povertystealer | hxxps://www[.]mediafire[.]com/file/f2xetfaub7gdmnq/Roblsol[.]rar/file

Analysis

max time kernel
479s
max time network
480s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 02:15

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

https://www.mediafire.com/file/f2xetfaub7gdmnq/Roblsol.rar/file

Score

10^/10

povertystealer discovery persistence spyware stealer

Malware Config

Signatures

Detect Poverty Stealer Payload 4 IoCs

resource	yara_rule
behavioral1/memory/6524-3401-0x0000000000400000-0x000000000040A000-memory.dmp	family_povertystealer
behavioral1/memory/6524-3404-0x0000000000400000-0x000000000040A000-memory.dmp	family_povertystealer
behavioral1/memory/6524-3405-0x0000000000400000-0x000000000040A000-memory.dmp	family_povertystealer
behavioral1/memory/6524-3407-0x0000000000400000-0x000000000040A000-memory.dmp	family_povertystealer

Poverty Stealer
Poverty Stealer is a crypto and infostealer written in C++.
stealer povertystealer
Downloads MZ/PE file

Executes dropped EXE 7 IoCs

pid	Process
7140	winrar-x64-701.exe
5836	winrar-x64-701.exe
2228	7z2405-x64.exe
4260	7zG.exe
4352	loader.exe
7700	Solara 1.23.exe
8468	Solara 1.23.exe

Loads dropped DLL 2 IoCs

pid	Process
3436	Process not Found
4260	7zG.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Registers COM server for autorun 1 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2405-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll"	7z2405-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2405-x64.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
965	bitbucket.org
966	bitbucket.org
972	bitbucket.org

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4352 set thread context of 6524	4352	loader.exe	193
PID 7700 set thread context of 2720	7700	Solara 1.23.exe	195

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\pa-in.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pl.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ps.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\br.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ga.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hr.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ms.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ca.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\et.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fr.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hy.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sw.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hu.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sa.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lt.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ug.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uk.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\af.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\co.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\en.ttt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ka.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz-cyrl.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bn.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\he.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ta.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.chm	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ne.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\is.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ru.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spl.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mn.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\io.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nb.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-tw.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\7-zip32.dll	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ky.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng2.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nl.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kab.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cy.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fa.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sv.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ko.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.dll	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bg.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\el.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ext.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gu.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\de.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\yo.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\it.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\History.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ast.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ba.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\id.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\be.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cs.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\da.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\vi.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku-ckb.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\7z.sfx	7z2405-x64.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 14 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "137"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe

Modifies registry class 24 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2405-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2405-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2405-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2405-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2405-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll"	7z2405-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2405-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip	7z2405-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2405-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2405-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2405-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2405-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip	7z2405-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip	7z2405-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip	7z2405-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2405-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2405-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2405-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	taskmgr.exe
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	firefox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip32.dll"	7z2405-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip	7z2405-x64.exe

NTFS ADS 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\Roblsol.rar:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\7z2405-x64.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\winrar-x64-701.exe:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
2720	MSBuild.exe
2720	MSBuild.exe
2720	MSBuild.exe
2720	MSBuild.exe
2720	MSBuild.exe
2720	MSBuild.exe
2720	MSBuild.exe
2720	MSBuild.exe
2720	MSBuild.exe
2720	MSBuild.exe
2720	MSBuild.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
7988	OpenWith.exe
5156	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 34 IoCs

description	pid	Process
Token: SeDebugPrivilege	3504	firefox.exe
Token: SeDebugPrivilege	3504	firefox.exe
Token: SeDebugPrivilege	3504	firefox.exe
Token: SeDebugPrivilege	3504	firefox.exe
Token: SeDebugPrivilege	3504	firefox.exe
Token: SeDebugPrivilege	3504	firefox.exe
Token: SeDebugPrivilege	7608	taskmgr.exe
Token: SeSystemProfilePrivilege	7608	taskmgr.exe
Token: SeCreateGlobalPrivilege	7608	taskmgr.exe
Token: SeDebugPrivilege	3504	firefox.exe
Token: 33	7608	taskmgr.exe
Token: SeIncBasePriorityPrivilege	7608	taskmgr.exe
Token: SeDebugPrivilege	2228	7z2405-x64.exe
Token: SeDebugPrivilege	2228	7z2405-x64.exe
Token: SeDebugPrivilege	2228	7z2405-x64.exe
Token: SeDebugPrivilege	2228	7z2405-x64.exe
Token: SeDebugPrivilege	2228	7z2405-x64.exe
Token: SeRestorePrivilege	4260	7zG.exe
Token: 35	4260	7zG.exe
Token: SeSecurityPrivilege	4260	7zG.exe
Token: SeSecurityPrivilege	4260	7zG.exe
Token: SeDebugPrivilege	2720	MSBuild.exe
Token: SeBackupPrivilege	2720	MSBuild.exe
Token: SeSecurityPrivilege	2720	MSBuild.exe
Token: SeSecurityPrivilege	2720	MSBuild.exe
Token: SeSecurityPrivilege	2720	MSBuild.exe
Token: SeSecurityPrivilege	2720	MSBuild.exe
Token: SeDebugPrivilege	5156	taskmgr.exe
Token: SeSystemProfilePrivilege	5156	taskmgr.exe
Token: SeCreateGlobalPrivilege	5156	taskmgr.exe
Token: SeDebugPrivilege	4480	firefox.exe
Token: SeDebugPrivilege	4480	firefox.exe
Token: 33	5156	taskmgr.exe
Token: SeIncBasePriorityPrivilege	5156	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3504	firefox.exe
3504	firefox.exe
3504	firefox.exe
3504	firefox.exe
3504	firefox.exe
3504	firefox.exe
3504	firefox.exe
3504	firefox.exe
3504	firefox.exe
3504	firefox.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3504	firefox.exe
3504	firefox.exe
3504	firefox.exe
3504	firefox.exe
3504	firefox.exe
3504	firefox.exe
3504	firefox.exe
3504	firefox.exe
3504	firefox.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe
7608	taskmgr.exe

Suspicious use of SetWindowsHookEx 57 IoCs

pid	Process
3504	firefox.exe
3504	firefox.exe
3504	firefox.exe
3504	firefox.exe
3504	firefox.exe
3504	firefox.exe
3504	firefox.exe
3504	firefox.exe
3504	firefox.exe
3504	firefox.exe
7140	winrar-x64-701.exe
7140	winrar-x64-701.exe
7140	winrar-x64-701.exe
5836	winrar-x64-701.exe
5836	winrar-x64-701.exe
5836	winrar-x64-701.exe
7988	OpenWith.exe
7988	OpenWith.exe
7988	OpenWith.exe
7988	OpenWith.exe
7988	OpenWith.exe
7988	OpenWith.exe
7988	OpenWith.exe
7988	OpenWith.exe
7988	OpenWith.exe
7988	OpenWith.exe
7988	OpenWith.exe
7988	OpenWith.exe
7988	OpenWith.exe
7988	OpenWith.exe
7988	OpenWith.exe
7988	OpenWith.exe
7988	OpenWith.exe
7988	OpenWith.exe
7988	OpenWith.exe
7988	OpenWith.exe
7988	OpenWith.exe
7988	OpenWith.exe
7988	OpenWith.exe
7988	OpenWith.exe
7988	OpenWith.exe
7988	OpenWith.exe
7988	OpenWith.exe
7988	OpenWith.exe
7988	OpenWith.exe
7988	OpenWith.exe
7988	OpenWith.exe
7988	OpenWith.exe
7988	OpenWith.exe
7988	OpenWith.exe
7988	OpenWith.exe
3504	firefox.exe
3504	firefox.exe
3504	firefox.exe
2228	7z2405-x64.exe
4480	firefox.exe
4956	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2500 wrote to memory of 3504	2500	firefox.exe	91
PID 2500 wrote to memory of 3504	2500	firefox.exe	91
PID 2500 wrote to memory of 3504	2500	firefox.exe	91
PID 2500 wrote to memory of 3504	2500	firefox.exe	91
PID 2500 wrote to memory of 3504	2500	firefox.exe	91
PID 2500 wrote to memory of 3504	2500	firefox.exe	91
PID 2500 wrote to memory of 3504	2500	firefox.exe	91
PID 2500 wrote to memory of 3504	2500	firefox.exe	91
PID 2500 wrote to memory of 3504	2500	firefox.exe	91
PID 2500 wrote to memory of 3504	2500	firefox.exe	91
PID 2500 wrote to memory of 3504	2500	firefox.exe	91
PID 3504 wrote to memory of 2340	3504	firefox.exe	92
PID 3504 wrote to memory of 2340	3504	firefox.exe	92
PID 3504 wrote to memory of 2340	3504	firefox.exe	92
PID 3504 wrote to memory of 2340	3504	firefox.exe	92
PID 3504 wrote to memory of 2340	3504	firefox.exe	92
PID 3504 wrote to memory of 2340	3504	firefox.exe	92
PID 3504 wrote to memory of 2340	3504	firefox.exe	92
PID 3504 wrote to memory of 2340	3504	firefox.exe	92
PID 3504 wrote to memory of 2340	3504	firefox.exe	92
PID 3504 wrote to memory of 2340	3504	firefox.exe	92
PID 3504 wrote to memory of 2340	3504	firefox.exe	92
PID 3504 wrote to memory of 2340	3504	firefox.exe	92
PID 3504 wrote to memory of 2340	3504	firefox.exe	92
PID 3504 wrote to memory of 2340	3504	firefox.exe	92
PID 3504 wrote to memory of 2340	3504	firefox.exe	92
PID 3504 wrote to memory of 2340	3504	firefox.exe	92
PID 3504 wrote to memory of 2340	3504	firefox.exe	92
PID 3504 wrote to memory of 2340	3504	firefox.exe	92
PID 3504 wrote to memory of 2340	3504	firefox.exe	92
PID 3504 wrote to memory of 2340	3504	firefox.exe	92
PID 3504 wrote to memory of 2340	3504	firefox.exe	92
PID 3504 wrote to memory of 2340	3504	firefox.exe	92
PID 3504 wrote to memory of 2340	3504	firefox.exe	92
PID 3504 wrote to memory of 2340	3504	firefox.exe	92
PID 3504 wrote to memory of 2340	3504	firefox.exe	92
PID 3504 wrote to memory of 2340	3504	firefox.exe	92
PID 3504 wrote to memory of 2340	3504	firefox.exe	92
PID 3504 wrote to memory of 2340	3504	firefox.exe	92
PID 3504 wrote to memory of 2340	3504	firefox.exe	92
PID 3504 wrote to memory of 2340	3504	firefox.exe	92
PID 3504 wrote to memory of 2340	3504	firefox.exe	92
PID 3504 wrote to memory of 2340	3504	firefox.exe	92
PID 3504 wrote to memory of 2340	3504	firefox.exe	92
PID 3504 wrote to memory of 2340	3504	firefox.exe	92
PID 3504 wrote to memory of 2340	3504	firefox.exe	92
PID 3504 wrote to memory of 2340	3504	firefox.exe	92
PID 3504 wrote to memory of 2340	3504	firefox.exe	92
PID 3504 wrote to memory of 2340	3504	firefox.exe	92
PID 3504 wrote to memory of 2340	3504	firefox.exe	92
PID 3504 wrote to memory of 2340	3504	firefox.exe	92
PID 3504 wrote to memory of 2340	3504	firefox.exe	92
PID 3504 wrote to memory of 2340	3504	firefox.exe	92
PID 3504 wrote to memory of 2340	3504	firefox.exe	92
PID 3504 wrote to memory of 3664	3504	firefox.exe	93
PID 3504 wrote to memory of 3664	3504	firefox.exe	93
PID 3504 wrote to memory of 3664	3504	firefox.exe	93
PID 3504 wrote to memory of 3664	3504	firefox.exe	93
PID 3504 wrote to memory of 3664	3504	firefox.exe	93
PID 3504 wrote to memory of 3664	3504	firefox.exe	93
PID 3504 wrote to memory of 3664	3504	firefox.exe	93
PID 3504 wrote to memory of 3664	3504	firefox.exe	93
PID 3504 wrote to memory of 3664	3504	firefox.exe	93
PID 3504 wrote to memory of 3664	3504	firefox.exe	93

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://www.mediafire.com/file/f2xetfaub7gdmnq/Roblsol.rar/file"
1⤵
- Suspicious use of WriteProcessMemory
PID:2500
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://www.mediafire.com/file/f2xetfaub7gdmnq/Roblsol.rar/file
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3504
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3504.0.411635566\1177598210" -parentBuildID 20230214051806 -prefsHandle 1752 -prefMapHandle 1744 -prefsLen 22076 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f96e018f-7d70-49b4-bc60-63435a605f9f} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" 1832 24dd8d0e858 gpu
    3⤵
    PID:2340
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3504.1.903164052\714509750" -parentBuildID 20230214051806 -prefsHandle 2396 -prefMapHandle 2384 -prefsLen 22927 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2098a8fa-4b91-4a2f-bc25-097d9c932608} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" 2424 24dcbe84d58 socket
    3⤵
    PID:3664
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3504.2.375642429\943239386" -childID 1 -isForBrowser -prefsHandle 3008 -prefMapHandle 3004 -prefsLen 22965 -prefMapSize 235121 -jsInitHandle 896 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e6a8aac5-5035-4d71-a21c-a49a8eb700b7} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" 3020 24dd9239258 tab
    3⤵
    PID:5096
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3504.3.889338149\1117752855" -childID 2 -isForBrowser -prefsHandle 3656 -prefMapHandle 3652 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 896 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {11b0235a-731e-4148-8269-d8fe93162736} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" 3668 24ddda33558 tab
    3⤵
    PID:4116
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3504.4.176921345\951258392" -childID 3 -isForBrowser -prefsHandle 5316 -prefMapHandle 5312 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 896 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {65a32617-3237-40ea-bc58-9d3d5c50c19e} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" 5300 24ddfcfb558 tab
    3⤵
    PID:2356
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3504.5.1084309042\133515305" -childID 4 -isForBrowser -prefsHandle 5408 -prefMapHandle 5416 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 896 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6650045a-6f53-40cf-9278-a514eb676696} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" 5484 24ddfcf8558 tab
    3⤵
    PID:436
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3504.6.1515658585\1105266982" -childID 5 -isForBrowser -prefsHandle 5596 -prefMapHandle 5604 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 896 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8828993a-ca88-4590-82ba-73cbb08ce1d0} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" 5680 24ddf971258 tab
    3⤵
    PID:2244
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3504.7.1242247313\579983764" -parentBuildID 20230214051806 -prefsHandle 5812 -prefMapHandle 5620 -prefsLen 27697 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1c4030de-8d47-4e5b-bdae-db116ad0c05c} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" 5616 24de0127858 rdd
    3⤵
    PID:840
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3504.8.909451634\1039195290" -childID 6 -isForBrowser -prefsHandle 9976 -prefMapHandle 9980 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 896 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {32bf11f2-be97-4b6d-a340-cf1b471f2bcb} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" 9940 24de0ccd158 tab
    3⤵
    PID:2888
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3504.9.928126110\492829391" -childID 7 -isForBrowser -prefsHandle 9560 -prefMapHandle 4672 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 896 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dc0e4c46-b150-4445-846a-51b08c54d341} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" 9464 24de1606e58 tab
    3⤵
    PID:5904
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3504.10.1449265576\1480553801" -childID 8 -isForBrowser -prefsHandle 9280 -prefMapHandle 9284 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 896 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {90556408-9ff9-4c36-a620-fca1d603ff89} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" 9356 24de1a33958 tab
    3⤵
    PID:5916
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3504.11.2024123893\711279989" -childID 9 -isForBrowser -prefsHandle 9172 -prefMapHandle 9168 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 896 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c6adf291-b07e-4b80-90ce-69d52a917154} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" 9180 24de1bf7858 tab
    3⤵
    PID:5964
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3504.12.1036047333\1227537280" -childID 10 -isForBrowser -prefsHandle 8840 -prefMapHandle 8836 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 896 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cf01c40d-40fc-4eda-b375-2ee02bbc3449} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" 8852 24de1e93558 tab
    3⤵
    PID:3804
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3504.13.657614508\1759446234" -childID 11 -isForBrowser -prefsHandle 8568 -prefMapHandle 8572 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 896 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9144db0e-fa3f-410b-ac0a-a3bd28dc40e2} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" 8540 24de28da158 tab
    3⤵
    PID:5952
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3504.14.1876811972\1250998556" -childID 12 -isForBrowser -prefsHandle 8632 -prefMapHandle 8628 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 896 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dee74893-508e-42ef-b294-6291a64189d4} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" 8640 24de2bc3558 tab
    3⤵
    PID:6432
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3504.15.309532538\1983516156" -childID 13 -isForBrowser -prefsHandle 3552 -prefMapHandle 3548 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 896 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {416ab5f8-2952-4a26-8d41-2362ed1dd5e5} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" 4552 24ddf888c58 tab
    3⤵
    PID:7004
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3504.16.1512604003\803478485" -childID 14 -isForBrowser -prefsHandle 8072 -prefMapHandle 4560 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 896 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7b3b3562-abf5-41c3-831b-6b1869d9a309} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" 3812 24ddd3ddf58 tab
    3⤵
    PID:7012
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3504.17.1237081071\7737455" -childID 15 -isForBrowser -prefsHandle 7864 -prefMapHandle 7868 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 896 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {357a735f-82c4-4f74-9eb6-dd43d58e355f} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" 7884 24ddf973f58 tab
    3⤵
    PID:6152
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3504.18.1179344184\1906742828" -childID 16 -isForBrowser -prefsHandle 7852 -prefMapHandle 7848 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 896 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7a6e45e8-b9ea-4f2c-8f40-77ddf703d422} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" 7764 24ddfcb7b58 tab
    3⤵
    PID:6644
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3504.19.69739692\441054793" -childID 17 -isForBrowser -prefsHandle 7748 -prefMapHandle 9172 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 896 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7ac79678-b841-443a-8164-b29669d6a49f} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" 7596 24dd8d0d658 tab
    3⤵
    PID:6668
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3504.20.1095608656\1820443974" -childID 18 -isForBrowser -prefsHandle 9304 -prefMapHandle 9360 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 896 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d7c8f628-765b-4a8d-a8f7-3768ca3d4f04} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" 8992 24de00a5f58 tab
    3⤵
    PID:6684
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3504.21.1723657080\799524790" -childID 19 -isForBrowser -prefsHandle 7308 -prefMapHandle 7312 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 896 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {77c5f174-0b84-4ff3-bab9-1082d1016407} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" 7296 24de00a3558 tab
    3⤵
    PID:6696
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3504.22.2078313656\1148057950" -childID 20 -isForBrowser -prefsHandle 7144 -prefMapHandle 7140 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 896 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0be56ef9-c063-48d1-a7bd-0a12add92ec7} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" 9060 24de00a6858 tab
    3⤵
    PID:3476
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3504.23.765418039\1550043609" -childID 21 -isForBrowser -prefsHandle 8012 -prefMapHandle 8008 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 896 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a15f81dc-4e77-4019-b77b-9c5c8b27c211} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" 9536 24de3d34a58 tab
    3⤵
    PID:6912
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3504.24.791053912\95944720" -childID 22 -isForBrowser -prefsHandle 6744 -prefMapHandle 6748 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 896 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c7e9c5c0-4485-4f62-89e4-e503b0dfdcbf} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" 6732 24de4253c58 tab
    3⤵
    PID:6708
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3504.25.1855412385\831605823" -childID 23 -isForBrowser -prefsHandle 8340 -prefMapHandle 7564 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 896 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e01131d5-b0aa-426c-8a5c-af8d91be83b9} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" 7764 24de3f9fe58 tab
    3⤵
    PID:5436
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3504.26.1689590948\304108498" -childID 24 -isForBrowser -prefsHandle 7864 -prefMapHandle 8236 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 896 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ffd0d5ca-4903-4368-843e-9d2445157ff2} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" 6428 24de19aa558 tab
    3⤵
    PID:6220
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3504.27.1368983417\849823731" -childID 25 -isForBrowser -prefsHandle 6748 -prefMapHandle 6744 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 896 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7dd24a67-8f3c-46b4-a29a-5af588798b4a} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" 3548 24de3978e58 tab
    3⤵
    PID:6244
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3504.28.362855491\1130117796" -childID 26 -isForBrowser -prefsHandle 8612 -prefMapHandle 8620 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 896 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {67f67018-2459-4f4f-91e9-0b8f2677d9cd} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" 9280 24dcbe84a58 tab
    3⤵
    PID:5648
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3504.29.1211726392\18594331" -childID 27 -isForBrowser -prefsHandle 6256 -prefMapHandle 8592 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 896 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d44edd46-831e-4a86-b88c-162ac122f093} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" 6236 24dd9217458 tab
    3⤵
    PID:5616
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3504.30.1046050704\249175004" -childID 28 -isForBrowser -prefsHandle 6108 -prefMapHandle 6104 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 896 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2793413b-84bf-4c5d-9e65-affff7276b3c} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" 6116 24dd9218358 tab
    3⤵
    PID:5620
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3504.31.128536858\673827592" -childID 29 -isForBrowser -prefsHandle 9788 -prefMapHandle 6780 -prefsLen 31357 -prefMapSize 235121 -jsInitHandle 896 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {27c49a8c-db83-4433-9928-90a4109e0384} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" 2728 24ddf65a858 tab
    3⤵
    PID:2780
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3504.32.1000619915\747190583" -childID 30 -isForBrowser -prefsHandle 6468 -prefMapHandle 6460 -prefsLen 31357 -prefMapSize 235121 -jsInitHandle 896 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {04151070-5e4e-44cb-a335-5804bdd18294} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" 6244 24ddf972458 tab
    3⤵
    PID:3472
- - C:\Users\Admin\Downloads\winrar-x64-701.exe
    "C:\Users\Admin\Downloads\winrar-x64-701.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:7140
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3504.33.19549131\1848072365" -childID 31 -isForBrowser -prefsHandle 5184 -prefMapHandle 5180 -prefsLen 31406 -prefMapSize 235121 -jsInitHandle 896 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {973bb3ba-0af9-4e9a-856c-aee69d47bc16} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" 7448 24dcbe6fb58 tab
    3⤵
    PID:2592
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3504.34.114997798\1607890747" -childID 32 -isForBrowser -prefsHandle 4344 -prefMapHandle 4928 -prefsLen 31415 -prefMapSize 235121 -jsInitHandle 896 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d118e0ff-df06-4bb3-8685-f0bfe19c8c92} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" 4320 24ddd57f458 tab
    3⤵
    PID:5208
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3504.35.1605953287\1529099511" -childID 33 -isForBrowser -prefsHandle 4320 -prefMapHandle 4928 -prefsLen 31415 -prefMapSize 235121 -jsInitHandle 896 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {68b6c0a6-215b-4cea-98e0-ca4468da6374} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" 10264 24ddbcf2958 tab
    3⤵
    PID:5132
- - C:\Users\Admin\Downloads\7z2405-x64.exe
    "C:\Users\Admin\Downloads\7z2405-x64.exe"
    3⤵
    - Executes dropped EXE
    - Registers COM server for autorun
    - Drops file in Program Files directory
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:2228

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3804,i,1809100026287847100,9768898026582633513,262144 --variations-seed-version --mojo-platform-channel-handle=3808 /prefetch:8
1⤵
PID:5520

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\305e5d0cdf3c4599b48766eec6134762 /t 6644 /p 7140
1⤵
PID:7928

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4576

C:\Users\Admin\Downloads\winrar-x64-701.exe
"C:\Users\Admin\Downloads\winrar-x64-701.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5836

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault2d324811he6e7h46d5h923dh16fb563ccac1
1⤵
PID:7268

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:7608

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\512297b7c8da46af8398a7f46d8b9226 /t 5840 /p 5836
1⤵
PID:5488

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:7988

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap30389:76:7zEvent7948
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:4260

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c82192ee-6cb5-4bc0-9ef0-fb818773790a} -Embedding
1⤵
PID:764

C:\Users\Admin\Downloads\Solara\metod 2\loader.exe
"C:\Users\Admin\Downloads\Solara\metod 2\loader.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4352
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6524

C:\Users\Admin\Downloads\Solara\Solara 1.23.exe
"C:\Users\Admin\Downloads\Solara\Solara 1.23.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:7700
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2720

C:\Users\Admin\Downloads\Solara\Solara 1.23.exe
"C:\Users\Admin\Downloads\Solara\Solara 1.23.exe"
1⤵
- Executes dropped EXE
PID:8468
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8652

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:5156

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:3836
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4480
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4480.0.1541199129\1572597054" -parentBuildID 20230214051806 -prefsHandle 1772 -prefMapHandle 1764 -prefsLen 25237 -prefMapSize 235664 -appDir "C:\Program Files\Mozilla Firefox\browser" - {bd476f86-59cc-47f4-896b-3d509db2ea77} 4480 "\\.\pipe\gecko-crash-server-pipe.4480" 1852 19e1e62ac58 gpu
    3⤵
    PID:6384
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4480.1.938196079\120826194" -parentBuildID 20230214051806 -prefsHandle 2300 -prefMapHandle 2296 -prefsLen 25237 -prefMapSize 235664 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {816ce021-88c9-4c44-8dc3-31e412595565} 4480 "\\.\pipe\gecko-crash-server-pipe.4480" 2324 19e11b89958 socket
    3⤵
    PID:8432
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4480.2.1953709022\2133674088" -childID 1 -isForBrowser -prefsHandle 3124 -prefMapHandle 3120 -prefsLen 25633 -prefMapSize 235664 -jsInitHandle 1444 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3d7857ee-1959-4bbb-b558-2b4d9d9ed53e} 4480 "\\.\pipe\gecko-crash-server-pipe.4480" 3136 19e2259c958 tab
    3⤵
    PID:636
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4480.3.1159979887\364351918" -childID 2 -isForBrowser -prefsHandle 3684 -prefMapHandle 3680 -prefsLen 30227 -prefMapSize 235664 -jsInitHandle 1444 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {267763be-d275-44e2-8460-a9ecaeed3c75} 4480 "\\.\pipe\gecko-crash-server-pipe.4480" 3696 19e235c3a58 tab
    3⤵
    PID:9000
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4480.4.113510036\1960928497" -childID 3 -isForBrowser -prefsHandle 4724 -prefMapHandle 4720 -prefsLen 31042 -prefMapSize 235664 -jsInitHandle 1444 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8505e501-e7b3-4414-8574-244601277115} 4480 "\\.\pipe\gecko-crash-server-pipe.4480" 4728 19e22821458 tab
    3⤵
    PID:7892
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4480.5.934676783\636302510" -childID 4 -isForBrowser -prefsHandle 5396 -prefMapHandle 5388 -prefsLen 31042 -prefMapSize 235664 -jsInitHandle 1444 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {30536e89-a755-4847-8aa0-d839ccd4c846} 4480 "\\.\pipe\gecko-crash-server-pipe.4480" 5404 19e25c04758 tab
    3⤵
    PID:8104
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4480.6.2117320065\843277947" -childID 5 -isForBrowser -prefsHandle 5540 -prefMapHandle 5544 -prefsLen 31042 -prefMapSize 235664 -jsInitHandle 1444 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {05173d04-5c3c-4f06-9f8c-a05a34fee730} 4480 "\\.\pipe\gecko-crash-server-pipe.4480" 5532 19e25c05958 tab
    3⤵
    PID:8100
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4480.7.1584985220\895891972" -childID 6 -isForBrowser -prefsHandle 5736 -prefMapHandle 5744 -prefsLen 31042 -prefMapSize 235664 -jsInitHandle 1444 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a52a4bec-0607-4b22-a5a0-a9b102f853a7} 4480 "\\.\pipe\gecko-crash-server-pipe.4480" 5608 19e25c03858 tab
    3⤵
    PID:8028
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4480.8.998284683\1327144615" -childID 7 -isForBrowser -prefsHandle 6032 -prefMapHandle 5752 -prefsLen 31042 -prefMapSize 235664 -jsInitHandle 1444 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c05e66e2-8ac3-481d-95ad-ad9f25c3f177} 4480 "\\.\pipe\gecko-crash-server-pipe.4480" 5064 19e27a8ce58 tab
    3⤵
    PID:8172
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4480.9.374224611\1967783106" -childID 8 -isForBrowser -prefsHandle 6264 -prefMapHandle 5020 -prefsLen 31042 -prefMapSize 235664 -jsInitHandle 1444 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e878da9b-50d1-4905-93c8-8dfc8583432b} 4480 "\\.\pipe\gecko-crash-server-pipe.4480" 6252 19e27d94858 tab
    3⤵
    PID:9156
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4480.10.811038110\2048566663" -childID 9 -isForBrowser -prefsHandle 4772 -prefMapHandle 4768 -prefsLen 31042 -prefMapSize 235664 -jsInitHandle 1444 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a0ccaaf4-e89f-4ef3-858a-aa4fb30ad3d9} 4480 "\\.\pipe\gecko-crash-server-pipe.4480" 4836 19e27d95a58 tab
    3⤵
    PID:5496
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4480.11.1100709740\2025341189" -childID 10 -isForBrowser -prefsHandle 6456 -prefMapHandle 6300 -prefsLen 31042 -prefMapSize 235664 -jsInitHandle 1444 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bd313e2c-b022-47b4-bd89-ddb1de9d3a64} 4480 "\\.\pipe\gecko-crash-server-pipe.4480" 6372 19e2280ef58 tab
    3⤵
    PID:6576

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa386f055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4956

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
1⤵
PID:5328

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
1⤵
PID:4124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7-zip.dll

Filesize
99KB

MD5
3428b9967f63c00213d6dbdb27973996

SHA1
1cf56abc2e0b71f5a927ea230c8cca073d20fc97

SHA256
56008756553ea5876fb8aad98f6f5dbca1ba14c5e53f4fa9ec318e355e146a7e

SHA512
b876b39d030818ce7879eb9bb5ff4375712cf145b7457a815880bf010215bd9dcde539e7d0877c56558e0d23a310bc75bfb9d315f9966cbda4ae02a7821980cc

Download Submit
C:\Program Files\7-Zip\7z.dll

Filesize
1.8MB

MD5
2537a4ba91cb5ad22293b506ad873500

SHA1
ce3f4a90278206b33f037eaf664a5fbc39089ec4

SHA256
5529fdc4e6385ad95106a4e6da1d2792046a71c9d7452ee6cbc8012b4eb8f3f4

SHA512
7c02445d8a9c239d31f1c14933d75b3e731ed4c5f21a0ecf32d1395be0302e50aab5eb2df3057f3e9668f4b8ec0ccbed533cd54bc36ee1ada4cc5098cc0cfb14

Download Submit
C:\Program Files\7-Zip\7zG.exe

Filesize
691KB

MD5
ebff295ea5bb139eb04c699e1a52c286

SHA1
4d71053397304ab545f246ed6676d5927691b833

SHA256
835d114678b311e938ee235519be252b38f14f2c5117d3ee3b905f09f0615f94

SHA512
4320277436d737efb3ea04515a52ec86102a02f840b2f16d8f27673244124e149f01eee15870448710ec015c103a83f8bbf491f9928dbc1bc1b55236da8473b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619

Filesize
471B

MD5
42051e4019755dc0ae7ba5889d17e373

SHA1
f69a5670b2c2baf5049863e4b4806ad8afaece42

SHA256
e268c5ccdeeae2ea764ba387bebef3f9f046eeda6d4f37a658461dac8c2212ef

SHA512
cf4be4aa13f08bdc056bbd0cf7dedc86880a12f10fbb6a1f6f7a550ccc9edd4ccf0e61abf9aeffb25efd1caa71a607b0767f2c0da951de78ec7f5011715a7ef9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619

Filesize
400B

MD5
ba8c750c141c5222c6a9f06a86340515

SHA1
f90c465fdac5a659f8b781259adb3cc0fc5c951c

SHA256
829fa976591e830555860c098d0ba3f5d198bbfd679d528672e6e9542230ae84

SHA512
87ac69aca0e8bea21f82b3f048b06436eb6e2698acc1af419befd331bfdbb8691b3036091d5df12bba3fd7c8ccded3807ff7451a8c531a2019b186d6930eb9f3

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Filesize
64KB

MD5
d2fb266b97caff2086bf0fa74eddb6b2

SHA1
2f0061ce9c51b5b4fbab76b37fc6a540be7f805d

SHA256
b09f68b61d9ff5a7c7c8b10eee9447d4813ee0e866346e629e788cd4adecb66a

SHA512
c3ba95a538c1d266beb83334af755c34ce642a4178ab0f2e5f7822fd6821d3b68862a8b58f167a9294e6d913b08c1054a69b5d7aec2efdb3cf9796ed84de21a8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Filesize
4B

MD5
f49655f856acb8884cc0ace29216f511

SHA1
cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

SHA256
7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

SHA512
599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

Filesize
944B

MD5
6bd369f7c74a28194c991ed1404da30f

SHA1
0f8e3f8ab822c9374409fe399b6bfe5d68cbd643

SHA256
878947d0ec814fe7c343cdebc05eebf00eb14f3023bdb3809a559e17f399fe5d

SHA512
8fc5f073dc9fa1e1ae47c60a5f06e0a48709fd6a4302dffaa721858409e7bde64bc6856d3fb28891090516d1a7afc542579de287778b5755eafe75cc67d45d93

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n9vxbo99.default-release\activity-stream.discovery_stream.json.tmp

Filesize
24KB

MD5
fe85530d6946e0cfd08d4b3e266c736e

SHA1
3fe59807d6db7ee069096db233df119fe8d100a9

SHA256
44914ff52900cb68fe242c8a16b9c649be3d0b3757c2c7ef951c3e5fe959083c

SHA512
0b1f0e8ab94e499e714582a2029075e8cef2cfd51033b8ad6b5bbb3eac22f514ba51abb2d3ae13172883857424ff48a75e4b4fd6e8441db051124232d1bba603

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n9vxbo99.default-release\cache2\doomed\17053

Filesize
15KB

MD5
235b1574b4bc7de54a94b75007d66ed9

SHA1
5210631f4bcf1044e3d93f6e8f25f2ce19a9ff65

SHA256
b90e2132689890547669a944650b6d1c0e110e53fe77657c0729f73b134c62a3

SHA512
41344ec7839b22ce8862ddd01151c15967cbb9ac9f8ce63a112f64671dceab5b1dd6d23b5f903a9dc3bd96d0f05aaf36b5972e8be010f7dab3bbaccf3f70d531

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n9vxbo99.default-release\cache2\doomed\8333

Filesize
9KB

MD5
e8d15c96dbab7c92e74575e93db567eb

SHA1
4ccc5a7e65205a2e166c0ee90b074ee22d51a226

SHA256
d9e264148e5f5da36a0cdbe4b037f091415becb03881d51decdead2fbd307182

SHA512
d8ee22c69dc78babc32a329dab201207e365d18c3b55b7389a1a5e030d7330da8e55efa3d31ec1134b16132cc4ffab29d1b6ea0aff0ac734a7d6db31132bdfbb

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n9vxbo99.default-release\cache2\entries\18923D51876599B784BA52ADC983C5E9BFBC9D7D

Filesize
215KB

MD5
d185d7dcd3b5de217788653a30c070de

SHA1
1fc19202fbcff537ee82bd81ce691dcc43027d3b

SHA256
241c32a55229685042d6f4e811da561966ed5db7a96e847e78a26b1a777fc3f2

SHA512
a7ed82ddeb0d933578a2b71ecd9527234b22e3dcdf1dc5c5339ce06a978d2fe4bfd7e0e961eceaeffcefbaf0fa8411e37aa724f02917d2e7314284352eeb3516

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n9vxbo99.default-release\cache2\entries\254256B27E0C48CF9B80B695F0B3B8CA84610495

Filesize
9KB

MD5
772c44ba318a78cc55e13cb1226d3f57

SHA1
7190754365c056c08955c78dc28c21c2c943a35f

SHA256
851d2044283d8dc987b1f2534d8ea1ad15ae7edde76194ca22ed934e5279fc72

SHA512
77f9bdc4bd09e32fb3a9d95176aa0446bef6342d9706dc961d10adf195f0730cb6f2ee2dad5f8f8c9ba30a2468ce6d611984cbb6b1bb6c204fe2ab3ff9de7e22

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n9vxbo99.default-release\cache2\entries\35CF8F0BACAFFC9656F3D3134E049835542C83AC

Filesize
182B

MD5
aa447847c7648796dad89f96baedb5d3

SHA1
e0bc29f488e579e5c3e59f919abefff8f801e7f7

SHA256
b7457837f65316f04785cc17dbde7c9cfec669f597fe28dc24124d427ed9c0c5

SHA512
d198777b4029d976a31d83621015645c8a1c17a2635b592a4ffe1f97bf9da4625c13ed8b5a803b4d6af32d58104ec024e52fb4485aea7db586aeaf9bd43a2163

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n9vxbo99.default-release\cache2\entries\3E21F87FC649C52459EB2DE0596CB9F9EB4E57EA

Filesize
10KB

MD5
243acd83c7d17e84ba1ce61ae189f9ae

SHA1
08440cd73a257cc1c6f76afb45e4304d9f711237

SHA256
26b87fc729629ad2688f11db45403bb35fd4e53210d9abc18b0b36bf67d470a3

SHA512
b70a2e10bfca1e7414c66a61b04fb20d9590fb942974994133616eed8a202298f26e5771cf7cf88be1e8c5e4a0e4279b401d59e52fa5fccd043b65bffa693616

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n9vxbo99.default-release\cache2\entries\5B23235D54208C34AFF88FC6F18585FD8A8F8FAD

Filesize
33KB

MD5
eda022fce05d995fa532f260d1ffd2e0

SHA1
9ee98b08b2f82108dba57843c5b0f75753803b43

SHA256
271a5263c4222c665d6e9b952ea2d5e65fac238bbf93f8276a6bf4e7ddca5cd0

SHA512
f24bffe429c4d5d14f9be8ede72d157b16e858d789ff2d63b665f2ff105335954822bef57eecc9831a27433843839e4bb24b24b50447c4a871c35336962f4fb8

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n9vxbo99.default-release\cache2\entries\6D89348819C8881868053197CA0754F36784BF5F

Filesize
11KB

MD5
3fbaee5d73d4259e4d2d8be4da38ce3c

SHA1
037e5ee75711a15fc015a65d63b21c8e5707e418

SHA256
a8a2f9e6171e1436aca2ce05c52b58b44da87718cf0f5ae820f920c34c95a673

SHA512
67c6c9eff9c0e8f4f572c2065547abf91fb5cbc3e29c0a9e8ad40aeafeb38f1e9ff5551231d86ce9a5b879527e67d40b85b563d7ac6e13dd3df7203a038ac36f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n9vxbo99.default-release\cache2\entries\BE74831D051A660C6692D04B8B7B8DE6D3D0F562

Filesize
157KB

MD5
9871af21b2f58cc64e49e150d3e9f1d1

SHA1
26a7240e80170fb403f01e4ed54020573b5e8f8b

SHA256
f9bed2066de492a322ae952f67a8799de0c66142a1f6156c7611eb832213eea1

SHA512
edaaf2a2d31bd9bac6bc06ab5e70a58155a88932974a293c7c13b26820ac440610ee1652da09246136ac0f671448fd338ae3452b44344f6d2224dc2c2cad6abd

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n9vxbo99.default-release\cache2\entries\CC9AFF3BE02AD27708D587AE49B3DC68644172BA

Filesize
13KB

MD5
e15c692b506106c8510cf1d9064289e6

SHA1
2d94389bf01872d0d6f96431fa2d2dc6e3fee5b9

SHA256
e1f7c317fa3bd56ba550c59442903b7c031c8ffd2ecc03e7ca4c413856ad160e

SHA512
c8d02a9ccc43a9a7e68451b844aff3e134e7dec91fc8b51d1a3275468e591b323116258ad0f5395c09fd089ec87a83d60f28232ea8f6fe76eac863dd0362694c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n9vxbo99.default-release\cache2\entries\F4EFE37A30D0F14C6AC03FF7949A51CBC2EBC649

Filesize
13KB

MD5
30f5a22b3a16b285c71209f36ccc256d

SHA1
d98b12296b183a283b2f5bbfc8b10eff0bfc22ce

SHA256
984413e36b4991ae5f5e8bf27cd8fd4f08821546b89439d78681a371032789e1

SHA512
20e592ba844d6a8b870c52a9e03601f6b38dddcbc610d01dc2be3f4e74e61bfefd2fdc27bd106024f10c44da848e6c335a02488d2c85b424205c7f8a1b88b68e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n9vxbo99.default-release\cache2\index

Filesize
85KB

MD5
54525ee77374e037e0b89944b7c47d44

SHA1
7eb02463c278b5d265513a95c4d9019c3bb6306a

SHA256
6946ba9776edf69b63418597f4c7f5b4270945eab9dc6aa2788b9475078beae1

SHA512
7886bb5546a681101af46dae621e1e18197cc2e76f1eac9f983243278950f5d945d3344ca6fa238071c9c70c07da4035c9ca9c097bb710de6fda193086ec5838

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n9vxbo99.default-release\startupCache\scriptCache-child.bin

Filesize
459KB

MD5
3cd5743d239ea536510c7bac9282963a

SHA1
23b334a505aa4e9a3c43e10c7ba1a4ba67dd3b4a

SHA256
5e864cffe118bee4cd25cc51b39c003b06ddd719c38f5220a97d2fdfb38200ae

SHA512
97dea12bb545a808129f415ea3e3c09d0818af73b18c3e6ac6d10c25f0c731565663d4730d7e8d75c4f8c589bc8174fc0edc90a5d22e53625f15acfc16622985

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n9vxbo99.default-release\startupCache\scriptCache.bin

Filesize
8.2MB

MD5
8f6f61be95df2c61fda0ad41ab0eccfc

SHA1
fede3b3d3702ce12bb9aedfb6a88d0758bb154bd

SHA256
6f7484693addc3ef4b7a117441c2060a47475d68610c3fa41604e63e31cd7513

SHA512
fdc9e0412878942984c7350d51536d02555a5f5bd25808c601f4b664e5b37291792b702db25a46094c6c2fee6aad9eff52437da49cc8f0466fff85e4f22be6f3

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n9vxbo99.default-release\startupCache\urlCache.bin

Filesize
2KB

MD5
af86f872bd0f4741a75267d1f6b8fdab

SHA1
ef88e0ce1dd8b106f0e71251f36f0a217294c809

SHA256
962c6d9fcf7b0c2ce39c6e6d1a1af72c8a209ee5228150cdb2b54b82f043a7a7

SHA512
86450787819be93240732a3a459aa811095c698a6769e50ecc26c523881d369e7983abba9c21fa6f2864b242723006e7db86c7cd0e58c71b20f75dbcb5adfedb

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
8.0MB

MD5
a01c5ecd6108350ae23d2cddf0e77c17

SHA1
c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

SHA256
345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

SHA512
b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
5KB

MD5
4c5e21101d3a9af2b90f428bb0e6ac68

SHA1
41ad25c9a1c212533d4392707667a192560c5e03

SHA256
a5f5992251b2edbb2da34ef27976f37cbfb4850b49c02be6ee71ce1ab6570599

SHA512
b666ffed0bebb7019d663c16cddeed1db09b99d279f5b190127171bcb33ec6ec6c740dcb675c687bc6a81ba2633535324017d598c98756d2682e42d3cd3b5c23

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
5KB

MD5
922de788f10f769f7728086fb3273dcd

SHA1
e0603193b862c5a0697887bbb8ebaf39c833d008

SHA256
e5594ee9cd193a663a9e41aa4a85961320295b8035a5611fdaa0ddecfc74e59b

SHA512
e0426d3653a3af571ddbebf6f7e53b35f8d6c4a1a960eb9a20999c7c08e807fedd2ffbf9af87d9c3fc69eb6d4e0592cc06a3e944652cd87b63b8185fe3b34581

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\AlternateServices.txt

Filesize
12KB

MD5
62daad1f65bac38e4afe510e99e35c3d

SHA1
3dfbe88a9273dca0cd895edf93b747bbe9968b17

SHA256
7f8e1b838ff7e5fb9a9526f53b6dabd0e900dce91c8bcf13414dc6c65f594153

SHA512
9fbbd5a0661d2c0ff4c67603c8a3ebf89694d43bc2ff3cf803baaa88f7adcd2eb09a40f0c1b9d46a0bfc61f2d9f9cfc5b9eab0b353fa294d734cef0b56a8fc5d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\SiteSecurityServiceState.txt

Filesize
561B

MD5
f37e2fffa0b4357cc1a18f02bfb1a21b

SHA1
b0e695743bc006e682b0df7a05acee1dbb6057d0

SHA256
f0a509e7cfb6837776e9b215bc9672f5f5d9a5700ace07c2603f30e8a605595d

SHA512
f4d521f6eae44cdb87026e3bd8057e344d7dd758987b89d68c8e61022602dfe0e6c7f6716a46d8e1b5488552c689e9bf27442de5d0d7798ae9cb862f6e265b99

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\broadcast-listeners.json

Filesize
216B

MD5
a615cf28e5724a519faba3bafd62d403

SHA1
eed89709bcb01b189a1a59772ae71cb967876220

SHA256
4f2f4fdcc91309c4d2abe9eeec719eae486a025f2627c5748e3f64acbbb88d81

SHA512
bc9f0b2354f46cdfc21711400c57f7ae030504b83ab030d504fe3bda3510bed708abc65a1e66f5e6ff490b60498bb87952897e307723290fdf5d98476133bc07

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\cert9.db

Filesize
288KB

MD5
7d45bbbe79428dc7ffd316b8b82c3abe

SHA1
8e1e8d8cc701df974236bc5e308b7decedde47eb

SHA256
743f3f7805df17dd38fc5405537233419a4674e08f0d0db21cccdc652157bedd

SHA512
2209874fd84c41b283fd76324873f218e3a0b223c0cd11fb981bd919ca5905b4d242f46973141ce6e8d5cb031d61abc17dfd759b43014ce630801780f1df47f7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\cookies.sqlite

Filesize
512KB

MD5
9e2e7afcc064f7d2728bb7d4d7633564

SHA1
4569d7c48e716f510a825d322c6bddd727823984

SHA256
1a25b219e5dbbf44d859bec2bcc26b0cdf03ec194ded5123c33a2b2508917923

SHA512
f2d73d7052ddcaa553b04133daf246a7838bead9540b6c107f66754eb9ac3cdfe12e55cf1ecfc09c2dde4836eb82699197c109209e82a4c75036be69c62ec0e8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\cookies.sqlite-wal

Filesize
512KB

MD5
dae1b07184f44230b00a7b8f7b664990

SHA1
310fc0cdcd239000921be22ae30f0bbf22505491

SHA256
23e096cd95ae5b546884aaf7bce88577a8da03f63d3ecac09168ffd839b5e436

SHA512
fb263ced46265152682f690ad7b56d1462ce1342ff2d5dfddbeebb467d527cd60ccecd32f33b4f7b5512962a877f37b7063a46bd68fc9103c7b4682c9202a2e4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\crashes\store.json.mozlz4.tmp

Filesize
66B

MD5
a6338865eb252d0ef8fcf11fa9af3f0d

SHA1
cecdd4c4dcae10c2ffc8eb938121b6231de48cd3

SHA256
078648c042b9b08483ce246b7f01371072541a2e90d1beb0c8009a6118cbd965

SHA512
d950227ac83f4e8246d73f9f35c19e88ce65d0ca5f1ef8ccbb02ed6efc66b1b7e683e2ba0200279d7ca4b49831fd8c3ceb0584265b10accff2611ec1ca8c0c6c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\datareporting\glean\db\data.safe.bin

Filesize
182B

MD5
b1c8aa9861b461806c9e738511edd6ae

SHA1
fe13c1bbc7e323845cbe6a1bb89259cbd05595f8

SHA256
7cea48e7add3340b36f47ba4ea2ded8d6cb0423ffc2a64b44d7e86e0507d6b70

SHA512
841a0f8c98dd04dc9a4be2f05c34ecd511388c76d08ca0f415bfb6056166d9a521b8bc2c46b74697f3ecdac5141d1fe6af76dd0689350caca14e9f849ee75a8b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\datareporting\state.json

Filesize
51B

MD5
3e32e2cc1ed028dd8ff9b06f50a4707b

SHA1
b3910351bd8e13ad1479db699cf6fac6544a5bef

SHA256
4a3a666d98e61b5fe06fecac56807137a0fffb4bb71d4c3b16baa8702dde738c

SHA512
4585ee9ec04adf138727cd039a9cbe78db6cf2926f6ce92524312a42efd1250100848a919ec4b833f9a013181ce93734575b86eed37f1bf32effa3237eba84db

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\downloads.json.tmp

Filesize
879B

MD5
cdfaf9f6c6cf9b93aa2790a748d12a92

SHA1
8d13ffb19f0e0f599ddf702e3bfeeaefe7b8e5c3

SHA256
e756da0810dcab87e42b769050c5f6fb0c5737fd7d9be44135897d5fb6e1eeff

SHA512
3d2cf0a665bb61bf185f4600e7c9844a6562d5074056d339611056070ffdc05bfb76c4d4fe02144dec0fd0ec3d0569c70f3015c872d409b9a41ea1c66533c3c6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\favicons.sqlite-wal

Filesize
992KB

MD5
3ff74eee6db381f196836f376633ff9a

SHA1
51c6fb6c2480f61a6587b80ac0c11f15cc249964

SHA256
83ab4715897b7d37bd5a42dfc7159b0217a53305388c53d8402edf42b204e0ce

SHA512
091c008569a42c0b9430381ef8e0024a2795321e559d0a63717eb4bc1b1266a4a0656ce3799c8ae07e7241a4dfffb5a77cda03e4421bbe93d172f485a729e87f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\formhistory.sqlite

Filesize
256KB

MD5
ebdc24e6cc3968134fa2d91507b60146

SHA1
14cbe85a1cfb731ca4ebcd1f2338275da2fd5921

SHA256
93656e74dfd8a7d8d4000e7b12e2dc8b8f73d7a45ebb404b8cad00b9f3099390

SHA512
0968e15df19fca2c4a5bdaba870066bbf4f43e15cd3b22ba45e4bccb2165efe5f5a3896e5dd22fb21abc6d22e68ccfbe9f22c17ada4ed86ca40e1e3b49b6b9e1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

Filesize
11.8MB

MD5
33bf7b0439480effb9fb212efce87b13

SHA1
cee50f2745edc6dc291887b6075ca64d716f495a

SHA256
8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

SHA512
d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\permissions.sqlite

Filesize
96KB

MD5
fa8e5e43593c65cfd23c352b7fb732bc

SHA1
46cf673f719b1dd458543a07b4fb1af43512d511

SHA256
884040d9ad71f162ef55fea1389c0f78098ba9d6c59fc1571c0d87f111ca187f

SHA512
e35b94098f893084276bb59330cacdfd2ee173b53c3fb7ec4e86747e4848c1f48fd93a709175377823630be83d67a5f9a55eb7ef555a06ef55117d0710d62479

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\places.sqlite

Filesize
5.0MB

MD5
2370e4626755404659fef421a2023ae4

SHA1
9f6b5180a21e93351c046a0a87019b1f4545f663

SHA256
ccfee5aee2a3f5aae4c63168b5962e376385653da8b6040f77a37ed44d86f555

SHA512
74097dcc488078f8fb97d36cdc0f1a4becabfe644a7217f976781f2004e839fc588c5b77ebdb4137398065d3be6ba0f252d2dc546cc3e8351b0f2a9dd655b47a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\places.sqlite-wal

Filesize
2.3MB

MD5
a5fa62da09b7080db382dea6ce695c0a

SHA1
83b327d9f0c724119dfc0591989d289a7c5cf1d6

SHA256
b767d46711da0b0d37c2f09afccfa5d8aba199b3cdd0bab37cc154b59a9a5e1c

SHA512
bd00a2469bbeca43829dac31d2657a4b800a5f36eadc90dc64abab040013054aacc75e666b158381f76451a7dc68f9dedc2b8e1648547ef45b36887d618afa64

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\prefs-1.js

Filesize
9KB

MD5
4163761dc999651443c3707cfb549bd7

SHA1
3bbb0a386642053eabb3e505849c6a5337d41518

SHA256
9cbd3f6f5b5bce97fcfad4eb43b6276945426a84415a6d5f252b81d36551b328

SHA512
edea439acfb28bdc7b752dd074688783cd401030f686280f1280875ef2bfa8a33d86c023dc60910d17fe1e72baf03a2e87c4874147136a708f92f96d542e8bed

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\prefs-1.js

Filesize
10KB

MD5
0ce015d7cdb2b5b026bcfd7aea16512b

SHA1
26fb1e7d85b9e5de543f0366885f019102ba5ee9

SHA256
eea4699cf89533e4d0ebc40c36943e4faf9aefe23aebf2aaf5959d884c04ca2d

SHA512
9a5668a1dcf0f58e2bc838a2e0c93163c262bf1a19d15da32c9a8acd89ab0a59d33fab4f36d32648c060b96d019613c9d466338718a271578861248715349c53

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\prefs-1.js

Filesize
7KB

MD5
d73530f17f4a76ccc8931053baffded7

SHA1
95985dd7ca9b80830f120bb4bac28da150367187

SHA256
7acc655348a8236352979095d7b3093e2eb0350f672080c2b7c16351293777dc

SHA512
73cdc6d4c304dd25b516044e3b9eef1d3a16ae07586b599bb64ad6de590c48f5711934689b27bad93275e7baa07eb2e571a916bb6cdff04d4f5e410f275928b2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\prefs-1.js

Filesize
10KB

MD5
aeb09083645a75ed6e27507b37025db6

SHA1
1347366a527d5da51ebcb8be6e4ef5fc47e9dfc9

SHA256
bfa5d88234464d96009506521d4131518cf3bf939d19e7048c66da32372585b5

SHA512
b42711ac3f3ee1275b761051591e04e1b588ee38b0d4ec23ea371cc7a7310ea286aea3aecfe05e15c4d8cd255aadce4bc2737b3c36ba7d34169a403e707795ba

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\prefs-1.js

Filesize
10KB

MD5
7f9a383a3cbca92a0e8295c995bc889e

SHA1
f22f201d6146ef3e26fa5a32805f66a2bc376dcd

SHA256
54a47560bab9a8212d4f5c3855e5645c762f642a77e49a0f548c549c643fef6e

SHA512
5197e943edaeb392b30bdc585ad3f35528145e39aacae214647dcdc91a50a98488310984ba6f57e951d69fb199b1f79970c69d4a2f3cafba9b433c3666bb7e29

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\prefs-1.js

Filesize
10KB

MD5
ff8ff3b5437fe02fae829f17888ae31e

SHA1
7c8b197076b6876b09a1c0aab2436c911fa8a16c

SHA256
c21c9ea29fa36b2b91c9e70c4ec586511d9646d894db9ad75b3f4566e6bc18e6

SHA512
142da5d3a0ed8abf64c3729457e48b771b086ef9e5af953011faf9368a61c57d76c08a2d1fe26f609c5cc7b7171adf7216e63660cb5827ba601dd46f34c442df

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\prefs-1.js

Filesize
11KB

MD5
b48e6c0aa4805d19960c90fc072ec384

SHA1
af4d6b2e87d028a4cc0599308aec497074e8966b

SHA256
0ebfb46658e01bc67fc957f9b04ecb6770b81680e47613145ab42f1a56bdcc6d

SHA512
071a43ad1b0a9f1c9d34597372f298a1abea4d276817bab41ba0db438ba9b4ca80408e58be1be6cd36ec137c215cf67dd3a1125713bdd02b784811a87b4b810e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\prefs.js

Filesize
10KB

MD5
a9de084567bd38b2441631acc4fefbee

SHA1
2a138e8b15c0781156cdf598a75a0ed6c9f96ce5

SHA256
b0650ced3869ae76ba30d2e90f7699b7db1015c5f2a5e7f4567ddb4502586e43

SHA512
1ae345cdc16d54f36665a89197d8509a98bcedaad5003464fcb958640c1b2dca3f3d12574283059f66cac36f393fa9724d46dbd73732ddc60e4f078c17813ba8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\protections.sqlite

Filesize
64KB

MD5
c18f13f30c76a14834e6ddd6763243f9

SHA1
6ca0f5f5a17e8e3bd4e0cfeef4e9cb3d6b134724

SHA256
7cf0d6285bd65b7b77919a1a1c2ec3e3295ab6b907ea5e484b012b5e5827ce2d

SHA512
6608b24b5de2bcc7979a7c0a0f89b90673b74e5e8c17598068deb3c55ca0551708f51ec48971d228516adb8b19470ad1a86b1997e94fe6187328f48119a61f34

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\security_state\data.safe.bin

Filesize
2.9MB

MD5
0b47f430981d75fa91889aa7af1f819f

SHA1
d1ee6138308c584447df7a8da166dda89aa06175

SHA256
d46b10d6c5f8c6670fd73735fd1b470876f358faa4cd85394c6944ca35a2699d

SHA512
8397ab902283e26ad81671ddd40799298f9200a0069606473da255515b36b64491d6355076f4393435942c72d1990c05da8e2ddf410085a987ad4fbecbce36ae

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\sessionCheckpoints.json

Filesize
90B

MD5
c4ab2ee59ca41b6d6a6ea911f35bdc00

SHA1
5942cd6505fc8a9daba403b082067e1cdefdfbc4

SHA256
00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2

SHA512
71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\sessionCheckpoints.json.tmp

Filesize
53B

MD5
ea8b62857dfdbd3d0be7d7e4a954ec9a

SHA1
b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a

SHA256
792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da

SHA512
076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\sessionCheckpoints.json.tmp

Filesize
259B

MD5
c8dc58eff0c029d381a67f5dca34a913

SHA1
3576807e793473bcbd3cf7d664b83948e3ec8f2d

SHA256
4c22e8a42797f14510228f9f4de8eea45c526228a869837bd43c0540092e5f17

SHA512
b8f7c4150326f617b63d6bc72953160804a3749f6dec0492779f6c72b3b09c8d1bd58f47d499205c9a0e716f55fe5f1503d7676a4c85d31d1c1e456898af77b4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
8KB

MD5
47ee53b05f583ac6b1a9090f8b88fa00

SHA1
6d3949ad7be49e966b2d347894e3c6dec18e95e7

SHA256
a729cbf1f6fd1b3408bd8d7b9010687e2cc6be92e3f29123f4e7902c1b5cb776

SHA512
1649eaeb052ca1279ecffa49b83dd7141e2bed3cf813cd7ca4167549953addfafc48286b81c02af41bb880229e80da0fff0781598e3f31518835ed2f11e9599e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
9KB

MD5
98cc5db22cc9e6a9d978f2a45f40b5a8

SHA1
dde2857d1db03b7779785ccad7ab290bfb793be4

SHA256
e4730660a7c026a67c0708528b2ba00162195dc052897599cfc4854a02b147e6

SHA512
038c367cac2d1a036a656838d4cec3b8950425961c75dc2c9a9b12c4ce561e99621a1a80895c54920bc71c70a5036abc46eae7c496d94a370fb1c8f165551b17

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
10KB

MD5
3fe5440a4da0e1222773e63bffd54cdc

SHA1
126c4147ee163e7aa9fb32066d71546f00674a3a

SHA256
964f53f841b042317af9ac6bc031358d8836f7e7221d9df543b8afe67d1dcd05

SHA512
2b9ea45c7d0736fa13963da63830b2528193471f7272233eef2ef167e74f593e9aa508643d90315a827862f0af759815d32a707ad661917012487336aecf5d4e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
9KB

MD5
164eb6b8ac0cc585fa12db1c6cfbcd47

SHA1
6204b5b8e10ce560271c9381fe24cde39f84c2f4

SHA256
fe6cbfdb5686af6c4232495376b8cc02af75e5cdccc91381a36973164d226dd6

SHA512
4969b99e65efafa13555931b821e815e8cc65e98d3b4ab102459a01c82dfd2c03d370a5bb13b25113f64a01c9e03e24a9f7edfaad7bcfd586760ef3dcdbe417b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
11KB

MD5
a00d6a647df3d09c867da448b990ced7

SHA1
aa55ce890675349841a07fb95d10dd343b2156b7

SHA256
191dd4d9c9153fe8806147d8bb744794f4f923719d79b17e64b98f7e22643f73

SHA512
435b67aebbeb7221d9d56710ca0a1b67761e3ef8980b43851d5e30a474bb0f8cf5c764de91986affc7180280b63cb30b7de91e40d0235bdbe46ff0d81101b05c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
8KB

MD5
e604d07f52cacaa544cb1badce623bd7

SHA1
bc0efe5e97f6657ec3a94a01b865057e47c3abbd

SHA256
3f91031a2b51791e89a731d7b2437fa4fed0b5fef7962c8ab4e514827a837ae0

SHA512
a322d70ed228db9b0973f44a5adfedd05bcf3da2258d1825b70be9d26dc916f6751e922323131ebd20f49a9c6bcf723f39b72b8a1bd3ca188b0d525a25cba927

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
11KB

MD5
ee437bb7ee8fa99456394769ac081e6b

SHA1
240d7c82a056b0b7413abce1c953b0552a9a8bfc

SHA256
1425a6488c6d48b8fc413e2b8067bbe715ee9959898757a8ab97bde4748b3829

SHA512
865093e9c91130b3898bf966da58ccac082ba1e699e9b9acde61f7138592b42bb8033e70db872c972034d14ac547272ddad63bc463d4f5af4edc9aa978e67a6e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
9KB

MD5
c186ee7b92a4a5cb08decc5b83ad6e9e

SHA1
15155e21fe657be061e5519f3145e38057e5c278

SHA256
3c0625c16b23f3bb8e76749bd3570bec379bce63c3245157dbfc9ff49fe011c6

SHA512
ac72ed528865a8534dbf849c1ba5c62c175412b9b4c879482f20e8ee57272bfa124474a807cd9c22f617176529a0a8df3e021d2ddde2b698e48bad75f32af44b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
12KB

MD5
19f56e1536098bf175ee321a61479171

SHA1
b9c07e601901d6eaec6e57ce8032f23f395cbe7d

SHA256
819f4aa2423c675c1bec7891abac92cc7663738e14b1dc36915f073448515cac

SHA512
f2c73346cdd6733e8c4d3e2b0c45fdd98bb1ce36a8d2c12766fcce529343aa39b4c1837962f57ee0fbf6b61e9f58e773a581e36ce678b110462c24198432103f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
10KB

MD5
0045908eecde01b4efdcabd15bb2de1c

SHA1
163b035104b6f26668b4383b4913b6ec4d405d8c

SHA256
a739da8eb14533b0044f97ee0207b3f17fb38d80b6c252ed1040b46d846b34fc

SHA512
1c7e25736c5003c7f6ee9e38778164da65a2e21e51ac9de33aa87577ebc2485ed468a15622f7d25dbbeb1bdcbbfb10c329fb6ae37b11b7f6d3c0cc4dd9043d6a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
11KB

MD5
6e38f9574a0b7973fdaccd9c58a6abbf

SHA1
c2e547b5ffedd4ffc69bc7bd52cfbe3e69ecda9a

SHA256
07a9b063358985a6ede4d39ead484f7e7d2ddc9fecb0687887c7c4410b4809b0

SHA512
ae2e8a1494a794d2c969af8880df17a1966260988685a7f722320793bbb3b95f7030c5920b935fa408455b2705c81f03760b76978088cdf46a5822144698e3d7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
12KB

MD5
defc22a711cf68526fd8c9cd54a07b4e

SHA1
28b17c38d6535fabce5cbd160820805b7b28e501

SHA256
bef72d3a4c51cf7cadb90cbd1d3d2455b33ad47021cd293c8b35673e9823faa5

SHA512
551fe1e524fa45121a0c4d2c39d82246a5a4c271e82cda3ae516b66c57680ad16d3758936a35a500419258486b1345cb46a79bdd059ab5b8ffb66e80cbfccf2c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
8KB

MD5
fff76232548a3af72600d0fff980b6bc

SHA1
85e64b8517ee362e7b696f3cfbf59b2d16961fc3

SHA256
b7fabcf5bced7c85f2290acb26d58fc2c822584c5ba10f586e49163f9b2dcc0e

SHA512
8f9f5b4a055cd7f1a1d23ad7d2a1f92c2701c8157d9d38ea6728cf6c5e1ea152022cfb88a75b632c06b6ff85b872db64f652a5b7194b810b1296550a88dbd0ba

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\sessionstore.jsonlz4

Filesize
12KB

MD5
9db52223a05e974ff9a7bd47074102cd

SHA1
5da07fdb6abffe529b502926e6b667ed395cf9da

SHA256
d732ac9f3bf65c81afb6012ae95f9f68b318310610ec80032d5f10270dde0152

SHA512
a5c2ad2db74a9019261edf360ba90192d791a70e3f61cb0d0468cbbb938be98fbf71aa1555c1256063ffd230fef357c9a805361421b32889e76bf67bbffc7699

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\storage.sqlite

Filesize
4KB

MD5
e754fbe11ba0e708fa319a0396ff4274

SHA1
46687e5fe95275f8d9512e64659a7ad985343553

SHA256
33f31db8b6798aad9d7752c69ddbf9c4b97621fb924c9171f7f8c4d4e6c59704

SHA512
e02fc85d8b3bcc22c33e93dda90993122df5be0dcdff02302577978f47fb202ecb20cfaa899c2c67f4d09c6381b076eae6b2e0af682de10b8df7e187e735bdab

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\storage\default\https+++player.aniview.com^partitionKey=%28https%2Cmediafire.com%29\.metadata-v2

Filesize
190B

MD5
f2405aa21fdc45986d219928c155e60e

SHA1
47913cb2742bb2692bdf8e8b3918fb93671fd563

SHA256
94271416c00f4c428b6cb0fc00a858d4802ffe969d2500c47f9672fe7bafffc7

SHA512
bcd4e094949624a1e04df4e61497a413c9ce2c6e91b9d36247bd41b370b940a96092edb3eb30e485b03001788a666941861c71cfeb2edecba837f3185e408fac

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\storage\default\https+++player.aniview.com^partitionKey=%28https%2Cmediafire.com%29\ls\usage

Filesize
12B

MD5
29a695de75d4d55b197a117e11e75283

SHA1
74d79eea8624bef1b625017c154a3be311da3c39

SHA256
30d1c437ef1eff4845ab14b263c875e09a7ae187f95a988a8c0270b6457b29f8

SHA512
b97186fac0b56480e254d6c3579b2293f1c64d9ea96a24a4ad93c3f959d1114010b3504d5a31eca02993f163b6bdda386c3aae77c7b2840ecd51a34b5464ac16

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\storage\default\https+++prebid.a-mo.net^partitionKey=%28https%2Cmediafire.com%29\.metadata-v2

Filesize
184B

MD5
e0239faa7a1675f62eca6d0f407bef8d

SHA1
099b9ae926d96d6894a47ffe225c020625628107

SHA256
a824888c19295fba5ef368a1b8acc7c6c9caf41d13749cbc88c6265b074e0607

SHA512
da8df4c8cc0b2d53c5869c7c3ce0f617a7bdb0770293b2b930ee47c7b6c2cbad636b91596f658d58698b554205d4a22711a9af5ceed72a78fa971ea025752130

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\storage\default\https+++prebid.a-mo.net^partitionKey=%28https%2Cmediafire.com%29\ls\usage

Filesize
12B

MD5
412f01bf38c3978093e27b74d6eaee82

SHA1
e745d016ec1909dd51104c871e751726aadf8c42

SHA256
cb8d6b0e58d35080af4d2fe26126b11dd5aa66d06bb23c2b43b412abb12e8292

SHA512
ea806d3712a0dae0ef3d866f502d3e6ba1d4fc50e2d596f4b4da1358d0cd8049d81f87d686acfd42c4c6e0cb3ccccc40359f69ff3aaf54d3760931c6ac64095a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\storage\default\https+++www.google.com\.metadata-v2

Filesize
62B

MD5
759412d5332f7de508ba4e8a1d296f5f

SHA1
6186685a6a4733689fc96071252f6330de777864

SHA256
6bd88b22978cb80ca62d056d89966f952aa0383ad853b8f3c49067eabe15dd63

SHA512
61483bc229fa84d4adef8336eadad2d4a1ae3e2119484826aa61263ca43a8733ac9b244aa0409ebddcfe397c6dd4f4374acebf451a46b99cd403273aa32533b6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\storage\default\https+++www.google.com\ls\usage

Filesize
12B

MD5
a769b829c6c0f123b622cfa5a0dfc07c

SHA1
f4967a69f8402e3eef7e9bfbd86d37ed00ad6f67

SHA256
946f931df1acc87540436bcfe4791e9d59ed77635963f2c45189f7787dbe2654

SHA512
1d05068c6e5549d67f900d8323eeaa2e392764a35332b3de85c9702c90d8f3df38a24973fdb446529b6edfb0ed6da870c597be74cd1e6824fd823bc070100693

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\storage\default\https+++www.google.com^partitionKey=%28https%2Cmediafire.com%29\.metadata-v2

Filesize
185B

MD5
d501174e9fb8c31b17450f950512ae89

SHA1
1014965535220e5363bc3bb14b825274629df121

SHA256
87baf11c6c1e9c3b1ff75817474345f37739df0d7fd20e483fc9096696849df5

SHA512
116dcf3988954c843c6c9dab88b164d4f73888ef0e3afbe24147adcada65f0738210827a26c2d6021f4aa48e555603baf95f59bd69badd9331c19fb30ba3b8cb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\storage\default\https+++www.google.com^partitionKey=%28https%2Cmediafire.com%29\ls\usage

Filesize
12B

MD5
ef5bef2c23533b20775817e0acf08128

SHA1
7e6292d37817cb31904c13795ff44f14e69a7678

SHA256
0ef72b88336bf69ce23a2f09cd08268e0eb7ef6ce19e7fd0632c7179a22f7f31

SHA512
61c57a8772cbfd11f9118704795d4ac30259b447ab34575ae25636fa1f7138d015e89514ea9025abf3fbce791cf597023a3ac209ca3a27031aa2f01aff2cd0c8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\storage\default\https+++www.mediafire.com\.metadata-v2

Filesize
68B

MD5
de96eb24702d186bb9b50ef0260658eb

SHA1
639ed8192b13bad47c7125dabb871162846dbf79

SHA256
de3664612c1a905bb115a0c01b48421d152f947857b0b8a60eb8bd10fdde6274

SHA512
cfc0adf6677d63bb6971e8c44b56c35f13d63ff81983a3524c6dee571f4f1c1e8cd64867909ab55576a792e4f11988448ac4f6caafec01682c4a4ba8e43fc65e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\storage\default\https+++www.mediafire.com\ls\usage

Filesize
12B

MD5
542f586dbd55023deb41740a911dda13

SHA1
0733d2d9577a567563fa1177e976575049732169

SHA256
ff70d6eaa53049a0f9acc262544a09962f31d264b1558d132275eec0e3e67bb0

SHA512
fb1f187b65f0017d8f77e75f08d437569f01e34dbf3aa7ed3f762f914bd60493d6fa849815c2289f10c751beadfbdd870a1749f3b1a8c0ae59803c818bf9cc75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\storage\default\https+++www.virustotal.com\cache\morgue\142\{7d55c300-a64a-4423-8177-8cf5a203ad8e}.final

Filesize
47KB

MD5
54c3178d5f34066c836808cde13554e4

SHA1
736a5721e01b5731cc8f97973b29ba53fc02aec9

SHA256
93f00a9bbacc3e757a9b2d8e6bbf46649f5aa68b489eef1987222069d9fd6949

SHA512
27486cf2c9ae87fb3e0fc2e91a07d8edba407b8c338e6ec5617008f1faa9fbb852c54457c2a5bbe309d2db0d0a3412e65b6e13f23e1fb651872b170f8d7ea02b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
10.0MB

MD5
9c23c184832c21e4552f88bba79febb2

SHA1
9d39861868b70a7c7c48beafe4f43bbbfaa0b443

SHA256
6463b6a565e46cda3593ea74f965b93ff3254cae70e9cf6e83bd3c9c92143481

SHA512
a6d05085fa035c0b18a5ea70bf60efeab14663f37518118c140c6bb09d23872e3b39d7cf8d231c00d5999a272b18a22a09db2bf17ded45682a31be79f0a92caa

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
816KB

MD5
d98b71773f50680429dc2e085021a9fd

SHA1
872e98668d5865ff24ffbfccda9f3679b1361ca8

SHA256
e7f7e591e3e108e04f030688c1db46178a35463bcc4bb8fe6d4c73801a0077a2

SHA512
9a66c491c600161c29b10d2bf0784b2da1d379d8040ed9a06f75b53024a4f97565f77f4581b2db2f5bde105fcb822accd0aded23d93c20d1ff1434b6ab81f132

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\xulstore.json.tmp

Filesize
141B

MD5
1995825c748914809df775643764920f

SHA1
55c55d77bb712d2d831996344f0a1b3e0b7ff98a

SHA256
87835b1bd7d0934f997ef51c977349809551d47e32c3c9224899359ae0fce776

SHA512
c311970610d836550a07feb47bd0774fd728130d0660cbada2d2d68f2fcfbe84e85404d7f5b8ab0f71a6c947561dcffa95df2782a712f4dcb7230ea8ba01c34c

Download Submit
C:\Users\Admin\Downloads\7z2405-x64.ESLFKDZC.exe.part

Filesize
4KB

MD5
3abe3fdd0dfed53279cc0dc0deb37f91

SHA1
d79f39ed7eae8e3a033ba4fdbf7db892545c30c7

SHA256
c6aeecaf950684695c6c6eba3d926602c2adc2760b3638f14c87dd1692fa8d7e

SHA512
02a019611457b7987cb4fa99e020336c21acc8451d3eed9808a349703aa0c070a2148f207aac280230e789abdb099da1e7b76b12318a2c08ee9c80fd7f73ee03

Download Submit
C:\Users\Admin\Downloads\7z2405-x64.exe

Filesize
1.5MB

MD5
c73433dd532d445d099385865f62148b

SHA1
4723c45f297cc8075eac69d2ef94e7e131d3a734

SHA256
12ef1c8127ec3465520e4cfd23605b708d81a5a2cf37ba124f018e5c094de0d9

SHA512
1211c8b67652664d6f66e248856b95ca557d4fdb4ea90d30df68208055d4c94fea0d158e7e6a965eae5915312dee33f62db882bb173faec5332a17bd2fb59447

Download Submit
C:\Users\Admin\Downloads\Solara\metod 2\loader.exe

Filesize
81KB

MD5
c02b4294e68a2e0afe18c6865ac3da1a

SHA1
e28e58680ca93471f17532ff756713d7e886a0df

SHA256
a56f3e567eaf4d5cf3b5924fec383de32cc14d7a808034b0282b95e06b4a4c55

SHA512
53936f1f042a18bea303974415f296c85225479fcde6defeb861936a0010508fdba23f7e6756aead1b27cef80fd6674bfafe0e6df10a5c34976abacaa0403c0b

Download Submit
C:\Users\Admin\Downloads\winrar-x64-701.exe

Filesize
3.8MB

MD5
46c17c999744470b689331f41eab7df1

SHA1
b8a63127df6a87d333061c622220d6d70ed80f7c

SHA256
c5b5def1c8882b702b6b25cbd94461c737bc151366d2d9eba5006c04886bfc9a

SHA512
4b02a3e85b699f62df1b4fe752c4dee08cfabc9b8bb316bc39b854bd5187fc602943a95788ec680c7d3dc2c26ad882e69c0740294bd6cb3b32cdcd165a9441b6

Download Submit
C:\Users\Admin\Downloads\winrar-x64-701.grIJzBk7.exe.part

Filesize
63KB

MD5
d3ec96557834050f9edd29c3ed88cabe

SHA1
af26f02653f4a0d2a3c673517b6c517ed529051f

SHA256
bc7747c8272ce56edc0d941e81df1b9e93f8c03be786be59d2c240b985a6793a

SHA512
77e5121874fbb294bb072dbb4b823f0ec343952b49adc96c357090bee6758944f52d09b817307b5e84921ec679449d3049009e6ffe572e9104172f7518f2cb87

Download Submit
memory/2720-3425-0x0000000008590000-0x00000000085DC000-memory.dmp

Filesize
304KB

Download
memory/2720-3420-0x00000000053E0000-0x00000000053EA000-memory.dmp

Filesize
40KB

Download
memory/2720-3417-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/2720-3418-0x0000000005860000-0x0000000005E04000-memory.dmp

Filesize
5.6MB

Download
memory/2720-3419-0x00000000051E0000-0x0000000005272000-memory.dmp

Filesize
584KB

Download
memory/2720-3421-0x0000000008910000-0x0000000008F28000-memory.dmp

Filesize
6.1MB

Download
memory/2720-3422-0x0000000008480000-0x000000000858A000-memory.dmp

Filesize
1.0MB

Download
memory/2720-3423-0x00000000083C0000-0x00000000083D2000-memory.dmp

Filesize
72KB

Download
memory/2720-3424-0x0000000008420000-0x000000000845C000-memory.dmp

Filesize
240KB

Download
memory/2720-3426-0x0000000008710000-0x0000000008776000-memory.dmp

Filesize
408KB

Download
memory/2720-3430-0x000000000A310000-0x000000000A83C000-memory.dmp

Filesize
5.2MB

Download
memory/2720-3429-0x0000000009C10000-0x0000000009DD2000-memory.dmp

Filesize
1.8MB

Download
memory/2720-3428-0x00000000088E0000-0x00000000088FE000-memory.dmp

Filesize
120KB

Download
memory/2720-3427-0x00000000090B0000-0x0000000009126000-memory.dmp

Filesize
472KB

Download
memory/4352-3398-0x0000000000340000-0x0000000000356000-memory.dmp

Filesize
88KB

Download
memory/5156-3435-0x0000023A49890000-0x0000023A49891000-memory.dmp

Filesize
4KB

Download
memory/5156-3437-0x0000023A49890000-0x0000023A49891000-memory.dmp

Filesize
4KB

Download
memory/5156-3436-0x0000023A49890000-0x0000023A49891000-memory.dmp

Filesize
4KB

Download
memory/5156-3447-0x0000023A49890000-0x0000023A49891000-memory.dmp

Filesize
4KB

Download
memory/5156-3446-0x0000023A49890000-0x0000023A49891000-memory.dmp

Filesize
4KB

Download
memory/5156-3442-0x0000023A49890000-0x0000023A49891000-memory.dmp

Filesize
4KB

Download
memory/5156-3445-0x0000023A49890000-0x0000023A49891000-memory.dmp

Filesize
4KB

Download
memory/5156-3444-0x0000023A49890000-0x0000023A49891000-memory.dmp

Filesize
4KB

Download
memory/5156-3443-0x0000023A49890000-0x0000023A49891000-memory.dmp

Filesize
4KB

Download
memory/6524-3401-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/6524-3404-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/6524-3405-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/6524-3407-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/7608-2927-0x0000029C91C20000-0x0000029C91C21000-memory.dmp

Filesize
4KB

Download
memory/7608-2925-0x0000029C91C20000-0x0000029C91C21000-memory.dmp

Filesize
4KB

Download
memory/7608-2926-0x0000029C91C20000-0x0000029C91C21000-memory.dmp

Filesize
4KB

Download
memory/7608-2924-0x0000029C91C20000-0x0000029C91C21000-memory.dmp

Filesize
4KB

Download
memory/7608-2928-0x0000029C91C20000-0x0000029C91C21000-memory.dmp

Filesize
4KB

Download
memory/7608-2929-0x0000029C91C20000-0x0000029C91C21000-memory.dmp

Filesize
4KB

Download
memory/7608-2923-0x0000029C91C20000-0x0000029C91C21000-memory.dmp

Filesize
4KB

Download
memory/7608-2917-0x0000029C91C20000-0x0000029C91C21000-memory.dmp

Filesize
4KB

Download
memory/7608-2918-0x0000029C91C20000-0x0000029C91C21000-memory.dmp

Filesize
4KB

Download
memory/7608-2919-0x0000029C91C20000-0x0000029C91C21000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads