hxxps://getsolara[.]dev

Analysis

max time kernel
555s
max time network
556s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
29/08/2024, 10:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://getsolara.dev

Score

9^/10

credential_access defense_evasion discovery stealer

Malware Config

Signatures

Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Executes dropped EXE 6 IoCs

pid	Process
488	Bootstrapper.exe
5300	Bootstrapper.exe
5560	Bootstrapper.exe
5144	Bootstrapper(1).exe
4488	Bootstrapper.exe
5540	Bootstrapper.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 12 IoCs

Web Service

T1102

flow	ioc
104	discord.com
106	discord.com
108	discord.com
111	discord.com
198	discord.com
199	discord.com
202	discord.com
107	discord.com
136	discord.com
168	discord.com
174	discord.com
201	discord.com

Looks up external IP address via web service 7 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
258	api.ipify.org
259	api.ipify.org
260	api.ipify.org
263	api.ipify.org
550	api.ipify.org
558	api.ipify.org
608	api.ipify.org

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 2 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\Downloads\Bootstrapper.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\Bootstrapper(1).exe:Zone.Identifier	firefox.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = cb39e83c00fada01	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Revision = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingDelete\C:\Users\Admin\AppData\Local\Pack = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy\ClearBrowsingHistoryOnStart = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI\IsSignedIn = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DXFeatureLevel = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DXFeatureLevel = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\EnablementState = "1"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Extensible Cache	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath\dummySetting = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer\Main\OperationalData = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History\CacheLimit = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\PrivacyAdvanced = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\OneTimeCleanup = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\ACGPolicyState = "6"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\JumpListInPrivateBrowsingAllowed = "1"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\LowMic	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IETld\LowMic	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DeviceId = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{AEBA21FA-782A-4A90-978D-B7216 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\DynamicCodePolicy = 00000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\TreeView = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy\InProgressFlags = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\LastClosedWidth = "1280"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingDelete	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 51f6b74200fada01	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\JumpListFirstRun = "3"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 010000006e7f23007858dfeb40b97399bbd20e1d96d224110cef5c0c9d45b657eb3d5534f66067c1e3d393542ee755c221248d6acecfd80fa22bcb6dd725	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-Revision = "0"	MicrosoftEdge.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\Bootstrapper.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\Bootstrapper(1).exe:Zone.Identifier	firefox.exe

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
4836	MicrosoftEdgeCP.exe
4836	MicrosoftEdgeCP.exe
4836	MicrosoftEdgeCP.exe
4836	MicrosoftEdgeCP.exe
4836	MicrosoftEdgeCP.exe
4836	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeDebugPrivilege	2988	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2988	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2988	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2988	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4852	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4852	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3200	MicrosoftEdge.exe
Token: SeDebugPrivilege	3200	MicrosoftEdge.exe
Token: SeDebugPrivilege	4384	firefox.exe
Token: SeDebugPrivilege	4384	firefox.exe
Token: 33	3556	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3556	AUDIODG.EXE
Token: SeDebugPrivilege	4384	firefox.exe
Token: SeDebugPrivilege	4384	firefox.exe
Token: SeDebugPrivilege	4384	firefox.exe
Token: SeDebugPrivilege	488	Bootstrapper.exe
Token: SeDebugPrivilege	5300	Bootstrapper.exe
Token: SeDebugPrivilege	5560	Bootstrapper.exe
Token: SeDebugPrivilege	4384	firefox.exe
Token: SeDebugPrivilege	4488	Bootstrapper.exe
Token: SeDebugPrivilege	4384	firefox.exe
Token: SeDebugPrivilege	5540	Bootstrapper.exe
Token: SeDebugPrivilege	4384	firefox.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
4384	firefox.exe
4384	firefox.exe
4384	firefox.exe
4384	firefox.exe
4384	firefox.exe
4384	firefox.exe

Suspicious use of SendNotifyMessage 5 IoCs

pid	Process
4384	firefox.exe
4384	firefox.exe
4384	firefox.exe
4384	firefox.exe
4384	firefox.exe

Suspicious use of SetWindowsHookEx 41 IoCs

pid	Process
3200	MicrosoftEdge.exe
4836	MicrosoftEdgeCP.exe
2988	MicrosoftEdgeCP.exe
4836	MicrosoftEdgeCP.exe
4384	firefox.exe
4384	firefox.exe
4384	firefox.exe
4384	firefox.exe
4384	firefox.exe
4384	firefox.exe
4384	firefox.exe
4384	firefox.exe
4384	firefox.exe
4384	firefox.exe
4384	firefox.exe
4384	firefox.exe
4384	firefox.exe
4384	firefox.exe
4384	firefox.exe
4384	firefox.exe
4384	firefox.exe
4384	firefox.exe
4384	firefox.exe
4384	firefox.exe
4384	firefox.exe
4384	firefox.exe
4384	firefox.exe
4384	firefox.exe
4384	firefox.exe
4384	firefox.exe
4384	firefox.exe
4384	firefox.exe
4384	firefox.exe
4384	firefox.exe
4384	firefox.exe
4384	firefox.exe
4384	firefox.exe
4384	firefox.exe
4384	firefox.exe
4384	firefox.exe
4384	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4836 wrote to memory of 1884	4836	MicrosoftEdgeCP.exe	77
PID 4836 wrote to memory of 1884	4836	MicrosoftEdgeCP.exe	77
PID 4836 wrote to memory of 1884	4836	MicrosoftEdgeCP.exe	77
PID 4836 wrote to memory of 1884	4836	MicrosoftEdgeCP.exe	77
PID 4836 wrote to memory of 1884	4836	MicrosoftEdgeCP.exe	77
PID 4836 wrote to memory of 1884	4836	MicrosoftEdgeCP.exe	77
PID 4836 wrote to memory of 1884	4836	MicrosoftEdgeCP.exe	77
PID 4836 wrote to memory of 1884	4836	MicrosoftEdgeCP.exe	77
PID 4836 wrote to memory of 1884	4836	MicrosoftEdgeCP.exe	77
PID 4836 wrote to memory of 1884	4836	MicrosoftEdgeCP.exe	77
PID 4836 wrote to memory of 4024	4836	MicrosoftEdgeCP.exe	79
PID 4836 wrote to memory of 4024	4836	MicrosoftEdgeCP.exe	79
PID 4836 wrote to memory of 4024	4836	MicrosoftEdgeCP.exe	79
PID 4836 wrote to memory of 4024	4836	MicrosoftEdgeCP.exe	79
PID 4836 wrote to memory of 4024	4836	MicrosoftEdgeCP.exe	79
PID 4836 wrote to memory of 4024	4836	MicrosoftEdgeCP.exe	79
PID 928 wrote to memory of 4384	928	firefox.exe	82
PID 928 wrote to memory of 4384	928	firefox.exe	82
PID 928 wrote to memory of 4384	928	firefox.exe	82
PID 928 wrote to memory of 4384	928	firefox.exe	82
PID 928 wrote to memory of 4384	928	firefox.exe	82
PID 928 wrote to memory of 4384	928	firefox.exe	82
PID 928 wrote to memory of 4384	928	firefox.exe	82
PID 928 wrote to memory of 4384	928	firefox.exe	82
PID 928 wrote to memory of 4384	928	firefox.exe	82
PID 928 wrote to memory of 4384	928	firefox.exe	82
PID 928 wrote to memory of 4384	928	firefox.exe	82
PID 4384 wrote to memory of 980	4384	firefox.exe	83
PID 4384 wrote to memory of 980	4384	firefox.exe	83
PID 4384 wrote to memory of 3684	4384	firefox.exe	84
PID 4384 wrote to memory of 3684	4384	firefox.exe	84
PID 4384 wrote to memory of 3684	4384	firefox.exe	84
PID 4384 wrote to memory of 3684	4384	firefox.exe	84
PID 4384 wrote to memory of 3684	4384	firefox.exe	84
PID 4384 wrote to memory of 3684	4384	firefox.exe	84
PID 4384 wrote to memory of 3684	4384	firefox.exe	84
PID 4384 wrote to memory of 3684	4384	firefox.exe	84
PID 4384 wrote to memory of 3684	4384	firefox.exe	84
PID 4384 wrote to memory of 3684	4384	firefox.exe	84
PID 4384 wrote to memory of 3684	4384	firefox.exe	84
PID 4384 wrote to memory of 3684	4384	firefox.exe	84
PID 4384 wrote to memory of 3684	4384	firefox.exe	84
PID 4384 wrote to memory of 3684	4384	firefox.exe	84
PID 4384 wrote to memory of 3684	4384	firefox.exe	84
PID 4384 wrote to memory of 3684	4384	firefox.exe	84
PID 4384 wrote to memory of 3684	4384	firefox.exe	84
PID 4384 wrote to memory of 3684	4384	firefox.exe	84
PID 4384 wrote to memory of 3684	4384	firefox.exe	84
PID 4384 wrote to memory of 3684	4384	firefox.exe	84
PID 4384 wrote to memory of 3684	4384	firefox.exe	84
PID 4384 wrote to memory of 3684	4384	firefox.exe	84
PID 4384 wrote to memory of 3684	4384	firefox.exe	84
PID 4384 wrote to memory of 3684	4384	firefox.exe	84
PID 4384 wrote to memory of 3684	4384	firefox.exe	84
PID 4384 wrote to memory of 3684	4384	firefox.exe	84
PID 4384 wrote to memory of 3684	4384	firefox.exe	84
PID 4384 wrote to memory of 3684	4384	firefox.exe	84
PID 4384 wrote to memory of 3684	4384	firefox.exe	84
PID 4384 wrote to memory of 3684	4384	firefox.exe	84
PID 4384 wrote to memory of 3684	4384	firefox.exe	84
PID 4384 wrote to memory of 3684	4384	firefox.exe	84
PID 4384 wrote to memory of 3684	4384	firefox.exe	84
PID 4384 wrote to memory of 3684	4384	firefox.exe	84
PID 4384 wrote to memory of 3684	4384	firefox.exe	84

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\LaunchWinApp.exe
"C:\Windows\system32\LaunchWinApp.exe" "https://getsolara.dev"
1⤵
PID:4892

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3200

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:4488

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4836

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2988

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:1884

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4852

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:4024

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:928
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Checks processor information in registry
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4384
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4384.0.1336333817\1392964935" -parentBuildID 20221007134813 -prefsHandle 1716 -prefMapHandle 1684 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {81037e96-d19d-477d-be93-9d640e1a9d1b} 4384 "\\.\pipe\gecko-crash-server-pipe.4384" 1796 1ffb98d5758 gpu
    3⤵
    PID:980
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4384.1.11155307\1539242214" -parentBuildID 20221007134813 -prefsHandle 2140 -prefMapHandle 2136 -prefsLen 20828 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {df7628af-4fdc-4d94-ace8-b6cba7adaee4} 4384 "\\.\pipe\gecko-crash-server-pipe.4384" 2152 1ffb97fc858 socket
    3⤵
    PID:3684
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4384.2.2008742494\1196129207" -childID 1 -isForBrowser -prefsHandle 2700 -prefMapHandle 2716 -prefsLen 20931 -prefMapSize 233444 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6160b0c7-12c4-4d79-843c-6819d882a865} 4384 "\\.\pipe\gecko-crash-server-pipe.4384" 2900 1ffbdb9c758 tab
    3⤵
    PID:4740
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4384.3.1181430300\1932816497" -childID 2 -isForBrowser -prefsHandle 3472 -prefMapHandle 3468 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f8ff7c97-bfc3-466c-af8f-40bb65046404} 4384 "\\.\pipe\gecko-crash-server-pipe.4384" 3368 1ffbe9f8b58 tab
    3⤵
    PID:1752
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4384.4.470473198\1659837566" -childID 3 -isForBrowser -prefsHandle 4348 -prefMapHandle 4344 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d96023e8-9909-401d-8e10-31eed684dd65} 4384 "\\.\pipe\gecko-crash-server-pipe.4384" 4360 1ffbf8a2958 tab
    3⤵
    PID:2632
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4384.5.1464585349\1689576104" -childID 4 -isForBrowser -prefsHandle 2492 -prefMapHandle 4992 -prefsLen 26247 -prefMapSize 233444 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {22e284df-2243-497b-8d81-52b1d0142cdc} 4384 "\\.\pipe\gecko-crash-server-pipe.4384" 1620 1ffc0b1b258 tab
    3⤵
    PID:2520
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4384.6.1497298785\2003223759" -childID 5 -isForBrowser -prefsHandle 5116 -prefMapHandle 5000 -prefsLen 26247 -prefMapSize 233444 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d83aa48f-227b-4f59-80fc-676098616840} 4384 "\\.\pipe\gecko-crash-server-pipe.4384" 5100 1ffc0bc8a58 tab
    3⤵
    PID:4696
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4384.7.758571634\1057478732" -childID 6 -isForBrowser -prefsHandle 1620 -prefMapHandle 5096 -prefsLen 26247 -prefMapSize 233444 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {585cec9d-cfa1-4384-9b96-1ca39ff2300d} 4384 "\\.\pipe\gecko-crash-server-pipe.4384" 5156 1ffc0bc9f58 tab
    3⤵
    PID:4400
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4384.8.1710142691\1483488022" -childID 7 -isForBrowser -prefsHandle 1552 -prefMapHandle 5496 -prefsLen 29737 -prefMapSize 233444 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5d1c0fd8-0a66-41de-a187-72a2b586756e} 4384 "\\.\pipe\gecko-crash-server-pipe.4384" 5832 1ffc15af858 tab
    3⤵
    PID:956
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4384.9.637729378\1091701333" -childID 8 -isForBrowser -prefsHandle 5984 -prefMapHandle 3168 -prefsLen 29737 -prefMapSize 233444 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1b3ba41d-84c9-4045-a2fb-459d69ee6402} 4384 "\\.\pipe\gecko-crash-server-pipe.4384" 5408 1ffc304d558 tab
    3⤵
    PID:2176
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4384.10.901391606\2036783631" -childID 9 -isForBrowser -prefsHandle 5248 -prefMapHandle 5244 -prefsLen 29737 -prefMapSize 233444 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {77e4ea62-e574-4900-88a8-90ba8da6f1c8} 4384 "\\.\pipe\gecko-crash-server-pipe.4384" 5236 1ffbe360658 tab
    3⤵
    PID:1116
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4384.11.120780642\1198648744" -parentBuildID 20221007134813 -prefsHandle 5728 -prefMapHandle 5724 -prefsLen 29737 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7c155874-acad-44a9-8d78-0db5ef33cc0e} 4384 "\\.\pipe\gecko-crash-server-pipe.4384" 5720 1ffa752f358 rdd
    3⤵
    PID:4220
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4384.12.1338696912\743957435" -childID 10 -isForBrowser -prefsHandle 5528 -prefMapHandle 5728 -prefsLen 29737 -prefMapSize 233444 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4ebdb758-57b7-4cd8-b970-e9ff0b0c4266} 4384 "\\.\pipe\gecko-crash-server-pipe.4384" 4972 1ffa7566558 tab
    3⤵
    PID:584
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4384.13.250672082\126115521" -parentBuildID 20221007134813 -sandboxingKind 1 -prefsHandle 4612 -prefMapHandle 5496 -prefsLen 29737 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2c5ce764-496a-4e1d-8205-5831dcc206c7} 4384 "\\.\pipe\gecko-crash-server-pipe.4384" 6288 1ffa756b258 utility
    3⤵
    PID:4832
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4384.14.2065207172\1201910533" -childID 11 -isForBrowser -prefsHandle 6472 -prefMapHandle 4680 -prefsLen 29746 -prefMapSize 233444 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1a4e12c6-c217-47fd-ae27-f55c3c89fbe8} 4384 "\\.\pipe\gecko-crash-server-pipe.4384" 4848 1ffbdb9e258 tab
    3⤵
    PID:3076
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4384.15.1685248180\936284641" -childID 12 -isForBrowser -prefsHandle 6020 -prefMapHandle 6040 -prefsLen 29746 -prefMapSize 233444 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {da748052-d49b-4b41-b12d-fb1aedc207ac} 4384 "\\.\pipe\gecko-crash-server-pipe.4384" 6036 1ffc109d558 tab
    3⤵
    PID:2720
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4384.16.413735727\782828672" -childID 13 -isForBrowser -prefsHandle 10604 -prefMapHandle 10608 -prefsLen 29746 -prefMapSize 233444 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e69f35cf-591d-442f-ab0a-786107769f09} 4384 "\\.\pipe\gecko-crash-server-pipe.4384" 10388 1ffc3d73558 tab
    3⤵
    PID:1164
- - C:\Users\Admin\Downloads\Bootstrapper.exe
    "C:\Users\Admin\Downloads\Bootstrapper.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:488
- - C:\Users\Admin\Downloads\Bootstrapper.exe
    "C:\Users\Admin\Downloads\Bootstrapper.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:5300
- - C:\Users\Admin\Downloads\Bootstrapper(1).exe
    "C:\Users\Admin\Downloads\Bootstrapper(1).exe"
    3⤵
    - Executes dropped EXE
    PID:5144
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4384.17.1725400760\2096950919" -childID 14 -isForBrowser -prefsHandle 6764 -prefMapHandle 6760 -prefsLen 29851 -prefMapSize 233444 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {429a758e-d7d2-40ab-a864-c0a2ea6514b0} 4384 "\\.\pipe\gecko-crash-server-pipe.4384" 4848 1ffbe365f58 tab
    3⤵
    PID:5364
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4384.18.1214238047\102797640" -childID 15 -isForBrowser -prefsHandle 9896 -prefMapHandle 9852 -prefsLen 29851 -prefMapSize 233444 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c5d92c14-92a1-45a0-8486-0915ef5f6605} 4384 "\\.\pipe\gecko-crash-server-pipe.4384" 9928 1ffbe366b58 tab
    3⤵
    PID:5372
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4384.19.2001108898\592365421" -childID 16 -isForBrowser -prefsHandle 9860 -prefMapHandle 9856 -prefsLen 29851 -prefMapSize 233444 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8cbf5453-a154-4a39-b5ee-544f3c188f24} 4384 "\\.\pipe\gecko-crash-server-pipe.4384" 6760 1ffa755b858 tab
    3⤵
    PID:5824
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4384.20.1850421448\47705026" -childID 17 -isForBrowser -prefsHandle 3140 -prefMapHandle 1088 -prefsLen 29851 -prefMapSize 233444 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {849c446d-cfc9-4f4f-beb4-66baea43a93d} 4384 "\\.\pipe\gecko-crash-server-pipe.4384" 5208 1ffa756ee58 tab
    3⤵
    PID:6016
- - C:\Users\Admin\Downloads\Bootstrapper.exe
    "C:\Users\Admin\Downloads\Bootstrapper.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:4488
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4384.21.560319341\662688108" -childID 18 -isForBrowser -prefsHandle 10496 -prefMapHandle 10484 -prefsLen 29851 -prefMapSize 233444 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {da15eaee-b9ba-4583-9de0-6f98db1f13e9} 4384 "\\.\pipe\gecko-crash-server-pipe.4384" 6804 1ffa7566558 tab
    3⤵
    PID:5840
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4384.22.333638073\501112444" -childID 19 -isForBrowser -prefsHandle 4308 -prefMapHandle 4304 -prefsLen 29860 -prefMapSize 233444 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {afe13546-09fc-4cd9-a1ea-204728a828d0} 4384 "\\.\pipe\gecko-crash-server-pipe.4384" 4316 1ffa755e558 tab
    3⤵
    PID:3720
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4384.23.1873024836\890373981" -childID 20 -isForBrowser -prefsHandle 9488 -prefMapHandle 6740 -prefsLen 29869 -prefMapSize 233444 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {21ed967e-3265-4d8d-81af-a3a6807adbee} 4384 "\\.\pipe\gecko-crash-server-pipe.4384" 9476 1ffa752f058 tab
    3⤵
    PID:5600
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4384.24.383129847\1139572958" -childID 21 -isForBrowser -prefsHandle 9932 -prefMapHandle 9608 -prefsLen 29869 -prefMapSize 233444 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9abdd9bb-46a0-4b8b-8541-92cda8f500fd} 4384 "\\.\pipe\gecko-crash-server-pipe.4384" 9776 1ffc80b2258 tab
    3⤵
    PID:4348

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2b8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3556

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5496

C:\Users\Admin\Downloads\Bootstrapper.exe
"C:\Users\Admin\Downloads\Bootstrapper.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5560

C:\Users\Admin\Downloads\Bootstrapper.exe
"C:\Users\Admin\Downloads\Bootstrapper.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\doomed\11726

Filesize
6KB

MD5
2ee8c11996e0d450ba9d1d1338ba4daa

SHA1
0dd6b43e0cc1bc04578dd4a8116c193cc48e244c

SHA256
a397c5c3e2c19b1375ef3f4b0cd007ef68a55adc36663cdc53f005fb8361ddc4

SHA512
6e17d6fcd11e7ea780beaf98f2c684bc9d14e6a2c9ec7bebe7f6c6895ae60cf3b9cf2759906fd8b81090cffbca450d8befefdc6f90518d5d4a038070c56d70c2

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\doomed\11942

Filesize
8KB

MD5
2066d91fa97290493561a6f9580fc960

SHA1
fab9cb3b5c72cf94ff1ed3a80d3b5fad4b933a96

SHA256
dad3cc42fbac4051762b71b12027f928365e168c71309ae511f6f8ba3ef67196

SHA512
e971550559270895732c355fed65f5d431cccc380d0d38bd73264e61f36479b2ba35c082a2bbd14c016cb8de786cd45a6ee32233bdcc7e429a5ca1313d553c59

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\doomed\12500

Filesize
5KB

MD5
22576bc219e270dbc69e5ca6ce14ddb2

SHA1
180a7f443252614d37979671e57aab7fcc14da22

SHA256
fbb5f8892a41bae8e036c37d9bd01c4ca48e7a55371d5468a50f51ffcad47a1d

SHA512
d5e48e278c83d51f94687892599cd0ca2f3b3babd2267542652a3149fc9ba776b7c18ac013589a1e77a27d033e27efd3ead731a658d41d57fd2ad8f78f8852a6

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\doomed\13432

Filesize
45KB

MD5
0f2de7bdcdea390e4b91aacc7beabc8d

SHA1
639f441d1eab2a7a7ccc79a0c1c57ec6c249ff08

SHA256
2df4d89c5579ef0f287532dab583b49d30f9ae29faf8388374daf58b06244fe0

SHA512
dc67ca6d1ec64bc76398731c3857cb4d68ca33d377ffadc071f9e59e2cd5406fc5b128e0901ff2169076f2b0658229085e2299c9717592c37b3ee168fc9cea0f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\doomed\13737

Filesize
6KB

MD5
20d88599fdc0423315477006910bf0b3

SHA1
50b20b353268cad61b9564b13a0c1ee880cb3064

SHA256
41990100b1ef0d2fb71580eac9263988bb103534b9e5e829eb953ffd53c42d9f

SHA512
b7f16489fcb78224d28c58fe4a9ef3744068a544477558b317c40e5ec1ea6b2a18374dc18e66507f04787d623a91fe494d121465dccb2af5066ed4191a3c9b43

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\doomed\14199

Filesize
38KB

MD5
868af02f4643ba7cda9d5ecec5394401

SHA1
97277fa7c90969634c8b431b56ad39db565dadab

SHA256
0c8d7c756f539eae430150bdbf357a9cfc87b67a1767f14d995e4cdd2705980f

SHA512
c19f58dfbb71bf9c4d6255050bf247972419b78350a435b473dd223f507e73b71ea0fcccf179c0bf132bab84223ad6f025f331824205aa524a36ec4f3730b4d8

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\doomed\177

Filesize
6KB

MD5
739bd5e6c83c52559a76012bc07bda0c

SHA1
c9999cc2b120566cc87dba9677d1f00f3d09c57b

SHA256
41422f814e75d652e86bb2cefc6767432a15e9ccb395d1ce7fc56e8a38932873

SHA512
ed2467733fdecc85c992b3110607b677e71b2621c322f661b6e81097e54824dc34d852ae91b16807533183df0616252de985781ff72d46401ff4e851e9b38e19

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\doomed\24475

Filesize
8KB

MD5
1454bfc4197f8fb52f46db686299531a

SHA1
3af51baecdcd8a4b26684fc45e869c6783981afd

SHA256
0d5f67eb3ea9c2fe67f8ca688549743cbcad5c0618e95723ff56685710ff8db7

SHA512
cfdf55b2d1281776a17e21531b09012129ea13c1118d30ac37e220d756179b35cfbf4ed3d546212f5ac8a5df4a9c2b93afdb2eed2e6ec6ffefe641cfee4c631d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\doomed\24826

Filesize
8KB

MD5
8b5067d60f578e684de840ac02a8130e

SHA1
fcef4f81389c9b21ee523afebda5bb946dea4db5

SHA256
6d9700b6d07398caba6991cdc5e6f2d93991c26bcbd3d725dec44f490b58438e

SHA512
8528f41a2529e321f83033c9db208b53d576ba6a2a6e8d8838c9b57c2ea72cccbe174d991f2dc46729fefd5b49d03df8a4c91fdf5bc79fad98f88b3eb454938c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\doomed\25215

Filesize
3KB

MD5
0029a33e03329ad772fbb2bc44ef1f01

SHA1
97139299f880cddfe8d34220f52b414c7f2658a6

SHA256
1c2d6ea4daf0b46f6d3cc3e57bb7eb3bee78ce00ec2d47bd36c3e89401ef128c

SHA512
51f192ceef352f8dbda95f93503984b0a6980909767f4d62a4d5f4123dd5e890f260854897a59d787e24ebae334a1a7da3efe5030874eba7127e1835f262841e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\doomed\3724

Filesize
16KB

MD5
82298cad0e82945f7eb406a142ce4498

SHA1
82540ed63a371f0211884e74c5a995549022fbad

SHA256
57a5fc8f8c8d2e49476ccf840e2c7a525ea57c968f9987e9db0efdd8157e1bc0

SHA512
a5f6d782f08a63e2499fe5a052da97dc1ba4eab9a40def19f287fde8f2f8dafe973f8515c6b179e4077993e4cb0b1859479ab664690230a62c9bdf173e36674b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\doomed\6429

Filesize
10KB

MD5
7e0827ed573c45263288cec5eaa90245

SHA1
b6bfb6f6af6c4c912c7946fa598bee2280f8b9ba

SHA256
99253cce9c4115ce21bb9291892f211a9e61afcef7157a846ad4d18793a1c236

SHA512
b3de1a52a5b1b2e5233038530d06de8c506015e94c1977c23f2161fc667a256166210d296aed1db303825bfab9d96591e2b9ebe898b7c47794ca8d5164a79b24

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\doomed\8855

Filesize
21KB

MD5
7a3bd3b3439e49226b4149312f756277

SHA1
7f96249a653688dbfbafeeeff5a210b909424e6f

SHA256
003c5b41eef78aaeec3957fbbd11f799207456d6a147a0e1ab7761c44720f491

SHA512
2a2724342c05dc60d9a1b6b04d8c38066c7b8ce0806721652c8997ebe70a8d1d225700794330d24589cac5546ed2f2bdbf6b1e88b2b7338ab45d5a95e047ff47

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\entries\1539701B485C27AF2A85937A14D67030A838B5E6

Filesize
38KB

MD5
2f10af6b801d359d483ba250bdb1fb07

SHA1
31f224aba00f4975cdd87ff578ac13383c2d8e02

SHA256
7f98b2d966b825261cbe7d317c32e019e1b36c0623e30ab8bdf8ef250903227b

SHA512
aaba8bd1b34499e7ef988e7135265c92689e2a76cce248fcaba801340a82458f3218226a0f230b59320a1963a2469b50136a188114bdac27390bd8cb62248b2a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\entries\193EA591AC58D22CE19BB3D1D506CB0860AA7DDF

Filesize
121KB

MD5
0ef8afa4454d8be00b265a958a674625

SHA1
1f84a70d16b5e9d78759309eca04dfad3470af9c

SHA256
8cbd4fd96e4b8a6d1b694cdde18c31aa2d3ea020dc9cefa512d3814b04326d76

SHA512
878afbf8035624c29e620c231a96b1c71f56bc97e4ba16f8e48fc90adee98a9c250e7ceccb8157e82717c8f0aca9d6ebea4cc466f7fd1062b37f0e79ef01ebb8

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\entries\1E674701354CAC1C866AD30A8FFFE5A3CE9D2AF5

Filesize
13KB

MD5
392fb013f9a6dea8916183d47d3a345e

SHA1
7774ac9abf3c8679590a8653836f264d5c30b288

SHA256
a26ff45424c29820488fc184a7c001313d9b668004bd1138e9bf345aed9b11a2

SHA512
8c35196155024a7e99bb3aaf2fefc04fb9d2e4d01764493bbdcfccac155fbbe8669effae0662b5f00e78e9753c1fb5557d1e1c63a425be05158b4177794d4fd1

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\entries\58EFA56DB4BFFECB0EDA547894BC9A057159E22F

Filesize
13KB

MD5
3bbd1bdb3447aeb640a181ed6a782c0d

SHA1
85a88400a23a184d18cf23cbca5b08e7099428ec

SHA256
54de3778937d2a6721264ab57eb0c0ef637db177f2259a9096a8be53cd7b9aef

SHA512
94bcd4964ef632496407a58abcf96ca0c974da722a62c9722ab31959aca1f8ad014d81667517ccbbbf7599c0ce4bdc83651085dd9bc6caa6f533df02d8a6d815

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\entries\7387FDECD8F48C7449676ABC09A40C5E55745357

Filesize
572KB

MD5
a7c98c539db98da78e5edd924396baa9

SHA1
dde14e9315b5199791df42002c38a57d99867bf2

SHA256
9bd3f761057abe86f4921ad9c963482b8d729c7a62aafa988108f991d5b4231f

SHA512
7a131c0d330711adb270948a3c15b88d2278ed466ccc71e8975ccb9aa709edd55b4498c6fdc59546a47dd86975d6069084789297598a947e33019f77393e7538

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\entries\C0FB504EB8D5022AF1CCEBDDE5137444D06410FD

Filesize
16KB

MD5
acec4019087b1d70c2a63668039e8bf6

SHA1
675d1d65bbe02c2f6171dc914429fe68b5172a51

SHA256
37a13f075b2150ff6dd7576732096a8b7135b38f2e8177aa6bba1654ca1db808

SHA512
316f8ab819d57d7c7f35763511a7a736e30a9b8533810030d3ce00a1467cd08ab906f26aeea9bce8eb8c05c50d1d5c959684c0eaa93f3b4d1491f61e09df388f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\entries\CF564B5A92E1F9BA356B6343CB1C47E940442692

Filesize
38KB

MD5
ec799da845442c582e02e96666f69470

SHA1
1dbad108a775ceecd6ada86e3f99b53716c985eb

SHA256
d7f02b8fb1ac4e781e155657c11eba85531408d3046207fc135cb64fc0ff30e9

SHA512
5aec87e90eda4c83770a66701fee2b852f9693ea02912e0f0001eae1500bccb572b65d159a9d32cbaa9d572da32bcf3a1c6ea35ce9f4d187a568273a461fae92

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\thumbnails\895212477adc792c77f61b22fcd086de.png

Filesize
5KB

MD5
b3864a01f322a47d4ceb682515778ad9

SHA1
6f2df44e919d186077c6c077ca763deae5f663cc

SHA256
65b539f5c764d15fdf332610d59cc64eede4ddc247ef8894bda82229874e7eca

SHA512
047332228e93c39ffa3cb0ee8fb798cba87a26b0e3d7be4e65fa0848f20cd437ba139883bf82c6a617693d94a2fc904e86853d65fe5864e59c61d6e68e4a51b4

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\5OQVNHED\favicon[1].htm

Filesize
58KB

MD5
f79d7b2e81acbcdb5253090393d198e3

SHA1
633145cf2a36e70a9e663588ff968b57d8a73cc0

SHA256
90056965adfe9c63aa2252d2987c02cb80bb5eb4e73606574d90dbb4e7fa5584

SHA512
1519218bde26b5fe547901c0ffc4a74bb7d08e0862de0ff82f6436c6d9bff143477787cacccdad0b85dfa1ae92855212672304ce89640387be6de0d2edee64de

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\Temp\~DF54BAC978B92C3366.TMP

Filesize
16KB

MD5
2bc83eac5234beedfc28aed8a5e47ebd

SHA1
c5531b8d10f07fbe06b9f747abba9470e47b1717

SHA256
7414fb869fd870709eb1030edc90c90ae8f18e3da4abd52904af7cf6f9ed1a0c

SHA512
5ee0a9813457a5ab9e81c77c1488467afc0b9542f7871d63c79262a35b9e902d93cd67fb29439c5c8cf9947c502e9ba43bc897b027a2a2e50e54df7c29244213

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
8.0MB

MD5
a01c5ecd6108350ae23d2cddf0e77c17

SHA1
c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

SHA256
345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

SHA512
b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
16KB

MD5
890efd86af403bf0a1e40487f7817733

SHA1
3c787f6802755106eda64f5797c70c4687ce9287

SHA256
630542308a0cdf3ae09a40ff8d529348be72d3933c957fa1556fc65df3150b2c

SHA512
e8be51e8f1a7acf5d2e917bf23b55efae0fbb2c6fa54270c7ca9a182b903c9335ddd61922585aaa35a7f024a21a201f8e840816e70a3cfa9add9befa15d5f8f3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
fb18d68f00e3b0d1914e723976adb78b

SHA1
1835c9a48e4a52460c06b11162cf68fef7ad9c6c

SHA256
9239151102e554fd64c24d85d35b87b7a8c21b650a9778c1f9f8fe6c3bdcdd46

SHA512
34a9711d8ff13c5dd175c049fe816bca6871fe6b71e6f2c28c394cb111f7f7314a73d9e3c61ab37bff69bd15656b004305ebe47eec7980acddfe139faa66ac95

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\datareporting\glean\pending_pings\2f7fae16-4881-4d76-8992-94a146d3f040

Filesize
856B

MD5
bc62dc66bf4fe5404f5d4a679ae80ca2

SHA1
52f5a5d4e11fd3e820a500252f887471c17ee3eb

SHA256
fc116f1748fae1ce3a936de30d9bec13babd5f85369b3d76666bb7e45b850da4

SHA512
08f1aec48fea9172c11075c468af8eb2f8c2cdf99fbb519828200da7af3084212c5ecc55839da8e69b51f9a42ec3a2b276f388a526ded27c2424e0be1928d405

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\datareporting\glean\pending_pings\edc0b267-f653-4b40-8746-79d088ab905d

Filesize
1KB

MD5
1dfecb966b41acb558bac715efe624f4

SHA1
8b7f3829306aecef968e7709dd2cc40075a96515

SHA256
68e4a43ba6f3bf360f483a7d0e5d4b1bb6078b6d65af36e84194cc1633ab3d41

SHA512
d58832d6b4bfa82007281bdf053b9a77bc2035b0d269ecf611ac633ac2de55e67ad57b05453ce6d6d67c4b233786ae25df26ea7ae48e9342c6f48683f7844e91

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\datareporting\glean\pending_pings\f20692b2-b1ed-4fe9-a888-113c110be10a

Filesize
746B

MD5
7f4248562e8baaab4868fc6923b2a560

SHA1
f0883226ddc0e0a103c62de53c320557d4a8025a

SHA256
64e056ba28fa034807e4811c03323fafbe37864049a162aed860fb67b452ba17

SHA512
5f9bccfb8db9a692ac59a254a4eb73a902a9618e94a4b21dc36380e15532667b2ea4fbc0d9305b6a04674296b3125760d2bfc66c4a84b2d89d4d49686579eacb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\datareporting\glean\pending_pings\ff04857b-d325-4c28-b105-c8e43fcff767

Filesize
11KB

MD5
9bc472921035a8d6059e8afe7510a0ec

SHA1
62a93b75111933f96c609c843b68dacad1b9ee4c

SHA256
36eaaeda9529f38de327680f0b417afdc6c319f18da744695d81cc7d10d0350f

SHA512
2f2dac42835f7730875fe8bbf47062ed3c65deccf079d899616f1d33fa7ed80644a996e4c575ae9a734cdcd38550895d1ee32d5cede4343acd53befd708babbd

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

Filesize
11.8MB

MD5
33bf7b0439480effb9fb212efce87b13

SHA1
cee50f2745edc6dc291887b6075ca64d716f495a

SHA256
8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

SHA512
d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\prefs-1.js

Filesize
8KB

MD5
b5f138d6dad5cada086ca3a42c53ee76

SHA1
53d9d63f59a5fd60aad73e80cdccd3773c5d60b0

SHA256
0ad1848e39fad0f3ed65333ae14fcd18d87c17547844ae2b5a52cbbb11fe23a0

SHA512
9344eab8b250c96966ebebd5ac0d25772499001328845d7cb35c3276280f8fe6cfbc5a506391baa56bb9149be94301b61a0bc2bd85bd6e6df3966d54eda5443c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\prefs-1.js

Filesize
6KB

MD5
c5ce4b9e83346fedd7cf68d1435394e8

SHA1
9165cee5d010f32c9d5b46262ffe105c9e0606b1

SHA256
c801ca475040ee1de70af8fb0af8b298dc3ca48f5b1c40546d70a436953435dd

SHA512
cf2aea2e714fb487d6dc683835bba0096e10de5a717a3bfd9cf7273ea5775311ad7fff2591d7b40bf931527ccb0d34525f7988055308d36d6d606f715c20757a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\prefs-1.js

Filesize
6KB

MD5
1102e22aead0dd720276bc9ebb24f6f5

SHA1
bf1374dcacdb679fd37c1174256228de50856c74

SHA256
8a92dd0adc78d8756f74fd97de157aeee7a0605a19f0239ae5d2e31985a999e5

SHA512
1129d8466f51a562d80f6bb1c96103ab1b5e4c4f98eef3e393bc30305910ae94b3181f00140cf51c5b0c67eaadd1a5b6cfa24e2eab17784c109254e2dfdffdcd

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
30bb05c801a46bf7924b1f9c5c5f30dc

SHA1
dad909b990e0cefbc53001f73aa6957aae3e171d

SHA256
d89ad262f9e6664f068699aaf11e3fd4c5103d38b539e0f82cb200a37950e224

SHA512
c2fc34c4bc28a9ac54604dbde0309ec3d73213cfbd6c077cfba1e29f7483e9197feaad1fab8a31351e2217745b8a92052bd64508e344b8e1156245dec6c6032a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
2b3ea33f0c67540964c94ab44e3655bb

SHA1
739dad6bc6705ca7e845d9032cc2fe5890bc6279

SHA256
cd9607849e2df73d8b3da1db1e664144a6d03c70d53fff259f4df20316537f56

SHA512
9cecf142f4882fd72e1df0801aaf30c51751cfcb01f44fa32ff4b18d75905030c06d982a76e1afab3d7eb2e8f1bf3ca6032e625c0f452d844b39282f2fa82484

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
24KB

MD5
3c58eede2d77507fdf72a9651818b1d7

SHA1
546540cea322226267ee987a405aa59c522aa9a8

SHA256
bca3aedf8758e93d05907b6c3dc146743d1d99aaba0392affe4ed650116f257f

SHA512
c71ccf60ef451e92f711aca154536444f333ca577831a3e960f9e4465fb2332ee4124873b14c71283a27b6b42fa5f57451d0befcd390acea5f3eaddf8797b0a2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
21KB

MD5
0b14514f511b3de4cdc78239252351df

SHA1
7129ffb0b6759ee3c3b463d426820e9769cd1229

SHA256
ede3e6bc3f288b0e0675195acddd2f6aa6c259cd0da5e57103df13774f5536d9

SHA512
3d0f622df324740835173fa35952c22f77c071d8f7a805c8f38ca2c952c51131ccf205d4a86dd6e2459a364474f0e248cac0105971c59d6f0b7fa377a9e71b6f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
41KB

MD5
2b1d2e27a0db65fb56a21f8067a73875

SHA1
8c4d0657da8c660bf055805fa3d9339bcfdc4803

SHA256
f4a91d923cae91a24837e737eba8c3ac76aa53234617fecd3c47aac7e2ccdf9b

SHA512
0589af9bd943299d78db464231de19581d24c929c38bcbe9a94b181a2f4cde38175dc230fdccf81624d1de2de661297fb261a359edfee32a15c57bf7b1653a96

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
c3888c7727c111f70651ae6c453fc185

SHA1
9500a71cd02683ea5ee4ce962528a25740ea8397

SHA256
6cc9b83025ab30664affa9c8e968047aee6602e4d50c180d22e98b7ee8ec835c

SHA512
f087c056daea3c57e1eccfcab90b9ccd8a55c3583dead503b662b6ca8179ace7ecfd1de439087d96bd70ceac7bac8f8340b0e984f0a4450a46dd31837da6e85e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
20KB

MD5
3f3ef03972cd876670131e32adda5410

SHA1
a99ada78fb1a73b7d1f62fd457e6157d93ba94fc

SHA256
d373fe0849940cb4641e2439b023ccfc45b0ac49549ed68958dda80f47f21b30

SHA512
87922b02ef38cbbe40a144f6953310fe87924a267bcc1f8bba1c3335795eb696a114da0616a56a467f745890a34b80ac6759823075a53eb0406c3491f46174cc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
22KB

MD5
648c70fe14f3c4a549c982c8068bfbba

SHA1
14b54cb8009b2363ae6bfa0436b9f9b705ba6d68

SHA256
17939e8b18d1259c0f53bb1bf78f4df1a6a29f38d0073b826e82166c13a99b54

SHA512
6b67759dad3f406edfc66e49b6252085c294d6addd9b2fc9ac501f66e787f8fc07c2440c5c3002e4d1b98d12711d38bc0755fa7b90d474c848b6ef6ac0016435

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
24KB

MD5
eb22236db83eac1213407758771b3382

SHA1
51071c8b63b8282358b1a30beadd7022a1b4d629

SHA256
8cf9ff4a9d43c89e464926057d79788d727abe0be6985d8471c292b10697f5b8

SHA512
8784086f4bc13c7f25c2999b64ff31e9b01c6275a99cff49ecc6b43c056e0c79583093ee491c1ecd466c06cad1d20af4d67edf1517803df1a43db1d708dba913

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
24KB

MD5
dd32b10deee2bd4d1cb95138faca5149

SHA1
7500919f996860abbf92c3f73818783adae78da1

SHA256
38b4d8636eb8027c6ce8ceb35eb3062f773e9fb4f2336148848ec793794ead40

SHA512
4da45bc8ab5039f2d9e5470b125d684822b84abb9e41d412723a9ac21ff151f50cdb4d48bbd48be46e21a87bd8610a236e717d499c46143b0fe303db80039ee9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
21KB

MD5
e76a2d60c9df3c522126f5e7a19365b3

SHA1
f49e3c2008de1633ed0124205624451a42bb06b3

SHA256
9c3b53cfc389f1aac337167b3de2f72f81a9297599713b77724ddc0b7bb2cbdc

SHA512
18982e062c7ea5e9532e04816cee56eea0ebd148c0f115c67de81709ca77bb3a17b343ec6a0f64b3e4965bc795f3a48819fc06a13430b2c0ced2e6c7c98d1b62

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
42KB

MD5
f789e7c57e7f4b7bad59c3f871ffa17f

SHA1
ef503e9ee7e5dadf7b5bd69c8dba88d47318c83c

SHA256
39fdf90ae5f44f0407634dd2ed4cdacd1926eca83cca1ec5a4a7a790a9c94346

SHA512
603c00bafee24e2ef597e0fc77fd1f5a740dd98a61ea66a15b1bb6d4aaf23e068729b06b68369a8aef96efb172375de028d961d9445868b8e7aa33b043ff0b55

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
24KB

MD5
dce5f46a0f242446b31668cc95e27ebe

SHA1
9591a64384c191ef53eeda27c89f15037da87a71

SHA256
6a5e478039906e18224bf46bec74f30204675d9d97eff2d5e7a5049dd9080e90

SHA512
e0df2fc675577edd0fd0a786c8ecbad9f4397a173a771154057a35113fd79c220d6f911c9e237915d0314ce080440297148761dbc0daf2f50130ca9759d150fa

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
22KB

MD5
b1464fc73ea7e571ef2d2a933ad2b351

SHA1
c62c85dfd88ce3f431f2a0b8f29690bc4136f21c

SHA256
abb94a392287bea78a3d9dbc307284812b966469a4bee3ecc80bd82c498fdcfc

SHA512
07ad0d83d070ff10f95f586a0f2b027c3e462578bafc8c542983d04bc4d172251528c615e0cdf9cdcf3af7114c1d66c7543f1f7407dc2c45d9b6747e85501f4a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
24KB

MD5
3a89de4db3daa7279408ba60159ebc73

SHA1
e4c786f67cb999831b8523c17fc22644ef01cf14

SHA256
e24263eaf81dbb6cb416799f538f8aca015e44e0b24013d02ada5fa01f53b7d9

SHA512
0a97fd5cd01107cbcdc91f751ecd0cb9fc4d8c894695c03357ff08716cabe38d65543ecceab30cc5afac6e019231910b0c847cfc85726ea0ef10bd4d44722e4a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
22KB

MD5
8d9fb731a30c32c989f4075a2446b2e1

SHA1
d69245ad1a4075c3fbc230126a947a8f9f5f2c91

SHA256
936d6923346c50b4c2ad612afa7d88ad073855aabd2d4253bde7a42fb1252b8d

SHA512
50989c3b8fef8daf5691935bff3ac1084b97b113f0a35a2f151ca359defce2151beedf401ae30c6331916e877d5b27f2b0b5c2ece6f070832125b32907160fc0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
23KB

MD5
d617a331b35f9254289f771080f97f9e

SHA1
d482bd7fe8a84a324b54f4c84267a8a43b459123

SHA256
335bbd3446b4d8f202172d715b9feba1a1bc36749919656846fd00c29e5a22ef

SHA512
3d639d0d7d30b25f1b8cd7e7f18fed2a7366ab1dda1731629c48bc378dce2118a28eeeff91a2b627b0b7c6b2af8416ae31a72765038381c802eea355d6c4d00e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
7.7MB

MD5
bc1afeffdab8e8599352bf930a8b560b

SHA1
01e73e100ce0ef9ede8502f923be382c25a31240

SHA256
53e3e7e23e1a5ceeb250768380cfc824c6f6260b0d096918f1d673e671b3bf30

SHA512
510d7a0b056212c77be172c9e7828df6103063e2edf905804c4b6da4024877cbde6993c985239f4fad70bcaf81c8c9fa54ea9fda83298f3d46685a6f5c0c5adc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
184KB

MD5
731c0e733fe1e3123d366af7c8e578ae

SHA1
9756304ea773dd9cd96e5996dc79de2ed6a9ae9c

SHA256
8f426b4be5e3440fa14d37480f018b7dc3d1a547b0e91c2fbfc6e31d9054a359

SHA512
d29e0f2356a3226f64692b390c122d4d70f09f677d9f5d086f2babaeba6574d670171edb24ff52f928871ec489680f57910e21fac1ca8ec08783a07d21b1f427

Download Submit
C:\Users\Admin\Downloads\Bootstrapper(1).exe:Zone.Identifier

Filesize
134B

MD5
41550b72f87f0b52915117fb3b3aeaa6

SHA1
c4f88cf998584d197f05179e6e6bf07dbaf5b236

SHA256
c2de7ed9cab4e2f24acf25bb5b52517a35018d148fedd79536ed16f93320e8e7

SHA512
4522a9f15a473df7270694cde06e36c4922428a3a4961c3b443598c701d8a0030cbfe9b36a667e4894584cd072bf78e66a50a81ec89e5a51d7462be9161813f9

Download Submit
C:\Users\Admin\Downloads\Bootstrapper.bQFNSQLZ.exe.part

Filesize
10KB

MD5
fc4b54ee62b6d4a57f7308b24ccb3cf6

SHA1
21b32418bd0eaf361be67f2b1637839ab9b86e06

SHA256
ded5249392621aecbc133207764f6c86cd256341869873aa7a2594359d8e62b9

SHA512
d2698bf6cfba181abb5655ec15be3586852bd4e75b379ed85e172398469f38bb797776a6b6026faf579ed124fb2cd97aa608d623cacdeb92846eec2f3f029c3e

Download Submit
C:\Users\Admin\Downloads\Bootstrapper.exe

Filesize
796KB

MD5
4b94b989b0fe7bec6311153b309dfe81

SHA1
bb50a4bb8a66f0105c5b74f32cd114c672010b22

SHA256
7c4283f5e620b2506bcb273f947def4435d95e143ae3067a783fd3adc873a659

SHA512
fbbe60cf3e5d028d906e7d444b648f7dff8791c333834db8119e0a950532a75fda2e9bd5948f0b210904667923eb7b2c0176140babc497955d227e7d80fb109d

Download Submit
C:\Users\Admin\Downloads\DISCORD

Filesize
103B

MD5
5aa26de003aeebae624a08de919c52b5

SHA1
ff1a4dd7673a6b604324e1363738658cc4d565c0

SHA256
335052f362ac50a1d52e8268ebc4323f59644ef7988cb29ea485d57745667bd2

SHA512
43220140c68668fd309ce343c06e22910dbe6b74818a9a0f07da052cd8d6020524311c6c00201fc3bceb6f18743ba07ae65e2d4900dd79fab7218bef5caf192c

Download Submit
memory/488-3267-0x000001F7D7200000-0x000001F7D72CE000-memory.dmp

Filesize
824KB

Download
memory/1884-53-0x0000017BA7910000-0x0000017BA7912000-memory.dmp

Filesize
8KB

Download
memory/1884-80-0x0000017BA7C00000-0x0000017BA7C02000-memory.dmp

Filesize
8KB

Download
memory/1884-109-0x0000017BA7B30000-0x0000017BA7B32000-memory.dmp

Filesize
8KB

Download
memory/1884-82-0x0000017BA7DF0000-0x0000017BA7DF2000-memory.dmp

Filesize
8KB

Download
memory/1884-87-0x0000017BB8DB0000-0x0000017BB8DB2000-memory.dmp

Filesize
8KB

Download
memory/1884-48-0x0000017BA78C0000-0x0000017BA78C2000-memory.dmp

Filesize
8KB

Download
memory/1884-111-0x0000017BA7B50000-0x0000017BA7B52000-memory.dmp

Filesize
8KB

Download
memory/1884-51-0x0000017BA78F0000-0x0000017BA78F2000-memory.dmp

Filesize
8KB

Download
memory/1884-84-0x0000017BB8C70000-0x0000017BB8C72000-memory.dmp

Filesize
8KB

Download
memory/1884-106-0x0000017BB8EC0000-0x0000017BB8EC2000-memory.dmp

Filesize
8KB

Download
memory/2988-45-0x000001BF81380000-0x000001BF81480000-memory.dmp

Filesize
1024KB

Download
memory/3200-100-0x000001FD5A3A0000-0x000001FD5A3A1000-memory.dmp

Filesize
4KB

Download
memory/3200-151-0x000001FD512E0000-0x000001FD512E2000-memory.dmp

Filesize
8KB

Download
memory/3200-0-0x000001FD53E20000-0x000001FD53E30000-memory.dmp

Filesize
64KB

Download
memory/3200-158-0x000001FD51240000-0x000001FD51241000-memory.dmp

Filesize
4KB

Download
memory/3200-154-0x000001FD51280000-0x000001FD51281000-memory.dmp

Filesize
4KB

Download
memory/3200-99-0x000001FD5A390000-0x000001FD5A391000-memory.dmp

Filesize
4KB

Download
memory/3200-35-0x000001FD51250000-0x000001FD51252000-memory.dmp

Filesize
8KB

Download
memory/3200-17-0x000001FD53F30000-0x000001FD53F40000-memory.dmp

Filesize
64KB

Download