Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
446s -
max time network
454s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
02/09/2024, 19:56
Behavioral task
behavioral1
Sample
Solara.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral2
Sample
SolaraFixer.exe
Resource
win10v2004-20240802-en
Errors
General
-
Target
SolaraFixer.exe
-
Size
86KB
-
MD5
28b71b14a91dc144298ac43e725d27fd
-
SHA1
e6b8bd585e2dabc43d2dbbe6352eac60bdf93ac3
-
SHA256
c3ea1603378e0bfbf7fcc64643144c0c5c699bcffc8505b68a251d00097a0c63
-
SHA512
58446084d1e6365d017a0fac0ba10877b7e96a7dbacfb99dc375a65ce5716611cc341653006c043cd3968556c1d2e0559ebbf161c5c25db18ae23716654218f7
-
SSDEEP
1536:0PJQdYi/z5s3d434+UHnaJCt53ZbHDSXtDq1MO6tXlMFjGkOWCK4vOnOS:2JQdhatn1HnaJCtRZbHDekadlMJDOWC
Malware Config
Extracted
xworm
accessories-retrieve.gl.at.ply.gg:13970
-
Install_directory
%LocalAppData%
-
install_file
USB.exe
Signatures
-
Detect Xworm Payload 2 IoCs
resource yara_rule behavioral2/memory/2876-1-0x00000000001E0000-0x00000000001FC000-memory.dmp family_xworm behavioral2/files/0x001100000002338d-49.dat family_xworm -
StormKitty
StormKitty is an open source info stealer written in C#.
-
StormKitty payload 1 IoCs
resource yara_rule behavioral2/memory/2876-3725-0x000000001CF10000-0x000000001D02E000-memory.dmp family_stormkitty -
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 1716 powershell.exe 2720 powershell.exe 1468 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation SolaraFixer.exe -
Drops startup file 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SolaraFixer.lnk SolaraFixer.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SolaraFixer.lnk SolaraFixer.exe -
Executes dropped EXE 7 IoCs
pid Process 4088 SolaraFixer.exe 2292 SolaraFixer.exe 516 SolaraFixer.exe 2392 SolaraFixer.exe 2544 SolaraFixer.exe 32 SolaraFixer.exe 2984 SolaraFixer.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SolaraFixer = "C:\\Users\\Admin\\AppData\\Local\\SolaraFixer.exe" SolaraFixer.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\XBackground.bmp" SolaraFixer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 11 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe -
Enumerates system info in registry 2 TTPs 11 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser explorer.exe -
Modifies data under HKEY_USERS 15 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "58" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe -
Modifies registry class 43 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\ShowCmd = "1" explorer.exe Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings firefox.exe Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Rev = "0" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents" explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616193" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1" explorer.exe Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 explorer.exe Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\HotKey = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WFlags = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616209" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" explorer.exe Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1" explorer.exe Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{7D49D726-3C21-4F05-99AA-FDC2C9474656} explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1" explorer.exe Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Vid = "{137E7700-3573-11CF-AE69-08002B2E1262}" explorer.exe Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags explorer.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1896 schtasks.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2960 explorer.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1468 powershell.exe 1468 powershell.exe 1716 powershell.exe 1716 powershell.exe 2720 powershell.exe 2720 powershell.exe 2876 SolaraFixer.exe 2876 SolaraFixer.exe 2876 SolaraFixer.exe 2876 SolaraFixer.exe 2876 SolaraFixer.exe 3216 chrome.exe 3216 chrome.exe 2876 SolaraFixer.exe 2876 SolaraFixer.exe 2876 SolaraFixer.exe 2876 SolaraFixer.exe 2876 SolaraFixer.exe 2876 SolaraFixer.exe 2876 SolaraFixer.exe 2876 SolaraFixer.exe 2876 SolaraFixer.exe 2876 SolaraFixer.exe 2876 SolaraFixer.exe 2876 SolaraFixer.exe 2876 SolaraFixer.exe 2876 SolaraFixer.exe 2876 SolaraFixer.exe 2876 SolaraFixer.exe 2876 SolaraFixer.exe 2876 SolaraFixer.exe 2876 SolaraFixer.exe 2876 SolaraFixer.exe 2876 SolaraFixer.exe 2876 SolaraFixer.exe 2876 SolaraFixer.exe 2876 SolaraFixer.exe 2876 SolaraFixer.exe 2876 SolaraFixer.exe 2876 SolaraFixer.exe 2624 msedge.exe 2624 msedge.exe 2876 SolaraFixer.exe 2876 SolaraFixer.exe 2752 msedge.exe 2752 msedge.exe 2876 SolaraFixer.exe 2876 SolaraFixer.exe 2876 SolaraFixer.exe 2876 SolaraFixer.exe 3768 powershell.exe 3768 powershell.exe 3768 powershell.exe 5880 msedge.exe 5880 msedge.exe 5880 msedge.exe 5880 msedge.exe 4912 msedge.exe 4912 msedge.exe 4912 msedge.exe 4912 msedge.exe 5560 msedge.exe 5560 msedge.exe 4324 msedge.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2960 explorer.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs
pid Process 3216 chrome.exe 3216 chrome.exe 2752 msedge.exe 2752 msedge.exe 4324 msedge.exe 4324 msedge.exe 4324 msedge.exe 4324 msedge.exe 4324 msedge.exe 4324 msedge.exe 2752 msedge.exe 2752 msedge.exe 2752 msedge.exe 2752 msedge.exe 2752 msedge.exe 2752 msedge.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2876 SolaraFixer.exe Token: SeDebugPrivilege 1468 powershell.exe Token: SeDebugPrivilege 1716 powershell.exe Token: SeDebugPrivilege 2720 powershell.exe Token: SeDebugPrivilege 2876 SolaraFixer.exe Token: SeDebugPrivilege 4088 SolaraFixer.exe Token: SeDebugPrivilege 2292 SolaraFixer.exe Token: SeShutdownPrivilege 3216 chrome.exe Token: SeCreatePagefilePrivilege 3216 chrome.exe Token: SeShutdownPrivilege 3216 chrome.exe Token: SeCreatePagefilePrivilege 3216 chrome.exe Token: SeShutdownPrivilege 3216 chrome.exe Token: SeCreatePagefilePrivilege 3216 chrome.exe Token: SeShutdownPrivilege 3216 chrome.exe Token: SeCreatePagefilePrivilege 3216 chrome.exe Token: SeShutdownPrivilege 3216 chrome.exe Token: SeCreatePagefilePrivilege 3216 chrome.exe Token: SeShutdownPrivilege 3216 chrome.exe Token: SeCreatePagefilePrivilege 3216 chrome.exe Token: SeShutdownPrivilege 3216 chrome.exe Token: SeCreatePagefilePrivilege 3216 chrome.exe Token: SeShutdownPrivilege 3216 chrome.exe Token: SeCreatePagefilePrivilege 3216 chrome.exe Token: SeShutdownPrivilege 3216 chrome.exe Token: SeCreatePagefilePrivilege 3216 chrome.exe Token: SeShutdownPrivilege 3216 chrome.exe Token: SeCreatePagefilePrivilege 3216 chrome.exe Token: SeDebugPrivilege 1000 firefox.exe Token: SeDebugPrivilege 1000 firefox.exe Token: SeShutdownPrivilege 3216 chrome.exe Token: SeCreatePagefilePrivilege 3216 chrome.exe Token: SeShutdownPrivilege 3216 chrome.exe Token: SeCreatePagefilePrivilege 3216 chrome.exe Token: SeShutdownPrivilege 3216 chrome.exe Token: SeCreatePagefilePrivilege 3216 chrome.exe Token: SeDebugPrivilege 516 SolaraFixer.exe Token: SeShutdownPrivilege 3216 chrome.exe Token: SeCreatePagefilePrivilege 3216 chrome.exe Token: SeShutdownPrivilege 3216 chrome.exe Token: SeCreatePagefilePrivilege 3216 chrome.exe Token: SeShutdownPrivilege 3216 chrome.exe Token: SeCreatePagefilePrivilege 3216 chrome.exe Token: SeShutdownPrivilege 3216 chrome.exe Token: SeCreatePagefilePrivilege 3216 chrome.exe Token: SeShutdownPrivilege 3216 chrome.exe Token: SeCreatePagefilePrivilege 3216 chrome.exe Token: SeShutdownPrivilege 3216 chrome.exe Token: SeCreatePagefilePrivilege 3216 chrome.exe Token: SeShutdownPrivilege 3216 chrome.exe Token: SeCreatePagefilePrivilege 3216 chrome.exe Token: SeShutdownPrivilege 3216 chrome.exe Token: SeCreatePagefilePrivilege 3216 chrome.exe Token: SeShutdownPrivilege 3216 chrome.exe Token: SeCreatePagefilePrivilege 3216 chrome.exe Token: SeShutdownPrivilege 3216 chrome.exe Token: SeCreatePagefilePrivilege 3216 chrome.exe Token: SeShutdownPrivilege 3216 chrome.exe Token: SeCreatePagefilePrivilege 3216 chrome.exe Token: SeShutdownPrivilege 3216 chrome.exe Token: SeCreatePagefilePrivilege 3216 chrome.exe Token: SeShutdownPrivilege 3216 chrome.exe Token: SeCreatePagefilePrivilege 3216 chrome.exe Token: SeShutdownPrivilege 3216 chrome.exe Token: SeCreatePagefilePrivilege 3216 chrome.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 1000 firefox.exe 1000 firefox.exe 1000 firefox.exe 1000 firefox.exe 1000 firefox.exe 1000 firefox.exe 1000 firefox.exe 1000 firefox.exe 1000 firefox.exe 1000 firefox.exe 1000 firefox.exe 1000 firefox.exe 1000 firefox.exe 1000 firefox.exe 1000 firefox.exe 1000 firefox.exe 1000 firefox.exe 1000 firefox.exe 1000 firefox.exe 1000 firefox.exe 1000 firefox.exe 2752 msedge.exe 2752 msedge.exe 2752 msedge.exe 2752 msedge.exe 2752 msedge.exe 2752 msedge.exe 2752 msedge.exe 2752 msedge.exe 2752 msedge.exe 2752 msedge.exe 2752 msedge.exe 2752 msedge.exe 2752 msedge.exe 2752 msedge.exe 2752 msedge.exe 2752 msedge.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 1000 firefox.exe 1000 firefox.exe 1000 firefox.exe 1000 firefox.exe 1000 firefox.exe 1000 firefox.exe 1000 firefox.exe 1000 firefox.exe 1000 firefox.exe 1000 firefox.exe 1000 firefox.exe 1000 firefox.exe 1000 firefox.exe 1000 firefox.exe 1000 firefox.exe 1000 firefox.exe 1000 firefox.exe 1000 firefox.exe 1000 firefox.exe 1000 firefox.exe 2752 msedge.exe 2752 msedge.exe 2752 msedge.exe 2752 msedge.exe 2752 msedge.exe 2752 msedge.exe 2752 msedge.exe 2752 msedge.exe 2752 msedge.exe 2752 msedge.exe 2752 msedge.exe 2752 msedge.exe 2752 msedge.exe 2752 msedge.exe 2752 msedge.exe 2752 msedge.exe 2752 msedge.exe 2752 msedge.exe 2752 msedge.exe 2752 msedge.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 2876 SolaraFixer.exe 1000 firefox.exe 2960 explorer.exe 2960 explorer.exe 2444 LogonUI.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2876 wrote to memory of 1468 2876 SolaraFixer.exe 87 PID 2876 wrote to memory of 1468 2876 SolaraFixer.exe 87 PID 2876 wrote to memory of 1716 2876 SolaraFixer.exe 89 PID 2876 wrote to memory of 1716 2876 SolaraFixer.exe 89 PID 2876 wrote to memory of 2720 2876 SolaraFixer.exe 91 PID 2876 wrote to memory of 2720 2876 SolaraFixer.exe 91 PID 2876 wrote to memory of 1896 2876 SolaraFixer.exe 93 PID 2876 wrote to memory of 1896 2876 SolaraFixer.exe 93 PID 2876 wrote to memory of 3216 2876 SolaraFixer.exe 106 PID 2876 wrote to memory of 3216 2876 SolaraFixer.exe 106 PID 3216 wrote to memory of 1492 3216 chrome.exe 107 PID 3216 wrote to memory of 1492 3216 chrome.exe 107 PID 3216 wrote to memory of 1644 3216 chrome.exe 108 PID 3216 wrote to memory of 1644 3216 chrome.exe 108 PID 3216 wrote to memory of 1644 3216 chrome.exe 108 PID 3216 wrote to memory of 1644 3216 chrome.exe 108 PID 3216 wrote to memory of 1644 3216 chrome.exe 108 PID 3216 wrote to memory of 1644 3216 chrome.exe 108 PID 3216 wrote to memory of 1644 3216 chrome.exe 108 PID 3216 wrote to memory of 1644 3216 chrome.exe 108 PID 3216 wrote to memory of 1644 3216 chrome.exe 108 PID 3216 wrote to memory of 1644 3216 chrome.exe 108 PID 3216 wrote to memory of 1644 3216 chrome.exe 108 PID 3216 wrote to memory of 1644 3216 chrome.exe 108 PID 3216 wrote to memory of 1644 3216 chrome.exe 108 PID 3216 wrote to memory of 1644 3216 chrome.exe 108 PID 3216 wrote to memory of 1644 3216 chrome.exe 108 PID 3216 wrote to memory of 1644 3216 chrome.exe 108 PID 3216 wrote to memory of 1644 3216 chrome.exe 108 PID 3216 wrote to memory of 1644 3216 chrome.exe 108 PID 3216 wrote to memory of 1644 3216 chrome.exe 108 PID 3216 wrote to memory of 1644 3216 chrome.exe 108 PID 3216 wrote to memory of 1644 3216 chrome.exe 108 PID 3216 wrote to memory of 1644 3216 chrome.exe 108 PID 3216 wrote to memory of 1644 3216 chrome.exe 108 PID 3216 wrote to memory of 1644 3216 chrome.exe 108 PID 3216 wrote to memory of 1644 3216 chrome.exe 108 PID 3216 wrote to memory of 1644 3216 chrome.exe 108 PID 3216 wrote to memory of 1644 3216 chrome.exe 108 PID 3216 wrote to memory of 1644 3216 chrome.exe 108 PID 3216 wrote to memory of 1644 3216 chrome.exe 108 PID 3216 wrote to memory of 1644 3216 chrome.exe 108 PID 3216 wrote to memory of 1356 3216 chrome.exe 109 PID 3216 wrote to memory of 1356 3216 chrome.exe 109 PID 3216 wrote to memory of 3140 3216 chrome.exe 110 PID 3216 wrote to memory of 3140 3216 chrome.exe 110 PID 3216 wrote to memory of 3140 3216 chrome.exe 110 PID 3216 wrote to memory of 3140 3216 chrome.exe 110 PID 3216 wrote to memory of 3140 3216 chrome.exe 110 PID 3216 wrote to memory of 3140 3216 chrome.exe 110 PID 3216 wrote to memory of 3140 3216 chrome.exe 110 PID 3216 wrote to memory of 3140 3216 chrome.exe 110 PID 3216 wrote to memory of 3140 3216 chrome.exe 110 PID 3216 wrote to memory of 3140 3216 chrome.exe 110 PID 3216 wrote to memory of 3140 3216 chrome.exe 110 PID 3216 wrote to memory of 3140 3216 chrome.exe 110 PID 3216 wrote to memory of 3140 3216 chrome.exe 110 PID 3216 wrote to memory of 3140 3216 chrome.exe 110 PID 3216 wrote to memory of 3140 3216 chrome.exe 110 PID 3216 wrote to memory of 3140 3216 chrome.exe 110 PID 3216 wrote to memory of 3140 3216 chrome.exe 110 PID 3216 wrote to memory of 3140 3216 chrome.exe 110 PID 3216 wrote to memory of 3140 3216 chrome.exe 110 PID 3216 wrote to memory of 3140 3216 chrome.exe 110 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\SolaraFixer.exe"C:\Users\Admin\AppData\Local\Temp\SolaraFixer.exe"1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\SolaraFixer.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1468
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'SolaraFixer.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1716
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\SolaraFixer.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2720
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "SolaraFixer" /tr "C:\Users\Admin\AppData\Local\SolaraFixer.exe"2⤵
- Scheduled Task/Job: Scheduled Task
PID:1896
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --new-window "data:text/html,<title>Welcome Chrome Browser</title>" --mute-audio --disable-audio2⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3216 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffc683ecc40,0x7ffc683ecc4c,0x7ffc683ecc583⤵PID:1492
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1912,i,8652739147763629735,11070055491125312257,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1908 /prefetch:23⤵PID:1644
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mute-audio --no-appcompat-clear --field-trial-handle=2156,i,8652739147763629735,11070055491125312257,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2164 /prefetch:33⤵PID:1356
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mute-audio --no-appcompat-clear --field-trial-handle=2228,i,8652739147763629735,11070055491125312257,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2540 /prefetch:83⤵PID:3140
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3040,i,8652739147763629735,11070055491125312257,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3064 /prefetch:13⤵PID:3788
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4216,i,8652739147763629735,11070055491125312257,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4228 /prefetch:13⤵PID:2780
-
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --new-window data:text/html,<title>Welcome_firefox_Browser</title>2⤵PID:864
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --new-window data:text/html,<title>Welcome_firefox_Browser</title>3⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1000 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1996 -parentBuildID 20240401114208 -prefsHandle 1924 -prefMapHandle 1916 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2d285ae5-c2e7-43e9-bb04-73add706c6d4} 1000 "\\.\pipe\gecko-crash-server-pipe.1000" gpu4⤵PID:3956
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2432 -parentBuildID 20240401114208 -prefsHandle 2408 -prefMapHandle 2396 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {80461751-14b4-43d2-a8f8-71c99322f32d} 1000 "\\.\pipe\gecko-crash-server-pipe.1000" socket4⤵PID:3840
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3160 -childID 1 -isForBrowser -prefsHandle 3136 -prefMapHandle 2988 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1d965b0d-5c8b-4011-96ac-ba6799a0027b} 1000 "\\.\pipe\gecko-crash-server-pipe.1000" tab4⤵PID:4892
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4004 -childID 2 -isForBrowser -prefsHandle 3108 -prefMapHandle 3032 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1de0953c-9455-45fe-acb8-49aa52b82e6e} 1000 "\\.\pipe\gecko-crash-server-pipe.1000" tab4⤵PID:3760
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4796 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4968 -prefMapHandle 3916 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6df14975-9613-483e-947f-14dbbd72bec8} 1000 "\\.\pipe\gecko-crash-server-pipe.1000" utility4⤵
- Checks processor information in registry
PID:5360
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5368 -childID 3 -isForBrowser -prefsHandle 5340 -prefMapHandle 5356 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {28d94ca8-6984-49de-b932-ab0cc46be4fb} 1000 "\\.\pipe\gecko-crash-server-pipe.1000" tab4⤵PID:5912
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5512 -childID 4 -isForBrowser -prefsHandle 5520 -prefMapHandle 5524 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b4a25d77-b64c-41a4-a708-823c5992dd7d} 1000 "\\.\pipe\gecko-crash-server-pipe.1000" tab4⤵PID:5924
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5712 -childID 5 -isForBrowser -prefsHandle 5720 -prefMapHandle 5724 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7ea5fc71-f66c-4cfa-b07e-0c6e7099d4dd} 1000 "\\.\pipe\gecko-crash-server-pipe.1000" tab4⤵PID:5936
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --new-window "data:text/html,<title>Welcome Edge Browser</title>" --mute-audio --disable-audio2⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2752 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc4a5346f8,0x7ffc4a534708,0x7ffc4a5347183⤵PID:3564
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,2078774095922174657,13161120745610717267,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:23⤵PID:864
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2020,2078774095922174657,13161120745610717267,131072 --lang=en-US --service-sandbox-type=none --mute-audio --mojo-platform-channel-handle=2164 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
PID:2624
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2020,2078774095922174657,13161120745610717267,131072 --lang=en-US --service-sandbox-type=utility --mute-audio --mojo-platform-channel-handle=2736 /prefetch:83⤵PID:3344
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,2078774095922174657,13161120745610717267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:13⤵PID:5832
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,2078774095922174657,13161120745610717267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:13⤵PID:5688
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,2078774095922174657,13161120745610717267,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4024 /prefetch:23⤵
- Suspicious behavior: EnumeratesProcesses
PID:5880
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,2078774095922174657,13161120745610717267,131072 --lang=en-US --service-sandbox-type=none --mute-audio --mojo-platform-channel-handle=5152 /prefetch:83⤵PID:5344
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,2078774095922174657,13161120745610717267,131072 --lang=en-US --service-sandbox-type=none --mute-audio --mojo-platform-channel-handle=5152 /prefetch:83⤵PID:572
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,2078774095922174657,13161120745610717267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:13⤵PID:2684
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,2078774095922174657,13161120745610717267,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:13⤵PID:2372
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,2078774095922174657,13161120745610717267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:13⤵PID:4456
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,2078774095922174657,13161120745610717267,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4712 /prefetch:13⤵PID:448
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,2078774095922174657,13161120745610717267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1824 /prefetch:13⤵PID:5240
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,2078774095922174657,13161120745610717267,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:13⤵PID:5168
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -c explorer shell:::{3080F90E-D7AD-11D9-BD98-0000947B0257}2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3768 -
C:\Windows\explorer.exe"C:\Windows\explorer.exe" shell::: -encodedCommand MwAwADgAMABGADkAMABFAC0ARAA3AEEARAAtADEAMQBEADkALQBCAEQAOQA4AC0AMAAwADAAMAA5ADQANwBCADAAMgA1ADcA -inputFormat xml -outputFormat text3⤵PID:436
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --disable-3d-apis --disable-gpu --disable-d3d11 "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data"2⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
PID:4324 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffc4a5346f8,0x7ffc4a534708,0x7ffc4a5347183⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:4912
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,6001788925537394952,15570483638824361305,131072 --disable-d3d11 --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2080 /prefetch:23⤵PID:4296
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,6001788925537394952,15570483638824361305,131072 --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --mojo-platform-channel-handle=2672 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
PID:5560
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,6001788925537394952,15570483638824361305,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --mojo-platform-channel-handle=2916 /prefetch:83⤵PID:1528
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,6001788925537394952,15570483638824361305,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --disable-3d-apis --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3616 /prefetch:13⤵PID:2364
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,6001788925537394952,15570483638824361305,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --disable-3d-apis --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3636 /prefetch:13⤵PID:3720
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,6001788925537394952,15570483638824361305,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --disable-3d-apis --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4008 /prefetch:13⤵PID:3592
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,6001788925537394952,15570483638824361305,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --disable-3d-apis --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4760 /prefetch:13⤵PID:1168
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,6001788925537394952,15570483638824361305,131072 --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --mojo-platform-channel-handle=4928 /prefetch:83⤵PID:5576
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,6001788925537394952,15570483638824361305,131072 --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --mojo-platform-channel-handle=4928 /prefetch:83⤵PID:2484
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,6001788925537394952,15570483638824361305,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --disable-3d-apis --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4880 /prefetch:13⤵PID:5280
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,6001788925537394952,15570483638824361305,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --disable-3d-apis --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4076 /prefetch:13⤵PID:5536
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,6001788925537394952,15570483638824361305,131072 --disable-d3d11 --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2100 /prefetch:23⤵PID:2736
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,6001788925537394952,15570483638824361305,131072 --disable-d3d11 --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2052 /prefetch:23⤵PID:1696
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,6001788925537394952,15570483638824361305,131072 --disable-d3d11 --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=disabled --mojo-platform-channel-handle=2448 /prefetch:23⤵PID:1512
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,6001788925537394952,15570483638824361305,131072 --disable-d3d11 --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=disabled --mojo-platform-channel-handle=2244 /prefetch:23⤵PID:3520
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,6001788925537394952,15570483638824361305,131072 --disable-d3d11 --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=disabled --mojo-platform-channel-handle=5668 /prefetch:23⤵PID:1860
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\How To Decrypt My Files.html2⤵PID:3560
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc4a5346f8,0x7ffc4a534708,0x7ffc4a5347183⤵PID:5428
-
-
-
C:\Windows\SYSTEM32\shutdown.exeshutdown.exe /f /r /t 02⤵PID:3596
-
-
C:\Users\Admin\AppData\Local\SolaraFixer.exeC:\Users\Admin\AppData\Local\SolaraFixer.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4088
-
C:\Users\Admin\AppData\Local\SolaraFixer.exeC:\Users\Admin\AppData\Local\SolaraFixer.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2292
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵PID:4428
-
C:\Users\Admin\AppData\Local\SolaraFixer.exeC:\Users\Admin\AppData\Local\SolaraFixer.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:516
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5572
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3680
-
C:\Users\Admin\AppData\Local\SolaraFixer.exeC:\Users\Admin\AppData\Local\SolaraFixer.exe1⤵
- Executes dropped EXE
PID:2392
-
C:\Users\Admin\AppData\Local\SolaraFixer.exeC:\Users\Admin\AppData\Local\SolaraFixer.exe1⤵
- Executes dropped EXE
PID:2544
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2960
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {3eef301f-b596-4c0b-bd92-013beafce793} -Embedding1⤵PID:180
-
C:\Users\Admin\AppData\Local\SolaraFixer.exeC:\Users\Admin\AppData\Local\SolaraFixer.exe1⤵
- Executes dropped EXE
PID:32
-
C:\Users\Admin\AppData\Local\SolaraFixer.exeC:\Users\Admin\AppData\Local\SolaraFixer.exe1⤵
- Executes dropped EXE
PID:2984
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa3977055 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:2444
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
160KB
MD53b1e79547d729708e2ec83bf16a9d1c9
SHA14a4d4084be819e04284e6a541072a89b50e5f518
SHA2563465b92c0b481f0b7f3569c312de2881f43d92e77ef7c51222d4f6606135f67d
SHA512f0a03f86500cb802b036a61a173991f9e2412d8a0746360f9cb1f07ad1e081e4ffa129121fa8445739200fda8c0dfb77ca0f3c1c9da3c69c7e68acb8cb2b9038
-
Filesize
962B
MD5e759cb4c3bfae0594de4dc0df6ee06a1
SHA17e2e404b277190eb1c9a1751e7cb43d7ca36c227
SHA2568fb30bea53ed89493791da18a808faadb093f46448b8fc88dbf20b9d6093833d
SHA5122cf19d1ea2b741718d0f0ce788a061bb8c479b6687b6266effe7c2b7a9d7360b749b83d211f741b5528ca0a5221b50065a867dbbe0959a3a78691c6bb14a9cda
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
9KB
MD5c7227781b7f3e25e8109ce00cf410602
SHA188a30b6fd4d0a124436fcce1551f1ff92ef574a1
SHA256a7c9466e3ee6e8754c5ea83561806eacc3036ca8cff7f25a4f9b18a39d0ec12e
SHA5124eb5ff0a6fb3a3aa567eaca9240204777a9b611773910cf269143ea2b27d3c93adea2627a18b834f6829337436dba252d523fbdd2e5ad564474c9d4bf7e3172a
-
Filesize
9KB
MD55713327779208b66c79814943f8ab14f
SHA12f13230851bc631a27106548a3a937c4732f1c78
SHA25620aef0d76c5629e3f9ce0cf8684e0354cdc19bcd1dd8ebb6fdeafdf25f0ad07d
SHA5121a3062dddaa9f0c8a35cdf208bd59dbe1c0d2abd89e6a9fd356f961e11fd728e8c392fd0911087e7f576f43aa3da12a7524ab37ffd9a8da93b930e6f9085136c
-
Filesize
9KB
MD5220a87da0728eada561133c7aafda19a
SHA146930e2e06c6749e964c9ce8a66ae21a78729f0e
SHA25623b5c345136df59089cee81b8ce25f84d982b9f9a7ad4a194f2908d6fd0d74a6
SHA512393c1c593f9e822311274596f3aa47b32a102cdf2be44fa423e56b2bf6b398ca7c5ddd7b1bbe8ffd6db49c650c73d87fbf5a2b0016c190d5d30388f9f4c9c81a
-
Filesize
9KB
MD5fbe408c0a1b6873c891173fe89237591
SHA1d7c86ed813234c76d7386adf77f6054af17c49c7
SHA256a8a9e79f02a10b17fa0f54ab93899f55ed6a5d14bb478d42919aa0a63e27a24b
SHA512a7ac3ac3b6e64d85d8c6c42862ee9d78ca1c7de9f25a4eb306a3022d3faa6babd5a28fe22a54d5dbdbc326f5ae3321ee50907acd6e6bb7fd2dc04112239ed391
-
Filesize
9KB
MD5c5780b648a67097477158a1d59c7402a
SHA17feceda7f5fba4b847429465f13c93c584db647e
SHA25625114bfaf86928f50f65f4d82e73d89bdc31757b063fcdedc1a22ca770df3fc6
SHA512d4eb7292124b9c083ff73946d0aea2d6624a443d4c73f60808f69a1aa143f73af4d7ad4eac1bc006181a5d9aa3726bdf7ed8bae9aaa0f52ddcc79abea6381367
-
Filesize
264KB
MD5056b952a1de6e62bc199a69f686e3ebb
SHA12b121cb2f7749fa8ac691ab18af8a10bedf17331
SHA256e7c61c6482f100961de6a2e8f40d7c826199caa10928bc0dcf06ae1978050e06
SHA512eee3dba3d262654f858654da9fe7fe7533af5532919a43433b72f70ecfa1914d5307bba8cb61a235451dd915b9f948621306e5e5e298555fcdae66c7a6692df2
-
Filesize
99KB
MD5eb9d0f01cfa953429dd884d3735652f5
SHA1949c20b72921ce99901e4f719969f8d2d7c4fbd7
SHA2560b6ed9d57ad3573e53a9f0f26bad5a2b4d5b655e3075befa90d8fdec4cbbec92
SHA51217880851f9e6b557d655d8d59b6da80cf0eaa75f338d6265e3ce72039cb2748403d7598d71f6052df83785de8a419f2a9920c15bdaf157040d387840a82ecca6
-
Filesize
99KB
MD59362874d6c107bc211772160d5d39de9
SHA1cc39663f706677c70d3aa0369088c43b4ce90bf9
SHA25630b1af49509b781fa8bad84a807660e7dbe44a75ad8c43539639c22c61437ac5
SHA5120258872bb85c9b386316e140740c9c423a9198cb5bdefd1a66068ec71738c3b6a47a86bb3d144f8d04845633edc7deae8772a54c16f052afb7ef0291b6435ee5
-
Filesize
99KB
MD5881363a2843c4bf2a3874d180ff13ab5
SHA100ea5aac7e8802eb7bad970e6a2ed060395bc282
SHA2563c64e47bb8ed037b2a389ec6706376fdcd51c7217ae8f1ca712ff1203be5d5fc
SHA51283f61a6dc0df5cb5606853435b656135233857ab0cb6c463031e6f15747237ef194fa10f08b543d23a7c5e09d21ac992070a97a6c1967fe97d283b1d06ba6a9f
-
Filesize
654B
MD52ff39f6c7249774be85fd60a8f9a245e
SHA1684ff36b31aedc1e587c8496c02722c6698c1c4e
SHA256e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced
SHA5121d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
16KB
MD53116632b5cce5c8477c694b708a9d8b6
SHA11711664c9680416067b96dedbd344b057b88f4aa
SHA256b4335dbc7e97d271093ec652708e865214b03d1115628cea8255e5d13be14350
SHA512d124de1b88e858d01cdd4c6c432f417cfbe67716183581b28be3ccdc60b67e09deb0268453e79931184df17cb491238a1b3fe43f71892515320d972a48d1851d
-
Filesize
16KB
MD5f9abba11224c1ad45bcdaa95e882842b
SHA11c8bfbcb53d611f72ccc9b80c04eb4a1e45a2400
SHA256bb7428477de5d502b5414b3123ae7bcd5aeb61d37da8492318a9a6b45242884b
SHA51290a9a486a505a44e012d49104f3d87954f3c729a800939cc9b127f283eafd841db8c019ba30b96ab2ebed0ce4226af2147417b41242de2dc2d600af119345926
-
Filesize
418B
MD5d1880b52ace6a160627fafc5756ce857
SHA1c99595518408c831908ca1ff7fcea71c90984b45
SHA256c2b1dba54b609dd99e81dca60e6bc1450684fe29c1d6ffc2a69aeab533e313ff
SHA512d404c20196f80e88abe0c94898c6368360520a5de17c6962613f5f14674cc892a898fd31ee15dd698ab8e17e87b54820e68717736ec69054620b2a907f0b0b67
-
Filesize
552B
MD5f682ba71a24342ef20ee68ce4c4b48da
SHA1771c5a007e21b68531bcf7c34f7cf3c541f42ccc
SHA256b6f255a42561d8ad9fbe9497ea1d2e85b2d6632a66e16d58a2dfb6a9d1d3ca87
SHA512d64f34c91dde55ec2c85b7c6c7c05c93ade1d35acb3d1a87cdae8266316ae7e69aad207220ea02ca3db0548ae4ab9557cda8238f56b3fbab7f2f738131eb8460
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Crashpad\reports\008e3cb2-4581-4b0f-8f53-0e4c771166e6.dmp
Filesize6.1MB
MD58dbbd958f83f2a2dbc55ebb2ceb3732b
SHA1d2167fbafe884490e128ce6a67e75c7d7b443c20
SHA256f446a9191b64d7abd0ca68965b4f3f667f228492db3951d4b553e2249cf89c46
SHA5128f34cad880b75dc4bd1b31c964bfe2e1e458491ad3012c752a15c2634e25eddc260c04ae7a23265741cb27dffbf16d300c36595086a503424f90aec62b21fbdb
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Crashpad\reports\13812cab-814a-4649-bda0-ebe2de53bebe.dmp
Filesize842KB
MD5c8c20993ae7ffb4e9b3b609040c02558
SHA12512ae87c0fe64919e8d28a7f24922f82197651d
SHA256237d4a1ffb063a7d4e4ebc16ddd6433dd694f193ab175f791780010c5c975540
SHA512ece0a6cffd292a18f3a5356b257b50c33ff258bb0947e9229f7f56b69105e5cfe13df29e29ee4c8c5408db718d14c59e4c93c7e6cc03c8653d2e790829789fdb
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Crashpad\reports\186828fc-bc00-4488-83eb-25cfbfb5fb4f.dmp
Filesize842KB
MD591e690fd40a4283ee6f9576c1a636b39
SHA1f82cd8a810ec7ad7d74b6b45d84685b1ef4d6063
SHA256be3bedec998356f5ce6dc08443bba881736e5b1cb69ffdc71fc5915fdc80f715
SHA5124e93b648b470526f2c915f0afc571331244d44fb687278143498959e06258493ed10c4d1d3b9c0d293a0fe65b9d6b77b79e811e0f327a755a198ae122a9f626c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Crashpad\reports\ab40791f-4652-4d6f-ab68-ae661df8ffb1.dmp
Filesize842KB
MD520ed30e579c7bab2bf7505bfc1e15c45
SHA161f688f063c2d86cc92390f9f590190c370768d9
SHA256552c3d143a6e0d2a0ad5669837399f3d68eba1b2d56ce0bb8da3e203b0d17cd3
SHA5123c76fe97f9f19c11edd4e8f0badc9b38cd4dbc2f32517cc601601b8e7e6534e2514ec61fe419beac6d841f808e84afda5d2cf3b2ff6c29e3e33f0cceefff649d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Crashpad\reports\e1fd1117-aaaf-4c88-92ae-dfbbadd30750.dmp
Filesize842KB
MD5bfd9aba0776e55dcb8aaa5eb70e97fa8
SHA152330295a1d677c23012da77775d3fd3368cbb3f
SHA256ee8778a2bc59188ef52e149973e9bafd10f12efdce782f97784322ae3e0d9c30
SHA512e60e3400ec0397b12e255a7b0d2f3fcb38fb6d69a2b569f8b6ed561443f278b3e6e5fc4972add8f4a1d7d703de0cfa76a9d03ce04e6500de6999eb41ce66cd94
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Crashpad\reports\ecc4cdcf-f711-4a7d-9c58-66c1bbbb6650.dmp
Filesize846KB
MD56f12cf4f85f34123731df1dca08441df
SHA1b26b90f2f257fcfcacd84894cc04d829949060aa
SHA2561651850af5df753944e885b0eab4b752b596cb4d9e6fddfab395c0946162bd87
SHA512e7b02da792d3201e02496038da2896cfabff05ca969e245a5c5fdc98c2eb0c79e948457aff5d925a60962627f2b11d6fc62f9c47d60ddfcc449206e798801da9
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Crashpad\reports\ed94f25a-5f77-4fdd-ac5a-0824c684a19c.dmp
Filesize842KB
MD5e51f06751ccea47f58af00a519f22daa
SHA12e5911382b40d19ed8473c9e20e3b30339761bb8
SHA2567ea230d9bb55bbf8b943aab26e9615a7a513c62ef3ffdabace49c1ba4a7ae28f
SHA51230a897e4b816b3e5e6bf33fe25735f87fde3501144bcedc5ffe4c0f9ff4f5b5d25783ba228a9a0d532c56818293218111f8f594dbdcbb17643a5814f8ba326a2
-
Filesize
152B
MD5501f15e52b4b71879e8409455cac6d18
SHA1a622abc49bd7c08d6413f55579527cff9ecaef9e
SHA2566ccca8b65e3ca8cbe95c52985eb153b39ccc0ea3200bfde6b01a823975c861d5
SHA512279a9112d0a05bfd8217dd19e6a04e3d49bc2a171af631300d1fc0f57eeebd9302713e593738d1312dd04c635d90235e27156db6bf4f56f1fe6eb30b01191836
-
Filesize
152B
MD5a720b09762b9b6e7ad667e84e7f9ad4e
SHA15e0d244b9012e13a9d9422347661e23d64c4dec7
SHA2568f753db65f73cd3b0c8454bdfdd05fe9ab711a86207bcf3c733aa2d322bc01cf
SHA512fe855256f0eabe1657fb0cf2506bf63ba38dd0e9db779ec93862c9410992679ae05fa2565fb3a0ba2d6966c01f44ebff4c9140a983ff6e348f79090fd35542f0
-
Filesize
20B
MD59e4e94633b73f4a7680240a0ffd6cd2c
SHA1e68e02453ce22736169a56fdb59043d33668368f
SHA25641c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
SHA512193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Default\5d26ca8e-a849-446c-aa95-a34d2ac64c84.tmp
Filesize1B
MD55058f1af8388633f609cadb75a75dc9d
SHA13a52ce780950d4d969792a2559cd519d7ee8c727
SHA256cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
SHA5120b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
-
Filesize
6KB
MD599a550f96a67eea2689fedb2908b4388
SHA1905e55fa5f77ec216d845073df6450069650823b
SHA2567d3f05f662582bf57ec1bd765171ee1c424143b54142efa685a1e161b2641516
SHA512e66f6a364e3451830429532017217a684f900ded0fe9e1ac5d9e741cd2a408415893fc22bf5e142fd2ab0edd9421197419d263fed235a117677c6cb449d40ad2
-
Filesize
24KB
MD5852d886f30a60b001ee9e16d15da655c
SHA1713ae02473e2af931fb4455db3be07a00c734e97
SHA2560c05a4e24bafde15c1c9cfa778ac25eb5552c22b1a589b7b473eebc752a6ca68
SHA51209625a70076a264b7138dc14f2fe81b0e8ad6cc0ecb3cc4f5d5bd73eb58fab1e2528c5e3a3a40837740895a5a694b94b2fa174a8595960ef122823a4132d4f73
-
Filesize
323B
MD50b3b9474b6ae312752c2bf1b7992c3a9
SHA1fb4e52da92bfd5ddd4e71635ae717356b57818db
SHA2560dd2892058c5ef992a841c4c027344245e39899f15e868e5a360d4847c3d02dc
SHA512001f969519fc02b969ad7474b3a4989e916d5615be2032dfe83bf83856b88bd8b89bbe2bf8c105f383f2497422e7ce437f439effbcfd0da07b6e11e1e1dee6cb
-
Filesize
116KB
MD5f70aa3fa04f0536280f872ad17973c3d
SHA150a7b889329a92de1b272d0ecf5fce87395d3123
SHA2568d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8
SHA51230675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Default\shared_proto_db\metadata\MANIFEST-000001
Filesize41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
Filesize
184B
MD524127606dac5cc6142848b0387a3afb6
SHA12dd825cba2ded5f73de2f70d3056764788d6b3cd
SHA2567680b8117dce679eaf37a1c4670506fda78781cfcd994295b5108db18fbbc3a8
SHA5120c37b62b580255716371554cd47a1d7aa15a92b5376ff66d42cacf1e2fd95c027e7f8781231c4b0d9ccc17521a94f1e719cfd2307853d6d7d72dd8155ba6868b
-
Filesize
72B
MD53f66f244278461dd07a3feb77a17712f
SHA18d570b550699ad0f248ec98b5d678f54248c0a84
SHA256203ce5c7c1680c6e98f5ceca920e9d904122a9e26a743191e9b0fe1f6584ed60
SHA5128d4733222e2e0bbc18370055d0602d0389e7a562887e97b2e54073017ffea024e9b1341ed95e28883861ef5e0d4fa9d27ed0894912ffe167632aed2e4cf53e7d
-
Filesize
152B
MD5983cbc1f706a155d63496ebc4d66515e
SHA1223d0071718b80cad9239e58c5e8e64df6e2a2fe
SHA256cc34b8f8e3f4bfe4c9a227d88f56ea2dd276ca3ac81df622ff5e9a8ec46b951c
SHA512d9cf2ca46d9379902730c81e615a3eb694873ffd535c6bb3ded2dc97cdbbfb71051ab11a07754ed6f610f04285605b702b5a48a6cfda3ee3287230c41c9c45cd
-
Filesize
152B
MD5111c361619c017b5d09a13a56938bd54
SHA1e02b363a8ceb95751623f25025a9299a2c931e07
SHA256d7be4042a1e3511b0dbf0ab5c493245e4ac314440a4ae0732813db01a21ef8bc
SHA512fc16a4ad0b56899b82d05114d7b0ca8ee610cdba6ff0b6a67dea44faf17b3105109335359b78c0a59c9011a13152744a7f5d4f6a5b66ea519df750ef03f622b2
-
Filesize
319B
MD5deb7e74e4f6694d41e324928f5a2dace
SHA1e846da746c7515d7cc2f261479d35f3b764df819
SHA25676d4b0e7ee9ee74ca6731e6137adc890c188611b00884c55773885476cf4fc4f
SHA512fe334866943e7299b627d61afc586b113f1b737651e3074d4d569a25a92c28e6d36cda4c390dd73d20a1ef810078740ab04855d4c0aef8e552d862479e54d11b
-
Filesize
124KB
MD524c8470b7f78c805930c809d650d4f29
SHA1fb0f8342f32197926d6d37deca3719ff06b09a6d
SHA2563a5ba69e1321203163547b003d2f3bbf5f11cfff50e864df8db54ce4cc39e605
SHA512d22ad74993ea657d0907b4be05bb7a4e00fb1ab4e51c6150ab1d41a8f7721e77726a1ef19a23f7fe87ce7d20e0ea5c85af53cace4d56a6082decbb5c5ada6f91
-
Filesize
8KB
MD5228cf90dd19b6b420e1d186af8896d72
SHA13a23a263d1dca3246d2ac8a669b0b0b0efa9f1a7
SHA25633e1866e50831526dbe1105433bfe9a46b8a537d8e5029840d3b49e065eecc1c
SHA5122a9e85eba6fb170498869b3184d4c1c57ce06ba201734b8c3c2038bdec5089191590e03272dcf3ea1735d12792576e352b76416ac95d1ac3b49fe7ce0fab32b0
-
Filesize
334B
MD59dde91b5ef0417606ad36253a76739b5
SHA1b6f9485b8ad5d1e134a2fb396dd61e095d0ce67c
SHA256bdf4121ce34dce5d9be85392236ad1aec4fba7f6ce095245bb56fec2122adcff
SHA512dbce5b3efebe42f355ff67884f2a679fdfff95ad542faecea422307e42302806fabcd62c5d14b8ef12a78b6a8262bc26e18f618b2d5fa5ec5a756fa506647b59
-
Filesize
6KB
MD560747cd80f534794d2ee0addac6b4302
SHA1625d72ceed33a11e4ccd329810bbcb54cb6bbdb6
SHA256ce13b069024bd205614cf3edd988c5019260daf54b3c0805e46ad0dd0ef7a276
SHA512d0821acdc48f7682b17ab4742af67ae6310734edb155c10136bbe1f64014aec0e66cb1889750e58dda00fe4dd24e7070457cbb4e75715b3afd5d7c445342419f
-
Filesize
5KB
MD54db849673b4d557fd221522721e9a2c9
SHA131b41f8d4f25ed1d947d7dbbfdf5336ff48e3f7a
SHA2561a183a93b55611fdfff48dc8c7bf7025d6e9804cf280c1c9ab8da5005360825f
SHA5129f82753ed33eda7debc5b61c8b4a58145c05a1f784924e623bb95c42eaddd4bb603330bef2bbc6a7ecb3c2037a5c52bedd79c668f018cac0670e0351bfa69385
-
Filesize
6KB
MD59c10505402b61285db088d23a7f1ac07
SHA1486653857782d73dc7efd3fcd25eddd673e4a258
SHA256c2ed8d412085a78a6a1dacf95ef9cd042f5b60e53359e7b869bff0e781249ecb
SHA512547352d94fdc91eaceb9f053fe993c5bb7bd06894b44ac13b3d852c0f2096bdfcdd463076a981b6b9c19b3fe0ec8d01df0c71b02f8743e1bec498993b05f4613
-
Filesize
6KB
MD5e7b46e54636ba842bf82c1a02f741b4e
SHA1ed5bae428f9d2aa367d6662c996903f8f41e5110
SHA2565cc9c45f2d848d419fbebbeab7bf576235cd58547d314a378c53cea351290fb2
SHA512a96c4f3db424cb3fb257fa77c7c6b82a8771cc65b1ab0eea0f55df58270644ba8e647415c868cef28885f1d4fab80f8f5b9ffa54cfeaf5eee28514241f3bcabd
-
Filesize
6KB
MD516483dd01e18eb31b4b7561ad1d81085
SHA175a2d7f9121a378dff5b4e05f073795de0578d2d
SHA2565951f0c773abff9743ce421e90d35ddaa17428565f54b7d0cee5ac32b8c4eb85
SHA51236978dfd131183f3b94125eb455a4044cedf003599b3859128e60729c9cfc04f9a0eeff657f3fdd05694371ac456bdf043066214ac876262710ba85c2ec038e0
-
Filesize
99B
MD5ba92e5bbca79ea378c3376187ae43eae
SHA1f0947098577f6d0fe07422acbe3d71510289e2fc
SHA256ccf4c13cd2433fe8a7add616c7d8e6b384cf441e4d948de5c6fc73e9315c619f
SHA512aa1d8b7eb9add6c5ed5635295f501f950914affc3fa9aa1ee58167ed110f99a1760b05e4efb779df8e432eab1b2a0fc9cf9d67a05b2d5432ff8f82c620a38a62
-
Filesize
322B
MD5e3d56e98319cc7fa8e7a9b675548493b
SHA1d1606bfaebd768d718212a032837c69e501cf606
SHA25649492535092412ffee6d4fb27cbe627cf18a7d1ac1a1d3dfac182a407195d00a
SHA512986583ac4265f41de895182b33ee3fec28985015640510946ffcc8602c1851e220b53aa173e08ce0bffae4fa33a5e71080aa2728a9e0b7fb9c45c9c5cd522df9
-
Filesize
350B
MD51d4bb4474709796a6484ef140089788c
SHA17ace846d1f786df462b6af030e1af5456d21ead3
SHA256b582edb4c5cafc90ff37a897d0ab132bf863718b8a3666d4d234605f927972a0
SHA5121649a9f272d4320b3c7d254a9bfdbe704df90721a6e1f2a2de036c10d7ff18f686cc1d22e0c90e312022507da0c5b48263866874f296688a6d57a0fc7a5fbc59
-
Filesize
323B
MD5c947e2aebcf7082e7e7e3cdde81f0e6a
SHA17ad0083edcfb8c5680446348eb57027415b19816
SHA2566e426bf140eeea27835110e5c2b661f8ea5c341a4a6ff0172f3b55e4c3da0a93
SHA5129917554d1acda5c16937bac9a6cb9e76ec47622f2a5617896c1d76bdc225427c009702b3785fe2556270c44ab496884873e57b29ddc3e1e4ce64cdf78a1e40fd
-
Filesize
128KB
MD5613def7cc416e5c92ea0623cb9a10473
SHA1e0808dffc5b92f9a68efb5b9d785bbff1b93994b
SHA2560877dd22ce5565f51a548fa4b364581e7a4f26c35401fe76276ecc9f3e54daf9
SHA5125375b633708f6e0714b1fb2fb0a6e0c4d361a6032cf3302acf32744dcac3ac32a94d86eb066f80d4cef399e2a55db77149e98e9a4ea6ce6421831421362b7ea0
-
Filesize
57B
MD541c7d1373de8e7bd508c548a70910e51
SHA1f919499049571c75c7eb73fdaaa5198e6dd641b6
SHA25699c59cbe7db56d56a286485635e4467004641c6275e708887dd35728eb05109a
SHA512c30cb4ea2478fd816b4a160626b08cb63d2b9dc50eab694607d44d05117e6af8dd707bf4e14cf001cf69007a654ade55149a61ed07f9de6a9a2edcb51afa0773
-
Filesize
319B
MD5c33211a1c981d8cd7261e6c071b30e1b
SHA18d7be925015066db7bb2af43ba98fa72cccc08d0
SHA25661e91428e97e08e9b17c511630cc252bc59cc83ed6c73167d355b5ad2a05d5ab
SHA5128f4978ea2efb141cfbee741beb809a3b01692f59f70338c9eec27f53f6222001b973702558d7418010c9041e166dd13ea1919b73e58bb14caf876ba9680460f5
-
Filesize
160B
MD52e19a9040ed4a0c3ed82996607736b8f
SHA15a78ac2b74f385a12b019c420a681fd13e7b6013
SHA2562eeb6d38d7aad1dc32e24d3ffd6438698c16a13efd1463d281c46b8af861a8ce
SHA51286669994386b800888d4e3acb28ab36296594803824d78e095eb0c79642224f24aca5d2892596ac33b7a01b857367ed3a5e2c2fb3405f69a64eb8bf52c26753f
-
Filesize
337B
MD5a0e9d50dfe241e8bacbfde35cc569dfd
SHA1d181602182cf832023ae5471582edb38c977faf2
SHA25640b28430410017a171a0bdacea19d018d0bbfa3e75fcad6f1163e0a8e29ea8d9
SHA512a8834b693937a4aad87c48639e84f9750ab4415bbf61eb7c58861580d28ca40baea92ef88a67be07e55d9ecf887a8599f9d31e01a02720484ac94847575cba04
-
Filesize
44KB
MD5b622ae214d410389f9f47b9c261f9000
SHA1af3bb9a655d349f56568f5d9f58979f2acddc38a
SHA25646d37bb15549f6452f9e96e692af8cd94d1ed4bba8ec92686cc8b43579e8458b
SHA51230bf1ad3d3936a41b7944bdadead2b8696502d2cd6d5034abc909df0c0fb054081be4680d6c73bae12ca5b6c7ee9f5dad561fd3287ddffd2ec9f1fb30c2fedfa
-
Filesize
264KB
MD5bc886700f15c286d7c21f263852bd248
SHA1eebf6a1cb0cd98a6980976838ac14792ddbcdbe1
SHA2569ef1cd03fcb831f1739d34b6271780a99a793c6535e54ba291c43e128a441e67
SHA512d3bcb6357f7844f0c6fe97622b53daf5918061fa5496b8d3441d2962a3ba005d1e4dac720862b927e9564ec46cc7986d2a15ccd15e3a71f137caefb753d4abc9
-
Filesize
4.0MB
MD54459bf26eebf0293b75c624cdf1c6b23
SHA12a0cf63d7d2a2a729b1b84e221955a5ab46f2e47
SHA2562ddd13a6fc974d25f11c33a905c39ba8b6d266f7c58a93a41e5ada5975c821c7
SHA512f9246c653ea54d90833734d359ebba743e97a7978639a8c48f64f2b026affed9281e65a44d12af2224e0493df1e3ca3dfd8fd101bd4c5170471b5dd6dbaf8f12
-
Filesize
11B
MD5838a7b32aefb618130392bc7d006aa2e
SHA15159e0f18c9e68f0e75e2239875aa994847b8290
SHA256ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa
SHA5129e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9
-
Filesize
10KB
MD51c3a5865f3021173bd1e90e3d559b6a4
SHA12539bf42191d42b5e79754dbc5df2460c79cd025
SHA256c68c6e72026ce68d64929c436fec36887dcc0b38515c72dd7d3736521303113c
SHA51277c579c55114fe6b42a4888bd01e3f5087052d3a81abc82460915c8d8bafbbe714785fd4cb30ed821c1dbc63a63bebddefd2c1754a68d9ab7901009e7dc1d3fe
-
Filesize
10KB
MD559680d00db6655833fbd28419179370f
SHA1686a9e52b03d403fe956ecab64d10202893f9dfd
SHA256fc6b3d4b61833c444cc09248cd5f82e910eafef17d78df3131b6560c835fc5ab
SHA5126789042b7bbe888ce165d4b4ea39f5de98254cf2041ab8e25c5bdca27814d14318092126c83bd4fc9bde665cf0d3de50bc614036d3efdc9f8958062b5a7a1093
-
Filesize
20KB
MD549693267e0adbcd119f9f5e02adf3a80
SHA13ba3d7f89b8ad195ca82c92737e960e1f2b349df
SHA256d76e7512e496b7c8d9fcd3010a55e2e566881dc6dacaf0343652a4915d47829f
SHA512b4b9fcecf8d277bb0ccbb25e08f3559e3fc519d85d8761d8ad5bca983d04eb55a20d3b742b15b9b31a7c9187da40ad5c48baa7a54664cae4c40aa253165cbaa2
-
Filesize
944B
MD56d3e9c29fe44e90aae6ed30ccf799ca8
SHA1c7974ef72264bbdf13a2793ccf1aed11bc565dce
SHA2562360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d
SHA51260c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a
-
Filesize
944B
MD522310ad6749d8cc38284aa616efcd100
SHA1440ef4a0a53bfa7c83fe84326a1dff4326dcb515
SHA25655b1d8021c4eb4c3c0d75e3ed7a4eb30cd0123e3d69f32eeb596fe4ffec05abf
SHA5122ef08e2ee15bb86695fe0c10533014ffed76ececc6e579d299d3365fafb7627f53e32e600bb6d872b9f58aca94f8cb7e1e94cdfd14777527f7f0aa019d9c6def
-
Filesize
944B
MD550d3033f2bc3a3774c469d03e71a79a9
SHA122027b1d52085de99b3bffa276530fea5d961471
SHA2562987e99ec7fa17bd4ab7de3cb4dc62645e1052012a5a357904d6fc6db9054147
SHA512ecf7ab1a9e4192454a3e24c60453fd702a8c648e00078fc933b9182f4a3d3c10c6f5da622a5729b35727e6ddc8837029caddcaf76f56e805b9744253b56da5d8
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zrrtvxky.default-release\cache2\entries\58EFA56DB4BFFECB0EDA547894BC9A057159E22F
Filesize13KB
MD5f2e68c70e846c88ed613011c12db54a1
SHA1448f2c92fb1f4bfc34b4b875d70b8798ce527846
SHA256a90a8d8b8d12d68c2d847035e3364d693fa4c34cf62ab42c8b1aa0d2b33c053a
SHA5123c09f946b2b431cfa66f0f83079de0c8fda19da3b1bbf96ec0c614838f02ec9379ad91bfa50d6447aac884832f1a1d24e2331f655d1d5784efdd8b83c85961f8
-
Filesize
86KB
MD528b71b14a91dc144298ac43e725d27fd
SHA1e6b8bd585e2dabc43d2dbbe6352eac60bdf93ac3
SHA256c3ea1603378e0bfbf7fcc64643144c0c5c699bcffc8505b68a251d00097a0c63
SHA51258446084d1e6365d017a0fac0ba10877b7e96a7dbacfb99dc375a65ce5716611cc341653006c043cd3968556c1d2e0559ebbf161c5c25db18ae23716654218f7
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
479KB
MD509372174e83dbbf696ee732fd2e875bb
SHA1ba360186ba650a769f9303f48b7200fb5eaccee1
SHA256c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
SHA512b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
-
Filesize
13.8MB
MD50a8747a2ac9ac08ae9508f36c6d75692
SHA1b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA25632d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
SHA51259521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
Filesize5KB
MD5747d17805ff44fa5ff8910458ab68d41
SHA1080ca63067a085d985aaf17a5613e7fca828ffd5
SHA2560d701e7c08e9366084a8c40306d00332a70c63434dfaca556dacb318cd86d3ab
SHA5127b7a937003c5a2294e358f6310a07cdef9abe70a4b2999a6cebbb386830da0524bcef792390d7f975ff8e95d1407433f698db590e33cc9d52ad509437febe518
-
Filesize
988B
MD51456fc00a0d881711c9af65ef9d5c876
SHA1252ae57f2d19771096c67c2be40b04b73079c352
SHA2567a949b014047a8c083431af3099944b79eba09550cf726fb5ce67a150feb0dcd
SHA5129946f611113604fa6a6fadfe0889e003c951585156ce46e87fc7e0c2c6e4bbf885d0edeb18139a804fa1a66db38baa6fdcc5c4a598304b4101366dbafb2865ba
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\AlternateServices.bin
Filesize8KB
MD5f52c31b95a4bc999f78d95c0392224fa
SHA10f47c676f6ca51eb4644e59cb41ecf932192591e
SHA25687a129fb827a8c3a388c226fb1d0e6b70443def4eacef6734a5ab48ba990f8a2
SHA5127976b2083888beff8d5617450ace8d7d60ec326352d29fa02969687e21bf57c4baaeb6ca27af7950096db9c3c6a33f5d8996cd3f2dec42ccd76402e40fddf4e8
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\datareporting\glean\db\data.safe.tmp
Filesize5KB
MD5abf0947fce6fdc43f9c71ebf6da83043
SHA18399a3ca8475319952e1b2bac194b02e54776c54
SHA25670a01521a50386a8813baa68036ef69a41900ebce493f243596b2b855bdad73b
SHA512f8dc68d88da6c2c62900149e1a1991c5da650dfda60d6080bf0c01dc2a4fc9901c2309380d01e13f5775de8efb3719a4afd8ad28f42c3f8612ff8373f0f51fc3
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\datareporting\glean\db\data.safe.tmp
Filesize13KB
MD5b774f06501eeb429e31e6687b6cbbbbc
SHA19e09d8f374d7a4505c86194ad028f5e22ff57cae
SHA256a39dd4387bc8786a40d5de713d3ab437c2b2a095dae0b9a2121229619aec106b
SHA512d09034bdee0d8666249fd4ac49dfb2629b8d3779c1bcafe4cf4a92b7e833ec776172fbe1b4238992e398aab286c1e9493e2ba8888d601c1ed0e2939897fe0096
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\datareporting\glean\db\data.safe.tmp
Filesize23KB
MD5c25cf61a168cad6bd3bbbb3abaf4d919
SHA15ff04b8ba3afb724bf8540e8aa5a81826fe3814c
SHA256cffbb39256be640739a77ae6876f10c0af945451bd9d2746d45c2de305ec2617
SHA51248c68398370d6957d1362930cdcb0d87e04934db041feb2165b9634c9a7cdfbac743bcfddc63579c2e53e4b1485d6e4497581f9495796452f1166ff7828058c0
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\datareporting\glean\pending_pings\011096db-f604-4fcc-b524-a52d7b5a533f
Filesize27KB
MD59b1589e09678847f775ca72343208812
SHA13f427e3bd03a26ed69f4af1cd9c38f367905d9ef
SHA256906f64c6316c70781d8d8b47671a843fbd0e6b3925bafd6963744e4b25f0f04b
SHA5125385d7c3b1a19591f5f4cf6033559c2103ae06835e6954f80d144fea04e8856742aef6bb5d5ff78cbe7da223c8755492d993327eb2413a7d21cdf0d2b410c6c5
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\datareporting\glean\pending_pings\03eff66f-6337-4661-b938-428245fcb854
Filesize982B
MD54ae85e252c419a6476eb6c5430fba88a
SHA1616048e64a039843709f8b8644968b1cf7087f79
SHA25609cc5992e54d8c8d8f0d1e4be0e868b8242f1448a5dc586f9417261ddebee433
SHA51200968c88217a95e3b4b9382f5735863145ded7c1c932fdb1e6a7d69b3f7e2ff670d4f3619c06466e2af78d9184fe8bd6a81c0e29d08afd68aaaf9c583b4684f9
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\datareporting\glean\pending_pings\63b003b8-064c-4ea9-ac8d-c0b58f198d9c
Filesize671B
MD55a3849917c919cf52e625c9cf7f1cb9f
SHA1307cd7d28caf80d4da1b72c91c4e8921eaee1425
SHA2565a3dce59916d290a96496929db5030f7db92476ae09cd991d1b65c3a42a2f6aa
SHA5127ae6d92fb3268d1e131597fc00f4f6ebc0cb401636723e188c18746b783928ed4120a12dc602eb7e1647326bf3aff88e5ed28cf6dc9ebcab7bcd9e2da0f7a062
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Filesize1.1MB
MD5842039753bf41fa5e11b3a1383061a87
SHA13e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA256d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
SHA512d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Filesize116B
MD52a461e9eb87fd1955cea740a3444ee7a
SHA1b10755914c713f5a4677494dbe8a686ed458c3c5
SHA2564107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
SHA51234f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Filesize372B
MD5bf957ad58b55f64219ab3f793e374316
SHA1a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA256bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
SHA51279c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Filesize17.8MB
MD5daf7ef3acccab478aaa7d6dc1c60f865
SHA1f8246162b97ce4a945feced27b6ea114366ff2ad
SHA256bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
SHA5125840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
-
Filesize
5.0MB
MD5973ac60bd4fb741e243e61749e39cb5e
SHA184ddcc43de65be7ad4a927bd6692962fcb614347
SHA2568706e6a00042cecca21f7efd3513d2514c6a2377525c9150733008306e9da9c1
SHA51223b3183cc5b72e5f97a026553d545316a11bcab0ce1ae2ebf4fcdda93a0222755bc5269b5ddcccb4a6da568c636d4c920bff305f5c1c5ff96f30e9430a503fed
-
Filesize
16KB
MD527b674cd1062569a5ce6289d70cde2cc
SHA19ab807074a3c3b15ca6727e7b2dc12710eabc3c2
SHA256c3313715c65ccdb0761e5c0df5c43cfff5e5d47cc14f1a2619016f7433c6a9f0
SHA5124cdb744d3e5cead49b45ffb653ae4c4d489d9e68b65ec2bbd6a1cc25363970352b4273fe69caaea132083ab4009fda3b008228de3b45590bc684972f33ff9cee
-
Filesize
13KB
MD50f8f4e76147f363a0d22dbd19abc8e85
SHA1d76a34c8d80853621a54fbb4774e59ad1b79bb3a
SHA2568b0728dbafa8cca47c89d1d21b297e2e01ccce44f0da5d40a9c175ed0842978e
SHA512509667ad66b35bf9d77217e5b55c35caaaa162261b24511fcbfd5bbffed6a9a247aba7e7bc0e127ec7ffb92a8260ff2a19196a56e6d0e481389ee5605236a87c
-
Filesize
16KB
MD537a552b30c99c6cfd6cd99e23eabdb9f
SHA1ab0a528f3166f667a303210a23d34a8ace5ade96
SHA2562231e6e55bdd59a47c2af4e42b3fada2c2055d484c82d700bb297e8fe750125e
SHA5123df61891bb0d7d3b28cb67d183b5b6b75fa808ad2636289ef12fdd2e37d67383dae287c4f48c842dc5807401d0815e0f40fa95f7908028d698f1a2e71aa5640d
-
Filesize
11KB
MD5022aa22afbc5e7438f2ba57d1da8a501
SHA133c4b6a266ecec6dd7d7e84a831919c6e905c474
SHA256790c3a8f7ed43873f6b81e175d9d9464375e55781f819059c385efec4a6a97a6
SHA5127773c7331355785e91ac710223415006ae5e61f78fa7b15c8868eb304338848343ab53d5ff6a1ea248eda1a6c023fb9f2b77869f24c51a339b338cec20b083b9
-
Filesize
11KB
MD58481aa5502b516806e984a49c40a0328
SHA12f9dabecd4d8625876d4b917791fdac641a0bda6
SHA25621d807979654ac708ed24fe09511b547f2ffb5f39d2ac16be723094554ce7ef5
SHA5125c3f268462bf8c515ea86517bea089e0a6298be06a131dcdd7cd483e5fadaaf6952de16a4e1255976e0a4092824af1341d5493f7cb202acc7ace7b3e8ca9a0a1
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\sessionCheckpoints.json
Filesize181B
MD52d87ba02e79c11351c1d478b06ca9b29
SHA14b0fb1927ca869256e9e2e2d480c3feb8e67e6f1
SHA25616b7be97c92e0b75b9f8a3c22e90177941c7e6e3fbb97c8d46432554429f3524
SHA512be7e128c140a88348c3676afc49a143227c013056007406c66a3cae16aae170543ca8a0749136702411f502f2c933891d7dcdde0db81c5733415c818f1668185
-
C:\Users\Admin\NTUSER.DAT{53b39e88-18c4-11ea-a811-000d3aa4692b}.TMContainer00000000000000000001.regtrans-ms.ENC
Filesize16B
MD520d2f870bdce4bf57ef6a10c0dd9eab3
SHA1346d3a5770f677053430c242729981d0b5c0bf17
SHA2568cd72c3892b87d461185d16bfc8682246aaa223ecc7dec8af99f52631ac17f1d
SHA512d172195dd769c46630606973c19e0b6f0fff275f1425b2a1fa0dd8b2149970dd9c4049f49b40e825211c8d60112c6c4aa68dde7d9b83bdf672bd558a1d18a2bb