Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
13-12-2024 14:51
Static task
static1
General
-
Target
file.exe
-
Size
3.2MB
-
MD5
acf48e01c1d4d71dbfde9e5a4b52c38c
-
SHA1
6950a4271a4e357e3309f553673849ff0d26e3c5
-
SHA256
1d43eaa2b566d2111d938ef9617a65304db66158c4499d8b3a37db3d6607daa9
-
SHA512
2013170dc32e9f9e9cc1dbbbc2e3f425a61511635eef161d56815d592537ecc7f0b11209e8d777f3d43cd5db548339d4dcae8d6e6c35ac2046e5936be4fc8299
-
SSDEEP
49152:4VZvytWJYyZcALa38506hvjjO3Rj7IdzCodAXuLdsCT5ApUxAtfpSS2vpb:ULa3850o76hj7IdmodzdsCTayABYSQb
Malware Config
Extracted
amadey
4.42
9c9aa5
http://185.215.113.43
-
install_dir
abc3bc1985
-
install_file
skotes.exe
-
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
-
url_paths
/Zu7JuNko/index.php
Extracted
stealc
stok
http://185.215.113.206
-
url_path
/c4becf79229cb002.php
Extracted
lumma
https://drive-connect.cyou/api
Signatures
-
Amadey family
-
Gcleaner family
-
Lumma family
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection 62b81acb9c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 62b81acb9c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" 62b81acb9c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 62b81acb9c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 62b81acb9c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 62b81acb9c.exe -
Stealc family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ file.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ c8124465ab.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 67b636e343.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 62b81acb9c.exe -
Renames multiple (8904) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
pid Process 17988 powershell.exe 17644 powershell.exe -
Downloads MZ/PE file
-
Uses browser remote debugging 2 TTPs 6 IoCs
Can be used control the browser and steal sensitive information such as credentials and session cookies.
pid Process 15204 chrome.exe 18972 chrome.exe 5904 msedge.exe 19408 chrome.exe 5636 msedge.exe 14780 chrome.exe -
Checks BIOS information in registry 2 TTPs 14 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion c8124465ab.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 67b636e343.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 62b81acb9c.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion c8124465ab.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion file.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion file.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 67b636e343.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 62b81acb9c.exe -
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation file.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation skotes.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation 825abc5ae6.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation 178e2a9ac0.exe -
Executes dropped EXE 24 IoCs
pid Process 1244 skotes.exe 2144 4ZD5C3i.exe 944 skotes.exe 7244 Loader.exe 12772 Loader.exe 6360 17d3d0a4c6.exe 15336 17d3d0a4c6.exe 14872 825abc5ae6.exe 17548 05d9dc5952.exe 14380 c8124465ab.exe 13252 9c70d96a74.exe 19468 67b636e343.exe 20144 skotes.exe 22908 62b81acb9c.exe 10384 178e2a9ac0.exe 11368 7z.exe 11564 7z.exe 11748 7z.exe 11944 7z.exe 12012 7z.exe 10460 7z.exe 23504 7z.exe 23444 7z.exe 23396 in.exe -
Identifies Wine through registry keys 2 TTPs 7 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Wine c8124465ab.exe Key opened \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Wine 67b636e343.exe Key opened \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Wine skotes.exe Key opened \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Wine 62b81acb9c.exe Key opened \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Wine file.exe Key opened \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Wine skotes.exe Key opened \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Wine skotes.exe -
Loads dropped DLL 53 IoCs
pid Process 12772 Loader.exe 12772 Loader.exe 12772 Loader.exe 12772 Loader.exe 12772 Loader.exe 12772 Loader.exe 12772 Loader.exe 12772 Loader.exe 12772 Loader.exe 12772 Loader.exe 12772 Loader.exe 12772 Loader.exe 12772 Loader.exe 12772 Loader.exe 12772 Loader.exe 12772 Loader.exe 12772 Loader.exe 12772 Loader.exe 12772 Loader.exe 12772 Loader.exe 12772 Loader.exe 12772 Loader.exe 12772 Loader.exe 12772 Loader.exe 12772 Loader.exe 12772 Loader.exe 12772 Loader.exe 12772 Loader.exe 12772 Loader.exe 12772 Loader.exe 12772 Loader.exe 12772 Loader.exe 12772 Loader.exe 12772 Loader.exe 12772 Loader.exe 12772 Loader.exe 12772 Loader.exe 12772 Loader.exe 12772 Loader.exe 12772 Loader.exe 12772 Loader.exe 12772 Loader.exe 12772 Loader.exe 12772 Loader.exe 12772 Loader.exe 11368 7z.exe 11564 7z.exe 11748 7z.exe 11944 7z.exe 12012 7z.exe 10460 7z.exe 23504 7z.exe 23444 7z.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features 62b81acb9c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" 62b81acb9c.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Powershell = "\"powershell.exe\" -WindowStyle Hidden -ExecutionPolicy Bypass -File \"C:\\Users\\Admin\\AppData\\Roaming\\jRabopmkLCAxeGi.ps1\"" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\9c70d96a74.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1014830001\\9c70d96a74.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\67b636e343.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1014831001\\67b636e343.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\62b81acb9c.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1014832001\\62b81acb9c.exe" skotes.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops desktop.ini file(s) 16 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Temp\FileRetriever_Prysmax\Desktop\desktop.ini Loader.exe File created C:\Users\Admin\AppData\Local\Temp\FileRetriever_Prysmax\Downloads\desktop.ini Loader.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\FileRetriever_Prysmax\Videos\desktop.ini Loader.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\FileRetriever_Prysmax\Music\desktop.ini Loader.exe File created C:\Users\Admin\AppData\Local\Temp\FileRetriever_Prysmax\Pictures\desktop.ini Loader.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\FileRetriever_Prysmax\Pictures\desktop.ini Loader.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\FileRetriever_Prysmax\Desktop\desktop.ini Loader.exe File created C:\Users\Admin\AppData\Local\Temp\FileRetriever_Prysmax\Music\desktop.ini Loader.exe File created C:\Users\Admin\AppData\Local\Temp\FileRetriever_Prysmax\Pictures\Saved Pictures\desktop.ini Loader.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\FileRetriever_Prysmax\Pictures\Saved Pictures\desktop.ini Loader.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\FileRetriever_Prysmax\Downloads\desktop.ini Loader.exe File created C:\Users\Admin\AppData\Local\Temp\FileRetriever_Prysmax\Documents\desktop.ini Loader.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\FileRetriever_Prysmax\Documents\desktop.ini Loader.exe File created C:\Users\Admin\AppData\Local\Temp\FileRetriever_Prysmax\Videos\desktop.ini Loader.exe File created C:\Users\Admin\AppData\Local\Temp\FileRetriever_Prysmax\Pictures\Camera Roll\desktop.ini Loader.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\FileRetriever_Prysmax\Pictures\Camera Roll\desktop.ini Loader.exe -
Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F: 4ZD5C3i.exe File opened (read-only) \??\Z: 4ZD5C3i.exe -
Looks up external IP address via web service 8 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 755 api.ipify.org 757 api.ipify.org 759 api.ipify.org 763 api.ipify.org 285 api.ipify.org 635 api.ipify.org 734 api.ipify.org 738 api.ipify.org -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/files/0x000a000000024563-21727.dat autoit_exe -
Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 13020 tasklist.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs
pid Process 1732 file.exe 1244 skotes.exe 944 skotes.exe 12772 Loader.exe 14380 c8124465ab.exe 19468 67b636e343.exe 20144 skotes.exe 22908 62b81acb9c.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 6360 set thread context of 15336 6360 17d3d0a4c6.exe 130 -
resource yara_rule behavioral2/memory/23396-22234-0x00007FF606740000-0x00007FF606BD0000-memory.dmp upx behavioral2/memory/23396-22237-0x00007FF606740000-0x00007FF606BD0000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\BadgeLogo.scale-100_contrast-black.png 4ZD5C3i.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\animations\OneNoteFirstRunCarousel_Animation1.mp4 4ZD5C3i.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\GamesXboxHubAppList.scale-100.png 4ZD5C3i.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\contrast-black\MixedRealityPortalAppList.targetsize-40_altform-unplated_contrast-black.png 4ZD5C3i.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailMediumTile.scale-100.png 4ZD5C3i.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\clrjit.dll 4ZD5C3i.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Input.Manipulations.resources.dll 4ZD5C3i.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.scale-80.png 4ZD5C3i.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\themes\dark\[email protected] 4ZD5C3i.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\1033\NATIVESHIM.RESOURCES.DLL 4ZD5C3i.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\dt_socket.dll 4ZD5C3i.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\LinkedInboxSmallTile.scale-150.png 4ZD5C3i.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libcrystalhd_plugin.dll 4ZD5C3i.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\msmgdsrv.dll 4ZD5C3i.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\1033\msointl30.dll 4ZD5C3i.exe File opened for modification C:\Program Files\Java\jre-1.8\COPYRIGHT 4ZD5C3i.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailAppList.targetsize-30.png 4ZD5C3i.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\iheart-radio.scale-200_contrast-black.png 4ZD5C3i.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsAppList.targetsize-30_altform-lightunplated.png 4ZD5C3i.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\sk-sk\ui-strings.js 4ZD5C3i.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\dictation\SpeechOff.wav 4ZD5C3i.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\BadgeLogo.scale-100.png 4ZD5C3i.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libanaglyph_plugin.dll 4ZD5C3i.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsAppList.targetsize-64_altform-unplated_contrast-white.png 4ZD5C3i.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-black\PeopleAppList.targetsize-256.png 4ZD5C3i.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\sendforcomments.svg 4ZD5C3i.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ja-jp\README.TXT 4ZD5C3i.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\3082\MSO.ACL 4ZD5C3i.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libcdg_plugin.dll 4ZD5C3i.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\SplashScreen.scale-100_contrast-white.png 4ZD5C3i.exe File created C:\Program Files\dotnet\host\fxr\README.TXT 4ZD5C3i.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Audio\Skype_Camera_Capture_Loud.m4a 4ZD5C3i.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageMedTile.scale-200_contrast-black.png 4ZD5C3i.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_mlp_plugin.dll 4ZD5C3i.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\LTR\contrast-black\SmallTile.scale-100.png 4ZD5C3i.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Century Gothic-Palatino Linotype.xml 4ZD5C3i.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Windows.Forms.resources.dll 4ZD5C3i.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\Glyph_0xe7dd.png 4ZD5C3i.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ca@valencia\LC_MESSAGES\vlc.mo 4ZD5C3i.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\hr-hr\README.TXT 4ZD5C3i.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_MAK-ul-oob.xrm-ms 4ZD5C3i.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchStoreLogo.scale-200_contrast-white.png 4ZD5C3i.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\PeopleMedTile.scale-100.png 4ZD5C3i.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-256_altform-unplated_contrast-black_devicefamily-colorfulunplated.png 4ZD5C3i.exe File created C:\Program Files\Microsoft Office\root\Office16\AugLoop\README.TXT 4ZD5C3i.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ru-ru\README.TXT 4ZD5C3i.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\cs-cz\README.TXT 4ZD5C3i.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteAppList.scale-400.png 4ZD5C3i.exe File created C:\Program Files (x86)\README.TXT 4ZD5C3i.exe File opened for modification C:\Program Files\7-Zip\Lang\ba.txt 4ZD5C3i.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\root\README.TXT 4ZD5C3i.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Grace-ul-oob.xrm-ms 4ZD5C3i.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\en-us\officons.ttf 4ZD5C3i.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ja-jp\ui-strings.js 4ZD5C3i.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\classlist 4ZD5C3i.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\root\README.TXT 4ZD5C3i.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Office 2007 - 2010.xml 4ZD5C3i.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_neutral_split.scale-100_8wekyb3d8bbwe\images\splashscreen.scale-100.png 4ZD5C3i.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSectionSmallTile.scale-150.png 4ZD5C3i.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\share_icons2x.png 4ZD5C3i.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.DataWarehouse.Interfaces.DLL 4ZD5C3i.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\24.png 4ZD5C3i.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\PresentationCore.resources.dll 4ZD5C3i.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Fonts\private\WINGDNG2.TTF 4ZD5C3i.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\skotes.job file.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 16880 14872 WerFault.exe 134 -
System Location Discovery: System Language Discovery 1 TTPs 21 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 67b636e343.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 17d3d0a4c6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 05d9dc5952.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language 9c70d96a74.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language skotes.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4ZD5C3i.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 17d3d0a4c6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 825abc5ae6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c8124465ab.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9c70d96a74.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage 9c70d96a74.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 62b81acb9c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 178e2a9ac0.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 23332 powershell.exe 7692 PING.EXE -
Checks processor information in registry 2 TTPs 10 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 825abc5ae6.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 825abc5ae6.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 16540 timeout.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Gathers network information 2 TTPs 17 IoCs
Uses commandline utility to view network configuration.
pid Process 4104 ipconfig.exe 12900 ipconfig.exe 12500 ipconfig.exe 19288 ipconfig.exe 19144 ipconfig.exe 12432 ipconfig.exe 11000 ipconfig.exe 8216 ipconfig.exe 16824 ipconfig.exe 12804 ipconfig.exe 23144 ipconfig.exe 8416 ipconfig.exe 5404 ipconfig.exe 8788 ipconfig.exe 17732 ipconfig.exe 9632 ipconfig.exe 10860 ipconfig.exe -
Gathers system information 1 TTPs 7 IoCs
Runs systeminfo.exe.
pid Process 14588 systeminfo.exe 12592 systeminfo.exe 8988 systeminfo.exe 9816 systeminfo.exe 11332 systeminfo.exe 18472 systeminfo.exe 5700 systeminfo.exe -
Kills process with taskkill 7 IoCs
pid Process 12728 taskkill.exe 12140 taskkill.exe 19656 taskkill.exe 17256 taskkill.exe 17388 taskkill.exe 13180 taskkill.exe 12664 taskkill.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133785751650670071" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 7692 PING.EXE -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 23348 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1732 file.exe 1732 file.exe 1244 skotes.exe 1244 skotes.exe 2144 4ZD5C3i.exe 2144 4ZD5C3i.exe 2144 4ZD5C3i.exe 2144 4ZD5C3i.exe 2144 4ZD5C3i.exe 2144 4ZD5C3i.exe 2144 4ZD5C3i.exe 2144 4ZD5C3i.exe 2144 4ZD5C3i.exe 2144 4ZD5C3i.exe 2144 4ZD5C3i.exe 2144 4ZD5C3i.exe 2144 4ZD5C3i.exe 2144 4ZD5C3i.exe 2144 4ZD5C3i.exe 2144 4ZD5C3i.exe 2144 4ZD5C3i.exe 2144 4ZD5C3i.exe 2144 4ZD5C3i.exe 2144 4ZD5C3i.exe 2144 4ZD5C3i.exe 2144 4ZD5C3i.exe 2144 4ZD5C3i.exe 2144 4ZD5C3i.exe 2144 4ZD5C3i.exe 2144 4ZD5C3i.exe 2144 4ZD5C3i.exe 2144 4ZD5C3i.exe 2144 4ZD5C3i.exe 2144 4ZD5C3i.exe 2144 4ZD5C3i.exe 2144 4ZD5C3i.exe 2144 4ZD5C3i.exe 2144 4ZD5C3i.exe 2144 4ZD5C3i.exe 2144 4ZD5C3i.exe 2144 4ZD5C3i.exe 2144 4ZD5C3i.exe 2144 4ZD5C3i.exe 2144 4ZD5C3i.exe 2144 4ZD5C3i.exe 2144 4ZD5C3i.exe 2144 4ZD5C3i.exe 2144 4ZD5C3i.exe 2144 4ZD5C3i.exe 2144 4ZD5C3i.exe 2144 4ZD5C3i.exe 2144 4ZD5C3i.exe 2144 4ZD5C3i.exe 2144 4ZD5C3i.exe 2144 4ZD5C3i.exe 2144 4ZD5C3i.exe 2144 4ZD5C3i.exe 2144 4ZD5C3i.exe 2144 4ZD5C3i.exe 2144 4ZD5C3i.exe 2144 4ZD5C3i.exe 2144 4ZD5C3i.exe 2144 4ZD5C3i.exe 2144 4ZD5C3i.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 19408 chrome.exe 19408 chrome.exe 19408 chrome.exe -
Suspicious use of AdjustPrivilegeToken 61 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 2144 4ZD5C3i.exe Token: SeBackupPrivilege 3640 vssvc.exe Token: SeRestorePrivilege 3640 vssvc.exe Token: SeAuditPrivilege 3640 vssvc.exe Token: SeDebugPrivilege 12772 Loader.exe Token: SeShutdownPrivilege 19408 chrome.exe Token: SeCreatePagefilePrivilege 19408 chrome.exe Token: SeShutdownPrivilege 19408 chrome.exe Token: SeCreatePagefilePrivilege 19408 chrome.exe Token: SeShutdownPrivilege 19408 chrome.exe Token: SeCreatePagefilePrivilege 19408 chrome.exe Token: SeShutdownPrivilege 19408 chrome.exe Token: SeCreatePagefilePrivilege 19408 chrome.exe Token: SeShutdownPrivilege 19408 chrome.exe Token: SeCreatePagefilePrivilege 19408 chrome.exe Token: SeDebugPrivilege 17256 taskkill.exe Token: SeDebugPrivilege 17388 taskkill.exe Token: SeDebugPrivilege 17988 powershell.exe Token: SeDebugPrivilege 17644 powershell.exe Token: SeDebugPrivilege 13180 taskkill.exe Token: SeDebugPrivilege 13020 tasklist.exe Token: SeDebugPrivilege 12664 taskkill.exe Token: SeDebugPrivilege 12728 taskkill.exe Token: SeDebugPrivilege 12140 taskkill.exe Token: SeDebugPrivilege 19656 taskkill.exe Token: SeDebugPrivilege 19924 firefox.exe Token: SeDebugPrivilege 19924 firefox.exe Token: SeDebugPrivilege 22908 62b81acb9c.exe Token: SeRestorePrivilege 11368 7z.exe Token: 35 11368 7z.exe Token: SeSecurityPrivilege 11368 7z.exe Token: SeSecurityPrivilege 11368 7z.exe Token: SeRestorePrivilege 11564 7z.exe Token: 35 11564 7z.exe Token: SeSecurityPrivilege 11564 7z.exe Token: SeSecurityPrivilege 11564 7z.exe Token: SeRestorePrivilege 11748 7z.exe Token: 35 11748 7z.exe Token: SeSecurityPrivilege 11748 7z.exe Token: SeSecurityPrivilege 11748 7z.exe Token: SeRestorePrivilege 11944 7z.exe Token: 35 11944 7z.exe Token: SeSecurityPrivilege 11944 7z.exe Token: SeSecurityPrivilege 11944 7z.exe Token: SeRestorePrivilege 12012 7z.exe Token: 35 12012 7z.exe Token: SeSecurityPrivilege 12012 7z.exe Token: SeSecurityPrivilege 12012 7z.exe Token: SeRestorePrivilege 10460 7z.exe Token: 35 10460 7z.exe Token: SeSecurityPrivilege 10460 7z.exe Token: SeSecurityPrivilege 10460 7z.exe Token: SeRestorePrivilege 23504 7z.exe Token: 35 23504 7z.exe Token: SeSecurityPrivilege 23504 7z.exe Token: SeSecurityPrivilege 23504 7z.exe Token: SeRestorePrivilege 23444 7z.exe Token: 35 23444 7z.exe Token: SeSecurityPrivilege 23444 7z.exe Token: SeSecurityPrivilege 23444 7z.exe Token: SeDebugPrivilege 23332 powershell.exe -
Suspicious use of FindShellTrayWindow 36 IoCs
pid Process 1732 file.exe 19408 chrome.exe 13252 9c70d96a74.exe 13252 9c70d96a74.exe 13252 9c70d96a74.exe 13252 9c70d96a74.exe 13252 9c70d96a74.exe 13252 9c70d96a74.exe 13252 9c70d96a74.exe 13252 9c70d96a74.exe 13252 9c70d96a74.exe 19924 firefox.exe 19924 firefox.exe 19924 firefox.exe 19924 firefox.exe 19924 firefox.exe 19924 firefox.exe 19924 firefox.exe 19924 firefox.exe 19924 firefox.exe 19924 firefox.exe 19924 firefox.exe 19924 firefox.exe 19924 firefox.exe 19924 firefox.exe 19924 firefox.exe 19924 firefox.exe 19924 firefox.exe 19924 firefox.exe 19924 firefox.exe 19924 firefox.exe 19924 firefox.exe 13252 9c70d96a74.exe 13252 9c70d96a74.exe 13252 9c70d96a74.exe 13252 9c70d96a74.exe -
Suspicious use of SendNotifyMessage 33 IoCs
pid Process 13252 9c70d96a74.exe 13252 9c70d96a74.exe 13252 9c70d96a74.exe 13252 9c70d96a74.exe 13252 9c70d96a74.exe 13252 9c70d96a74.exe 13252 9c70d96a74.exe 13252 9c70d96a74.exe 13252 9c70d96a74.exe 19924 firefox.exe 19924 firefox.exe 19924 firefox.exe 19924 firefox.exe 19924 firefox.exe 19924 firefox.exe 19924 firefox.exe 19924 firefox.exe 19924 firefox.exe 19924 firefox.exe 19924 firefox.exe 19924 firefox.exe 19924 firefox.exe 19924 firefox.exe 19924 firefox.exe 19924 firefox.exe 19924 firefox.exe 19924 firefox.exe 19924 firefox.exe 19924 firefox.exe 13252 9c70d96a74.exe 13252 9c70d96a74.exe 13252 9c70d96a74.exe 13252 9c70d96a74.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 19924 firefox.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1732 wrote to memory of 1244 1732 file.exe 83 PID 1732 wrote to memory of 1244 1732 file.exe 83 PID 1732 wrote to memory of 1244 1732 file.exe 83 PID 1244 wrote to memory of 2144 1244 skotes.exe 92 PID 1244 wrote to memory of 2144 1244 skotes.exe 92 PID 1244 wrote to memory of 2144 1244 skotes.exe 92 PID 1244 wrote to memory of 7244 1244 skotes.exe 109 PID 1244 wrote to memory of 7244 1244 skotes.exe 109 PID 7244 wrote to memory of 12772 7244 Loader.exe 110 PID 7244 wrote to memory of 12772 7244 Loader.exe 110 PID 12772 wrote to memory of 4720 12772 Loader.exe 111 PID 12772 wrote to memory of 4720 12772 Loader.exe 111 PID 1244 wrote to memory of 6360 1244 skotes.exe 115 PID 1244 wrote to memory of 6360 1244 skotes.exe 115 PID 1244 wrote to memory of 6360 1244 skotes.exe 115 PID 12772 wrote to memory of 19408 12772 Loader.exe 117 PID 12772 wrote to memory of 19408 12772 Loader.exe 117 PID 12772 wrote to memory of 5636 12772 Loader.exe 118 PID 12772 wrote to memory of 5636 12772 Loader.exe 118 PID 19408 wrote to memory of 19104 19408 chrome.exe 119 PID 19408 wrote to memory of 19104 19408 chrome.exe 119 PID 5636 wrote to memory of 19116 5636 msedge.exe 120 PID 5636 wrote to memory of 19116 5636 msedge.exe 120 PID 5636 wrote to memory of 18544 5636 msedge.exe 121 PID 5636 wrote to memory of 18544 5636 msedge.exe 121 PID 5636 wrote to memory of 18544 5636 msedge.exe 121 PID 5636 wrote to memory of 18544 5636 msedge.exe 121 PID 5636 wrote to memory of 18544 5636 msedge.exe 121 PID 5636 wrote to memory of 18544 5636 msedge.exe 121 PID 5636 wrote to memory of 18544 5636 msedge.exe 121 PID 5636 wrote to memory of 18544 5636 msedge.exe 121 PID 5636 wrote to memory of 18544 5636 msedge.exe 121 PID 5636 wrote to memory of 18544 5636 msedge.exe 121 PID 5636 wrote to memory of 18544 5636 msedge.exe 121 PID 5636 wrote to memory of 18544 5636 msedge.exe 121 PID 5636 wrote to memory of 18544 5636 msedge.exe 121 PID 5636 wrote to memory of 18544 5636 msedge.exe 121 PID 5636 wrote to memory of 18544 5636 msedge.exe 121 PID 5636 wrote to memory of 18544 5636 msedge.exe 121 PID 5636 wrote to memory of 18544 5636 msedge.exe 121 PID 5636 wrote to memory of 18544 5636 msedge.exe 121 PID 5636 wrote to memory of 18544 5636 msedge.exe 121 PID 5636 wrote to memory of 18544 5636 msedge.exe 121 PID 5636 wrote to memory of 18544 5636 msedge.exe 121 PID 5636 wrote to memory of 18544 5636 msedge.exe 121 PID 5636 wrote to memory of 18544 5636 msedge.exe 121 PID 5636 wrote to memory of 18544 5636 msedge.exe 121 PID 5636 wrote to memory of 18544 5636 msedge.exe 121 PID 5636 wrote to memory of 18544 5636 msedge.exe 121 PID 5636 wrote to memory of 18544 5636 msedge.exe 121 PID 5636 wrote to memory of 18544 5636 msedge.exe 121 PID 5636 wrote to memory of 18544 5636 msedge.exe 121 PID 5636 wrote to memory of 18544 5636 msedge.exe 121 PID 5636 wrote to memory of 18544 5636 msedge.exe 121 PID 5636 wrote to memory of 18544 5636 msedge.exe 121 PID 5636 wrote to memory of 18544 5636 msedge.exe 121 PID 5636 wrote to memory of 18544 5636 msedge.exe 121 PID 5636 wrote to memory of 18544 5636 msedge.exe 121 PID 5636 wrote to memory of 18544 5636 msedge.exe 121 PID 5636 wrote to memory of 18544 5636 msedge.exe 121 PID 5636 wrote to memory of 18544 5636 msedge.exe 121 PID 5636 wrote to memory of 18544 5636 msedge.exe 121 PID 5636 wrote to memory of 18544 5636 msedge.exe 121 PID 5636 wrote to memory of 18608 5636 msedge.exe 122 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Views/modifies file attributes 1 TTPs 3 IoCs
pid Process 23412 attrib.exe 23364 attrib.exe 23372 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\1014798001\4ZD5C3i.exe"C:\Users\Admin\AppData\Local\Temp\1014798001\4ZD5C3i.exe"3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2144
-
-
C:\Users\Admin\AppData\Local\Temp\1014819001\Loader.exe"C:\Users\Admin\AppData\Local\Temp\1014819001\Loader.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:7244 -
C:\Users\Admin\AppData\Local\Temp\1014819001\Loader.exe"C:\Users\Admin\AppData\Local\Temp\1014819001\Loader.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops desktop.ini file(s)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:12772 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"5⤵PID:4720
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --restore-last-session --remote-debugging-port=8612 --remote-allow-origins=* --headless=new "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data"5⤵
- Uses browser remote debugging
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:19408 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0x80,0x108,0x7ffef974cc40,0x7ffef974cc4c,0x7ffef974cc586⤵PID:19104
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1920,i,4051458694393344738,4239261426393631904,262144 --disable-features=PaintHolding --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1916 /prefetch:26⤵PID:18616
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-appcompat-clear --field-trial-handle=2156,i,4051458694393344738,4239261426393631904,262144 --disable-features=PaintHolding --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2192 /prefetch:36⤵PID:2260
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-appcompat-clear --field-trial-handle=2236,i,4051458694393344738,4239261426393631904,262144 --disable-features=PaintHolding --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2412 /prefetch:86⤵PID:18736
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-appcompat-clear --remote-debugging-port=8612 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3552,i,4051458694393344738,4239261426393631904,262144 --disable-features=PaintHolding --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3560 /prefetch:16⤵
- Uses browser remote debugging
PID:15204
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-appcompat-clear --remote-debugging-port=8612 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3584,i,4051458694393344738,4239261426393631904,262144 --disable-features=PaintHolding --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3600 /prefetch:16⤵
- Uses browser remote debugging
PID:14780
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-appcompat-clear --remote-debugging-port=8612 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4464,i,4051458694393344738,4239261426393631904,262144 --disable-features=PaintHolding --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4476 /prefetch:16⤵
- Uses browser remote debugging
PID:18972
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-appcompat-clear --field-trial-handle=4712,i,4051458694393344738,4239261426393631904,262144 --disable-features=PaintHolding --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4732 /prefetch:86⤵PID:16364
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-appcompat-clear --field-trial-handle=4944,i,4051458694393344738,4239261426393631904,262144 --disable-features=PaintHolding --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4956 /prefetch:86⤵PID:15804
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --restore-last-session --remote-debugging-port=8600 --remote-allow-origins=* --headless=new "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data"5⤵
- Uses browser remote debugging
- Suspicious use of WriteProcessMemory
PID:5636 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffef96046f8,0x7ffef9604708,0x7ffef96047186⤵PID:19116
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1404,2725795078144084425,13530561697032103826,131072 --disable-features=PaintHolding --headless=new --headless --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=swiftshader-webgl --override-use-software-gl-for-tests --mojo-platform-channel-handle=1516 /prefetch:26⤵PID:18544
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1404,2725795078144084425,13530561697032103826,131072 --disable-features=PaintHolding --lang=en-US --service-sandbox-type=none --use-gl=swiftshader-webgl --headless --mojo-platform-channel-handle=1852 /prefetch:36⤵PID:18608
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=8600 --allow-pre-commit-input --field-trial-handle=1404,2725795078144084425,13530561697032103826,131072 --disable-features=PaintHolding --lang=en-US --headless --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=1968 /prefetch:16⤵
- Uses browser remote debugging
PID:5904
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /IM msedge.exe"5⤵PID:17200
-
C:\Windows\system32\taskkill.exetaskkill /F /IM msedge.exe6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:17256
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /IM chrome.exe"5⤵PID:17300
-
C:\Windows\system32\taskkill.exetaskkill /F /IM chrome.exe6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:17388
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command " Add-MpPreference -ExclusionExtension '.ps1', '.tmp', '.py' Add-MpPreference -ExclusionPath \"$env:TEMP\", \"$env:APPDATA\" "5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:17644
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"5⤵PID:17864
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Powershell\Get-Clipboard.ps15⤵
- Command and Scripting Interpreter: PowerShell
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:17988 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\kja54huj\kja54huj.cmdline"6⤵PID:15976
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES140B.tmp" "c:\Users\Admin\AppData\Local\Temp\kja54huj\CSC25E4335DF3CB426995347514F653783D.TMP"7⤵PID:14788
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ipconfig"5⤵PID:18116
-
C:\Windows\system32\ipconfig.exeipconfig6⤵
- Gathers network information
PID:16824
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ipconfig /all"5⤵PID:16780
-
C:\Windows\system32\ipconfig.exeipconfig /all6⤵
- Gathers network information
PID:4104
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "systeminfo"5⤵PID:15944
-
C:\Windows\system32\systeminfo.exesysteminfo6⤵
- Gathers system information
PID:14588
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist"5⤵PID:13072
-
C:\Windows\system32\tasklist.exetasklist6⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:13020
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ipconfig /all"5⤵PID:12976
-
C:\Windows\system32\ipconfig.exeipconfig /all6⤵
- Gathers network information
PID:12900
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ipconfig"5⤵PID:12844
-
C:\Windows\system32\ipconfig.exeipconfig6⤵
- Gathers network information
PID:12804
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ipconfig"5⤵PID:12372
-
C:\Windows\system32\ipconfig.exeipconfig6⤵
- Gathers network information
PID:12432
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ipconfig /all"5⤵PID:12448
-
C:\Windows\system32\ipconfig.exeipconfig /all6⤵
- Gathers network information
PID:12500
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "systeminfo"5⤵PID:12540
-
C:\Windows\system32\systeminfo.exesysteminfo6⤵
- Gathers system information
PID:12592
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ipconfig"5⤵PID:23108
-
C:\Windows\system32\ipconfig.exeipconfig6⤵
- Gathers network information
PID:23144
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ipconfig /all"5⤵PID:23164
-
C:\Windows\system32\ipconfig.exeipconfig /all6⤵
- Gathers network information
PID:8788
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "systeminfo"5⤵PID:8872
-
C:\Windows\system32\systeminfo.exesysteminfo6⤵
- Gathers system information
PID:8988
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ipconfig"5⤵PID:9312
-
C:\Windows\system32\ipconfig.exeipconfig6⤵
- Gathers network information
PID:17732
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ipconfig /all"5⤵PID:9492
-
C:\Windows\system32\ipconfig.exeipconfig /all6⤵
- Gathers network information
PID:9632
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "systeminfo"5⤵PID:9656
-
C:\Windows\system32\systeminfo.exesysteminfo6⤵
- Gathers system information
PID:9816
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ipconfig"5⤵PID:10720
-
C:\Windows\system32\ipconfig.exeipconfig6⤵
- Gathers network information
PID:10860
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ipconfig /all"5⤵PID:10892
-
C:\Windows\system32\ipconfig.exeipconfig /all6⤵
- Gathers network information
PID:11000
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "systeminfo"5⤵PID:11092
-
C:\Windows\system32\systeminfo.exesysteminfo6⤵
- Gathers system information
PID:11332
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ipconfig"5⤵PID:7976
-
C:\Windows\system32\ipconfig.exeipconfig6⤵
- Gathers network information
PID:8216
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ipconfig /all"5⤵PID:8264
-
C:\Windows\system32\ipconfig.exeipconfig /all6⤵
- Gathers network information
PID:8416
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "systeminfo"5⤵PID:8648
-
C:\Windows\system32\systeminfo.exesysteminfo6⤵
- Gathers system information
PID:18472
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ipconfig"5⤵PID:19424
-
C:\Windows\system32\ipconfig.exeipconfig6⤵
- Gathers network information
PID:19288
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ipconfig"5⤵PID:19260
-
C:\Windows\system32\ipconfig.exeipconfig6⤵
- Gathers network information
PID:19144
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ipconfig /all"5⤵PID:19112
-
C:\Windows\system32\ipconfig.exeipconfig /all6⤵
- Gathers network information
PID:5404
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "systeminfo"5⤵PID:5500
-
C:\Windows\system32\systeminfo.exesysteminfo6⤵
- Gathers system information
PID:5700
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1014823001\17d3d0a4c6.exe"C:\Users\Admin\AppData\Local\Temp\1014823001\17d3d0a4c6.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:6360 -
C:\Users\Admin\AppData\Local\Temp\1014823001\17d3d0a4c6.exe"C:\Users\Admin\AppData\Local\Temp\1014823001\17d3d0a4c6.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:15336
-
-
-
C:\Users\Admin\AppData\Local\Temp\1014827001\825abc5ae6.exe"C:\Users\Admin\AppData\Local\Temp\1014827001\825abc5ae6.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
PID:14872 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\Admin\AppData\Local\Temp\1014827001\825abc5ae6.exe" & rd /s /q "C:\ProgramData\M7YMGDTJM7G4" & exit4⤵
- System Location Discovery: System Language Discovery
PID:18152 -
C:\Windows\SysWOW64\timeout.exetimeout /t 105⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:16540
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 14872 -s 21244⤵
- Program crash
PID:16880
-
-
-
C:\Users\Admin\AppData\Local\Temp\1014828001\05d9dc5952.exe"C:\Users\Admin\AppData\Local\Temp\1014828001\05d9dc5952.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:17548
-
-
C:\Users\Admin\AppData\Local\Temp\1014829001\c8124465ab.exe"C:\Users\Admin\AppData\Local\Temp\1014829001\c8124465ab.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
PID:14380
-
-
C:\Users\Admin\AppData\Local\Temp\1014830001\9c70d96a74.exe"C:\Users\Admin\AppData\Local\Temp\1014830001\9c70d96a74.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:13252 -
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM firefox.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:13180
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM chrome.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:12664
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM msedge.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:12728
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM opera.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:12140
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM brave.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:19656
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking4⤵PID:19912
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking5⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:19924 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1976 -parentBuildID 20240401114208 -prefsHandle 1736 -prefMapHandle 1728 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e1494795-eb84-4d96-a737-deb33586c4c1} 19924 "\\.\pipe\gecko-crash-server-pipe.19924" gpu6⤵PID:20104
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2464 -parentBuildID 20240401114208 -prefsHandle 2440 -prefMapHandle 2436 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a7632a8b-0cf1-4f8c-8a0e-673ad03bf839} 19924 "\\.\pipe\gecko-crash-server-pipe.19924" socket6⤵PID:20188
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3308 -childID 1 -isForBrowser -prefsHandle 3304 -prefMapHandle 3300 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0fe29619-a54d-4dbc-aed6-03f8f6972237} 19924 "\\.\pipe\gecko-crash-server-pipe.19924" tab6⤵PID:20448
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3132 -childID 2 -isForBrowser -prefsHandle 3760 -prefMapHandle 3756 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fda7477b-230c-4bae-95b6-95f22c510a88} 19924 "\\.\pipe\gecko-crash-server-pipe.19924" tab6⤵PID:20732
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4288 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4280 -prefMapHandle 4296 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {10ba79ae-6b4b-49c8-94e9-d0ee10572129} 19924 "\\.\pipe\gecko-crash-server-pipe.19924" utility6⤵
- Checks processor information in registry
PID:21452
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5192 -childID 3 -isForBrowser -prefsHandle 5188 -prefMapHandle 5184 -prefsLen 26944 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {98832658-f4d3-41ff-9f6f-3a351462fc70} 19924 "\\.\pipe\gecko-crash-server-pipe.19924" tab6⤵PID:21980
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5428 -childID 4 -isForBrowser -prefsHandle 5348 -prefMapHandle 5356 -prefsLen 26944 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2afc4eac-6b97-40ec-9904-8078738f2ee9} 19924 "\\.\pipe\gecko-crash-server-pipe.19924" tab6⤵PID:21988
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5220 -childID 5 -isForBrowser -prefsHandle 5540 -prefMapHandle 5548 -prefsLen 26944 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {caeb5e1c-7155-4e18-9b60-79c503f9a897} 19924 "\\.\pipe\gecko-crash-server-pipe.19924" tab6⤵PID:22028
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1014831001\67b636e343.exe"C:\Users\Admin\AppData\Local\Temp\1014831001\67b636e343.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
PID:19468
-
-
C:\Users\Admin\AppData\Local\Temp\1014832001\62b81acb9c.exe"C:\Users\Admin\AppData\Local\Temp\1014832001\62b81acb9c.exe"3⤵
- Modifies Windows Defender Real-time Protection settings
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Windows security modification
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:22908
-
-
C:\Users\Admin\AppData\Local\Temp\1014833001\178e2a9ac0.exe"C:\Users\Admin\AppData\Local\Temp\1014833001\178e2a9ac0.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:10384 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"4⤵PID:10788
-
C:\Windows\system32\mode.commode 65,105⤵PID:11020
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e file.zip -p24291711423417250691697322505 -oextracted5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:11368
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_7.zip -oextracted5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:11564
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_6.zip -oextracted5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:11748
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_5.zip -oextracted5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:11944
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_4.zip -oextracted5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:12012
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_3.zip -oextracted5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:10460
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_2.zip -oextracted5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:23504
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_1.zip -oextracted5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:23444
-
-
C:\Windows\system32\attrib.exeattrib +H "in.exe"5⤵
- Views/modifies file attributes
PID:23412
-
-
C:\Users\Admin\AppData\Local\Temp\main\in.exe"in.exe"5⤵
- Executes dropped EXE
PID:23396 -
C:\Windows\SYSTEM32\attrib.exeattrib +H +S C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe6⤵
- Views/modifies file attributes
PID:23372
-
-
C:\Windows\SYSTEM32\attrib.exeattrib +H C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe6⤵
- Views/modifies file attributes
PID:23364
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE6⤵
- Scheduled Task/Job: Scheduled Task
PID:23348
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell ping 127.0.0.1; del in.exe6⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of AdjustPrivilegeToken
PID:23332 -
C:\Windows\system32\PING.EXE"C:\Windows\system32\PING.EXE" 127.0.0.17⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:7692
-
-
-
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3640
-
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exeC:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:944
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:17568
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵PID:13668
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:15856
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 14872 -ip 148721⤵PID:18440
-
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exeC:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:20144
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
2PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Modify Authentication Process
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Impair Defenses
2Disable or Modify Tools
2Modify Authentication Process
1Modify Registry
3Virtualization/Sandbox Evasion
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Modify Authentication Process
1Steal Web Session Cookie
1Unsecured Credentials
4Credentials In Files
4Discovery
Browser Information Discovery
1Peripheral Device Discovery
1Process Discovery
1Query Registry
9Remote System Discovery
1System Information Discovery
8System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1Virtualization/Sandbox Evasion
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
533B
MD581d185495b4e6430a87dfd37789bb872
SHA1b5da653f81a548c74205c7ae3d19f30af1a14271
SHA256838d654b9cb0360d8b3bb767db8fc1954fc41ba0a56fc34688aad9b50f5ddb40
SHA5121106c9c2245cbd44effb42e4e1365eb796d3b2390b011fb97205550bf183b097c489194aa001f97f949e9d1ed1c970eea6cbb0477da47511e5bc18e88bf2dfa5
-
Filesize
1KB
MD567e486b2f148a3fca863728242b6273e
SHA1452a84c183d7ea5b7c015b597e94af8eef66d44a
SHA256facaf1c3a4bf232abce19a2d534e495b0d3adc7dbe3797d336249aa6f70adcfb
SHA512d3a37da3bb10a9736dc03e8b2b49baceef5d73c026e2077b8ebc1b786f2c9b2f807e0aa13a5866cf3b3cafd2bc506242ef139c423eaffb050bbb87773e53881e
-
Filesize
436B
MD5971c514f84bba0785f80aa1c23edfd79
SHA1732acea710a87530c6b08ecdf32a110d254a54c8
SHA256f157ed17fcaf8837fa82f8b69973848c9b10a02636848f995698212a08f31895
SHA51243dc1425d80e170c645a3e3bb56da8c3acd31bd637329e9e37094ac346ac85434df4edcdbefc05ae00aea33a80a88e2af695997a495611217fe6706075a63c58
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12
Filesize174B
MD509740a73dd2d2d8897cf2794ae4b89a7
SHA14a327e2da9a1fb282505955d3a79fa494324c9a1
SHA256c560220e68833f7b5102aaa30b260dfdbadce67d238d97d1098281ade4520783
SHA5124331445a7efbb13cbc6d430869a1550b2e0de3c77fe98e95dc79967c8416bca55c62ed6c5dda6ae0f91128452a163ad66f202d9b47d87b7f47f7195d1b8eea87
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
Filesize170B
MD56a62091269b0cdb9820f7aceec07cdbf
SHA1edc5bb1d14f23be742bdea1b0b127f65e69b4080
SHA25640073ab3fa7f998d88abcda7c2cf87d06d9212b2b2e7af19f540f8235b74d520
SHA5124db4ff416b09d54b601b4efea97dc58af8623ff5ce3218a0685504585ff44735eb175bc4e74f9d5634f7bfeaf3fb9d9fae7c2c7fedb8b88fc27a692680d945d2
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\activity-stream.discovery_stream.json
Filesize19KB
MD588669ceef1f3822072710c79577966c8
SHA189c8e8296afb79e548544d4da95b807d3b5a6fe1
SHA256a0f3100fcb5f50a21b0835d836c83b9190ac56a547069e419c55a6a31658428c
SHA5124316e6daade87a698345de56a4ab054898afa22c9fd06301b4e210c09c86e318524482c9483a1857bb7375149d481a015080cc74ae0ab91f472b4f24607a7da2
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\cache2\entries\92F4D5A4F9CED6E2E644D803AEE3647A0EA4D984
Filesize13KB
MD5f14b896cd733724e8455f0ddab0fb110
SHA13e5a50909d741905a47ae47b710a8577ba5985ee
SHA2562d3ce86f8160d4d9e1982355c4fd212ea6adf5465ebc261f3413c892569c76d7
SHA512835973ca4f9ea28f2620d2f7d2c70803f8f60b9cdef9ef4fc87cda9fb853847f74ad478be125bf2919db270f791288cb564122ccd872e109bb3d469279f21fdc
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
Filesize15KB
MD596c542dec016d9ec1ecc4dddfcbaac66
SHA16199f7648bb744efa58acf7b96fee85d938389e4
SHA2567f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798
SHA512cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658
-
Filesize
39B
MD5c2b1385b0ee636444a82abcfa02045b8
SHA10a00ba03a8762da0bbddb1c07b1670c3fd1f0e56
SHA25612221f5ea418cc152bc1f78e46748989707271b97154a84bbe3503537e95c772
SHA512b8fbc6d60ed1ceb1c25b3c5a666a94ad253be8b57d5d7bda045e618e2ec1d3883c6dbd33caa89dfe563b9f32e4f39b08c3409851777578ac2f0d6b8da07e0b8d
-
Filesize
1.1MB
MD542a8588cc82773cd223c42f8fe4be91a
SHA1e2ed3cda00140ecd445f5f742729d34f2c452c8c
SHA256d4521c34f489f4a6065dea15634df9bb700c84741f476bde1084d9cdfb373a7b
SHA512681e4b155ce1015723469bd819618b292844aa00f7dab447d9557e244792efcef5614f753283efe9dd76ea77b838af78a3e69008c380482a4412b1cea75c535d
-
Filesize
710KB
MD528e568616a7b792cac1726deb77d9039
SHA139890a418fb391b823ed5084533e2e24dff021e1
SHA2569597798f7789adc29fbe97707b1bd8ca913c4d5861b0ad4fdd6b913af7c7a8e2
SHA51285048799e6d2756f1d6af77f34e6a1f454c48f2f43042927845931b7ecff2e5de45f864627a3d4aa061252401225bbb6c2caa8532320ccbe401e97c9c79ac8e5
-
Filesize
384KB
MD5dfd5f78a711fa92337010ecc028470b4
SHA11a389091178f2be8ce486cd860de16263f8e902e
SHA256da96f2eb74e60de791961ef3800c36a5e12202fe97ae5d2fcfc1fe404bc13c0d
SHA512a3673074919039a2dc854b0f91d1e1a69724056594e33559741f53594e0f6e61e3d99ec664d541b17f09ffdebc2de1b042eec19ca8477fac86359c703f8c9656
-
Filesize
2.5MB
MD52a78ce9f3872f5e591d643459cabe476
SHA19ac947dfc71a868bc9c2eb2bd78dfb433067682e
SHA25621a2ac44acd7a640735870eebfd04b8dc57bc66877cb5be3b929299e86a43dae
SHA51203e2cd8161a1394ee535a2ea7d197791ab715d69a02ffab98121ec5ac8150d2b17a9a32a59307042c4bbeffad7425b55efa047651de6ed39277dba80711454f9
-
Filesize
1.9MB
MD57cc027e8f950db5ae7d8f7db7c8fb6ea
SHA118de17766afec56c1bc2696a5f60152a6abc4211
SHA25633e1798571044045de11b18b53109870f221e8ec94a21ba4389b558198c61c10
SHA5129d73f16e9e15dae391e503b3d5f952019e0a0eb079a9e9c5dbe41beea014928516163e3bc07bdc0c5ff5fb7af4a80f28ccabc5d1d4d9fe50b1b122ca900ed242
-
Filesize
949KB
MD5bc5ad03db5df646afff1a49f5b577ec1
SHA13a8d37bd848deecf451d87bc7244f781d7c2eed3
SHA256381d2b1895e7fee64a9f8708fc68e3ac12f04bebf16e686ac57cdb24ec7a3656
SHA512db158216970e686399487362b5f02138881ff9c307f1ffcd0113c9156dd807239f002a5b3a182c875dbcef94cd53226e20ebb0c4fe47eba4d98f67b458830edb
-
Filesize
1.7MB
MD5797ff7aaf097fc8cf9d6c8f4af823693
SHA1acd8322029a37ce398bae41064a90c7fc930ea04
SHA25687b39184c8e610e7ef784651d735a6fb4d419516375b1b5beef4fec992426399
SHA5121438ef9890bc96a767055641764473848b8b8cc3c777efe5a1fd3ed8f0dd53bbfcc4f320e0203a5760d746f7a43affad3dfcbac6ec4f4b6c5e34149bf17fbc1d
-
Filesize
2.6MB
MD576dadbeb0cad33c4f85133bc35f9993c
SHA1c5d2c63a1f506b1bd264cedfe4e677ced1df03e9
SHA256ac600703275a0440671ae53c02c43167bcdc94e557c06d880ac8e311181f5510
SHA51223adb2d5e33ed5a834eb382e0f92aa924cf7fe31de204d5abddb3f622e389a37e6055118a870c9bf5a453e971754790b54640ac7295a68d75b40b5928618b31a
-
Filesize
4.2MB
MD53a425626cbd40345f5b8dddd6b2b9efa
SHA17b50e108e293e54c15dce816552356f424eea97a
SHA256ba9212d2d5cd6df5eb7933fb37c1b72a648974c1730bf5c32439987558f8e8b1
SHA512a7538c6b7e17c35f053721308b8d6dc53a90e79930ff4ed5cffecaa97f4d0fbc5f9e8b59f1383d8f0699c8d4f1331f226af71d40325022d10b885606a72fe668
-
Filesize
494B
MD5b0cf103eddae3c9f1ab8b095bb7c54aa
SHA1ff211eee7510a1dd391f8d48145023a202c0c281
SHA256894866f8b4af194727df88a065d9d846ed8626a0292e6526b840fb68a42db202
SHA512eb36a9709065d1e8606c6c66681feb4eb6bf3e68d3598530050d246f93d6b32d9428f9c229e12dcd4c302280f495c4256eb993626334f55c48dfd85974971972
-
Filesize
282B
MD59e36cc3537ee9ee1e3b10fa4e761045b
SHA17726f55012e1e26cc762c9982e7c6c54ca7bb303
SHA2564b9d687ac625690fd026ed4b236dad1cac90ef69e7ad256cc42766a065b50026
SHA5125f92493c533d3add10b4ce2a364624817ebd10e32daa45ee16593e913073602db5e339430a3f7d2c44abf250e96ca4e679f1f09f8ca807d58a47cf3d5c9c3790
-
Filesize
402B
MD5ecf88f261853fe08d58e2e903220da14
SHA1f72807a9e081906654ae196605e681d5938a2e6c
SHA256cafec240d998e4b6e92ad1329cd417e8e9cbd73157488889fd93a542de4a4844
SHA51282c1c3dd163fbf7111c7ef5043b009dafc320c0c5e088dec16c835352c5ffb7d03c5829f65a9ff1dc357bae97e8d2f9c3fc1e531fe193e84811fb8c62888a36b
-
Filesize
282B
MD53a37312509712d4e12d27240137ff377
SHA130ced927e23b584725cf16351394175a6d2a9577
SHA256b029393ea7b7cf644fb1c9f984f57c1980077562ee2e15d0ffd049c4c48098d3
SHA512dbb9abe70f8a781d141a71651a62a3a743c71a75a8305e9d23af92f7307fb639dc4a85499115885e2a781b040cbb7613f582544c2d6de521e588531e9c294b05
-
Filesize
504B
MD506e8f7e6ddd666dbd323f7d9210f91ae
SHA1883ae527ee83ed9346cd82c33dfc0eb97298dc14
SHA2568301e344371b0753d547b429c5fe513908b1c9813144f08549563ac7f4d7da68
SHA512f7646f8dcd37019623d5540ad8e41cb285bcc04666391258dbf4c42873c4de46977a4939b091404d8d86f367cc31e36338757a776a632c7b5bf1c6f28e59ad98
-
Filesize
190B
MD5d48fce44e0f298e5db52fd5894502727
SHA1fce1e65756138a3ca4eaaf8f7642867205b44897
SHA256231a08caba1f9ba9f14bd3e46834288f3c351079fcedda15e391b724ac0c7ea8
SHA512a1c0378db4e6dac9a8638586f6797bad877769d76334b976779cd90324029d755fb466260ef27bd1e7f9fdf97696cd8cd1318377970a1b5bf340efb12a4feb4a
-
Filesize
190B
MD587a524a2f34307c674dba10708585a5e
SHA1e0508c3f1496073b9f6f9ecb2fb01cb91f9e8201
SHA256d01a7ef6233ef4ab3ea7210c0f2837931d334a20ae4d2a05ed03291e59e576c9
SHA5127cfa6d47190075e1209fb081e36ed7e50e735c9682bfb482dbf5a36746abdad0dccfdb8803ef5042e155e8c1f326770f3c8f7aa32ce66cf3b47cd13781884c38
-
Filesize
504B
MD529eae335b77f438e05594d86a6ca22ff
SHA1d62ccc830c249de6b6532381b4c16a5f17f95d89
SHA25688856962cef670c087eda4e07d8f78465beeabb6143b96bd90f884a80af925b4
SHA5125d2d05403b39675b9a751c8eed4f86be58cb12431afec56946581cb116b9ae1014ab9334082740be5b4de4a25e190fe76de071ef1b9074186781477919eb3c17
-
Filesize
504B
MD550a956778107a4272aae83c86ece77cb
SHA110bce7ea45077c0baab055e0602eef787dba735e
SHA256b287b639f6edd612f414caf000c12ba0555adb3a2643230cbdd5af4053284978
SHA512d1df6bdc871cacbc776ac8152a76e331d2f1d905a50d9d358c7bf9ed7c5cbb510c9d52d6958b071e5bcba7c5117fc8f9729fe51724e82cc45f6b7b5afe5ed51a
-
Filesize
12KB
MD573dd025bfa3cfb38e5daad0ed9914679
SHA165d141331e8629293146d3398a2f76c52301d682
SHA256c89f3c0b89cfee35583d6c470d378da0af455ebd9549be341b4179d342353641
SHA51220569f672f3f2e6439afd714f179a590328a1f9c40c6bc0dc6fcad7581bc620a877282baf7ec7f16aaa79724ba2165f71d79aa5919c8d23214bbd39611c23aed
-
Filesize
13KB
MD5e87aac7f2a9bf57d6796e5302626ee2f
SHA14b633501e76e96c8859436445f38240f877fc6c6
SHA25697bf9e392d6ad9e1ec94237407887ea3d1dec2d23978891a8174c03af606fd34
SHA512108663f0700d9e30e259a62c1ae35b23f5f2abd0eff00523aae171d1db803da99488c7395afd3ad54a242f0cb2c66a60e6904d3e3f75bb1193621fd65df4ad5c
-
Filesize
14KB
MD5f3f30d72d6d7f4ba94b3c1a9364f1831
SHA146705c3a35c84bf15cf434e2607bddd18991e138
SHA2567820395c44eab26de0312dfc5d08a9a27398f0caa80d8f9a88dee804880996ff
SHA51201c5ea300a7458efe1b209c56a826df0bf3d6ff4dd512f169d6aee9d540600510c3249866bfb991975ca5e41c77107123e480eda4d55eccb88ed22399ee57912
-
Filesize
10KB
MD593da52e6ce73e0c1fc14f7b24dcf4b45
SHA10961cfb91bbcee3462954996c422e1a9302a690b
SHA256ddd427c76f29edd559425b31eee54eb5b1bdd567219ba5023254efde6591faa0
SHA51249202a13d260473d3281bf7ca375ac1766189b6936c4aa03f524081cc573ee98d236aa9c736ba674ade876b7e29ae9891af50f1a72c49850bb21186f84a3c3ab
-
Filesize
12KB
MD50628dc6d83f4a9dddb0552bd0cc9b54c
SHA1c73f990b84a126a05f1d32d509b6361dca80bc93
SHA256f136b963b5ceb60b0f58127a925d68f04c1c8a946970e10c4abc3c45a1942bc7
SHA51278d005a2fec5d1c67fc2b64936161026f9a0b1756862baf51eaf14edee7739f915d059814c8d6f66797f84a28071c46b567f3392daf4ff7fcdfa94220c965c1a
-
Filesize
96KB
MD5f12681a472b9dd04a812e16096514974
SHA16fd102eb3e0b0e6eef08118d71f28702d1a9067c
SHA256d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8
SHA5127d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2
-
Filesize
81KB
MD5a4b636201605067b676cc43784ae5570
SHA1e9f49d0fc75f25743d04ce23c496eb5f89e72a9a
SHA256f178e29921c04fb68cc08b1e5d1181e5df8ce1de38a968778e27990f4a69973c
SHA51202096bc36c7a9ecfa1712fe738b5ef8b78c6964e0e363136166657c153727b870a6a44c1e1ec9b81289d1aa0af9c85f1a37b95b667103edc2d3916280b6a9488
-
Filesize
174KB
MD52baaa98b744915339ae6c016b17c3763
SHA1483c11673b73698f20ca2ff0748628c789b4dc68
SHA2564f1ce205c2be986c9d38b951b6bcb6045eb363e06dacc069a41941f80be9068c
SHA5122ae8df6e764c0813a4c9f7ac5a08e045b44daac551e8ff5f8aa83286be96aa0714d373b8d58e6d3aa4b821786a919505b74f118013d9fcd1ebc5a9e4876c2b5f
-
Filesize
119KB
MD587596db63925dbfe4d5f0f36394d7ab0
SHA1ad1dd48bbc078fe0a2354c28cb33f92a7e64907e
SHA25692d7954d9099762d81c1ae2836c11b6ba58c1883fde8eeefe387cc93f2f6afb4
SHA512e6d63e6fe1c3bd79f1e39cb09b6f56589f0ee80fd4f4638002fe026752bfa65457982adbef13150fa2f36e68771262d9378971023e07a75d710026ed37e83d7b
-
Filesize
60KB
MD549ce7a28e1c0eb65a9a583a6ba44fa3b
SHA1dcfbee380e7d6c88128a807f381a831b6a752f10
SHA2561be5cfd06a782b2ae8e4629d9d035cbc487074e8f63b9773c85e317be29c0430
SHA512cf1f96d6d61ecb2997bb541e9eda7082ef4a445d3dd411ce6fd71b0dfe672f4dfaddf36ae0fb7d5f6d1345fbd90c19961a8f35328332cdaa232f322c0bf9a1f9
-
Filesize
154KB
MD5b5fbc034ad7c70a2ad1eb34d08b36cf8
SHA14efe3f21be36095673d949cceac928e11522b29c
SHA25680a6ebe46f43ffa93bbdbfc83e67d6f44a44055de1439b06e4dd2983cb243df6
SHA512e7185da748502b645030c96d3345d75814ba5fd95a997c2d1c923d981c44d5b90db64faf77ddbbdc805769af1bec37daf0ecee0930a248b67a1c2d92b59c250c
-
Filesize
1.1MB
MD5e4761848102a6902b8e38f3116a91a41
SHA1c262973e26bd9d8549d4a9abf4b7ae0ca4db75f0
SHA2569d03619721c887413315bd674dae694fbd70ef575eb0138f461a34e2dd98a5fd
SHA512a148640aa6f4b4ef3ae37922d8a11f4def9ecfd595438b9a36b1be0810bfb36abf0e01bee0aa79712af0d70cddce928c0df5057c0418c4ed0d733c6193761e82
-
Filesize
29KB
MD523f4becf6a1df36aee468bb0949ac2bc
SHA1a0e027d79a281981f97343f2d0e7322b9fe9b441
SHA25609c5faf270fd63bde6c45cc53b05160262c7ca47d4c37825ed3e15d479daee66
SHA5123ee5b3b7583be1408c0e1e1c885512445a7e47a69ff874508e8f0a00a66a40a0e828ce33e6f30ddc3ac518d69e4bb96c8b36011fb4ededf9a9630ef98a14893b
-
Filesize
75KB
MD5e137df498c120d6ac64ea1281bcab600
SHA1b515e09868e9023d43991a05c113b2b662183cfe
SHA2568046bf64e463d5aa38d13525891156131cf997c2e6cdf47527bc352f00f5c90a
SHA512cc2772d282b81873aa7c5cba5939d232cceb6be0908b211edb18c25a17cbdb5072f102c0d6b7bc9b6b2f1f787b56ab1bc9be731bb9e98885c17e26a09c2beb90
-
Filesize
155KB
MD535f66ad429cd636bcad858238c596828
SHA1ad4534a266f77a9cdce7b97818531ce20364cb65
SHA25658b772b53bfe898513c0eb264ae4fa47ed3d8f256bc8f70202356d20f9ecb6dc
SHA5121cca8e6c3a21a8b05cc7518bd62c4e3f57937910f2a310e00f13f60f6a94728ef2004a2f4a3d133755139c3a45b252e6db76987b6b78bc8269a21ad5890356ad
-
Filesize
812KB
MD5622c5b3c73ed54fc1361ead839c99d97
SHA1bbd9406db4578d813f242251055bd8fa839d2d38
SHA256d0bbd742960c568d82ad9caf513bf1afb7bd519caa9e3721414687e8813c903a
SHA51237515b40568c5b87eb27d7aec3f051427d1df088d489aa596f81a94383736aa3a80fd195b00238d66d0ad686bc03a20ad4a0210e1448b1b4f856739d00d5fd8a
-
Filesize
1KB
MD54ce7501f6608f6ce4011d627979e1ae4
SHA178363672264d9cd3f72d5c1d3665e1657b1a5071
SHA25637fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
SHA512a4cdf92725e1d740758da4dd28df5d1131f70cef46946b173fe6956cc0341f019d7c4fecc3c9605f354e1308858721dada825b4c19f59c5ad1ce01ab84c46b24
-
Filesize
3.3MB
MD5ab01c808bed8164133e5279595437d3d
SHA10f512756a8db22576ec2e20cf0cafec7786fb12b
SHA2569c0a0a11629cced6a064932e95a0158ee936739d75a56338702fed97cb0bad55
SHA5124043cda02f6950abdc47413cfd8a0ba5c462f16bcd4f339f9f5a690823f4d0916478cab5cae81a3d5b03a8a196e17a716b06afee3f92dec3102e3bbc674774f2
-
Filesize
32KB
MD5eef7981412be8ea459064d3090f4b3aa
SHA1c60da4830ce27afc234b3c3014c583f7f0a5a925
SHA256f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
SHA512dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016
-
Filesize
682KB
MD5de72697933d7673279fb85fd48d1a4dd
SHA1085fd4c6fb6d89ffcc9b2741947b74f0766fc383
SHA256ed1c8769f5096afd000fc730a37b11177fcf90890345071ab7fbceac684d571f
SHA5120fd4678c65da181d7c27b19056d5ab0e5dd0e9714e9606e524cdad9e46ec4d0b35fe22d594282309f718b30e065f6896674d3edce6b3b0c8eb637a3680715c2c
-
Filesize
193KB
MD56bc89ebc4014a8db39e468f54aaafa5e
SHA168d04e760365f18b20f50a78c60ccfde52f7fcd8
SHA256dbe6e7be3a7418811bd5987b0766d8d660190d867cd42f8ed79e70d868e8aa43
SHA512b7a6a383eb131deb83eee7cc134307f8545fb7d043130777a8a9a37311b64342e5a774898edd73d80230ab871c4d0aa0b776187fa4edec0ccde5b9486dbaa626
-
Filesize
63KB
MD507bd9f1e651ad2409fd0b7d706be6071
SHA1dfeb2221527474a681d6d8b16a5c378847c59d33
SHA2565d78cd1365ea9ae4e95872576cfa4055342f1e80b06f3051cf91d564b6cd09f5
SHA512def31d2df95cb7999ce1f55479b2ff7a3cb70e9fc4778fc50803f688448305454fbbf82b5a75032f182dff663a6d91d303ef72e3d2ca9f2a1b032956ec1a0e2a
-
Filesize
4.3MB
MD5c80b5cb43e5fe7948c3562c1fff1254e
SHA1f73cb1fb9445c96ecd56b984a1822e502e71ab9d
SHA256058925e4bbfcb460a3c00ec824b8390583baef0c780a7c7ff01d43d9eec45f20
SHA512faa97a9d5d2a0bf78123f19f8657c24921b907268938c26f79e1df6d667f7bee564259a3a11022e8629996406cda9fa00434bb2b1de3e10b9bddc59708dbad81
-
Filesize
543KB
MD5b7acfad9f0f36e7cf8bfb0dd58360ffe
SHA18fa816d403f126f3326cb6c73b83032bb0590107
SHA256461328c988d4c53f84579fc0880c4a9382e14b0c8b830403100a2fa3df0fd9a9
SHA5124fed8a9162a9a2ebc113ea44d461fb498f9f586730218d9c1cddcd7c8c803cad6dea0f563b8d7533321ecb25f6153ca7c5777c314e7cb76d159e39e74c72d1b8
-
Filesize
139KB
MD5f200ca466bf3b8b56a272460e0ee4abc
SHA1ca18e04f143424b06e0df8d00d995c2873aa268d
SHA256a6700ca2bee84c1a051ba4b22c0cde5a6a5d3e35d4764656cfdc64639c2f6b77
SHA51229bf2425b665af9d2f9fd7795bf2ab012aa96faed9a1a023c86afa0d2036cc6014b48116940fad93b7de1e8f4f93eb709cc9319439d7609b79fd8b92669b377d
-
Filesize
28KB
MD5adc412384b7e1254d11e62e451def8e9
SHA104e6dff4a65234406b9bc9d9f2dcfe8e30481829
SHA25668b80009ab656ffe811d680585fac3d4f9c1b45f29d48c67ea2b3580ec4d86a1
SHA512f250f1236882668b2686bd42e1c334c60da7abec3a208ebebdee84a74d7c4c6b1bc79eed7241bc7012e4ef70a6651a32aa00e32a83f402475b479633581e0b07
-
Filesize
131KB
MD5ec7c48ea92d9ff0c32c6d87ee8358bd0
SHA1a67a417fdb36c84871d0e61bfb1015cb30c9898a
SHA256a0f3cc0e98bea5a598e0d4367272e4c65bf446f21932dc2a051546b098d6ce62
SHA512c06e3c0260b918509947a89518d55f0cb03cb19fc28d9e7ed9e3f837d71df31154f0093929446a93a7c7da1293ffd0cc69547e2540f15e3055fe1d12d837f935
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
3.2MB
MD5acf48e01c1d4d71dbfde9e5a4b52c38c
SHA16950a4271a4e357e3309f553673849ff0d26e3c5
SHA2561d43eaa2b566d2111d938ef9617a65304db66158c4499d8b3a37db3d6607daa9
SHA5122013170dc32e9f9e9cc1dbbbc2e3f425a61511635eef161d56815d592537ecc7f0b11209e8d777f3d43cd5db548339d4dcae8d6e6c35ac2046e5936be4fc8299
-
Filesize
458KB
MD5619f7135621b50fd1900ff24aade1524
SHA16c7ea8bbd435163ae3945cbef30ef6b9872a4591
SHA256344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2
SHA5122c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628
-
Filesize
479KB
MD509372174e83dbbf696ee732fd2e875bb
SHA1ba360186ba650a769f9303f48b7200fb5eaccee1
SHA256c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
SHA512b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\AlternateServices.bin
Filesize6KB
MD518b4f2198c809043d9ca8164b8a144bc
SHA1729f1451faecb1bd0f80b688e3187f47b5d7e0fe
SHA256a95cc83f2a604a5f21f2e42ee4a7ba08a873c9e1c5a2cb9a85c2a7fd4dd7f30e
SHA512bc3c8eaccd32b8988752093a835f16431dfdc8f7736921bb2fd9b94f39e7f6599b2a186a74521e673ff7f4d2a342e38e9c70add62cd16e982cae261e3675d86a
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\AlternateServices.bin
Filesize8KB
MD5874b9950fb9ce14b014c617194dc5d71
SHA1188bf8928e94d57d5ec43436792e3c85fab7fa38
SHA256c7cc30c6d2e1e63f56bb50960d40c53b5fa18ccb0673053381ad36e1515c6c17
SHA5122f3303a7cd2265072a65b0e17ea7cff7b4727e6f7cd3361d8427f15648e14092ff87c91a3bec1ae236768a7fc197d41aebe3474c098bd4a97f1301e3a5c6932b
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\AlternateServices.bin
Filesize17KB
MD5eb01a6f4894455562e4f672e659abeb4
SHA1d9cefef909407e2761a7a83ee1a182f744a4cc63
SHA256ba415733ca569905460633d0dce614397efa1499e3746eeb12675f1e74e4e968
SHA512f9584a518c3d9c119866d5712938e2d4a294ec741e265c791024e2ba010a360444c3a28eeb92b9e70b0b00cfab6a4d10042e5aecf29ba029886a9a90694c4a95
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\db\data.safe.tmp
Filesize27KB
MD574da5ff219a6d3835951efd98482d47d
SHA1554370332957ed79d2b312068c6e83e7ddd93d08
SHA2560ca2a01ee9220312ee39a6ff29d795f41c1449f6bb0339dd29b06be1752db4bb
SHA512f54f360793d918005da68a389fa178136a3faa00b24c827c5abb5e02da872bcda1003f36f46eb3526f3aed5e75c0805c443f3977a1d1f4de8010ba1fd5c8600f
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\db\data.safe.tmp
Filesize5KB
MD5c582dfb527d8dcac41faf60b5583fd2d
SHA1e16fd6bda3b94bf0d17576ca2844cff73934d465
SHA2563b0f5bfe7296ccd7d1ca966b07e9e838ab84d58c67a9c9c523da9cfe0f2dc78a
SHA512d6dd0a49509aed882504c67187639260605e1cb77fa363fa6cf6df2ab8a71c33116645825c2da920a15408bf93549c7f6c6f273067eeb4e6c1fd7df1c5d478ca
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\db\data.safe.tmp
Filesize6KB
MD5ba055babaf7b8d0088bb9e59ff71efa1
SHA11f1fd6a2e2ddc4ced8fdc13ee153358dad291bb0
SHA2564a6f79ae34f0794d178b84d1b38ee7f7a1a5c9e24b6affe8ca212b3703ac7da7
SHA512b790c8ae3fd9cedd0ab36ec6405379b5bf498dd2c9f438158cce07e804e640ed93c06cf8f72b8a43cbd0b20268bafbb8cde99bf8493544c41181641bfa05717b
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\db\data.safe.tmp
Filesize6KB
MD50ecd4881ecdf91186048fb5874e42319
SHA1ad942aa4d07caec79218737e02a1cc0149b80304
SHA256873dca83a26940b8e37434df8de3eed925d0762a008054443ce7625752fd766d
SHA51225ee0aa3cccde3874ce1c95a4745baefd5d31ae975081cb6a70907a522804e36773a0e86511f52547f424acfe941224918b0c3aa35077c0fed0b72b5905adeda
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\pending_pings\18cc1548-84ac-44ef-828c-2562d34ddce6
Filesize671B
MD51b6bade149035d8a64fb554fc0350dbb
SHA1f4bb6370541e06a02bc503b325ad6a4c0f75c782
SHA2561a454aae4702209ef2b7da693f1b1d61cdce4b9d36fc517f582a28899b58d389
SHA512b19209ecae5d7b1cf02f24f10ac9b4da3028317d99a6935a8d7afd388e5ba77e8b8b78ba7c4251c4e0230c88e4cb6cb069009c56a4423d2e12ea47232441a720
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\pending_pings\6d3ed3f1-7297-4ea8-ae96-2f516bc51995
Filesize982B
MD588ab6e8c77c6e0c17e6d5dfdaaf3e6dc
SHA10691d9bc1f3538057519bfcfff05a8506cdec5f5
SHA256a0a81465fcb90c35e490b3b8c4de562be59bac245e9bd6369b3153691ed5cb97
SHA512df661b12791e2102956b8455b50bdeeacd8b23f2f895f09d83a4c171881e15ffe8c326613d21c8a78f262355eeba964c71950ef915d14863f278c3391a126102
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\pending_pings\9f5b2fd4-9126-4a9a-b050-016403dcc5bd
Filesize26KB
MD59a82617f2e621c04f492648f1da8a7c7
SHA1ee6e880b81f849f5cc59ceebde596bf48851ac84
SHA2567c7a4d6f3c85a5e2d6d0e97e43b4f024cdf58bae5a859dbf24aba4571c842e62
SHA512edfbfd406fb96c52add7d1b74a6bf2bb800ff302dc1091da185a2c5124f1d4daa60e9b322853da092c2a7ce69a1c43f19f5a48f33fcad166b287a837f96511c2
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Filesize1.1MB
MD5842039753bf41fa5e11b3a1383061a87
SHA13e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA256d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
SHA512d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info.tmp
Filesize116B
MD52a461e9eb87fd1955cea740a3444ee7a
SHA1b10755914c713f5a4677494dbe8a686ed458c3c5
SHA2564107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
SHA51234f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
-
Filesize
10KB
MD55645bcf4d52709abdece84a2585d77b9
SHA198e14dbff05b72ad0f64464a8bc6d84ee0b52e44
SHA25666b9b66e711f72e5349549435691c73c45516d6952ee517eb14323165181aaa6
SHA5124e352aa0269b477fa8d02c9234cbb3b80e2d3f362acea003205c63ef5771b680b4c538ca05d5939fa6a4bf5bff22339c12193ab98decf59b6b19e90184d24212
-
Filesize
11KB
MD5c0bee503ddeccfbc29dd1f2f9cb9e384
SHA10edee999774a692827728f05614f44f7384b8603
SHA25678ac9a5dec171122e9061f09b300528bb9b434268046f5b7e89e1b1ffd7b1bc5
SHA51259325b4232fe1e8607e9d0fad9a7c6e557442700f265d09136017f157c6e6ad02218b104571c9ed1a3f7cd99469fa1b84e7169569d7ee03f12a7fb1f58a0ddbd
-
Filesize
10KB
MD5f137bec5c7ff803748eb253f1accd2b6
SHA191dc9786ea326883185b87af86ed5768eca3a8d6
SHA2561146260f08ef207e49b25bcedc9de3b180dc4150e02687da86ea97d60b1a40b8
SHA512ea0d7b8e7055d980902f89def04be0292f779711b3ad48a55a5b26b0657c2b2eff0e48530eb8341f1accc8d0b6406f389a957102e5f3008f89214a7b6de010ce