SHA10f512756a8db22576ec2e20cf0cafec7786fb12b
SHA2569c0a0a11629cced6a064932e95a0158ee936739d75a56338702fed97cb0bad55
SHA5124043cda02f6950abdc47413cfd8a0ba5c462f16bcd4f339f9f5a690823f4d0916478cab5cae81a3d5b03a8a196e17a716b06afee3f92dec3102e3bbc674774f2
-
Filesize
32KB
MD5eef7981412be8ea459064d3090f4b3aa
SHA1c60da4830ce27afc234b3c3014c583f7f0a5a925
SHA256f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
SHA512dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016
-
Filesize
682KB
MD5de72697933d7673279fb85fd48d1a4dd
SHA1085fd4c6fb6d89ffcc9b2741947b74f0766fc383
SHA256ed1c8769f5096afd000fc730a37b11177fcf90890345071ab7fbceac684d571f
SHA5120fd4678c65da181d7c27b19056d5ab0e5dd0e9714e9606e524cdad9e46ec4d0b35fe22d594282309f718b30e065f6896674d3edce6b3b0c8eb637a3680715c2c
-
Filesize
193KB
MD56bc89ebc4014a8db39e468f54aaafa5e
SHA168d04e760365f18b20f50a78c60ccfde52f7fcd8
SHA256dbe6e7be3a7418811bd5987b0766d8d660190d867cd42f8ed79e70d868e8aa43
SHA512b7a6a383eb131deb83eee7cc134307f8545fb7d043130777a8a9a37311b64342e5a774898edd73d80230ab871c4d0aa0b776187fa4edec0ccde5b9486dbaa626
-
Filesize
63KB
MD507bd9f1e651ad2409fd0b7d706be6071
SHA1dfeb2221527474a681d6d8b16a5c378847c59d33
SHA2565d78cd1365ea9ae4e95872576cfa4055342f1e80b06f3051cf91d564b6cd09f5
SHA512def31d2df95cb7999ce1f55479b2ff7a3cb70e9fc4778fc50803f688448305454fbbf82b5a75032f182dff663a6d91d303ef72e3d2ca9f2a1b032956ec1a0e2a
-
Filesize
4.3MB
MD5c80b5cb43e5fe7948c3562c1fff1254e
SHA1f73cb1fb9445c96ecd56b984a1822e502e71ab9d
SHA256058925e4bbfcb460a3c00ec824b8390583baef0c780a7c7ff01d43d9eec45f20
SHA512faa97a9d5d2a0bf78123f19f8657c24921b907268938c26f79e1df6d667f7bee564259a3a11022e8629996406cda9fa00434bb2b1de3e10b9bddc59708dbad81
-
Filesize
543KB
MD5b7acfad9f0f36e7cf8bfb0dd58360ffe
SHA18fa816d403f126f3326cb6c73b83032bb0590107
SHA256461328c988d4c53f84579fc0880c4a9382e14b0c8b830403100a2fa3df0fd9a9
SHA5124fed8a9162a9a2ebc113ea44d461fb498f9f586730218d9c1cddcd7c8c803cad6dea0f563b8d7533321ecb25f6153ca7c5777c314e7cb76d159e39e74c72d1b8
-
Filesize
139KB
MD5f200ca466bf3b8b56a272460e0ee4abc
SHA1ca18e04f143424b06e0df8d00d995c2873aa268d
SHA256a6700ca2bee84c1a051ba4b22c0cde5a6a5d3e35d4764656cfdc64639c2f6b77
SHA51229bf2425b665af9d2f9fd7795bf2ab012aa96faed9a1a023c86afa0d2036cc6014b48116940fad93b7de1e8f4f93eb709cc9319439d7609b79fd8b92669b377d
-
Filesize
28KB
MD5adc412384b7e1254d11e62e451def8e9
SHA104e6dff4a65234406b9bc9d9f2dcfe8e30481829
SHA25668b80009ab656ffe811d680585fac3d4f9c1b45f29d48c67ea2b3580ec4d86a1
SHA512f250f1236882668b2686bd42e1c334c60da7abec3a208ebebdee84a74d7c4c6b1bc79eed7241bc7012e4ef70a6651a32aa00e32a83f402475b479633581e0b07
-
Filesize
131KB
MD5ec7c48ea92d9ff0c32c6d87ee8358bd0
SHA1a67a417fdb36c84871d0e61bfb1015cb30c9898a
SHA256a0f3cc0e98bea5a598e0d4367272e4c65bf446f21932dc2a051546b098d6ce62
SHA512c06e3c0260b918509947a89518d55f0cb03cb19fc28d9e7ed9e3f837d71df31154f0093929446a93a7c7da1293ffd0cc69547e2540f15e3055fe1d12d837f935
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
3.1MB
MD5197f7a10814e446ee3d649f2509b1608
SHA1a459ec5320318e01318105d8e87e707ea480a4c7
SHA256b4ab50c0c3a89046764d4b805c9c4cf5cbe6ae07aa2eddb5e445c11479a912ce
SHA512b595f5b8de7ecf96cb18f9f1de10bbb4988bb9b6412e1837b49469b78f7f15bbae661b8092b1d46fa6d2bdfeaa5f0e8e0f493c70dbe7d94c66cba325d83e6c85
-
Filesize
458KB
MD5619f7135621b50fd1900ff24aade1524
SHA16c7ea8bbd435163ae3945cbef30ef6b9872a4591
SHA256344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2
SHA5122c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628
-
Filesize
22B
MD576cdb2bad9582d23c1f6f4d868218d6c
SHA1b04f3ee8f5e43fa3b162981b50bb72fe1acabb33
SHA2568739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85
SHA5125e2f959f36b66df0580a94f384c5fc1ceeec4b2a3925f062d7b68f21758b86581ac2adcfdde73a171a28496e758ef1b23ca4951c05455cdae9357cc3b5a5825f
-
Filesize
479KB
MD509372174e83dbbf696ee732fd2e875bb
SHA1ba360186ba650a769f9303f48b7200fb5eaccee1
SHA256c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
SHA512b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
-
Filesize
13.8MB
MD50a8747a2ac9ac08ae9508f36c6d75692
SHA1b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA25632d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
SHA51259521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\AlternateServices.bin
Filesize6KB
MD5edf9f631d041f246524f7915e506dbd8
SHA11990769590f8354fabfe336d917a3ee59f275365
SHA2569f63e76a020b045b56a26ccc5e3b71ef190b2e533ee6428a52a5d8aa2e8f14f7
SHA51248f0dbc12918a88d9571b3c21130eaf8ea709d5086a6b754f59db184e46b474d6e0d82fdbbc2662b494b6175c7eb7009fd546c4ac9b762c1c38fca02b54e8a3f
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\AlternateServices.bin
Filesize8KB
MD50c32679d8d13dc0d30af773e4e78a0c1
SHA136c5a9ac603a7411ffe3ac30888ad3d66ef058e6
SHA2568c91d61a1d262d66b0ff45506e0d38255d467f804be6a9b8ace6cc50ddfa68c7
SHA512be0e4b3ea040f0fe3cf122369d6c8359215d02ea2b5ac86f0b1a57edde3c36825e8b5d8e06346b923aaf5551a95eb5c64ece5c227afeec94db1d963c63e63455
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\AlternateServices.bin
Filesize13KB
MD5ed6c67efc67ce90cdd45594221ffbf55
SHA10278778e9a523f96536e38a71629c6eaedcd2d83
SHA256caffe91c47a9e0067e2b2f68d69cc91d4333883245d6150906d39d390e00eb22
SHA5123cb22958d2079c17de6de221911f049f16cc6a622e861798ad07f0e4ae57dbaa3e82fea7318d121c0a6effd0d79bf3481076d3ed6fd9df3274a3a41d536efe65
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\db\data.safe.tmp
Filesize5KB
MD5a07c8665cf2bf869ec0a4840c237c65d
SHA1735e347dc7b3205bc6a5b9671b032a0c6b060a86
SHA256f66dbdfa91069f82e7fa6162f17d9fc506cfd3353a493d63c5e643859283f9a7
SHA5124135e4c3a588ff71ab72d298b5ab29aa989b3860b7c13cf55357eb4f8f3dab6f6b13cf5a43103decb7434ec804f0d513508f570dac07ae9ac647fb629b646a01
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\db\data.safe.tmp
Filesize6KB
MD5bd77ef5b48d27a853ce5d6a5f150c5fa
SHA1fa2463a4fcef988b601c85ee071b7d5508374783
SHA2563f927ef4e23b7a7840d0a7ab3461685c233c70edc90ff0b12fbada853d99d6e9
SHA51200f9dcd432156cb797e7989981a9639dea8daf5ed16a7fd8472729f7584f90047046fb9aac8dbc6cd4225c682ff689dc40224c779c3532e494e7bd7e506f2dc1
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\db\data.safe.tmp
Filesize14KB
MD52541aeba8e08bb75e4f1d21e87115be5
SHA1ad6a2210d58de39077594a26be474763385f33f9
SHA25624da4a9555e1f724c7fd5e30281b99b8e37d99fff3ce653ac1617b72d5aae0d2
SHA512886ad4556853092274753b24cae79d7172be88f5e5c6d95fcfdf8f650896e29f6d6103e8bb488d063242d63e25334d6971a39ba07204e14e0f1772601374e4ae
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\pending_pings\1615a87f-342c-4a45-8977-384288d856a9
Filesize982B
MD5ec54e333457e0f9003fa8df4a647ce4f
SHA134c63034c07ceb96b92d40f451dcc3624fa85687
SHA256231eaffd0d947f2354d2d20c6d7901d3669ba3a57594e5d4be67479d2152f916
SHA512c2c5f65541f34f1dd29236a536d849c5b7e29d306affb33b61f7440b3b5a4cd01e33d8f9de755cc36b37046986614ffe6acd78ddd0ae92e5cb5d6488dadec040
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\pending_pings\78caa59f-d838-4365-9c47-d57fbc3b871e
Filesize26KB
MD5f3dffdaec12da3df86e7683da67caa88
SHA1edbf2cb4fcdf1551088b58bb2ca2441ce735d6cc
SHA2563c92e45669783064d5611078ad1335bef10d80fe06255d2bf500e16146d742ef
SHA51253dda5776672e2782ab31834873c38ec046dade42f6a71faea5ced54c67953580e4ee4bd8108570a326c29336753ba8c10b346bebf99cf30d269d805bae6bfa9
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\pending_pings\e1d40484-0b6a-4ef4-bdc2-0db32f62a46d
Filesize671B
MD5c15e5bd434b77f15a176d3597463db50
SHA12aa9d07bd6eaea92cf6fa82190b45596ad87164e
SHA256f17a85e1e153a7afabd1bb6775adceaedfc936598b4968c8be2a944ca75c526f
SHA512bcd001dbe79e0ee0af9e4e44fb4e11f166ff654cde005897e1a375e79879651f91b72511433f79072324938df6c79060e8a83b927f95ecbbacb0dc0f78d3ec7e
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Filesize1.1MB
MD5842039753bf41fa5e11b3a1383061a87
SHA13e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA256d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
SHA512d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Filesize116B
MD52a461e9eb87fd1955cea740a3444ee7a
SHA1b10755914c713f5a4677494dbe8a686ed458c3c5
SHA2564107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
SHA51234f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Filesize372B
MD5bf957ad58b55f64219ab3f793e374316
SHA1a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA256bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
SHA51279c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Filesize17.8MB
MD5daf7ef3acccab478aaa7d6dc1c60f865
SHA1f8246162b97ce4a945feced27b6ea114366ff2ad
SHA256bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
SHA5125840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
-
Filesize
10KB
MD5c070be30e334bba5201a4da4774d79d1
SHA105a74896747844eda421c7a554a96cd798dbe581
SHA256c94a621ab938dd8b88c4cfa943c4a6b49b70f71cafdd7107bc4b8a5ce83d8fea
SHA5120150826dc0711c6b0a3e959cac4be91f664c93735f5637d52074da9dfb90c84d42a08c15b33fc3330455e4a3c7bf828edaaa4d7e6ffb745d2bf975b074d45172
-
Filesize
12KB
MD573f3de021c129543dd2895390cf08376
SHA11e7f5b963f38342a0a6ce96766ae3375bbd53ca5
SHA256374955e0fef9780cd424702f368b13208bb5d71da8818d8543ca292f0d402aee
SHA512a654f15fb6fbb546c9917d95b0c9a47e6212311c9b69f9153ebc8235af8e546fd4ec5cee54e141b4593bd5afe7776eb44bff41c1a70b4f1eeea1a2d8b06cb432
-
Filesize
15KB
MD58bcf0e8fdd7088d5b26af31274f42dd6
SHA1ffed624e30b396ecdb047b8620f4e1df2a9b6a3d
SHA2564a22d0430548691c3276574330e486979afb9f4b4c84a3fdcf1be9728aa812a0
SHA5121bb18c6df8931d7e075bc4aba71acc615e29ce98fd9c13ba1fefbfa40292f5d1768619f2333927c1e1f7a2e743ccf644560e9cb56ba1f0311b27056a1a92d9ff
-
Filesize
11KB
MD59518b53ea31e4c2fb91fb24a9148390e
SHA173d38a214b09aeae76a232e07f67e14b19b7ea5d
SHA25689584a2e7fd432eb407ecf5c6b74dc3e1bd413e23eed7aafd8b0763e3a1444e7
SHA512f82a624ef832f6a171a077a283b8ab2b1950cb29ecce38a4548096a9ae8a044a6e8940b80754af117abe12839909efdcb28b8572278ac1df78fc929015f92a9a
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Filesize2.1MB
MD565ce883f18f17ed37cec9235e358cf00
SHA1abcc5ec129c8a00a27fb59dd36b619afcd979b5a
SHA256c5d24f9922648e6228aea95d12336feb4fb4b9cd4555bd7e5ed43b4094eefc4e
SHA5127c9c5a16cc303434e9f9ccb4c30cb9149caeb10e5f47b8ace42b91cc021347bf9d1afe261ee496bb632b198e148c6e2e99e1f8d36768972b361f5b2f8576ae54