Analysis
-
max time kernel
479s -
max time network
480s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 02:15
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.mediafire.com/file/f2xetfaub7gdmnq/Roblsol.rar/file
Resource
win10v2004-20240508-en
Errors
General
-
Target
https://www.mediafire.com/file/f2xetfaub7gdmnq/Roblsol.rar/file
Malware Config
Signatures
-
Detect Poverty Stealer Payload 4 IoCs
resource yara_rule behavioral1/memory/6524-3401-0x0000000000400000-0x000000000040A000-memory.dmp family_povertystealer behavioral1/memory/6524-3404-0x0000000000400000-0x000000000040A000-memory.dmp family_povertystealer behavioral1/memory/6524-3405-0x0000000000400000-0x000000000040A000-memory.dmp family_povertystealer behavioral1/memory/6524-3407-0x0000000000400000-0x000000000040A000-memory.dmp family_povertystealer -
Poverty Stealer
Poverty Stealer is a crypto and infostealer written in C++.
-
Downloads MZ/PE file
-
Executes dropped EXE 7 IoCs
pid Process 7140 winrar-x64-701.exe 5836 winrar-x64-701.exe 2228 7z2405-x64.exe 4260 7zG.exe 4352 loader.exe 7700 Solara 1.23.exe 8468 Solara 1.23.exe -
Loads dropped DLL 2 IoCs
pid Process 3436 Process not Found 4260 7zG.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Registers COM server for autorun 1 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32 7z2405-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll" 7z2405-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment" 7z2405-x64.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
flow ioc 965 bitbucket.org 966 bitbucket.org 972 bitbucket.org -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 4352 set thread context of 6524 4352 loader.exe 193 PID 7700 set thread context of 2720 7700 Solara 1.23.exe 195 -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\Lang\pa-in.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\pl.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ps.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\br.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ga.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\hr.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ms.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ca.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\et.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\fr.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\hy.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\sw.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\hu.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\sa.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\lt.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ug.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\uk.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\af.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\co.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\en.ttt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ka.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\uz-cyrl.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\bn.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\he.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\pt.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ta.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\7-zip.chm 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ne.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\is.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ru.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\sr-spl.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\mn.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\7z.exe 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\io.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\nb.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\zh-tw.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\7-zip32.dll 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ky.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\mng2.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\nl.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\kab.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\cy.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\fa.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\sv.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ko.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\7-zip.dll 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\bg.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\el.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ext.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\gu.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\de.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\yo.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\it.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\History.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ast.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ba.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\id.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\be.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\cs.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\da.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\vi.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ku-ckb.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\7z.sfx 7z2405-x64.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 14 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe -
Modifies data under HKEY_USERS 15 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "137" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe -
Modifies registry class 24 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}" 7z2405-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}" 7z2405-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000} 7z2405-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}" 7z2405-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}" 7z2405-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll" 7z2405-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}" 7z2405-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip 7z2405-x64.exe Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings firefox.exe Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000} 7z2405-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32 7z2405-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension" 7z2405-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment" 7z2405-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip 7z2405-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip 7z2405-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip 7z2405-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension" 7z2405-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32 7z2405-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment" 7z2405-x64.exe Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings taskmgr.exe Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings firefox.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip32.dll" 7z2405-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip 7z2405-x64.exe -
NTFS ADS 3 IoCs
description ioc Process File created C:\Users\Admin\Downloads\Roblsol.rar:Zone.Identifier firefox.exe File created C:\Users\Admin\Downloads\7z2405-x64.exe:Zone.Identifier firefox.exe File created C:\Users\Admin\Downloads\winrar-x64-701.exe:Zone.Identifier firefox.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 2720 MSBuild.exe 2720 MSBuild.exe 2720 MSBuild.exe 2720 MSBuild.exe 2720 MSBuild.exe 2720 MSBuild.exe 2720 MSBuild.exe 2720 MSBuild.exe 2720 MSBuild.exe 2720 MSBuild.exe 2720 MSBuild.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 7988 OpenWith.exe 5156 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 34 IoCs
description pid Process Token: SeDebugPrivilege 3504 firefox.exe Token: SeDebugPrivilege 3504 firefox.exe Token: SeDebugPrivilege 3504 firefox.exe Token: SeDebugPrivilege 3504 firefox.exe Token: SeDebugPrivilege 3504 firefox.exe Token: SeDebugPrivilege 3504 firefox.exe Token: SeDebugPrivilege 7608 taskmgr.exe Token: SeSystemProfilePrivilege 7608 taskmgr.exe Token: SeCreateGlobalPrivilege 7608 taskmgr.exe Token: SeDebugPrivilege 3504 firefox.exe Token: 33 7608 taskmgr.exe Token: SeIncBasePriorityPrivilege 7608 taskmgr.exe Token: SeDebugPrivilege 2228 7z2405-x64.exe Token: SeDebugPrivilege 2228 7z2405-x64.exe Token: SeDebugPrivilege 2228 7z2405-x64.exe Token: SeDebugPrivilege 2228 7z2405-x64.exe Token: SeDebugPrivilege 2228 7z2405-x64.exe Token: SeRestorePrivilege 4260 7zG.exe Token: 35 4260 7zG.exe Token: SeSecurityPrivilege 4260 7zG.exe Token: SeSecurityPrivilege 4260 7zG.exe Token: SeDebugPrivilege 2720 MSBuild.exe Token: SeBackupPrivilege 2720 MSBuild.exe Token: SeSecurityPrivilege 2720 MSBuild.exe Token: SeSecurityPrivilege 2720 MSBuild.exe Token: SeSecurityPrivilege 2720 MSBuild.exe Token: SeSecurityPrivilege 2720 MSBuild.exe Token: SeDebugPrivilege 5156 taskmgr.exe Token: SeSystemProfilePrivilege 5156 taskmgr.exe Token: SeCreateGlobalPrivilege 5156 taskmgr.exe Token: SeDebugPrivilege 4480 firefox.exe Token: SeDebugPrivilege 4480 firefox.exe Token: 33 5156 taskmgr.exe Token: SeIncBasePriorityPrivilege 5156 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3504 firefox.exe 3504 firefox.exe 3504 firefox.exe 3504 firefox.exe 3504 firefox.exe 3504 firefox.exe 3504 firefox.exe 3504 firefox.exe 3504 firefox.exe 3504 firefox.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3504 firefox.exe 3504 firefox.exe 3504 firefox.exe 3504 firefox.exe 3504 firefox.exe 3504 firefox.exe 3504 firefox.exe 3504 firefox.exe 3504 firefox.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe 7608 taskmgr.exe -
Suspicious use of SetWindowsHookEx 57 IoCs
pid Process 3504 firefox.exe 3504 firefox.exe 3504 firefox.exe 3504 firefox.exe 3504 firefox.exe 3504 firefox.exe 3504 firefox.exe 3504 firefox.exe 3504 firefox.exe 3504 firefox.exe 7140 winrar-x64-701.exe 7140 winrar-x64-701.exe 7140 winrar-x64-701.exe 5836 winrar-x64-701.exe 5836 winrar-x64-701.exe 5836 winrar-x64-701.exe 7988 OpenWith.exe 7988 OpenWith.exe 7988 OpenWith.exe 7988 OpenWith.exe 7988 OpenWith.exe 7988 OpenWith.exe 7988 OpenWith.exe 7988 OpenWith.exe 7988 OpenWith.exe 7988 OpenWith.exe 7988 OpenWith.exe 7988 OpenWith.exe 7988 OpenWith.exe 7988 OpenWith.exe 7988 OpenWith.exe 7988 OpenWith.exe 7988 OpenWith.exe 7988 OpenWith.exe 7988 OpenWith.exe 7988 OpenWith.exe 7988 OpenWith.exe 7988 OpenWith.exe 7988 OpenWith.exe 7988 OpenWith.exe 7988 OpenWith.exe 7988 OpenWith.exe 7988 OpenWith.exe 7988 OpenWith.exe 7988 OpenWith.exe 7988 OpenWith.exe 7988 OpenWith.exe 7988 OpenWith.exe 7988 OpenWith.exe 7988 OpenWith.exe 7988 OpenWith.exe 3504 firefox.exe 3504 firefox.exe 3504 firefox.exe 2228 7z2405-x64.exe 4480 firefox.exe 4956 LogonUI.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2500 wrote to memory of 3504 2500 firefox.exe 91 PID 2500 wrote to memory of 3504 2500 firefox.exe 91 PID 2500 wrote to memory of 3504 2500 firefox.exe 91 PID 2500 wrote to memory of 3504 2500 firefox.exe 91 PID 2500 wrote to memory of 3504 2500 firefox.exe 91 PID 2500 wrote to memory of 3504 2500 firefox.exe 91 PID 2500 wrote to memory of 3504 2500 firefox.exe 91 PID 2500 wrote to memory of 3504 2500 firefox.exe 91 PID 2500 wrote to memory of 3504 2500 firefox.exe 91 PID 2500 wrote to memory of 3504 2500 firefox.exe 91 PID 2500 wrote to memory of 3504 2500 firefox.exe 91 PID 3504 wrote to memory of 2340 3504 firefox.exe 92 PID 3504 wrote to memory of 2340 3504 firefox.exe 92 PID 3504 wrote to memory of 2340 3504 firefox.exe 92 PID 3504 wrote to memory of 2340 3504 firefox.exe 92 PID 3504 wrote to memory of 2340 3504 firefox.exe 92 PID 3504 wrote to memory of 2340 3504 firefox.exe 92 PID 3504 wrote to memory of 2340 3504 firefox.exe 92 PID 3504 wrote to memory of 2340 3504 firefox.exe 92 PID 3504 wrote to memory of 2340 3504 firefox.exe 92 PID 3504 wrote to memory of 2340 3504 firefox.exe 92 PID 3504 wrote to memory of 2340 3504 firefox.exe 92 PID 3504 wrote to memory of 2340 3504 firefox.exe 92 PID 3504 wrote to memory of 2340 3504 firefox.exe 92 PID 3504 wrote to memory of 2340 3504 firefox.exe 92 PID 3504 wrote to memory of 2340 3504 firefox.exe 92 PID 3504 wrote to memory of 2340 3504 firefox.exe 92 PID 3504 wrote to memory of 2340 3504 firefox.exe 92 PID 3504 wrote to memory of 2340 3504 firefox.exe 92 PID 3504 wrote to memory of 2340 3504 firefox.exe 92 PID 3504 wrote to memory of 2340 3504 firefox.exe 92 PID 3504 wrote to memory of 2340 3504 firefox.exe 92 PID 3504 wrote to memory of 2340 3504 firefox.exe 92 PID 3504 wrote to memory of 2340 3504 firefox.exe 92 PID 3504 wrote to memory of 2340 3504 firefox.exe 92 PID 3504 wrote to memory of 2340 3504 firefox.exe 92 PID 3504 wrote to memory of 2340 3504 firefox.exe 92 PID 3504 wrote to memory of 2340 3504 firefox.exe 92 PID 3504 wrote to memory of 2340 3504 firefox.exe 92 PID 3504 wrote to memory of 2340 3504 firefox.exe 92 PID 3504 wrote to memory of 2340 3504 firefox.exe 92 PID 3504 wrote to memory of 2340 3504 firefox.exe 92 PID 3504 wrote to memory of 2340 3504 firefox.exe 92 PID 3504 wrote to memory of 2340 3504 firefox.exe 92 PID 3504 wrote to memory of 2340 3504 firefox.exe 92 PID 3504 wrote to memory of 2340 3504 firefox.exe 92 PID 3504 wrote to memory of 2340 3504 firefox.exe 92 PID 3504 wrote to memory of 2340 3504 firefox.exe 92 PID 3504 wrote to memory of 2340 3504 firefox.exe 92 PID 3504 wrote to memory of 2340 3504 firefox.exe 92 PID 3504 wrote to memory of 2340 3504 firefox.exe 92 PID 3504 wrote to memory of 2340 3504 firefox.exe 92 PID 3504 wrote to memory of 2340 3504 firefox.exe 92 PID 3504 wrote to memory of 2340 3504 firefox.exe 92 PID 3504 wrote to memory of 3664 3504 firefox.exe 93 PID 3504 wrote to memory of 3664 3504 firefox.exe 93 PID 3504 wrote to memory of 3664 3504 firefox.exe 93 PID 3504 wrote to memory of 3664 3504 firefox.exe 93 PID 3504 wrote to memory of 3664 3504 firefox.exe 93 PID 3504 wrote to memory of 3664 3504 firefox.exe 93 PID 3504 wrote to memory of 3664 3504 firefox.exe 93 PID 3504 wrote to memory of 3664 3504 firefox.exe 93 PID 3504 wrote to memory of 3664 3504 firefox.exe 93 PID 3504 wrote to memory of 3664 3504 firefox.exe 93 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://www.mediafire.com/file/f2xetfaub7gdmnq/Roblsol.rar/file"1⤵
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://www.mediafire.com/file/f2xetfaub7gdmnq/Roblsol.rar/file2⤵
- Checks processor information in registry
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3504 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3504.0.411635566\1177598210" -parentBuildID 20230214051806 -prefsHandle 1752 -prefMapHandle 1744 -prefsLen 22076 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f96e018f-7d70-49b4-bc60-63435a605f9f} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" 1832 24dd8d0e858 gpu3⤵PID:2340
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3504.1.903164052\714509750" -parentBuildID 20230214051806 -prefsHandle 2396 -prefMapHandle 2384 -prefsLen 22927 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2098a8fa-4b91-4a2f-bc25-097d9c932608} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" 2424 24dcbe84d58 socket3⤵PID:3664
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3504.2.375642429\943239386" -childID 1 -isForBrowser -prefsHandle 3008 -prefMapHandle 3004 -prefsLen 22965 -prefMapSize 235121 -jsInitHandle 896 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e6a8aac5-5035-4d71-a21c-a49a8eb700b7} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" 3020 24dd9239258 tab3⤵PID:5096
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3504.3.889338149\1117752855" -childID 2 -isForBrowser -prefsHandle 3656 -prefMapHandle 3652 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 896 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {11b0235a-731e-4148-8269-d8fe93162736} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" 3668 24ddda33558 tab3⤵PID:4116
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3504.4.176921345\951258392" -childID 3 -isForBrowser -prefsHandle 5316 -prefMapHandle 5312 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 896 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {65a32617-3237-40ea-bc58-9d3d5c50c19e} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" 5300 24ddfcfb558 tab3⤵PID:2356
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3504.5.1084309042\133515305" -childID 4 -isForBrowser -prefsHandle 5408 -prefMapHandle 5416 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 896 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6650045a-6f53-40cf-9278-a514eb676696} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" 5484 24ddfcf8558 tab3⤵PID:436
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3504.6.1515658585\1105266982" -childID 5 -isForBrowser -prefsHandle 5596 -prefMapHandle 5604 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 896 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8828993a-ca88-4590-82ba-73cbb08ce1d0} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" 5680 24ddf971258 tab3⤵PID:2244
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3504.7.1242247313\579983764" -parentBuildID 20230214051806 -prefsHandle 5812 -prefMapHandle 5620 -prefsLen 27697 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1c4030de-8d47-4e5b-bdae-db116ad0c05c} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" 5616 24de0127858 rdd3⤵PID:840
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3504.8.909451634\1039195290" -childID 6 -isForBrowser -prefsHandle 9976 -prefMapHandle 9980 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 896 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {32bf11f2-be97-4b6d-a340-cf1b471f2bcb} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" 9940 24de0ccd158 tab3⤵PID:2888
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3504.9.928126110\492829391" -childID 7 -isForBrowser -prefsHandle 9560 -prefMapHandle 4672 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 896 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dc0e4c46-b150-4445-846a-51b08c54d341} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" 9464 24de1606e58 tab3⤵PID:5904
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3504.10.1449265576\1480553801" -childID 8 -isForBrowser -prefsHandle 9280 -prefMapHandle 9284 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 896 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {90556408-9ff9-4c36-a620-fca1d603ff89} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" 9356 24de1a33958 tab3⤵PID:5916
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3504.11.2024123893\711279989" -childID 9 -isForBrowser -prefsHandle 9172 -prefMapHandle 9168 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 896 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c6adf291-b07e-4b80-90ce-69d52a917154} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" 9180 24de1bf7858 tab3⤵PID:5964
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3504.12.1036047333\1227537280" -childID 10 -isForBrowser -prefsHandle 8840 -prefMapHandle 8836 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 896 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cf01c40d-40fc-4eda-b375-2ee02bbc3449} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" 8852 24de1e93558 tab3⤵PID:3804
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3504.13.657614508\1759446234" -childID 11 -isForBrowser -prefsHandle 8568 -prefMapHandle 8572 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 896 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9144db0e-fa3f-410b-ac0a-a3bd28dc40e2} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" 8540 24de28da158 tab3⤵PID:5952
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3504.14.1876811972\1250998556" -childID 12 -isForBrowser -prefsHandle 8632 -prefMapHandle 8628 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 896 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dee74893-508e-42ef-b294-6291a64189d4} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" 8640 24de2bc3558 tab3⤵PID:6432
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3504.15.309532538\1983516156" -childID 13 -isForBrowser -prefsHandle 3552 -prefMapHandle 3548 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 896 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {416ab5f8-2952-4a26-8d41-2362ed1dd5e5} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" 4552 24ddf888c58 tab3⤵PID:7004
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3504.16.1512604003\803478485" -childID 14 -isForBrowser -prefsHandle 8072 -prefMapHandle 4560 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 896 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7b3b3562-abf5-41c3-831b-6b1869d9a309} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" 3812 24ddd3ddf58 tab3⤵PID:7012
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3504.17.1237081071\7737455" -childID 15 -isForBrowser -prefsHandle 7864 -prefMapHandle 7868 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 896 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {357a735f-82c4-4f74-9eb6-dd43d58e355f} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" 7884 24ddf973f58 tab3⤵PID:6152
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3504.18.1179344184\1906742828" -childID 16 -isForBrowser -prefsHandle 7852 -prefMapHandle 7848 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 896 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7a6e45e8-b9ea-4f2c-8f40-77ddf703d422} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" 7764 24ddfcb7b58 tab3⤵PID:6644
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3504.19.69739692\441054793" -childID 17 -isForBrowser -prefsHandle 7748 -prefMapHandle 9172 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 896 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7ac79678-b841-443a-8164-b29669d6a49f} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" 7596 24dd8d0d658 tab3⤵PID:6668
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3504.20.1095608656\1820443974" -childID 18 -isForBrowser -prefsHandle 9304 -prefMapHandle 9360 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 896 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d7c8f628-765b-4a8d-a8f7-3768ca3d4f04} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" 8992 24de00a5f58 tab3⤵PID:6684
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3504.21.1723657080\799524790" -childID 19 -isForBrowser -prefsHandle 7308 -prefMapHandle 7312 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 896 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {77c5f174-0b84-4ff3-bab9-1082d1016407} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" 7296 24de00a3558 tab3⤵PID:6696
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3504.22.2078313656\1148057950" -childID 20 -isForBrowser -prefsHandle 7144 -prefMapHandle 7140 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 896 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0be56ef9-c063-48d1-a7bd-0a12add92ec7} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" 9060 24de00a6858 tab3⤵PID:3476
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3504.23.765418039\1550043609" -childID 21 -isForBrowser -prefsHandle 8012 -prefMapHandle 8008 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 896 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a15f81dc-4e77-4019-b77b-9c5c8b27c211} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" 9536 24de3d34a58 tab3⤵PID:6912
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3504.24.791053912\95944720" -childID 22 -isForBrowser -prefsHandle 6744 -prefMapHandle 6748 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 896 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c7e9c5c0-4485-4f62-89e4-e503b0dfdcbf} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" 6732 24de4253c58 tab3⤵PID:6708
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3504.25.1855412385\831605823" -childID 23 -isForBrowser -prefsHandle 8340 -prefMapHandle 7564 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 896 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e01131d5-b0aa-426c-8a5c-af8d91be83b9} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" 7764 24de3f9fe58 tab3⤵PID:5436
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3504.26.1689590948\304108498" -childID 24 -isForBrowser -prefsHandle 7864 -prefMapHandle 8236 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 896 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ffd0d5ca-4903-4368-843e-9d2445157ff2} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" 6428 24de19aa558 tab3⤵PID:6220
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3504.27.1368983417\849823731" -childID 25 -isForBrowser -prefsHandle 6748 -prefMapHandle 6744 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 896 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7dd24a67-8f3c-46b4-a29a-5af588798b4a} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" 3548 24de3978e58 tab3⤵PID:6244
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3504.28.362855491\1130117796" -childID 26 -isForBrowser -prefsHandle 8612 -prefMapHandle 8620 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 896 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {67f67018-2459-4f4f-91e9-0b8f2677d9cd} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" 9280 24dcbe84a58 tab3⤵PID:5648
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3504.29.1211726392\18594331" -childID 27 -isForBrowser -prefsHandle 6256 -prefMapHandle 8592 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 896 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d44edd46-831e-4a86-b88c-162ac122f093} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" 6236 24dd9217458 tab3⤵PID:5616
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3504.30.1046050704\249175004" -childID 28 -isForBrowser -prefsHandle 6108 -prefMapHandle 6104 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 896 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2793413b-84bf-4c5d-9e65-affff7276b3c} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" 6116 24dd9218358 tab3⤵PID:5620
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3504.31.128536858\673827592" -childID 29 -isForBrowser -prefsHandle 9788 -prefMapHandle 6780 -prefsLen 31357 -prefMapSize 235121 -jsInitHandle 896 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {27c49a8c-db83-4433-9928-90a4109e0384} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" 2728 24ddf65a858 tab3⤵PID:2780
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3504.32.1000619915\747190583" -childID 30 -isForBrowser -prefsHandle 6468 -prefMapHandle 6460 -prefsLen 31357 -prefMapSize 235121 -jsInitHandle 896 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {04151070-5e4e-44cb-a335-5804bdd18294} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" 6244 24ddf972458 tab3⤵PID:3472
-
-
C:\Users\Admin\Downloads\winrar-x64-701.exe"C:\Users\Admin\Downloads\winrar-x64-701.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:7140
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3504.33.19549131\1848072365" -childID 31 -isForBrowser -prefsHandle 5184 -prefMapHandle 5180 -prefsLen 31406 -prefMapSize 235121 -jsInitHandle 896 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {973bb3ba-0af9-4e9a-856c-aee69d47bc16} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" 7448 24dcbe6fb58 tab3⤵PID:2592
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3504.34.114997798\1607890747" -childID 32 -isForBrowser -prefsHandle 4344 -prefMapHandle 4928 -prefsLen 31415 -prefMapSize 235121 -jsInitHandle 896 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d118e0ff-df06-4bb3-8685-f0bfe19c8c92} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" 4320 24ddd57f458 tab3⤵PID:5208
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3504.35.1605953287\1529099511" -childID 33 -isForBrowser -prefsHandle 4320 -prefMapHandle 4928 -prefsLen 31415 -prefMapSize 235121 -jsInitHandle 896 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {68b6c0a6-215b-4cea-98e0-ca4468da6374} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" 10264 24ddbcf2958 tab3⤵PID:5132
-
-
C:\Users\Admin\Downloads\7z2405-x64.exe"C:\Users\Admin\Downloads\7z2405-x64.exe"3⤵
- Executes dropped EXE
- Registers COM server for autorun
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2228
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3804,i,1809100026287847100,9768898026582633513,262144 --variations-seed-version --mojo-platform-channel-handle=3808 /prefetch:81⤵PID:5520
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\305e5d0cdf3c4599b48766eec6134762 /t 6644 /p 71401⤵PID:7928
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4576
-
C:\Users\Admin\Downloads\winrar-x64-701.exe"C:\Users\Admin\Downloads\winrar-x64-701.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5836
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault2d324811he6e7h46d5h923dh16fb563ccac11⤵PID:7268
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:7608
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\512297b7c8da46af8398a7f46d8b9226 /t 5840 /p 58361⤵PID:5488
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:7988
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap30389:76:7zEvent79481⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:4260
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c82192ee-6cb5-4bc0-9ef0-fb818773790a} -Embedding1⤵PID:764
-
C:\Users\Admin\Downloads\Solara\metod 2\loader.exe"C:\Users\Admin\Downloads\Solara\metod 2\loader.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4352 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:6524
-
-
C:\Users\Admin\Downloads\Solara\Solara 1.23.exe"C:\Users\Admin\Downloads\Solara\Solara 1.23.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:7700 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2720
-
-
C:\Users\Admin\Downloads\Solara\Solara 1.23.exe"C:\Users\Admin\Downloads\Solara\Solara 1.23.exe"1⤵
- Executes dropped EXE
PID:8468 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:8652
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:5156
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵PID:3836
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4480 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4480.0.1541199129\1572597054" -parentBuildID 20230214051806 -prefsHandle 1772 -prefMapHandle 1764 -prefsLen 25237 -prefMapSize 235664 -appDir "C:\Program Files\Mozilla Firefox\browser" - {bd476f86-59cc-47f4-896b-3d509db2ea77} 4480 "\\.\pipe\gecko-crash-server-pipe.4480" 1852 19e1e62ac58 gpu3⤵PID:6384
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4480.1.938196079\120826194" -parentBuildID 20230214051806 -prefsHandle 2300 -prefMapHandle 2296 -prefsLen 25237 -prefMapSize 235664 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {816ce021-88c9-4c44-8dc3-31e412595565} 4480 "\\.\pipe\gecko-crash-server-pipe.4480" 2324 19e11b89958 socket3⤵PID:8432
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4480.2.1953709022\2133674088" -childID 1 -isForBrowser -prefsHandle 3124 -prefMapHandle 3120 -prefsLen 25633 -prefMapSize 235664 -jsInitHandle 1444 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3d7857ee-1959-4bbb-b558-2b4d9d9ed53e} 4480 "\\.\pipe\gecko-crash-server-pipe.4480" 3136 19e2259c958 tab3⤵PID:636
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4480.3.1159979887\364351918" -childID 2 -isForBrowser -prefsHandle 3684 -prefMapHandle 3680 -prefsLen 30227 -prefMapSize 235664 -jsInitHandle 1444 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {267763be-d275-44e2-8460-a9ecaeed3c75} 4480 "\\.\pipe\gecko-crash-server-pipe.4480" 3696 19e235c3a58 tab3⤵PID:9000
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4480.4.113510036\1960928497" -childID 3 -isForBrowser -prefsHandle 4724 -prefMapHandle 4720 -prefsLen 31042 -prefMapSize 235664 -jsInitHandle 1444 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8505e501-e7b3-4414-8574-244601277115} 4480 "\\.\pipe\gecko-crash-server-pipe.4480" 4728 19e22821458 tab3⤵PID:7892
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4480.5.934676783\636302510" -childID 4 -isForBrowser -prefsHandle 5396 -prefMapHandle 5388 -prefsLen 31042 -prefMapSize 235664 -jsInitHandle 1444 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {30536e89-a755-4847-8aa0-d839ccd4c846} 4480 "\\.\pipe\gecko-crash-server-pipe.4480" 5404 19e25c04758 tab3⤵PID:8104
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4480.6.2117320065\843277947" -childID 5 -isForBrowser -prefsHandle 5540 -prefMapHandle 5544 -prefsLen 31042 -prefMapSize 235664 -jsInitHandle 1444 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {05173d04-5c3c-4f06-9f8c-a05a34fee730} 4480 "\\.\pipe\gecko-crash-server-pipe.4480" 5532 19e25c05958 tab3⤵PID:8100
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4480.7.1584985220\895891972" -childID 6 -isForBrowser -prefsHandle 5736 -prefMapHandle 5744 -prefsLen 31042 -prefMapSize 235664 -jsInitHandle 1444 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a52a4bec-0607-4b22-a5a0-a9b102f853a7} 4480 "\\.\pipe\gecko-crash-server-pipe.4480" 5608 19e25c03858 tab3⤵PID:8028
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4480.8.998284683\1327144615" -childID 7 -isForBrowser -prefsHandle 6032 -prefMapHandle 5752 -prefsLen 31042 -prefMapSize 235664 -jsInitHandle 1444 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c05e66e2-8ac3-481d-95ad-ad9f25c3f177} 4480 "\\.\pipe\gecko-crash-server-pipe.4480" 5064 19e27a8ce58 tab3⤵PID:8172
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4480.9.374224611\1967783106" -childID 8 -isForBrowser -prefsHandle 6264 -prefMapHandle 5020 -prefsLen 31042 -prefMapSize 235664 -jsInitHandle 1444 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e878da9b-50d1-4905-93c8-8dfc8583432b} 4480 "\\.\pipe\gecko-crash-server-pipe.4480" 6252 19e27d94858 tab3⤵PID:9156
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4480.10.811038110\2048566663" -childID 9 -isForBrowser -prefsHandle 4772 -prefMapHandle 4768 -prefsLen 31042 -prefMapSize 235664 -jsInitHandle 1444 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a0ccaaf4-e89f-4ef3-858a-aa4fb30ad3d9} 4480 "\\.\pipe\gecko-crash-server-pipe.4480" 4836 19e27d95a58 tab3⤵PID:5496
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4480.11.1100709740\2025341189" -childID 10 -isForBrowser -prefsHandle 6456 -prefMapHandle 6300 -prefsLen 31042 -prefMapSize 235664 -jsInitHandle 1444 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bd313e2c-b022-47b4-bd89-ddb1de9d3a64} 4480 "\\.\pipe\gecko-crash-server-pipe.4480" 6372 19e2280ef58 tab3⤵PID:6576
-
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa386f055 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4956
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding1⤵PID:5328
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding1⤵PID:4124
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
99KB
MD53428b9967f63c00213d6dbdb27973996
SHA11cf56abc2e0b71f5a927ea230c8cca073d20fc97
SHA25656008756553ea5876fb8aad98f6f5dbca1ba14c5e53f4fa9ec318e355e146a7e
SHA512b876b39d030818ce7879eb9bb5ff4375712cf145b7457a815880bf010215bd9dcde539e7d0877c56558e0d23a310bc75bfb9d315f9966cbda4ae02a7821980cc
-
Filesize
1.8MB
MD52537a4ba91cb5ad22293b506ad873500
SHA1ce3f4a90278206b33f037eaf664a5fbc39089ec4
SHA2565529fdc4e6385ad95106a4e6da1d2792046a71c9d7452ee6cbc8012b4eb8f3f4
SHA5127c02445d8a9c239d31f1c14933d75b3e731ed4c5f21a0ecf32d1395be0302e50aab5eb2df3057f3e9668f4b8ec0ccbed533cd54bc36ee1ada4cc5098cc0cfb14
-
Filesize
691KB
MD5ebff295ea5bb139eb04c699e1a52c286
SHA14d71053397304ab545f246ed6676d5927691b833
SHA256835d114678b311e938ee235519be252b38f14f2c5117d3ee3b905f09f0615f94
SHA5124320277436d737efb3ea04515a52ec86102a02f840b2f16d8f27673244124e149f01eee15870448710ec015c103a83f8bbf491f9928dbc1bc1b55236da8473b9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619
Filesize471B
MD542051e4019755dc0ae7ba5889d17e373
SHA1f69a5670b2c2baf5049863e4b4806ad8afaece42
SHA256e268c5ccdeeae2ea764ba387bebef3f9f046eeda6d4f37a658461dac8c2212ef
SHA512cf4be4aa13f08bdc056bbd0cf7dedc86880a12f10fbb6a1f6f7a550ccc9edd4ccf0e61abf9aeffb25efd1caa71a607b0767f2c0da951de78ec7f5011715a7ef9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619
Filesize400B
MD5ba8c750c141c5222c6a9f06a86340515
SHA1f90c465fdac5a659f8b781259adb3cc0fc5c951c
SHA256829fa976591e830555860c098d0ba3f5d198bbfd679d528672e6e9542230ae84
SHA51287ac69aca0e8bea21f82b3f048b06436eb6e2698acc1af419befd331bfdbb8691b3036091d5df12bba3fd7c8ccded3807ff7451a8c531a2019b186d6930eb9f3
-
Filesize
64KB
MD5d2fb266b97caff2086bf0fa74eddb6b2
SHA12f0061ce9c51b5b4fbab76b37fc6a540be7f805d
SHA256b09f68b61d9ff5a7c7c8b10eee9447d4813ee0e866346e629e788cd4adecb66a
SHA512c3ba95a538c1d266beb83334af755c34ce642a4178ab0f2e5f7822fd6821d3b68862a8b58f167a9294e6d913b08c1054a69b5d7aec2efdb3cf9796ed84de21a8
-
Filesize
4B
MD5f49655f856acb8884cc0ace29216f511
SHA1cb0f1f87ec0455ec349aaa950c600475ac7b7b6b
SHA2567852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba
SHA512599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8
-
Filesize
944B
MD56bd369f7c74a28194c991ed1404da30f
SHA10f8e3f8ab822c9374409fe399b6bfe5d68cbd643
SHA256878947d0ec814fe7c343cdebc05eebf00eb14f3023bdb3809a559e17f399fe5d
SHA5128fc5f073dc9fa1e1ae47c60a5f06e0a48709fd6a4302dffaa721858409e7bde64bc6856d3fb28891090516d1a7afc542579de287778b5755eafe75cc67d45d93
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n9vxbo99.default-release\activity-stream.discovery_stream.json.tmp
Filesize24KB
MD5fe85530d6946e0cfd08d4b3e266c736e
SHA13fe59807d6db7ee069096db233df119fe8d100a9
SHA25644914ff52900cb68fe242c8a16b9c649be3d0b3757c2c7ef951c3e5fe959083c
SHA5120b1f0e8ab94e499e714582a2029075e8cef2cfd51033b8ad6b5bbb3eac22f514ba51abb2d3ae13172883857424ff48a75e4b4fd6e8441db051124232d1bba603
-
Filesize
15KB
MD5235b1574b4bc7de54a94b75007d66ed9
SHA15210631f4bcf1044e3d93f6e8f25f2ce19a9ff65
SHA256b90e2132689890547669a944650b6d1c0e110e53fe77657c0729f73b134c62a3
SHA51241344ec7839b22ce8862ddd01151c15967cbb9ac9f8ce63a112f64671dceab5b1dd6d23b5f903a9dc3bd96d0f05aaf36b5972e8be010f7dab3bbaccf3f70d531
-
Filesize
9KB
MD5e8d15c96dbab7c92e74575e93db567eb
SHA14ccc5a7e65205a2e166c0ee90b074ee22d51a226
SHA256d9e264148e5f5da36a0cdbe4b037f091415becb03881d51decdead2fbd307182
SHA512d8ee22c69dc78babc32a329dab201207e365d18c3b55b7389a1a5e030d7330da8e55efa3d31ec1134b16132cc4ffab29d1b6ea0aff0ac734a7d6db31132bdfbb
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n9vxbo99.default-release\cache2\entries\18923D51876599B784BA52ADC983C5E9BFBC9D7D
Filesize215KB
MD5d185d7dcd3b5de217788653a30c070de
SHA11fc19202fbcff537ee82bd81ce691dcc43027d3b
SHA256241c32a55229685042d6f4e811da561966ed5db7a96e847e78a26b1a777fc3f2
SHA512a7ed82ddeb0d933578a2b71ecd9527234b22e3dcdf1dc5c5339ce06a978d2fe4bfd7e0e961eceaeffcefbaf0fa8411e37aa724f02917d2e7314284352eeb3516
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n9vxbo99.default-release\cache2\entries\254256B27E0C48CF9B80B695F0B3B8CA84610495
Filesize9KB
MD5772c44ba318a78cc55e13cb1226d3f57
SHA17190754365c056c08955c78dc28c21c2c943a35f
SHA256851d2044283d8dc987b1f2534d8ea1ad15ae7edde76194ca22ed934e5279fc72
SHA51277f9bdc4bd09e32fb3a9d95176aa0446bef6342d9706dc961d10adf195f0730cb6f2ee2dad5f8f8c9ba30a2468ce6d611984cbb6b1bb6c204fe2ab3ff9de7e22
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n9vxbo99.default-release\cache2\entries\35CF8F0BACAFFC9656F3D3134E049835542C83AC
Filesize182B
MD5aa447847c7648796dad89f96baedb5d3
SHA1e0bc29f488e579e5c3e59f919abefff8f801e7f7
SHA256b7457837f65316f04785cc17dbde7c9cfec669f597fe28dc24124d427ed9c0c5
SHA512d198777b4029d976a31d83621015645c8a1c17a2635b592a4ffe1f97bf9da4625c13ed8b5a803b4d6af32d58104ec024e52fb4485aea7db586aeaf9bd43a2163
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n9vxbo99.default-release\cache2\entries\3E21F87FC649C52459EB2DE0596CB9F9EB4E57EA
Filesize10KB
MD5243acd83c7d17e84ba1ce61ae189f9ae
SHA108440cd73a257cc1c6f76afb45e4304d9f711237
SHA25626b87fc729629ad2688f11db45403bb35fd4e53210d9abc18b0b36bf67d470a3
SHA512b70a2e10bfca1e7414c66a61b04fb20d9590fb942974994133616eed8a202298f26e5771cf7cf88be1e8c5e4a0e4279b401d59e52fa5fccd043b65bffa693616
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n9vxbo99.default-release\cache2\entries\5B23235D54208C34AFF88FC6F18585FD8A8F8FAD
Filesize33KB
MD5eda022fce05d995fa532f260d1ffd2e0
SHA19ee98b08b2f82108dba57843c5b0f75753803b43
SHA256271a5263c4222c665d6e9b952ea2d5e65fac238bbf93f8276a6bf4e7ddca5cd0
SHA512f24bffe429c4d5d14f9be8ede72d157b16e858d789ff2d63b665f2ff105335954822bef57eecc9831a27433843839e4bb24b24b50447c4a871c35336962f4fb8
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n9vxbo99.default-release\cache2\entries\6D89348819C8881868053197CA0754F36784BF5F
Filesize11KB
MD53fbaee5d73d4259e4d2d8be4da38ce3c
SHA1037e5ee75711a15fc015a65d63b21c8e5707e418
SHA256a8a2f9e6171e1436aca2ce05c52b58b44da87718cf0f5ae820f920c34c95a673
SHA51267c6c9eff9c0e8f4f572c2065547abf91fb5cbc3e29c0a9e8ad40aeafeb38f1e9ff5551231d86ce9a5b879527e67d40b85b563d7ac6e13dd3df7203a038ac36f
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n9vxbo99.default-release\cache2\entries\BE74831D051A660C6692D04B8B7B8DE6D3D0F562
Filesize157KB
MD59871af21b2f58cc64e49e150d3e9f1d1
SHA126a7240e80170fb403f01e4ed54020573b5e8f8b
SHA256f9bed2066de492a322ae952f67a8799de0c66142a1f6156c7611eb832213eea1
SHA512edaaf2a2d31bd9bac6bc06ab5e70a58155a88932974a293c7c13b26820ac440610ee1652da09246136ac0f671448fd338ae3452b44344f6d2224dc2c2cad6abd
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n9vxbo99.default-release\cache2\entries\CC9AFF3BE02AD27708D587AE49B3DC68644172BA
Filesize13KB
MD5e15c692b506106c8510cf1d9064289e6
SHA12d94389bf01872d0d6f96431fa2d2dc6e3fee5b9
SHA256e1f7c317fa3bd56ba550c59442903b7c031c8ffd2ecc03e7ca4c413856ad160e
SHA512c8d02a9ccc43a9a7e68451b844aff3e134e7dec91fc8b51d1a3275468e591b323116258ad0f5395c09fd089ec87a83d60f28232ea8f6fe76eac863dd0362694c
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n9vxbo99.default-release\cache2\entries\F4EFE37A30D0F14C6AC03FF7949A51CBC2EBC649
Filesize13KB
MD530f5a22b3a16b285c71209f36ccc256d
SHA1d98b12296b183a283b2f5bbfc8b10eff0bfc22ce
SHA256984413e36b4991ae5f5e8bf27cd8fd4f08821546b89439d78681a371032789e1
SHA51220e592ba844d6a8b870c52a9e03601f6b38dddcbc610d01dc2be3f4e74e61bfefd2fdc27bd106024f10c44da848e6c335a02488d2c85b424205c7f8a1b88b68e
-
Filesize
85KB
MD554525ee77374e037e0b89944b7c47d44
SHA17eb02463c278b5d265513a95c4d9019c3bb6306a
SHA2566946ba9776edf69b63418597f4c7f5b4270945eab9dc6aa2788b9475078beae1
SHA5127886bb5546a681101af46dae621e1e18197cc2e76f1eac9f983243278950f5d945d3344ca6fa238071c9c70c07da4035c9ca9c097bb710de6fda193086ec5838
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n9vxbo99.default-release\startupCache\scriptCache-child.bin
Filesize459KB
MD53cd5743d239ea536510c7bac9282963a
SHA123b334a505aa4e9a3c43e10c7ba1a4ba67dd3b4a
SHA2565e864cffe118bee4cd25cc51b39c003b06ddd719c38f5220a97d2fdfb38200ae
SHA51297dea12bb545a808129f415ea3e3c09d0818af73b18c3e6ac6d10c25f0c731565663d4730d7e8d75c4f8c589bc8174fc0edc90a5d22e53625f15acfc16622985
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n9vxbo99.default-release\startupCache\scriptCache.bin
Filesize8.2MB
MD58f6f61be95df2c61fda0ad41ab0eccfc
SHA1fede3b3d3702ce12bb9aedfb6a88d0758bb154bd
SHA2566f7484693addc3ef4b7a117441c2060a47475d68610c3fa41604e63e31cd7513
SHA512fdc9e0412878942984c7350d51536d02555a5f5bd25808c601f4b664e5b37291792b702db25a46094c6c2fee6aad9eff52437da49cc8f0466fff85e4f22be6f3
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n9vxbo99.default-release\startupCache\urlCache.bin
Filesize2KB
MD5af86f872bd0f4741a75267d1f6b8fdab
SHA1ef88e0ce1dd8b106f0e71251f36f0a217294c809
SHA256962c6d9fcf7b0c2ce39c6e6d1a1af72c8a209ee5228150cdb2b54b82f043a7a7
SHA51286450787819be93240732a3a459aa811095c698a6769e50ecc26c523881d369e7983abba9c21fa6f2864b242723006e7db86c7cd0e58c71b20f75dbcb5adfedb
-
Filesize
442KB
MD585430baed3398695717b0263807cf97c
SHA1fffbee923cea216f50fce5d54219a188a5100f41
SHA256a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
SHA51206511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1
-
Filesize
8.0MB
MD5a01c5ecd6108350ae23d2cddf0e77c17
SHA1c6ac28a2cd979f1f9a75d56271821d5ff665e2b6
SHA256345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42
SHA512b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
Filesize5KB
MD54c5e21101d3a9af2b90f428bb0e6ac68
SHA141ad25c9a1c212533d4392707667a192560c5e03
SHA256a5f5992251b2edbb2da34ef27976f37cbfb4850b49c02be6ee71ce1ab6570599
SHA512b666ffed0bebb7019d663c16cddeed1db09b99d279f5b190127171bcb33ec6ec6c740dcb675c687bc6a81ba2633535324017d598c98756d2682e42d3cd3b5c23
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
Filesize5KB
MD5922de788f10f769f7728086fb3273dcd
SHA1e0603193b862c5a0697887bbb8ebaf39c833d008
SHA256e5594ee9cd193a663a9e41aa4a85961320295b8035a5611fdaa0ddecfc74e59b
SHA512e0426d3653a3af571ddbebf6f7e53b35f8d6c4a1a960eb9a20999c7c08e807fedd2ffbf9af87d9c3fc69eb6d4e0592cc06a3e944652cd87b63b8185fe3b34581
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\AlternateServices.txt
Filesize12KB
MD562daad1f65bac38e4afe510e99e35c3d
SHA13dfbe88a9273dca0cd895edf93b747bbe9968b17
SHA2567f8e1b838ff7e5fb9a9526f53b6dabd0e900dce91c8bcf13414dc6c65f594153
SHA5129fbbd5a0661d2c0ff4c67603c8a3ebf89694d43bc2ff3cf803baaa88f7adcd2eb09a40f0c1b9d46a0bfc61f2d9f9cfc5b9eab0b353fa294d734cef0b56a8fc5d
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\SiteSecurityServiceState.txt
Filesize561B
MD5f37e2fffa0b4357cc1a18f02bfb1a21b
SHA1b0e695743bc006e682b0df7a05acee1dbb6057d0
SHA256f0a509e7cfb6837776e9b215bc9672f5f5d9a5700ace07c2603f30e8a605595d
SHA512f4d521f6eae44cdb87026e3bd8057e344d7dd758987b89d68c8e61022602dfe0e6c7f6716a46d8e1b5488552c689e9bf27442de5d0d7798ae9cb862f6e265b99
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\broadcast-listeners.json
Filesize216B
MD5a615cf28e5724a519faba3bafd62d403
SHA1eed89709bcb01b189a1a59772ae71cb967876220
SHA2564f2f4fdcc91309c4d2abe9eeec719eae486a025f2627c5748e3f64acbbb88d81
SHA512bc9f0b2354f46cdfc21711400c57f7ae030504b83ab030d504fe3bda3510bed708abc65a1e66f5e6ff490b60498bb87952897e307723290fdf5d98476133bc07
-
Filesize
288KB
MD57d45bbbe79428dc7ffd316b8b82c3abe
SHA18e1e8d8cc701df974236bc5e308b7decedde47eb
SHA256743f3f7805df17dd38fc5405537233419a4674e08f0d0db21cccdc652157bedd
SHA5122209874fd84c41b283fd76324873f218e3a0b223c0cd11fb981bd919ca5905b4d242f46973141ce6e8d5cb031d61abc17dfd759b43014ce630801780f1df47f7
-
Filesize
512KB
MD59e2e7afcc064f7d2728bb7d4d7633564
SHA14569d7c48e716f510a825d322c6bddd727823984
SHA2561a25b219e5dbbf44d859bec2bcc26b0cdf03ec194ded5123c33a2b2508917923
SHA512f2d73d7052ddcaa553b04133daf246a7838bead9540b6c107f66754eb9ac3cdfe12e55cf1ecfc09c2dde4836eb82699197c109209e82a4c75036be69c62ec0e8
-
Filesize
512KB
MD5dae1b07184f44230b00a7b8f7b664990
SHA1310fc0cdcd239000921be22ae30f0bbf22505491
SHA25623e096cd95ae5b546884aaf7bce88577a8da03f63d3ecac09168ffd839b5e436
SHA512fb263ced46265152682f690ad7b56d1462ce1342ff2d5dfddbeebb467d527cd60ccecd32f33b4f7b5512962a877f37b7063a46bd68fc9103c7b4682c9202a2e4
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\crashes\store.json.mozlz4.tmp
Filesize66B
MD5a6338865eb252d0ef8fcf11fa9af3f0d
SHA1cecdd4c4dcae10c2ffc8eb938121b6231de48cd3
SHA256078648c042b9b08483ce246b7f01371072541a2e90d1beb0c8009a6118cbd965
SHA512d950227ac83f4e8246d73f9f35c19e88ce65d0ca5f1ef8ccbb02ed6efc66b1b7e683e2ba0200279d7ca4b49831fd8c3ceb0584265b10accff2611ec1ca8c0c6c
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\datareporting\glean\db\data.safe.bin
Filesize182B
MD5b1c8aa9861b461806c9e738511edd6ae
SHA1fe13c1bbc7e323845cbe6a1bb89259cbd05595f8
SHA2567cea48e7add3340b36f47ba4ea2ded8d6cb0423ffc2a64b44d7e86e0507d6b70
SHA512841a0f8c98dd04dc9a4be2f05c34ecd511388c76d08ca0f415bfb6056166d9a521b8bc2c46b74697f3ecdac5141d1fe6af76dd0689350caca14e9f849ee75a8b
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\datareporting\state.json
Filesize51B
MD53e32e2cc1ed028dd8ff9b06f50a4707b
SHA1b3910351bd8e13ad1479db699cf6fac6544a5bef
SHA2564a3a666d98e61b5fe06fecac56807137a0fffb4bb71d4c3b16baa8702dde738c
SHA5124585ee9ec04adf138727cd039a9cbe78db6cf2926f6ce92524312a42efd1250100848a919ec4b833f9a013181ce93734575b86eed37f1bf32effa3237eba84db
-
Filesize
879B
MD5cdfaf9f6c6cf9b93aa2790a748d12a92
SHA18d13ffb19f0e0f599ddf702e3bfeeaefe7b8e5c3
SHA256e756da0810dcab87e42b769050c5f6fb0c5737fd7d9be44135897d5fb6e1eeff
SHA5123d2cf0a665bb61bf185f4600e7c9844a6562d5074056d339611056070ffdc05bfb76c4d4fe02144dec0fd0ec3d0569c70f3015c872d409b9a41ea1c66533c3c6
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\favicons.sqlite-wal
Filesize992KB
MD53ff74eee6db381f196836f376633ff9a
SHA151c6fb6c2480f61a6587b80ac0c11f15cc249964
SHA25683ab4715897b7d37bd5a42dfc7159b0217a53305388c53d8402edf42b204e0ce
SHA512091c008569a42c0b9430381ef8e0024a2795321e559d0a63717eb4bc1b1266a4a0656ce3799c8ae07e7241a4dfffb5a77cda03e4421bbe93d172f485a729e87f
-
Filesize
256KB
MD5ebdc24e6cc3968134fa2d91507b60146
SHA114cbe85a1cfb731ca4ebcd1f2338275da2fd5921
SHA25693656e74dfd8a7d8d4000e7b12e2dc8b8f73d7a45ebb404b8cad00b9f3099390
SHA5120968e15df19fca2c4a5bdaba870066bbf4f43e15cd3b22ba45e4bccb2165efe5f5a3896e5dd22fb21abc6d22e68ccfbe9f22c17ada4ed86ca40e1e3b49b6b9e1
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
Filesize997KB
MD5fe3355639648c417e8307c6d051e3e37
SHA1f54602d4b4778da21bc97c7238fc66aa68c8ee34
SHA2561ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
SHA5128f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
Filesize116B
MD53d33cdc0b3d281e67dd52e14435dd04f
SHA14db88689282fd4f9e9e6ab95fcbb23df6e6485db
SHA256f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
SHA512a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
Filesize479B
MD549ddb419d96dceb9069018535fb2e2fc
SHA162aa6fea895a8b68d468a015f6e6ab400d7a7ca6
SHA2562af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
SHA51248386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
Filesize372B
MD58be33af717bb1b67fbd61c3f4b807e9e
SHA17cf17656d174d951957ff36810e874a134dd49e0
SHA256e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
SHA5126125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
Filesize11.8MB
MD533bf7b0439480effb9fb212efce87b13
SHA1cee50f2745edc6dc291887b6075ca64d716f495a
SHA2568ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e
SHA512d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
Filesize1KB
MD5688bed3676d2104e7f17ae1cd2c59404
SHA1952b2cdf783ac72fcb98338723e9afd38d47ad8e
SHA25633899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
SHA5127a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
Filesize1KB
MD5937326fead5fd401f6cca9118bd9ade9
SHA14526a57d4ae14ed29b37632c72aef3c408189d91
SHA25668a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
SHA512b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2
-
Filesize
96KB
MD5fa8e5e43593c65cfd23c352b7fb732bc
SHA146cf673f719b1dd458543a07b4fb1af43512d511
SHA256884040d9ad71f162ef55fea1389c0f78098ba9d6c59fc1571c0d87f111ca187f
SHA512e35b94098f893084276bb59330cacdfd2ee173b53c3fb7ec4e86747e4848c1f48fd93a709175377823630be83d67a5f9a55eb7ef555a06ef55117d0710d62479
-
Filesize
5.0MB
MD52370e4626755404659fef421a2023ae4
SHA19f6b5180a21e93351c046a0a87019b1f4545f663
SHA256ccfee5aee2a3f5aae4c63168b5962e376385653da8b6040f77a37ed44d86f555
SHA51274097dcc488078f8fb97d36cdc0f1a4becabfe644a7217f976781f2004e839fc588c5b77ebdb4137398065d3be6ba0f252d2dc546cc3e8351b0f2a9dd655b47a
-
Filesize
2.3MB
MD5a5fa62da09b7080db382dea6ce695c0a
SHA183b327d9f0c724119dfc0591989d289a7c5cf1d6
SHA256b767d46711da0b0d37c2f09afccfa5d8aba199b3cdd0bab37cc154b59a9a5e1c
SHA512bd00a2469bbeca43829dac31d2657a4b800a5f36eadc90dc64abab040013054aacc75e666b158381f76451a7dc68f9dedc2b8e1648547ef45b36887d618afa64
-
Filesize
9KB
MD54163761dc999651443c3707cfb549bd7
SHA13bbb0a386642053eabb3e505849c6a5337d41518
SHA2569cbd3f6f5b5bce97fcfad4eb43b6276945426a84415a6d5f252b81d36551b328
SHA512edea439acfb28bdc7b752dd074688783cd401030f686280f1280875ef2bfa8a33d86c023dc60910d17fe1e72baf03a2e87c4874147136a708f92f96d542e8bed
-
Filesize
10KB
MD50ce015d7cdb2b5b026bcfd7aea16512b
SHA126fb1e7d85b9e5de543f0366885f019102ba5ee9
SHA256eea4699cf89533e4d0ebc40c36943e4faf9aefe23aebf2aaf5959d884c04ca2d
SHA5129a5668a1dcf0f58e2bc838a2e0c93163c262bf1a19d15da32c9a8acd89ab0a59d33fab4f36d32648c060b96d019613c9d466338718a271578861248715349c53
-
Filesize
7KB
MD5d73530f17f4a76ccc8931053baffded7
SHA195985dd7ca9b80830f120bb4bac28da150367187
SHA2567acc655348a8236352979095d7b3093e2eb0350f672080c2b7c16351293777dc
SHA51273cdc6d4c304dd25b516044e3b9eef1d3a16ae07586b599bb64ad6de590c48f5711934689b27bad93275e7baa07eb2e571a916bb6cdff04d4f5e410f275928b2
-
Filesize
10KB
MD5aeb09083645a75ed6e27507b37025db6
SHA11347366a527d5da51ebcb8be6e4ef5fc47e9dfc9
SHA256bfa5d88234464d96009506521d4131518cf3bf939d19e7048c66da32372585b5
SHA512b42711ac3f3ee1275b761051591e04e1b588ee38b0d4ec23ea371cc7a7310ea286aea3aecfe05e15c4d8cd255aadce4bc2737b3c36ba7d34169a403e707795ba
-
Filesize
10KB
MD57f9a383a3cbca92a0e8295c995bc889e
SHA1f22f201d6146ef3e26fa5a32805f66a2bc376dcd
SHA25654a47560bab9a8212d4f5c3855e5645c762f642a77e49a0f548c549c643fef6e
SHA5125197e943edaeb392b30bdc585ad3f35528145e39aacae214647dcdc91a50a98488310984ba6f57e951d69fb199b1f79970c69d4a2f3cafba9b433c3666bb7e29
-
Filesize
10KB
MD5ff8ff3b5437fe02fae829f17888ae31e
SHA17c8b197076b6876b09a1c0aab2436c911fa8a16c
SHA256c21c9ea29fa36b2b91c9e70c4ec586511d9646d894db9ad75b3f4566e6bc18e6
SHA512142da5d3a0ed8abf64c3729457e48b771b086ef9e5af953011faf9368a61c57d76c08a2d1fe26f609c5cc7b7171adf7216e63660cb5827ba601dd46f34c442df
-
Filesize
11KB
MD5b48e6c0aa4805d19960c90fc072ec384
SHA1af4d6b2e87d028a4cc0599308aec497074e8966b
SHA2560ebfb46658e01bc67fc957f9b04ecb6770b81680e47613145ab42f1a56bdcc6d
SHA512071a43ad1b0a9f1c9d34597372f298a1abea4d276817bab41ba0db438ba9b4ca80408e58be1be6cd36ec137c215cf67dd3a1125713bdd02b784811a87b4b810e
-
Filesize
10KB
MD5a9de084567bd38b2441631acc4fefbee
SHA12a138e8b15c0781156cdf598a75a0ed6c9f96ce5
SHA256b0650ced3869ae76ba30d2e90f7699b7db1015c5f2a5e7f4567ddb4502586e43
SHA5121ae345cdc16d54f36665a89197d8509a98bcedaad5003464fcb958640c1b2dca3f3d12574283059f66cac36f393fa9724d46dbd73732ddc60e4f078c17813ba8
-
Filesize
64KB
MD5c18f13f30c76a14834e6ddd6763243f9
SHA16ca0f5f5a17e8e3bd4e0cfeef4e9cb3d6b134724
SHA2567cf0d6285bd65b7b77919a1a1c2ec3e3295ab6b907ea5e484b012b5e5827ce2d
SHA5126608b24b5de2bcc7979a7c0a0f89b90673b74e5e8c17598068deb3c55ca0551708f51ec48971d228516adb8b19470ad1a86b1997e94fe6187328f48119a61f34
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\security_state\data.safe.bin
Filesize2.9MB
MD50b47f430981d75fa91889aa7af1f819f
SHA1d1ee6138308c584447df7a8da166dda89aa06175
SHA256d46b10d6c5f8c6670fd73735fd1b470876f358faa4cd85394c6944ca35a2699d
SHA5128397ab902283e26ad81671ddd40799298f9200a0069606473da255515b36b64491d6355076f4393435942c72d1990c05da8e2ddf410085a987ad4fbecbce36ae
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\sessionCheckpoints.json
Filesize90B
MD5c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA15942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA25600ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
SHA51271ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\sessionCheckpoints.json.tmp
Filesize53B
MD5ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA256792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
SHA512076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\sessionCheckpoints.json.tmp
Filesize259B
MD5c8dc58eff0c029d381a67f5dca34a913
SHA13576807e793473bcbd3cf7d664b83948e3ec8f2d
SHA2564c22e8a42797f14510228f9f4de8eea45c526228a869837bd43c0540092e5f17
SHA512b8f7c4150326f617b63d6bc72953160804a3749f6dec0492779f6c72b3b09c8d1bd58f47d499205c9a0e716f55fe5f1503d7676a4c85d31d1c1e456898af77b4
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\sessionstore-backups\recovery.jsonlz4
Filesize8KB
MD547ee53b05f583ac6b1a9090f8b88fa00
SHA16d3949ad7be49e966b2d347894e3c6dec18e95e7
SHA256a729cbf1f6fd1b3408bd8d7b9010687e2cc6be92e3f29123f4e7902c1b5cb776
SHA5121649eaeb052ca1279ecffa49b83dd7141e2bed3cf813cd7ca4167549953addfafc48286b81c02af41bb880229e80da0fff0781598e3f31518835ed2f11e9599e
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\sessionstore-backups\recovery.jsonlz4
Filesize9KB
MD598cc5db22cc9e6a9d978f2a45f40b5a8
SHA1dde2857d1db03b7779785ccad7ab290bfb793be4
SHA256e4730660a7c026a67c0708528b2ba00162195dc052897599cfc4854a02b147e6
SHA512038c367cac2d1a036a656838d4cec3b8950425961c75dc2c9a9b12c4ce561e99621a1a80895c54920bc71c70a5036abc46eae7c496d94a370fb1c8f165551b17
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\sessionstore-backups\recovery.jsonlz4
Filesize10KB
MD53fe5440a4da0e1222773e63bffd54cdc
SHA1126c4147ee163e7aa9fb32066d71546f00674a3a
SHA256964f53f841b042317af9ac6bc031358d8836f7e7221d9df543b8afe67d1dcd05
SHA5122b9ea45c7d0736fa13963da63830b2528193471f7272233eef2ef167e74f593e9aa508643d90315a827862f0af759815d32a707ad661917012487336aecf5d4e
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\sessionstore-backups\recovery.jsonlz4
Filesize9KB
MD5164eb6b8ac0cc585fa12db1c6cfbcd47
SHA16204b5b8e10ce560271c9381fe24cde39f84c2f4
SHA256fe6cbfdb5686af6c4232495376b8cc02af75e5cdccc91381a36973164d226dd6
SHA5124969b99e65efafa13555931b821e815e8cc65e98d3b4ab102459a01c82dfd2c03d370a5bb13b25113f64a01c9e03e24a9f7edfaad7bcfd586760ef3dcdbe417b
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\sessionstore-backups\recovery.jsonlz4
Filesize11KB
MD5a00d6a647df3d09c867da448b990ced7
SHA1aa55ce890675349841a07fb95d10dd343b2156b7
SHA256191dd4d9c9153fe8806147d8bb744794f4f923719d79b17e64b98f7e22643f73
SHA512435b67aebbeb7221d9d56710ca0a1b67761e3ef8980b43851d5e30a474bb0f8cf5c764de91986affc7180280b63cb30b7de91e40d0235bdbe46ff0d81101b05c
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\sessionstore-backups\recovery.jsonlz4
Filesize8KB
MD5e604d07f52cacaa544cb1badce623bd7
SHA1bc0efe5e97f6657ec3a94a01b865057e47c3abbd
SHA2563f91031a2b51791e89a731d7b2437fa4fed0b5fef7962c8ab4e514827a837ae0
SHA512a322d70ed228db9b0973f44a5adfedd05bcf3da2258d1825b70be9d26dc916f6751e922323131ebd20f49a9c6bcf723f39b72b8a1bd3ca188b0d525a25cba927
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\sessionstore-backups\recovery.jsonlz4
Filesize11KB
MD5ee437bb7ee8fa99456394769ac081e6b
SHA1240d7c82a056b0b7413abce1c953b0552a9a8bfc
SHA2561425a6488c6d48b8fc413e2b8067bbe715ee9959898757a8ab97bde4748b3829
SHA512865093e9c91130b3898bf966da58ccac082ba1e699e9b9acde61f7138592b42bb8033e70db872c972034d14ac547272ddad63bc463d4f5af4edc9aa978e67a6e
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\sessionstore-backups\recovery.jsonlz4
Filesize9KB
MD5c186ee7b92a4a5cb08decc5b83ad6e9e
SHA115155e21fe657be061e5519f3145e38057e5c278
SHA2563c0625c16b23f3bb8e76749bd3570bec379bce63c3245157dbfc9ff49fe011c6
SHA512ac72ed528865a8534dbf849c1ba5c62c175412b9b4c879482f20e8ee57272bfa124474a807cd9c22f617176529a0a8df3e021d2ddde2b698e48bad75f32af44b
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\sessionstore-backups\recovery.jsonlz4
Filesize12KB
MD519f56e1536098bf175ee321a61479171
SHA1b9c07e601901d6eaec6e57ce8032f23f395cbe7d
SHA256819f4aa2423c675c1bec7891abac92cc7663738e14b1dc36915f073448515cac
SHA512f2c73346cdd6733e8c4d3e2b0c45fdd98bb1ce36a8d2c12766fcce529343aa39b4c1837962f57ee0fbf6b61e9f58e773a581e36ce678b110462c24198432103f
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\sessionstore-backups\recovery.jsonlz4
Filesize10KB
MD50045908eecde01b4efdcabd15bb2de1c
SHA1163b035104b6f26668b4383b4913b6ec4d405d8c
SHA256a739da8eb14533b0044f97ee0207b3f17fb38d80b6c252ed1040b46d846b34fc
SHA5121c7e25736c5003c7f6ee9e38778164da65a2e21e51ac9de33aa87577ebc2485ed468a15622f7d25dbbeb1bdcbbfb10c329fb6ae37b11b7f6d3c0cc4dd9043d6a
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\sessionstore-backups\recovery.jsonlz4
Filesize11KB
MD56e38f9574a0b7973fdaccd9c58a6abbf
SHA1c2e547b5ffedd4ffc69bc7bd52cfbe3e69ecda9a
SHA25607a9b063358985a6ede4d39ead484f7e7d2ddc9fecb0687887c7c4410b4809b0
SHA512ae2e8a1494a794d2c969af8880df17a1966260988685a7f722320793bbb3b95f7030c5920b935fa408455b2705c81f03760b76978088cdf46a5822144698e3d7
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\sessionstore-backups\recovery.jsonlz4
Filesize12KB
MD5defc22a711cf68526fd8c9cd54a07b4e
SHA128b17c38d6535fabce5cbd160820805b7b28e501
SHA256bef72d3a4c51cf7cadb90cbd1d3d2455b33ad47021cd293c8b35673e9823faa5
SHA512551fe1e524fa45121a0c4d2c39d82246a5a4c271e82cda3ae516b66c57680ad16d3758936a35a500419258486b1345cb46a79bdd059ab5b8ffb66e80cbfccf2c
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\sessionstore-backups\recovery.jsonlz4
Filesize8KB
MD5fff76232548a3af72600d0fff980b6bc
SHA185e64b8517ee362e7b696f3cfbf59b2d16961fc3
SHA256b7fabcf5bced7c85f2290acb26d58fc2c822584c5ba10f586e49163f9b2dcc0e
SHA5128f9f5b4a055cd7f1a1d23ad7d2a1f92c2701c8157d9d38ea6728cf6c5e1ea152022cfb88a75b632c06b6ff85b872db64f652a5b7194b810b1296550a88dbd0ba
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\sessionstore.jsonlz4
Filesize12KB
MD59db52223a05e974ff9a7bd47074102cd
SHA15da07fdb6abffe529b502926e6b667ed395cf9da
SHA256d732ac9f3bf65c81afb6012ae95f9f68b318310610ec80032d5f10270dde0152
SHA512a5c2ad2db74a9019261edf360ba90192d791a70e3f61cb0d0468cbbb938be98fbf71aa1555c1256063ffd230fef357c9a805361421b32889e76bf67bbffc7699
-
Filesize
4KB
MD5e754fbe11ba0e708fa319a0396ff4274
SHA146687e5fe95275f8d9512e64659a7ad985343553
SHA25633f31db8b6798aad9d7752c69ddbf9c4b97621fb924c9171f7f8c4d4e6c59704
SHA512e02fc85d8b3bcc22c33e93dda90993122df5be0dcdff02302577978f47fb202ecb20cfaa899c2c67f4d09c6381b076eae6b2e0af682de10b8df7e187e735bdab
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\storage\default\https+++player.aniview.com^partitionKey=%28https%2Cmediafire.com%29\.metadata-v2
Filesize190B
MD5f2405aa21fdc45986d219928c155e60e
SHA147913cb2742bb2692bdf8e8b3918fb93671fd563
SHA25694271416c00f4c428b6cb0fc00a858d4802ffe969d2500c47f9672fe7bafffc7
SHA512bcd4e094949624a1e04df4e61497a413c9ce2c6e91b9d36247bd41b370b940a96092edb3eb30e485b03001788a666941861c71cfeb2edecba837f3185e408fac
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\storage\default\https+++player.aniview.com^partitionKey=%28https%2Cmediafire.com%29\ls\usage
Filesize12B
MD529a695de75d4d55b197a117e11e75283
SHA174d79eea8624bef1b625017c154a3be311da3c39
SHA25630d1c437ef1eff4845ab14b263c875e09a7ae187f95a988a8c0270b6457b29f8
SHA512b97186fac0b56480e254d6c3579b2293f1c64d9ea96a24a4ad93c3f959d1114010b3504d5a31eca02993f163b6bdda386c3aae77c7b2840ecd51a34b5464ac16
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\storage\default\https+++prebid.a-mo.net^partitionKey=%28https%2Cmediafire.com%29\.metadata-v2
Filesize184B
MD5e0239faa7a1675f62eca6d0f407bef8d
SHA1099b9ae926d96d6894a47ffe225c020625628107
SHA256a824888c19295fba5ef368a1b8acc7c6c9caf41d13749cbc88c6265b074e0607
SHA512da8df4c8cc0b2d53c5869c7c3ce0f617a7bdb0770293b2b930ee47c7b6c2cbad636b91596f658d58698b554205d4a22711a9af5ceed72a78fa971ea025752130
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\storage\default\https+++prebid.a-mo.net^partitionKey=%28https%2Cmediafire.com%29\ls\usage
Filesize12B
MD5412f01bf38c3978093e27b74d6eaee82
SHA1e745d016ec1909dd51104c871e751726aadf8c42
SHA256cb8d6b0e58d35080af4d2fe26126b11dd5aa66d06bb23c2b43b412abb12e8292
SHA512ea806d3712a0dae0ef3d866f502d3e6ba1d4fc50e2d596f4b4da1358d0cd8049d81f87d686acfd42c4c6e0cb3ccccc40359f69ff3aaf54d3760931c6ac64095a
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\storage\default\https+++www.google.com\.metadata-v2
Filesize62B
MD5759412d5332f7de508ba4e8a1d296f5f
SHA16186685a6a4733689fc96071252f6330de777864
SHA2566bd88b22978cb80ca62d056d89966f952aa0383ad853b8f3c49067eabe15dd63
SHA51261483bc229fa84d4adef8336eadad2d4a1ae3e2119484826aa61263ca43a8733ac9b244aa0409ebddcfe397c6dd4f4374acebf451a46b99cd403273aa32533b6
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\storage\default\https+++www.google.com\ls\usage
Filesize12B
MD5a769b829c6c0f123b622cfa5a0dfc07c
SHA1f4967a69f8402e3eef7e9bfbd86d37ed00ad6f67
SHA256946f931df1acc87540436bcfe4791e9d59ed77635963f2c45189f7787dbe2654
SHA5121d05068c6e5549d67f900d8323eeaa2e392764a35332b3de85c9702c90d8f3df38a24973fdb446529b6edfb0ed6da870c597be74cd1e6824fd823bc070100693
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\storage\default\https+++www.google.com^partitionKey=%28https%2Cmediafire.com%29\.metadata-v2
Filesize185B
MD5d501174e9fb8c31b17450f950512ae89
SHA11014965535220e5363bc3bb14b825274629df121
SHA25687baf11c6c1e9c3b1ff75817474345f37739df0d7fd20e483fc9096696849df5
SHA512116dcf3988954c843c6c9dab88b164d4f73888ef0e3afbe24147adcada65f0738210827a26c2d6021f4aa48e555603baf95f59bd69badd9331c19fb30ba3b8cb
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\storage\default\https+++www.google.com^partitionKey=%28https%2Cmediafire.com%29\ls\usage
Filesize12B
MD5ef5bef2c23533b20775817e0acf08128
SHA17e6292d37817cb31904c13795ff44f14e69a7678
SHA2560ef72b88336bf69ce23a2f09cd08268e0eb7ef6ce19e7fd0632c7179a22f7f31
SHA51261c57a8772cbfd11f9118704795d4ac30259b447ab34575ae25636fa1f7138d015e89514ea9025abf3fbce791cf597023a3ac209ca3a27031aa2f01aff2cd0c8
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\storage\default\https+++www.mediafire.com\.metadata-v2
Filesize68B
MD5de96eb24702d186bb9b50ef0260658eb
SHA1639ed8192b13bad47c7125dabb871162846dbf79
SHA256de3664612c1a905bb115a0c01b48421d152f947857b0b8a60eb8bd10fdde6274
SHA512cfc0adf6677d63bb6971e8c44b56c35f13d63ff81983a3524c6dee571f4f1c1e8cd64867909ab55576a792e4f11988448ac4f6caafec01682c4a4ba8e43fc65e
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\storage\default\https+++www.mediafire.com\ls\usage
Filesize12B
MD5542f586dbd55023deb41740a911dda13
SHA10733d2d9577a567563fa1177e976575049732169
SHA256ff70d6eaa53049a0f9acc262544a09962f31d264b1558d132275eec0e3e67bb0
SHA512fb1f187b65f0017d8f77e75f08d437569f01e34dbf3aa7ed3f762f914bd60493d6fa849815c2289f10c751beadfbdd870a1749f3b1a8c0ae59803c818bf9cc75
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\storage\default\https+++www.virustotal.com\cache\morgue\142\{7d55c300-a64a-4423-8177-8cf5a203ad8e}.final
Filesize47KB
MD554c3178d5f34066c836808cde13554e4
SHA1736a5721e01b5731cc8f97973b29ba53fc02aec9
SHA25693f00a9bbacc3e757a9b2d8e6bbf46649f5aa68b489eef1987222069d9fd6949
SHA51227486cf2c9ae87fb3e0fc2e91a07d8edba407b8c338e6ec5617008f1faa9fbb852c54457c2a5bbe309d2db0d0a3412e65b6e13f23e1fb651872b170f8d7ea02b
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Filesize10.0MB
MD59c23c184832c21e4552f88bba79febb2
SHA19d39861868b70a7c7c48beafe4f43bbbfaa0b443
SHA2566463b6a565e46cda3593ea74f965b93ff3254cae70e9cf6e83bd3c9c92143481
SHA512a6d05085fa035c0b18a5ea70bf60efeab14663f37518118c140c6bb09d23872e3b39d7cf8d231c00d5999a272b18a22a09db2bf17ded45682a31be79f0a92caa
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Filesize816KB
MD5d98b71773f50680429dc2e085021a9fd
SHA1872e98668d5865ff24ffbfccda9f3679b1361ca8
SHA256e7f7e591e3e108e04f030688c1db46178a35463bcc4bb8fe6d4c73801a0077a2
SHA5129a66c491c600161c29b10d2bf0784b2da1d379d8040ed9a06f75b53024a4f97565f77f4581b2db2f5bde105fcb822accd0aded23d93c20d1ff1434b6ab81f132
-
Filesize
141B
MD51995825c748914809df775643764920f
SHA155c55d77bb712d2d831996344f0a1b3e0b7ff98a
SHA25687835b1bd7d0934f997ef51c977349809551d47e32c3c9224899359ae0fce776
SHA512c311970610d836550a07feb47bd0774fd728130d0660cbada2d2d68f2fcfbe84e85404d7f5b8ab0f71a6c947561dcffa95df2782a712f4dcb7230ea8ba01c34c
-
Filesize
4KB
MD53abe3fdd0dfed53279cc0dc0deb37f91
SHA1d79f39ed7eae8e3a033ba4fdbf7db892545c30c7
SHA256c6aeecaf950684695c6c6eba3d926602c2adc2760b3638f14c87dd1692fa8d7e
SHA51202a019611457b7987cb4fa99e020336c21acc8451d3eed9808a349703aa0c070a2148f207aac280230e789abdb099da1e7b76b12318a2c08ee9c80fd7f73ee03
-
Filesize
1.5MB
MD5c73433dd532d445d099385865f62148b
SHA14723c45f297cc8075eac69d2ef94e7e131d3a734
SHA25612ef1c8127ec3465520e4cfd23605b708d81a5a2cf37ba124f018e5c094de0d9
SHA5121211c8b67652664d6f66e248856b95ca557d4fdb4ea90d30df68208055d4c94fea0d158e7e6a965eae5915312dee33f62db882bb173faec5332a17bd2fb59447
-
Filesize
81KB
MD5c02b4294e68a2e0afe18c6865ac3da1a
SHA1e28e58680ca93471f17532ff756713d7e886a0df
SHA256a56f3e567eaf4d5cf3b5924fec383de32cc14d7a808034b0282b95e06b4a4c55
SHA51253936f1f042a18bea303974415f296c85225479fcde6defeb861936a0010508fdba23f7e6756aead1b27cef80fd6674bfafe0e6df10a5c34976abacaa0403c0b
-
Filesize
3.8MB
MD546c17c999744470b689331f41eab7df1
SHA1b8a63127df6a87d333061c622220d6d70ed80f7c
SHA256c5b5def1c8882b702b6b25cbd94461c737bc151366d2d9eba5006c04886bfc9a
SHA5124b02a3e85b699f62df1b4fe752c4dee08cfabc9b8bb316bc39b854bd5187fc602943a95788ec680c7d3dc2c26ad882e69c0740294bd6cb3b32cdcd165a9441b6
-
Filesize
63KB
MD5d3ec96557834050f9edd29c3ed88cabe
SHA1af26f02653f4a0d2a3c673517b6c517ed529051f
SHA256bc7747c8272ce56edc0d941e81df1b9e93f8c03be786be59d2c240b985a6793a
SHA51277e5121874fbb294bb072dbb4b823f0ec343952b49adc96c357090bee6758944f52d09b817307b5e84921ec679449d3049009e6ffe572e9104172f7518f2cb87