Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
555s -
max time network
556s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
29/08/2024, 10:42
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://getsolara.dev
Resource
win10-20240404-en
General
-
Target
https://getsolara.dev
Malware Config
Signatures
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Executes dropped EXE 6 IoCs
pid Process 488 Bootstrapper.exe 5300 Bootstrapper.exe 5560 Bootstrapper.exe 5144 Bootstrapper(1).exe 4488 Bootstrapper.exe 5540 Bootstrapper.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 12 IoCs
flow ioc 104 discord.com 106 discord.com 108 discord.com 111 discord.com 198 discord.com 199 discord.com 202 discord.com 107 discord.com 136 discord.com 168 discord.com 174 discord.com 201 discord.com -
Looks up external IP address via web service 7 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 258 api.ipify.org 259 api.ipify.org 260 api.ipify.org 263 api.ipify.org 550 api.ipify.org 558 api.ipify.org 608 api.ipify.org -
Drops file in Windows directory 5 IoCs
description ioc Process File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe File created C:\Windows\rescache\_merged\3720402701\1568373884.pri MicrosoftEdge.exe File created C:\Windows\rescache\_merged\3720402701\1568373884.pri MicrosoftEdgeCP.exe File created C:\Windows\rescache\_merged\3720402701\1568373884.pri MicrosoftEdgeCP.exe File created C:\Windows\rescache\_merged\3720402701\1568373884.pri MicrosoftEdgeCP.exe -
Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 2 IoCs
When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.
description ioc Process File created C:\Users\Admin\Downloads\Bootstrapper.exe:Zone.Identifier firefox.exe File created C:\Users\Admin\Downloads\Bootstrapper(1).exe:Zone.Identifier firefox.exe -
Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe Key created \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdgeCP.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = cb39e83c00fada01 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Revision = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingDelete\C:\Users\Admin\AppData\Local\Pack = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy\ClearBrowsingHistoryOnStart = "0" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI\IsSignedIn = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DXFeatureLevel = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DXFeatureLevel = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\EnablementState = "1" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Extensible Cache MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath\dummySetting = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer\Main\OperationalData = "1" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History\CacheLimit = "1" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\PrivacyAdvanced = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\OneTimeCleanup = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\ACGPolicyState = "6" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus\CIPolicyState = "0" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\JumpListInPrivateBrowsingAllowed = "1" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\LowMic MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IETld\LowMic MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DeviceId = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{AEBA21FA-782A-4A90-978D-B7216 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\DynamicCodePolicy = 00000000 MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\TreeView = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy\InProgressFlags = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\LastClosedWidth = "1280" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingDelete MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000 MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 51f6b74200fada01 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\JumpListFirstRun = "3" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\ACGPolicyState = "8" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 010000006e7f23007858dfeb40b97399bbd20e1d96d224110cef5c0c9d45b657eb3d5534f66067c1e3d393542ee755c221248d6acecfd80fa22bcb6dd725 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-Revision = "0" MicrosoftEdge.exe -
NTFS ADS 2 IoCs
description ioc Process File created C:\Users\Admin\Downloads\Bootstrapper.exe:Zone.Identifier firefox.exe File created C:\Users\Admin\Downloads\Bootstrapper(1).exe:Zone.Identifier firefox.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 4836 MicrosoftEdgeCP.exe 4836 MicrosoftEdgeCP.exe 4836 MicrosoftEdgeCP.exe 4836 MicrosoftEdgeCP.exe 4836 MicrosoftEdgeCP.exe 4836 MicrosoftEdgeCP.exe -
Suspicious use of AdjustPrivilegeToken 23 IoCs
description pid Process Token: SeDebugPrivilege 2988 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 2988 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 2988 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 2988 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 4852 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 4852 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 3200 MicrosoftEdge.exe Token: SeDebugPrivilege 3200 MicrosoftEdge.exe Token: SeDebugPrivilege 4384 firefox.exe Token: SeDebugPrivilege 4384 firefox.exe Token: 33 3556 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 3556 AUDIODG.EXE Token: SeDebugPrivilege 4384 firefox.exe Token: SeDebugPrivilege 4384 firefox.exe Token: SeDebugPrivilege 4384 firefox.exe Token: SeDebugPrivilege 488 Bootstrapper.exe Token: SeDebugPrivilege 5300 Bootstrapper.exe Token: SeDebugPrivilege 5560 Bootstrapper.exe Token: SeDebugPrivilege 4384 firefox.exe Token: SeDebugPrivilege 4488 Bootstrapper.exe Token: SeDebugPrivilege 4384 firefox.exe Token: SeDebugPrivilege 5540 Bootstrapper.exe Token: SeDebugPrivilege 4384 firefox.exe -
Suspicious use of FindShellTrayWindow 6 IoCs
pid Process 4384 firefox.exe 4384 firefox.exe 4384 firefox.exe 4384 firefox.exe 4384 firefox.exe 4384 firefox.exe -
Suspicious use of SendNotifyMessage 5 IoCs
pid Process 4384 firefox.exe 4384 firefox.exe 4384 firefox.exe 4384 firefox.exe 4384 firefox.exe -
Suspicious use of SetWindowsHookEx 41 IoCs
pid Process 3200 MicrosoftEdge.exe 4836 MicrosoftEdgeCP.exe 2988 MicrosoftEdgeCP.exe 4836 MicrosoftEdgeCP.exe 4384 firefox.exe 4384 firefox.exe 4384 firefox.exe 4384 firefox.exe 4384 firefox.exe 4384 firefox.exe 4384 firefox.exe 4384 firefox.exe 4384 firefox.exe 4384 firefox.exe 4384 firefox.exe 4384 firefox.exe 4384 firefox.exe 4384 firefox.exe 4384 firefox.exe 4384 firefox.exe 4384 firefox.exe 4384 firefox.exe 4384 firefox.exe 4384 firefox.exe 4384 firefox.exe 4384 firefox.exe 4384 firefox.exe 4384 firefox.exe 4384 firefox.exe 4384 firefox.exe 4384 firefox.exe 4384 firefox.exe 4384 firefox.exe 4384 firefox.exe 4384 firefox.exe 4384 firefox.exe 4384 firefox.exe 4384 firefox.exe 4384 firefox.exe 4384 firefox.exe 4384 firefox.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4836 wrote to memory of 1884 4836 MicrosoftEdgeCP.exe 77 PID 4836 wrote to memory of 1884 4836 MicrosoftEdgeCP.exe 77 PID 4836 wrote to memory of 1884 4836 MicrosoftEdgeCP.exe 77 PID 4836 wrote to memory of 1884 4836 MicrosoftEdgeCP.exe 77 PID 4836 wrote to memory of 1884 4836 MicrosoftEdgeCP.exe 77 PID 4836 wrote to memory of 1884 4836 MicrosoftEdgeCP.exe 77 PID 4836 wrote to memory of 1884 4836 MicrosoftEdgeCP.exe 77 PID 4836 wrote to memory of 1884 4836 MicrosoftEdgeCP.exe 77 PID 4836 wrote to memory of 1884 4836 MicrosoftEdgeCP.exe 77 PID 4836 wrote to memory of 1884 4836 MicrosoftEdgeCP.exe 77 PID 4836 wrote to memory of 4024 4836 MicrosoftEdgeCP.exe 79 PID 4836 wrote to memory of 4024 4836 MicrosoftEdgeCP.exe 79 PID 4836 wrote to memory of 4024 4836 MicrosoftEdgeCP.exe 79 PID 4836 wrote to memory of 4024 4836 MicrosoftEdgeCP.exe 79 PID 4836 wrote to memory of 4024 4836 MicrosoftEdgeCP.exe 79 PID 4836 wrote to memory of 4024 4836 MicrosoftEdgeCP.exe 79 PID 928 wrote to memory of 4384 928 firefox.exe 82 PID 928 wrote to memory of 4384 928 firefox.exe 82 PID 928 wrote to memory of 4384 928 firefox.exe 82 PID 928 wrote to memory of 4384 928 firefox.exe 82 PID 928 wrote to memory of 4384 928 firefox.exe 82 PID 928 wrote to memory of 4384 928 firefox.exe 82 PID 928 wrote to memory of 4384 928 firefox.exe 82 PID 928 wrote to memory of 4384 928 firefox.exe 82 PID 928 wrote to memory of 4384 928 firefox.exe 82 PID 928 wrote to memory of 4384 928 firefox.exe 82 PID 928 wrote to memory of 4384 928 firefox.exe 82 PID 4384 wrote to memory of 980 4384 firefox.exe 83 PID 4384 wrote to memory of 980 4384 firefox.exe 83 PID 4384 wrote to memory of 3684 4384 firefox.exe 84 PID 4384 wrote to memory of 3684 4384 firefox.exe 84 PID 4384 wrote to memory of 3684 4384 firefox.exe 84 PID 4384 wrote to memory of 3684 4384 firefox.exe 84 PID 4384 wrote to memory of 3684 4384 firefox.exe 84 PID 4384 wrote to memory of 3684 4384 firefox.exe 84 PID 4384 wrote to memory of 3684 4384 firefox.exe 84 PID 4384 wrote to memory of 3684 4384 firefox.exe 84 PID 4384 wrote to memory of 3684 4384 firefox.exe 84 PID 4384 wrote to memory of 3684 4384 firefox.exe 84 PID 4384 wrote to memory of 3684 4384 firefox.exe 84 PID 4384 wrote to memory of 3684 4384 firefox.exe 84 PID 4384 wrote to memory of 3684 4384 firefox.exe 84 PID 4384 wrote to memory of 3684 4384 firefox.exe 84 PID 4384 wrote to memory of 3684 4384 firefox.exe 84 PID 4384 wrote to memory of 3684 4384 firefox.exe 84 PID 4384 wrote to memory of 3684 4384 firefox.exe 84 PID 4384 wrote to memory of 3684 4384 firefox.exe 84 PID 4384 wrote to memory of 3684 4384 firefox.exe 84 PID 4384 wrote to memory of 3684 4384 firefox.exe 84 PID 4384 wrote to memory of 3684 4384 firefox.exe 84 PID 4384 wrote to memory of 3684 4384 firefox.exe 84 PID 4384 wrote to memory of 3684 4384 firefox.exe 84 PID 4384 wrote to memory of 3684 4384 firefox.exe 84 PID 4384 wrote to memory of 3684 4384 firefox.exe 84 PID 4384 wrote to memory of 3684 4384 firefox.exe 84 PID 4384 wrote to memory of 3684 4384 firefox.exe 84 PID 4384 wrote to memory of 3684 4384 firefox.exe 84 PID 4384 wrote to memory of 3684 4384 firefox.exe 84 PID 4384 wrote to memory of 3684 4384 firefox.exe 84 PID 4384 wrote to memory of 3684 4384 firefox.exe 84 PID 4384 wrote to memory of 3684 4384 firefox.exe 84 PID 4384 wrote to memory of 3684 4384 firefox.exe 84 PID 4384 wrote to memory of 3684 4384 firefox.exe 84 PID 4384 wrote to memory of 3684 4384 firefox.exe 84 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\LaunchWinApp.exe"C:\Windows\system32\LaunchWinApp.exe" "https://getsolara.dev"1⤵PID:4892
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3200
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
PID:4488
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4836
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2988
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
PID:1884
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4852
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
PID:4024
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:928 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- Checks processor information in registry
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4384.0.1336333817\1392964935" -parentBuildID 20221007134813 -prefsHandle 1716 -prefMapHandle 1684 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {81037e96-d19d-477d-be93-9d640e1a9d1b} 4384 "\\.\pipe\gecko-crash-server-pipe.4384" 1796 1ffb98d5758 gpu3⤵PID:980
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4384.1.11155307\1539242214" -parentBuildID 20221007134813 -prefsHandle 2140 -prefMapHandle 2136 -prefsLen 20828 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {df7628af-4fdc-4d94-ace8-b6cba7adaee4} 4384 "\\.\pipe\gecko-crash-server-pipe.4384" 2152 1ffb97fc858 socket3⤵PID:3684
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4384.2.2008742494\1196129207" -childID 1 -isForBrowser -prefsHandle 2700 -prefMapHandle 2716 -prefsLen 20931 -prefMapSize 233444 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6160b0c7-12c4-4d79-843c-6819d882a865} 4384 "\\.\pipe\gecko-crash-server-pipe.4384" 2900 1ffbdb9c758 tab3⤵PID:4740
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4384.3.1181430300\1932816497" -childID 2 -isForBrowser -prefsHandle 3472 -prefMapHandle 3468 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f8ff7c97-bfc3-466c-af8f-40bb65046404} 4384 "\\.\pipe\gecko-crash-server-pipe.4384" 3368 1ffbe9f8b58 tab3⤵PID:1752
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4384.4.470473198\1659837566" -childID 3 -isForBrowser -prefsHandle 4348 -prefMapHandle 4344 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d96023e8-9909-401d-8e10-31eed684dd65} 4384 "\\.\pipe\gecko-crash-server-pipe.4384" 4360 1ffbf8a2958 tab3⤵PID:2632
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4384.5.1464585349\1689576104" -childID 4 -isForBrowser -prefsHandle 2492 -prefMapHandle 4992 -prefsLen 26247 -prefMapSize 233444 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {22e284df-2243-497b-8d81-52b1d0142cdc} 4384 "\\.\pipe\gecko-crash-server-pipe.4384" 1620 1ffc0b1b258 tab3⤵PID:2520
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4384.6.1497298785\2003223759" -childID 5 -isForBrowser -prefsHandle 5116 -prefMapHandle 5000 -prefsLen 26247 -prefMapSize 233444 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d83aa48f-227b-4f59-80fc-676098616840} 4384 "\\.\pipe\gecko-crash-server-pipe.4384" 5100 1ffc0bc8a58 tab3⤵PID:4696
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4384.7.758571634\1057478732" -childID 6 -isForBrowser -prefsHandle 1620 -prefMapHandle 5096 -prefsLen 26247 -prefMapSize 233444 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {585cec9d-cfa1-4384-9b96-1ca39ff2300d} 4384 "\\.\pipe\gecko-crash-server-pipe.4384" 5156 1ffc0bc9f58 tab3⤵PID:4400
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4384.8.1710142691\1483488022" -childID 7 -isForBrowser -prefsHandle 1552 -prefMapHandle 5496 -prefsLen 29737 -prefMapSize 233444 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5d1c0fd8-0a66-41de-a187-72a2b586756e} 4384 "\\.\pipe\gecko-crash-server-pipe.4384" 5832 1ffc15af858 tab3⤵PID:956
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4384.9.637729378\1091701333" -childID 8 -isForBrowser -prefsHandle 5984 -prefMapHandle 3168 -prefsLen 29737 -prefMapSize 233444 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1b3ba41d-84c9-4045-a2fb-459d69ee6402} 4384 "\\.\pipe\gecko-crash-server-pipe.4384" 5408 1ffc304d558 tab3⤵PID:2176
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4384.10.901391606\2036783631" -childID 9 -isForBrowser -prefsHandle 5248 -prefMapHandle 5244 -prefsLen 29737 -prefMapSize 233444 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {77e4ea62-e574-4900-88a8-90ba8da6f1c8} 4384 "\\.\pipe\gecko-crash-server-pipe.4384" 5236 1ffbe360658 tab3⤵PID:1116
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4384.11.120780642\1198648744" -parentBuildID 20221007134813 -prefsHandle 5728 -prefMapHandle 5724 -prefsLen 29737 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7c155874-acad-44a9-8d78-0db5ef33cc0e} 4384 "\\.\pipe\gecko-crash-server-pipe.4384" 5720 1ffa752f358 rdd3⤵PID:4220
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4384.12.1338696912\743957435" -childID 10 -isForBrowser -prefsHandle 5528 -prefMapHandle 5728 -prefsLen 29737 -prefMapSize 233444 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4ebdb758-57b7-4cd8-b970-e9ff0b0c4266} 4384 "\\.\pipe\gecko-crash-server-pipe.4384" 4972 1ffa7566558 tab3⤵PID:584
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4384.13.250672082\126115521" -parentBuildID 20221007134813 -sandboxingKind 1 -prefsHandle 4612 -prefMapHandle 5496 -prefsLen 29737 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2c5ce764-496a-4e1d-8205-5831dcc206c7} 4384 "\\.\pipe\gecko-crash-server-pipe.4384" 6288 1ffa756b258 utility3⤵PID:4832
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4384.14.2065207172\1201910533" -childID 11 -isForBrowser -prefsHandle 6472 -prefMapHandle 4680 -prefsLen 29746 -prefMapSize 233444 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1a4e12c6-c217-47fd-ae27-f55c3c89fbe8} 4384 "\\.\pipe\gecko-crash-server-pipe.4384" 4848 1ffbdb9e258 tab3⤵PID:3076
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4384.15.1685248180\936284641" -childID 12 -isForBrowser -prefsHandle 6020 -prefMapHandle 6040 -prefsLen 29746 -prefMapSize 233444 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {da748052-d49b-4b41-b12d-fb1aedc207ac} 4384 "\\.\pipe\gecko-crash-server-pipe.4384" 6036 1ffc109d558 tab3⤵PID:2720
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4384.16.413735727\782828672" -childID 13 -isForBrowser -prefsHandle 10604 -prefMapHandle 10608 -prefsLen 29746 -prefMapSize 233444 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e69f35cf-591d-442f-ab0a-786107769f09} 4384 "\\.\pipe\gecko-crash-server-pipe.4384" 10388 1ffc3d73558 tab3⤵PID:1164
-
-
C:\Users\Admin\Downloads\Bootstrapper.exe"C:\Users\Admin\Downloads\Bootstrapper.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:488
-
-
C:\Users\Admin\Downloads\Bootstrapper.exe"C:\Users\Admin\Downloads\Bootstrapper.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5300
-
-
C:\Users\Admin\Downloads\Bootstrapper(1).exe"C:\Users\Admin\Downloads\Bootstrapper(1).exe"3⤵
- Executes dropped EXE
PID:5144
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4384.17.1725400760\2096950919" -childID 14 -isForBrowser -prefsHandle 6764 -prefMapHandle 6760 -prefsLen 29851 -prefMapSize 233444 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {429a758e-d7d2-40ab-a864-c0a2ea6514b0} 4384 "\\.\pipe\gecko-crash-server-pipe.4384" 4848 1ffbe365f58 tab3⤵PID:5364
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4384.18.1214238047\102797640" -childID 15 -isForBrowser -prefsHandle 9896 -prefMapHandle 9852 -prefsLen 29851 -prefMapSize 233444 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c5d92c14-92a1-45a0-8486-0915ef5f6605} 4384 "\\.\pipe\gecko-crash-server-pipe.4384" 9928 1ffbe366b58 tab3⤵PID:5372
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4384.19.2001108898\592365421" -childID 16 -isForBrowser -prefsHandle 9860 -prefMapHandle 9856 -prefsLen 29851 -prefMapSize 233444 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8cbf5453-a154-4a39-b5ee-544f3c188f24} 4384 "\\.\pipe\gecko-crash-server-pipe.4384" 6760 1ffa755b858 tab3⤵PID:5824
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4384.20.1850421448\47705026" -childID 17 -isForBrowser -prefsHandle 3140 -prefMapHandle 1088 -prefsLen 29851 -prefMapSize 233444 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {849c446d-cfc9-4f4f-beb4-66baea43a93d} 4384 "\\.\pipe\gecko-crash-server-pipe.4384" 5208 1ffa756ee58 tab3⤵PID:6016
-
-
C:\Users\Admin\Downloads\Bootstrapper.exe"C:\Users\Admin\Downloads\Bootstrapper.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4488
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4384.21.560319341\662688108" -childID 18 -isForBrowser -prefsHandle 10496 -prefMapHandle 10484 -prefsLen 29851 -prefMapSize 233444 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {da15eaee-b9ba-4583-9de0-6f98db1f13e9} 4384 "\\.\pipe\gecko-crash-server-pipe.4384" 6804 1ffa7566558 tab3⤵PID:5840
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4384.22.333638073\501112444" -childID 19 -isForBrowser -prefsHandle 4308 -prefMapHandle 4304 -prefsLen 29860 -prefMapSize 233444 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {afe13546-09fc-4cd9-a1ea-204728a828d0} 4384 "\\.\pipe\gecko-crash-server-pipe.4384" 4316 1ffa755e558 tab3⤵PID:3720
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4384.23.1873024836\890373981" -childID 20 -isForBrowser -prefsHandle 9488 -prefMapHandle 6740 -prefsLen 29869 -prefMapSize 233444 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {21ed967e-3265-4d8d-81af-a3a6807adbee} 4384 "\\.\pipe\gecko-crash-server-pipe.4384" 9476 1ffa752f058 tab3⤵PID:5600
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4384.24.383129847\1139572958" -childID 21 -isForBrowser -prefsHandle 9932 -prefMapHandle 9608 -prefsLen 29869 -prefMapSize 233444 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9abdd9bb-46a0-4b8b-8541-92cda8f500fd} 4384 "\\.\pipe\gecko-crash-server-pipe.4384" 9776 1ffc80b2258 tab3⤵PID:4348
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x2b81⤵
- Suspicious use of AdjustPrivilegeToken
PID:3556
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:5496
-
C:\Users\Admin\Downloads\Bootstrapper.exe"C:\Users\Admin\Downloads\Bootstrapper.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5560
-
C:\Users\Admin\Downloads\Bootstrapper.exe"C:\Users\Admin\Downloads\Bootstrapper.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5540
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6KB
MD52ee8c11996e0d450ba9d1d1338ba4daa
SHA10dd6b43e0cc1bc04578dd4a8116c193cc48e244c
SHA256a397c5c3e2c19b1375ef3f4b0cd007ef68a55adc36663cdc53f005fb8361ddc4
SHA5126e17d6fcd11e7ea780beaf98f2c684bc9d14e6a2c9ec7bebe7f6c6895ae60cf3b9cf2759906fd8b81090cffbca450d8befefdc6f90518d5d4a038070c56d70c2
-
Filesize
8KB
MD52066d91fa97290493561a6f9580fc960
SHA1fab9cb3b5c72cf94ff1ed3a80d3b5fad4b933a96
SHA256dad3cc42fbac4051762b71b12027f928365e168c71309ae511f6f8ba3ef67196
SHA512e971550559270895732c355fed65f5d431cccc380d0d38bd73264e61f36479b2ba35c082a2bbd14c016cb8de786cd45a6ee32233bdcc7e429a5ca1313d553c59
-
Filesize
5KB
MD522576bc219e270dbc69e5ca6ce14ddb2
SHA1180a7f443252614d37979671e57aab7fcc14da22
SHA256fbb5f8892a41bae8e036c37d9bd01c4ca48e7a55371d5468a50f51ffcad47a1d
SHA512d5e48e278c83d51f94687892599cd0ca2f3b3babd2267542652a3149fc9ba776b7c18ac013589a1e77a27d033e27efd3ead731a658d41d57fd2ad8f78f8852a6
-
Filesize
45KB
MD50f2de7bdcdea390e4b91aacc7beabc8d
SHA1639f441d1eab2a7a7ccc79a0c1c57ec6c249ff08
SHA2562df4d89c5579ef0f287532dab583b49d30f9ae29faf8388374daf58b06244fe0
SHA512dc67ca6d1ec64bc76398731c3857cb4d68ca33d377ffadc071f9e59e2cd5406fc5b128e0901ff2169076f2b0658229085e2299c9717592c37b3ee168fc9cea0f
-
Filesize
6KB
MD520d88599fdc0423315477006910bf0b3
SHA150b20b353268cad61b9564b13a0c1ee880cb3064
SHA25641990100b1ef0d2fb71580eac9263988bb103534b9e5e829eb953ffd53c42d9f
SHA512b7f16489fcb78224d28c58fe4a9ef3744068a544477558b317c40e5ec1ea6b2a18374dc18e66507f04787d623a91fe494d121465dccb2af5066ed4191a3c9b43
-
Filesize
38KB
MD5868af02f4643ba7cda9d5ecec5394401
SHA197277fa7c90969634c8b431b56ad39db565dadab
SHA2560c8d7c756f539eae430150bdbf357a9cfc87b67a1767f14d995e4cdd2705980f
SHA512c19f58dfbb71bf9c4d6255050bf247972419b78350a435b473dd223f507e73b71ea0fcccf179c0bf132bab84223ad6f025f331824205aa524a36ec4f3730b4d8
-
Filesize
6KB
MD5739bd5e6c83c52559a76012bc07bda0c
SHA1c9999cc2b120566cc87dba9677d1f00f3d09c57b
SHA25641422f814e75d652e86bb2cefc6767432a15e9ccb395d1ce7fc56e8a38932873
SHA512ed2467733fdecc85c992b3110607b677e71b2621c322f661b6e81097e54824dc34d852ae91b16807533183df0616252de985781ff72d46401ff4e851e9b38e19
-
Filesize
8KB
MD51454bfc4197f8fb52f46db686299531a
SHA13af51baecdcd8a4b26684fc45e869c6783981afd
SHA2560d5f67eb3ea9c2fe67f8ca688549743cbcad5c0618e95723ff56685710ff8db7
SHA512cfdf55b2d1281776a17e21531b09012129ea13c1118d30ac37e220d756179b35cfbf4ed3d546212f5ac8a5df4a9c2b93afdb2eed2e6ec6ffefe641cfee4c631d
-
Filesize
8KB
MD58b5067d60f578e684de840ac02a8130e
SHA1fcef4f81389c9b21ee523afebda5bb946dea4db5
SHA2566d9700b6d07398caba6991cdc5e6f2d93991c26bcbd3d725dec44f490b58438e
SHA5128528f41a2529e321f83033c9db208b53d576ba6a2a6e8d8838c9b57c2ea72cccbe174d991f2dc46729fefd5b49d03df8a4c91fdf5bc79fad98f88b3eb454938c
-
Filesize
3KB
MD50029a33e03329ad772fbb2bc44ef1f01
SHA197139299f880cddfe8d34220f52b414c7f2658a6
SHA2561c2d6ea4daf0b46f6d3cc3e57bb7eb3bee78ce00ec2d47bd36c3e89401ef128c
SHA51251f192ceef352f8dbda95f93503984b0a6980909767f4d62a4d5f4123dd5e890f260854897a59d787e24ebae334a1a7da3efe5030874eba7127e1835f262841e
-
Filesize
16KB
MD582298cad0e82945f7eb406a142ce4498
SHA182540ed63a371f0211884e74c5a995549022fbad
SHA25657a5fc8f8c8d2e49476ccf840e2c7a525ea57c968f9987e9db0efdd8157e1bc0
SHA512a5f6d782f08a63e2499fe5a052da97dc1ba4eab9a40def19f287fde8f2f8dafe973f8515c6b179e4077993e4cb0b1859479ab664690230a62c9bdf173e36674b
-
Filesize
10KB
MD57e0827ed573c45263288cec5eaa90245
SHA1b6bfb6f6af6c4c912c7946fa598bee2280f8b9ba
SHA25699253cce9c4115ce21bb9291892f211a9e61afcef7157a846ad4d18793a1c236
SHA512b3de1a52a5b1b2e5233038530d06de8c506015e94c1977c23f2161fc667a256166210d296aed1db303825bfab9d96591e2b9ebe898b7c47794ca8d5164a79b24
-
Filesize
21KB
MD57a3bd3b3439e49226b4149312f756277
SHA17f96249a653688dbfbafeeeff5a210b909424e6f
SHA256003c5b41eef78aaeec3957fbbd11f799207456d6a147a0e1ab7761c44720f491
SHA5122a2724342c05dc60d9a1b6b04d8c38066c7b8ce0806721652c8997ebe70a8d1d225700794330d24589cac5546ed2f2bdbf6b1e88b2b7338ab45d5a95e047ff47
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\entries\1539701B485C27AF2A85937A14D67030A838B5E6
Filesize38KB
MD52f10af6b801d359d483ba250bdb1fb07
SHA131f224aba00f4975cdd87ff578ac13383c2d8e02
SHA2567f98b2d966b825261cbe7d317c32e019e1b36c0623e30ab8bdf8ef250903227b
SHA512aaba8bd1b34499e7ef988e7135265c92689e2a76cce248fcaba801340a82458f3218226a0f230b59320a1963a2469b50136a188114bdac27390bd8cb62248b2a
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\entries\193EA591AC58D22CE19BB3D1D506CB0860AA7DDF
Filesize121KB
MD50ef8afa4454d8be00b265a958a674625
SHA11f84a70d16b5e9d78759309eca04dfad3470af9c
SHA2568cbd4fd96e4b8a6d1b694cdde18c31aa2d3ea020dc9cefa512d3814b04326d76
SHA512878afbf8035624c29e620c231a96b1c71f56bc97e4ba16f8e48fc90adee98a9c250e7ceccb8157e82717c8f0aca9d6ebea4cc466f7fd1062b37f0e79ef01ebb8
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\entries\1E674701354CAC1C866AD30A8FFFE5A3CE9D2AF5
Filesize13KB
MD5392fb013f9a6dea8916183d47d3a345e
SHA17774ac9abf3c8679590a8653836f264d5c30b288
SHA256a26ff45424c29820488fc184a7c001313d9b668004bd1138e9bf345aed9b11a2
SHA5128c35196155024a7e99bb3aaf2fefc04fb9d2e4d01764493bbdcfccac155fbbe8669effae0662b5f00e78e9753c1fb5557d1e1c63a425be05158b4177794d4fd1
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\entries\58EFA56DB4BFFECB0EDA547894BC9A057159E22F
Filesize13KB
MD53bbd1bdb3447aeb640a181ed6a782c0d
SHA185a88400a23a184d18cf23cbca5b08e7099428ec
SHA25654de3778937d2a6721264ab57eb0c0ef637db177f2259a9096a8be53cd7b9aef
SHA51294bcd4964ef632496407a58abcf96ca0c974da722a62c9722ab31959aca1f8ad014d81667517ccbbbf7599c0ce4bdc83651085dd9bc6caa6f533df02d8a6d815
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\entries\7387FDECD8F48C7449676ABC09A40C5E55745357
Filesize572KB
MD5a7c98c539db98da78e5edd924396baa9
SHA1dde14e9315b5199791df42002c38a57d99867bf2
SHA2569bd3f761057abe86f4921ad9c963482b8d729c7a62aafa988108f991d5b4231f
SHA5127a131c0d330711adb270948a3c15b88d2278ed466ccc71e8975ccb9aa709edd55b4498c6fdc59546a47dd86975d6069084789297598a947e33019f77393e7538
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\entries\C0FB504EB8D5022AF1CCEBDDE5137444D06410FD
Filesize16KB
MD5acec4019087b1d70c2a63668039e8bf6
SHA1675d1d65bbe02c2f6171dc914429fe68b5172a51
SHA25637a13f075b2150ff6dd7576732096a8b7135b38f2e8177aa6bba1654ca1db808
SHA512316f8ab819d57d7c7f35763511a7a736e30a9b8533810030d3ce00a1467cd08ab906f26aeea9bce8eb8c05c50d1d5c959684c0eaa93f3b4d1491f61e09df388f
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\entries\CF564B5A92E1F9BA356B6343CB1C47E940442692
Filesize38KB
MD5ec799da845442c582e02e96666f69470
SHA11dbad108a775ceecd6ada86e3f99b53716c985eb
SHA256d7f02b8fb1ac4e781e155657c11eba85531408d3046207fc135cb64fc0ff30e9
SHA5125aec87e90eda4c83770a66701fee2b852f9693ea02912e0f0001eae1500bccb572b65d159a9d32cbaa9d572da32bcf3a1c6ea35ce9f4d187a568273a461fae92
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\thumbnails\895212477adc792c77f61b22fcd086de.png
Filesize5KB
MD5b3864a01f322a47d4ceb682515778ad9
SHA16f2df44e919d186077c6c077ca763deae5f663cc
SHA25665b539f5c764d15fdf332610d59cc64eede4ddc247ef8894bda82229874e7eca
SHA512047332228e93c39ffa3cb0ee8fb798cba87a26b0e3d7be4e65fa0848f20cd437ba139883bf82c6a617693d94a2fc904e86853d65fe5864e59c61d6e68e4a51b4
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\5OQVNHED\favicon[1].htm
Filesize58KB
MD5f79d7b2e81acbcdb5253090393d198e3
SHA1633145cf2a36e70a9e663588ff968b57d8a73cc0
SHA25690056965adfe9c63aa2252d2987c02cb80bb5eb4e73606574d90dbb4e7fa5584
SHA5121519218bde26b5fe547901c0ffc4a74bb7d08e0862de0ff82f6436c6d9bff143477787cacccdad0b85dfa1ae92855212672304ce89640387be6de0d2edee64de
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\Temp\~DF54BAC978B92C3366.TMP
Filesize16KB
MD52bc83eac5234beedfc28aed8a5e47ebd
SHA1c5531b8d10f07fbe06b9f747abba9470e47b1717
SHA2567414fb869fd870709eb1030edc90c90ae8f18e3da4abd52904af7cf6f9ed1a0c
SHA5125ee0a9813457a5ab9e81c77c1488467afc0b9542f7871d63c79262a35b9e902d93cd67fb29439c5c8cf9947c502e9ba43bc897b027a2a2e50e54df7c29244213
-
Filesize
442KB
MD585430baed3398695717b0263807cf97c
SHA1fffbee923cea216f50fce5d54219a188a5100f41
SHA256a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
SHA51206511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1
-
Filesize
8.0MB
MD5a01c5ecd6108350ae23d2cddf0e77c17
SHA1c6ac28a2cd979f1f9a75d56271821d5ff665e2b6
SHA256345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42
SHA512b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
Filesize16KB
MD5890efd86af403bf0a1e40487f7817733
SHA13c787f6802755106eda64f5797c70c4687ce9287
SHA256630542308a0cdf3ae09a40ff8d529348be72d3933c957fa1556fc65df3150b2c
SHA512e8be51e8f1a7acf5d2e917bf23b55efae0fbb2c6fa54270c7ca9a182b903c9335ddd61922585aaa35a7f024a21a201f8e840816e70a3cfa9add9befa15d5f8f3
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\datareporting\glean\db\data.safe.bin
Filesize2KB
MD5fb18d68f00e3b0d1914e723976adb78b
SHA11835c9a48e4a52460c06b11162cf68fef7ad9c6c
SHA2569239151102e554fd64c24d85d35b87b7a8c21b650a9778c1f9f8fe6c3bdcdd46
SHA51234a9711d8ff13c5dd175c049fe816bca6871fe6b71e6f2c28c394cb111f7f7314a73d9e3c61ab37bff69bd15656b004305ebe47eec7980acddfe139faa66ac95
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\datareporting\glean\pending_pings\2f7fae16-4881-4d76-8992-94a146d3f040
Filesize856B
MD5bc62dc66bf4fe5404f5d4a679ae80ca2
SHA152f5a5d4e11fd3e820a500252f887471c17ee3eb
SHA256fc116f1748fae1ce3a936de30d9bec13babd5f85369b3d76666bb7e45b850da4
SHA51208f1aec48fea9172c11075c468af8eb2f8c2cdf99fbb519828200da7af3084212c5ecc55839da8e69b51f9a42ec3a2b276f388a526ded27c2424e0be1928d405
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\datareporting\glean\pending_pings\edc0b267-f653-4b40-8746-79d088ab905d
Filesize1KB
MD51dfecb966b41acb558bac715efe624f4
SHA18b7f3829306aecef968e7709dd2cc40075a96515
SHA25668e4a43ba6f3bf360f483a7d0e5d4b1bb6078b6d65af36e84194cc1633ab3d41
SHA512d58832d6b4bfa82007281bdf053b9a77bc2035b0d269ecf611ac633ac2de55e67ad57b05453ce6d6d67c4b233786ae25df26ea7ae48e9342c6f48683f7844e91
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\datareporting\glean\pending_pings\f20692b2-b1ed-4fe9-a888-113c110be10a
Filesize746B
MD57f4248562e8baaab4868fc6923b2a560
SHA1f0883226ddc0e0a103c62de53c320557d4a8025a
SHA25664e056ba28fa034807e4811c03323fafbe37864049a162aed860fb67b452ba17
SHA5125f9bccfb8db9a692ac59a254a4eb73a902a9618e94a4b21dc36380e15532667b2ea4fbc0d9305b6a04674296b3125760d2bfc66c4a84b2d89d4d49686579eacb
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\datareporting\glean\pending_pings\ff04857b-d325-4c28-b105-c8e43fcff767
Filesize11KB
MD59bc472921035a8d6059e8afe7510a0ec
SHA162a93b75111933f96c609c843b68dacad1b9ee4c
SHA25636eaaeda9529f38de327680f0b417afdc6c319f18da744695d81cc7d10d0350f
SHA5122f2dac42835f7730875fe8bbf47062ed3c65deccf079d899616f1d33fa7ed80644a996e4c575ae9a734cdcd38550895d1ee32d5cede4343acd53befd708babbd
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
Filesize997KB
MD5fe3355639648c417e8307c6d051e3e37
SHA1f54602d4b4778da21bc97c7238fc66aa68c8ee34
SHA2561ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
SHA5128f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
Filesize116B
MD53d33cdc0b3d281e67dd52e14435dd04f
SHA14db88689282fd4f9e9e6ab95fcbb23df6e6485db
SHA256f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
SHA512a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
Filesize479B
MD549ddb419d96dceb9069018535fb2e2fc
SHA162aa6fea895a8b68d468a015f6e6ab400d7a7ca6
SHA2562af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
SHA51248386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
Filesize372B
MD58be33af717bb1b67fbd61c3f4b807e9e
SHA17cf17656d174d951957ff36810e874a134dd49e0
SHA256e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
SHA5126125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
Filesize11.8MB
MD533bf7b0439480effb9fb212efce87b13
SHA1cee50f2745edc6dc291887b6075ca64d716f495a
SHA2568ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e
SHA512d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
Filesize1KB
MD5688bed3676d2104e7f17ae1cd2c59404
SHA1952b2cdf783ac72fcb98338723e9afd38d47ad8e
SHA25633899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
SHA5127a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
Filesize1KB
MD5937326fead5fd401f6cca9118bd9ade9
SHA14526a57d4ae14ed29b37632c72aef3c408189d91
SHA25668a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
SHA512b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2
-
Filesize
8KB
MD5b5f138d6dad5cada086ca3a42c53ee76
SHA153d9d63f59a5fd60aad73e80cdccd3773c5d60b0
SHA2560ad1848e39fad0f3ed65333ae14fcd18d87c17547844ae2b5a52cbbb11fe23a0
SHA5129344eab8b250c96966ebebd5ac0d25772499001328845d7cb35c3276280f8fe6cfbc5a506391baa56bb9149be94301b61a0bc2bd85bd6e6df3966d54eda5443c
-
Filesize
6KB
MD5c5ce4b9e83346fedd7cf68d1435394e8
SHA19165cee5d010f32c9d5b46262ffe105c9e0606b1
SHA256c801ca475040ee1de70af8fb0af8b298dc3ca48f5b1c40546d70a436953435dd
SHA512cf2aea2e714fb487d6dc683835bba0096e10de5a717a3bfd9cf7273ea5775311ad7fff2591d7b40bf931527ccb0d34525f7988055308d36d6d606f715c20757a
-
Filesize
6KB
MD51102e22aead0dd720276bc9ebb24f6f5
SHA1bf1374dcacdb679fd37c1174256228de50856c74
SHA2568a92dd0adc78d8756f74fd97de157aeee7a0605a19f0239ae5d2e31985a999e5
SHA5121129d8466f51a562d80f6bb1c96103ab1b5e4c4f98eef3e393bc30305910ae94b3181f00140cf51c5b0c67eaadd1a5b6cfa24e2eab17784c109254e2dfdffdcd
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\sessionstore-backups\recovery.jsonlz4
Filesize1KB
MD530bb05c801a46bf7924b1f9c5c5f30dc
SHA1dad909b990e0cefbc53001f73aa6957aae3e171d
SHA256d89ad262f9e6664f068699aaf11e3fd4c5103d38b539e0f82cb200a37950e224
SHA512c2fc34c4bc28a9ac54604dbde0309ec3d73213cfbd6c077cfba1e29f7483e9197feaad1fab8a31351e2217745b8a92052bd64508e344b8e1156245dec6c6032a
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\sessionstore-backups\recovery.jsonlz4
Filesize1KB
MD52b3ea33f0c67540964c94ab44e3655bb
SHA1739dad6bc6705ca7e845d9032cc2fe5890bc6279
SHA256cd9607849e2df73d8b3da1db1e664144a6d03c70d53fff259f4df20316537f56
SHA5129cecf142f4882fd72e1df0801aaf30c51751cfcb01f44fa32ff4b18d75905030c06d982a76e1afab3d7eb2e8f1bf3ca6032e625c0f452d844b39282f2fa82484
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\sessionstore-backups\recovery.jsonlz4
Filesize24KB
MD53c58eede2d77507fdf72a9651818b1d7
SHA1546540cea322226267ee987a405aa59c522aa9a8
SHA256bca3aedf8758e93d05907b6c3dc146743d1d99aaba0392affe4ed650116f257f
SHA512c71ccf60ef451e92f711aca154536444f333ca577831a3e960f9e4465fb2332ee4124873b14c71283a27b6b42fa5f57451d0befcd390acea5f3eaddf8797b0a2
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\sessionstore-backups\recovery.jsonlz4
Filesize21KB
MD50b14514f511b3de4cdc78239252351df
SHA17129ffb0b6759ee3c3b463d426820e9769cd1229
SHA256ede3e6bc3f288b0e0675195acddd2f6aa6c259cd0da5e57103df13774f5536d9
SHA5123d0f622df324740835173fa35952c22f77c071d8f7a805c8f38ca2c952c51131ccf205d4a86dd6e2459a364474f0e248cac0105971c59d6f0b7fa377a9e71b6f
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\sessionstore-backups\recovery.jsonlz4
Filesize41KB
MD52b1d2e27a0db65fb56a21f8067a73875
SHA18c4d0657da8c660bf055805fa3d9339bcfdc4803
SHA256f4a91d923cae91a24837e737eba8c3ac76aa53234617fecd3c47aac7e2ccdf9b
SHA5120589af9bd943299d78db464231de19581d24c929c38bcbe9a94b181a2f4cde38175dc230fdccf81624d1de2de661297fb261a359edfee32a15c57bf7b1653a96
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\sessionstore-backups\recovery.jsonlz4
Filesize1KB
MD5c3888c7727c111f70651ae6c453fc185
SHA19500a71cd02683ea5ee4ce962528a25740ea8397
SHA2566cc9b83025ab30664affa9c8e968047aee6602e4d50c180d22e98b7ee8ec835c
SHA512f087c056daea3c57e1eccfcab90b9ccd8a55c3583dead503b662b6ca8179ace7ecfd1de439087d96bd70ceac7bac8f8340b0e984f0a4450a46dd31837da6e85e
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\sessionstore-backups\recovery.jsonlz4
Filesize20KB
MD53f3ef03972cd876670131e32adda5410
SHA1a99ada78fb1a73b7d1f62fd457e6157d93ba94fc
SHA256d373fe0849940cb4641e2439b023ccfc45b0ac49549ed68958dda80f47f21b30
SHA51287922b02ef38cbbe40a144f6953310fe87924a267bcc1f8bba1c3335795eb696a114da0616a56a467f745890a34b80ac6759823075a53eb0406c3491f46174cc
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\sessionstore-backups\recovery.jsonlz4
Filesize22KB
MD5648c70fe14f3c4a549c982c8068bfbba
SHA114b54cb8009b2363ae6bfa0436b9f9b705ba6d68
SHA25617939e8b18d1259c0f53bb1bf78f4df1a6a29f38d0073b826e82166c13a99b54
SHA5126b67759dad3f406edfc66e49b6252085c294d6addd9b2fc9ac501f66e787f8fc07c2440c5c3002e4d1b98d12711d38bc0755fa7b90d474c848b6ef6ac0016435
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\sessionstore-backups\recovery.jsonlz4
Filesize24KB
MD5eb22236db83eac1213407758771b3382
SHA151071c8b63b8282358b1a30beadd7022a1b4d629
SHA2568cf9ff4a9d43c89e464926057d79788d727abe0be6985d8471c292b10697f5b8
SHA5128784086f4bc13c7f25c2999b64ff31e9b01c6275a99cff49ecc6b43c056e0c79583093ee491c1ecd466c06cad1d20af4d67edf1517803df1a43db1d708dba913
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\sessionstore-backups\recovery.jsonlz4
Filesize24KB
MD5dd32b10deee2bd4d1cb95138faca5149
SHA17500919f996860abbf92c3f73818783adae78da1
SHA25638b4d8636eb8027c6ce8ceb35eb3062f773e9fb4f2336148848ec793794ead40
SHA5124da45bc8ab5039f2d9e5470b125d684822b84abb9e41d412723a9ac21ff151f50cdb4d48bbd48be46e21a87bd8610a236e717d499c46143b0fe303db80039ee9
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\sessionstore-backups\recovery.jsonlz4
Filesize21KB
MD5e76a2d60c9df3c522126f5e7a19365b3
SHA1f49e3c2008de1633ed0124205624451a42bb06b3
SHA2569c3b53cfc389f1aac337167b3de2f72f81a9297599713b77724ddc0b7bb2cbdc
SHA51218982e062c7ea5e9532e04816cee56eea0ebd148c0f115c67de81709ca77bb3a17b343ec6a0f64b3e4965bc795f3a48819fc06a13430b2c0ced2e6c7c98d1b62
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\sessionstore-backups\recovery.jsonlz4
Filesize42KB
MD5f789e7c57e7f4b7bad59c3f871ffa17f
SHA1ef503e9ee7e5dadf7b5bd69c8dba88d47318c83c
SHA25639fdf90ae5f44f0407634dd2ed4cdacd1926eca83cca1ec5a4a7a790a9c94346
SHA512603c00bafee24e2ef597e0fc77fd1f5a740dd98a61ea66a15b1bb6d4aaf23e068729b06b68369a8aef96efb172375de028d961d9445868b8e7aa33b043ff0b55
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\sessionstore-backups\recovery.jsonlz4
Filesize24KB
MD5dce5f46a0f242446b31668cc95e27ebe
SHA19591a64384c191ef53eeda27c89f15037da87a71
SHA2566a5e478039906e18224bf46bec74f30204675d9d97eff2d5e7a5049dd9080e90
SHA512e0df2fc675577edd0fd0a786c8ecbad9f4397a173a771154057a35113fd79c220d6f911c9e237915d0314ce080440297148761dbc0daf2f50130ca9759d150fa
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\sessionstore-backups\recovery.jsonlz4
Filesize22KB
MD5b1464fc73ea7e571ef2d2a933ad2b351
SHA1c62c85dfd88ce3f431f2a0b8f29690bc4136f21c
SHA256abb94a392287bea78a3d9dbc307284812b966469a4bee3ecc80bd82c498fdcfc
SHA51207ad0d83d070ff10f95f586a0f2b027c3e462578bafc8c542983d04bc4d172251528c615e0cdf9cdcf3af7114c1d66c7543f1f7407dc2c45d9b6747e85501f4a
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\sessionstore-backups\recovery.jsonlz4
Filesize24KB
MD53a89de4db3daa7279408ba60159ebc73
SHA1e4c786f67cb999831b8523c17fc22644ef01cf14
SHA256e24263eaf81dbb6cb416799f538f8aca015e44e0b24013d02ada5fa01f53b7d9
SHA5120a97fd5cd01107cbcdc91f751ecd0cb9fc4d8c894695c03357ff08716cabe38d65543ecceab30cc5afac6e019231910b0c847cfc85726ea0ef10bd4d44722e4a
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\sessionstore-backups\recovery.jsonlz4
Filesize22KB
MD58d9fb731a30c32c989f4075a2446b2e1
SHA1d69245ad1a4075c3fbc230126a947a8f9f5f2c91
SHA256936d6923346c50b4c2ad612afa7d88ad073855aabd2d4253bde7a42fb1252b8d
SHA51250989c3b8fef8daf5691935bff3ac1084b97b113f0a35a2f151ca359defce2151beedf401ae30c6331916e877d5b27f2b0b5c2ece6f070832125b32907160fc0
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\sessionstore-backups\recovery.jsonlz4
Filesize23KB
MD5d617a331b35f9254289f771080f97f9e
SHA1d482bd7fe8a84a324b54f4c84267a8a43b459123
SHA256335bbd3446b4d8f202172d715b9feba1a1bc36749919656846fd00c29e5a22ef
SHA5123d639d0d7d30b25f1b8cd7e7f18fed2a7366ab1dda1731629c48bc378dce2118a28eeeff91a2b627b0b7c6b2af8416ae31a72765038381c802eea355d6c4d00e
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Filesize7.7MB
MD5bc1afeffdab8e8599352bf930a8b560b
SHA101e73e100ce0ef9ede8502f923be382c25a31240
SHA25653e3e7e23e1a5ceeb250768380cfc824c6f6260b0d096918f1d673e671b3bf30
SHA512510d7a0b056212c77be172c9e7828df6103063e2edf905804c4b6da4024877cbde6993c985239f4fad70bcaf81c8c9fa54ea9fda83298f3d46685a6f5c0c5adc
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Filesize184KB
MD5731c0e733fe1e3123d366af7c8e578ae
SHA19756304ea773dd9cd96e5996dc79de2ed6a9ae9c
SHA2568f426b4be5e3440fa14d37480f018b7dc3d1a547b0e91c2fbfc6e31d9054a359
SHA512d29e0f2356a3226f64692b390c122d4d70f09f677d9f5d086f2babaeba6574d670171edb24ff52f928871ec489680f57910e21fac1ca8ec08783a07d21b1f427
-
Filesize
134B
MD541550b72f87f0b52915117fb3b3aeaa6
SHA1c4f88cf998584d197f05179e6e6bf07dbaf5b236
SHA256c2de7ed9cab4e2f24acf25bb5b52517a35018d148fedd79536ed16f93320e8e7
SHA5124522a9f15a473df7270694cde06e36c4922428a3a4961c3b443598c701d8a0030cbfe9b36a667e4894584cd072bf78e66a50a81ec89e5a51d7462be9161813f9
-
Filesize
10KB
MD5fc4b54ee62b6d4a57f7308b24ccb3cf6
SHA121b32418bd0eaf361be67f2b1637839ab9b86e06
SHA256ded5249392621aecbc133207764f6c86cd256341869873aa7a2594359d8e62b9
SHA512d2698bf6cfba181abb5655ec15be3586852bd4e75b379ed85e172398469f38bb797776a6b6026faf579ed124fb2cd97aa608d623cacdeb92846eec2f3f029c3e
-
Filesize
796KB
MD54b94b989b0fe7bec6311153b309dfe81
SHA1bb50a4bb8a66f0105c5b74f32cd114c672010b22
SHA2567c4283f5e620b2506bcb273f947def4435d95e143ae3067a783fd3adc873a659
SHA512fbbe60cf3e5d028d906e7d444b648f7dff8791c333834db8119e0a950532a75fda2e9bd5948f0b210904667923eb7b2c0176140babc497955d227e7d80fb109d
-
Filesize
103B
MD55aa26de003aeebae624a08de919c52b5
SHA1ff1a4dd7673a6b604324e1363738658cc4d565c0
SHA256335052f362ac50a1d52e8268ebc4323f59644ef7988cb29ea485d57745667bd2
SHA51243220140c68668fd309ce343c06e22910dbe6b74818a9a0f07da052cd8d6020524311c6c00201fc3bceb6f18743ba07ae65e2d4900dd79fab7218bef5caf192c